joyce8/EMBER2024-capa huggingface dataset:
Function at 0x36ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x5a4d
mov r12b, r8b
mov rbx, rcx
cmp word [rcx], ax
jne 0x36c58
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
je 0x36c58
mov edx, dword [rsi + 0x78]
test edx, edx
je 0x36c58
test r8b, r8b
jne 0x36b34
mov rcx, rsi
call fcn.00036a78
mov edx, eax
mov edi, edx
add rdi, rbx
je 0x36c58
mov ebp, dword [rsi + 0x50]
mov rax, rdi
sub rax, rbx
mov qword [rsp + 0x88], rax
cmp rbp, rax
jb 0x36c58
mov eax, dword [rsi + 0x7c]
sub rax, rbx
add rax, rdi
cmp rbp, rax
jb 0x36c58
mov edx, dword [rdi + 0x20]
test r12b, r12b
jne 0x36b7d
mov rcx, rsi
call fcn.00036a78
mov edx, eax
mov eax, edx
mov edx, dword [rdi + 0x1c]
add rax, rbx
mov qword [rsp + 0x20], rax
test r12b, r12b
jne 0x36b99
mov rcx, rsi
call fcn.00036a78
mov edx, eax
mov r14d, edx
mov edx, dword [rdi + 0x24]
add r14, rbx
test r12b, r12b
jne 0x36bb1
mov rcx, rsi
call fcn.00036a78
mov edx, eax
movsxd rcx, dword [rdi + 0x18]
mov r13d, edx
mov edx, dword [rdi + 0x14]
add r13, rbx
mov dword [rsp + 0x70], edx
cmp r13, rbx
jb 0x36c58
lea rax, [rbx + rbp]
cmp r13, rax
ja 0x36c58
xor edi, edi
mov r15, rcx
test ecx, ecx
jle 0x36c58
cmp rdi, r15
movzx ebp, word [r13 + rdi*2]
jge 0x36c58
cmp ebp, edx
jge 0x36c58
movsxd rax, ebp
mov ecx, dword [r14 + rax*4]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x36c10
mov r8d, dword [rsi + 0x7c]
add rax, r8
cmp rcx, rax
jb 0x36c50
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + rdi*4]
test r12b, r12b
jne 0x36c27
mov rcx, rsi
call fcn.00036a78
mov edx, eax
mov r8d, edx
mov rdx, qword [rsp + 0x78]
add r8, rbx
sub r8, rdx
movzx eax, byte [rdx]
movzx ecx, byte [rdx + r8]
sub eax, ecx
jne 0x36c48
inc rdx
test ecx, ecx
jne 0x36c35
test eax, eax
je 0x36c72
mov edx, dword [rsp + 0x70]
inc rdi
cmp rdi, r15
jl 0x36be1
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, dword [r14 + rbp*4]
test r12b, r12b
jne 0x36c85
mov rcx, rsi
call fcn.00036a78
mov edx, eax
mov eax, edx
add rax, rbx
jmp 0x36c5a

Function at 0x36c94
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x36cda
movsxd r9, dword [rcx + 0x3c]
add r9, rcx
je 0x36cda
movzx eax, word [r9 + 0x14]
movzx r11d, word [r9 + 6]
xor r10d, r10d
lea r8, [rax + r9 + 0x18]
cmp r11d, r10d
jbe 0x36cda
mov ecx, dword [r8 + 0x14]
cmp edx, ecx
jb 0x36cce
add ecx, dword [r8 + 0x10]
cmp edx, ecx
jb 0x36cdd
inc r10d
add r8, 0x28
cmp r10d, r11d
jb 0x36cbe
xor eax, eax
ret
mov eax, dword [r8 + 0xc]
sub eax, dword [r8 + 0x14]
add eax, edx
ret
Function at 0x37244
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
mov r13, rdx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x3733b
movsxd rax, dword [rcx + 0x3c]
mov ebx, dword [rax + rcx + 0x8c]
mov dword [rsp + 0x50], ebx
mov edx, dword [rax + rcx + 0x88]
cmp edx, r8d
je 0x3733b
mov rax, rdx
add rax, rcx
je 0x3733b
mov rsi, rax
sub rsi, rcx
mov r14d, dword [rax + 0x1c]
add r14, rcx
mov r12d, dword [rax + 0x24]
add r12, rcx
mov r11d, dword [rax + 0x20]
add r11, rcx
mov qword [rsp + 0x58], r11
mov r15d, dword [rax + 0x18]
mov r9d, dword [rax + 0x14]
mov dword [rsp + 0x50], r9d
mov edx, r8d
mov dword [rsp], edx
cmp edx, r15d
jae 0x37339
mov r10d, edx
movsx eax, word [r12 + r10*2]
cmp eax, r9d
jae 0x37335
mov r9d, dword [r14 + rax*4]
cmp r9, rsi
jb 0x372f1
lea rax, [rsi + rbx]
cmp r9, rax
jb 0x37329
mov eax, dword [r11 + r10*4]
add rax, rcx
mov rdi, r13
sub rdi, rax
movzx r10d, byte [rax]
movzx r11d, byte [rax + rdi]
sub r10d, r11d
jne 0x37314
inc rax
test r11d, r11d
jne 0x372fe
cmp r10d, r8d
jne 0x37324
lea r8, [r9 + rcx]
mov qword [rsp + 8], r8
jmp 0x37339
mov r11, qword [rsp + 0x58]
inc edx
mov dword [rsp], edx
mov r9d, dword [rsp + 0x50]
jmp 0x372cd
xor eax, eax
jmp 0x3734a
jmp 0x37347
xor eax, eax
jmp 0x3734a
mov rax, r8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x38a20
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov r12d, r8d
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp r8d, 0x40
jbe 0x38a8f
lea ebx, [r8 - 0x41]
shr ebx, 6
inc ebx
mov rdx, rbp
mov rcx, rsi
call fcn.000381d0
add r12d, 0xffffffc0
add rbp, 0x40
sub rbx, 1
jne 0x38a76
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x80
call fcn.0003b290
lea rcx, [rsp + 0x20]
mov r8d, r12d
mov rdx, rbp
mov ebx, r12d
call fcn.0003ad40
lea eax, [r12 + 1]
mov byte [rsp + rbx + 0x20], 0x80
cmp eax, 0x38
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov eax, edi
ja 0x38b0b
shl eax, 3
shr edi, 0x1d
mov byte [rsp + 0x58], al
shr eax, 8
mov byte [rsp + 0x5c], dil
shr edi, 8
mov byte [rsp + 0x59], al
shr eax, 8
mov byte [rsp + 0x5d], dil
shr edi, 8
mov byte [rsp + 0x5a], al
shr eax, 8
mov byte [rsp + 0x5e], dil
shr edi, 8
mov byte [rsp + 0x5f], dil
mov byte [rsp + 0x5b], al
jmp 0x38b6c
shl eax, 3
shr edi, 0x1d
mov byte [rsp + 0x98], al
mov byte [rsp + 0x9c], dil
shr eax, 8
shr edi, 8
mov byte [rsp + 0x99], al
shr eax, 8
mov byte [rsp + 0x9d], dil
shr edi, 8
mov byte [rsp + 0x9a], al
mov byte [rsp + 0x9e], dil
shr eax, 8
shr edi, 8
mov byte [rsp + 0x9b], al
mov byte [rsp + 0x9f], dil
call fcn.000381d0
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.000381d0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0003ac70
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x391b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9d, dword [rcx]
mov eax, dword [rdx]
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
lea edx, [r9 + rax + 1]
xor r8d, r8d
mov rcx, rbp
call fcn.00038c48
mov r11, qword [rdi + 0x10]
movsxd rsi, dword [rdi]
add rsi, r11
xor r13d, r13d
cmp r11, rsi
jae 0x392ba
lea r15d, [r13 + 1]
mov r9, qword [rbx + 0x10]
movsxd r10, dword [rbx]
add r10, r9
cmp r9, r10
jae 0x392ab
mov r14, r13
mov rax, qword [rbp + 0x10]
movzx r8d, byte [r9]
xor edx, edx
lea r12, [r14 + rax]
movzx eax, byte [r11]
imul r8w, ax
mov eax, 0xff
movzx ecx, r8w
and cx, ax
movzx eax, byte [r12]
add cx, ax
mov eax, 0x100
cmp cx, ax
mov byte [r12], cl
mov ecx, 0x100
cmovae edx, r15d
add r12, r15
shr r8w, 8
movzx eax, byte [r12]
add r8w, ax
xor eax, eax
add r8w, dx
cmp r8w, cx
mov byte [r12], r8b
setae al
add r12, r15
test eax, eax
je 0x3929c
movzx eax, byte [r12]
add ax, r15w
mov byte [r12], al
add r12, r15
cmp ax, cx
jae 0x39287
add r9, r15
add r14, r15
cmp r9, r10
jb 0x3921e
add r11, r15
add r13, r15
cmp r11, rsi
jb 0x39208
mov eax, dword [rdi + 8]
mov rcx, rbp
xor eax, dword [rbx + 8]
mov dword [rbp + 8], eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.00038d44
Function at 0x39ecc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x740
xor r14d, r14d
mov rbp, r8
mov r10, rdx
lea r12d, [r14 + 1]
lea r13d, [r14 + 4]
mov r11, rcx
movzx r9d, r14w
movsx rax, r9w
add r9w, r12w
mov dword [r8 + rax*4], r14d
cmp r9w, r13w
jb 0x39f04
movzx edx, r14w
movsx rcx, dx
add dx, r12w
mov eax, dword [r10 + rcx*4]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, r13w
jb 0x39f1a
movzx edx, r14w
movsx rcx, dx
add dx, r12w
mov eax, dword [r11 + rcx*4]
mov dword [rsp + rcx*4 + 0x30], eax
cmp dx, r13w
jb 0x39f34
mov edi, 0x70
mov r11, r13
lea rbx, [rsp + 0x40]
mov rsi, rdi
movzx r8d, r14w
movsx rax, r8w
add r8w, r12w
lea rdx, [r11 + rax]
lea rcx, [r11 + rax - 4]
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rdx*4 + 0x30], eax
cmp r8w, r13w
jb 0x39f5e
mov rcx, rbx
call fcn.00039e88
add r11, r13
add rbx, 0x10
sub rsi, r12
jne 0x39f5a
movsx r9, word [0x0004ce00]
movzx r8d, r14w
movsx rdx, r8w
add r8w, r12w
lea rax, [rdx + r9*4]
mov ecx, dword [rsp + rax*4 + 0x30]
and ecx, dword [rsp + rdx*4 + 0x20]
mov dword [rbp + rdx*4], ecx
cmp r8w, r13w
jb 0x39f9d
lea r11, [0x0004cfc8]
lea rcx, [rsp + 0x20]
call fcn.00039e88
movsx r10, word [r11]
movsx rbx, word [r11 - 0x1c6]
movzx r9d, r14w
movsx r8, r9w
add r9w, r12w
lea rcx, [r8 + r10*4]
lea rax, [r8 + rbx*4]
mov edx, dword [rsp + rcx*4 + 0x30]
xor edx, dword [rsp + rax*4 + 0x30]
and edx, dword [rsp + r8*4 + 0x20]
xor dword [rbp + r8*4], edx
cmp r9w, r13w
jb 0x39fdc
add r11, 2
sub rdi, r12
jne 0x39fc2
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x3a150
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x60
xor ebx, ebx
mov rbp, r9
mov rdi, r8
mov r12, rdx
mov rsi, rcx
movzx r10d, bx
movsx rax, r10w
inc r10w
mov dword [rsp + rax*4 + 0x40], ebx
cmp r10w, 4
jb 0x3a17b
movzx ecx, bx
movsx rax, cx
inc cx
mov dword [rsp + rax*4 + 0x20], ebx
cmp cx, 4
jb 0x3a191
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
mov eax, dword [rsi + rcx*4 + 0x10]
xor eax, dword [r12 + rcx*4 + 0x10]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x3a1a5
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.0003a038
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.00039ecc
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x3a1f0
lea rcx, [rsp + 0x20]
call fcn.00039e48
movzx edx, bx
cmp word [rbp], bx
je 0x3a23d
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
xor eax, dword [rbp + rcx*4 + 4]
xor eax, dword [rsp + rcx*4 + 0x20]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rdi + rcx*4], eax
cmp dx, 4
jb 0x3a218
jmp 0x3a25c
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rdi + rcx*4], eax
cmp dx, 4
jb 0x3a23d
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [rdi + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x3a25f
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.00039ecc
movsx rcx, bx
inc bx
mov eax, dword [rsi + rcx*4 + 0x10]
xor eax, dword [rdi + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
mov dword [rdi + rcx*4 + 0x10], eax
cmp bx, 4
jb 0x3a28a
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x3a2c8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
lea rdx, [rax - 0x28]
mov rdi, r8
mov rbp, rcx
call fcn.0003a038
lea rdx, [rbp + 0x10]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.00039ecc
xor ebx, ebx
movzx r9d, bx
movsx rcx, r9w
inc r9w
mov eax, dword [rbp + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
mov dword [rsp + rcx*4 + 0x30], eax
cmp r9w, 4
jb 0x3a307
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rcx*4 + 0x50], eax
cmp dx, 4
jb 0x3a325
lea rcx, [rsp + 0x50]
call fcn.00039e48
movzx edx, bx
cmp word [rdi], bx
je 0x3a36a
movsx rcx, dx
inc dx
mov eax, dword [rdi + rcx*4 + 4]
xor eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x3a34c
jmp 0x3a382
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x3a36a
movzx ecx, bx
movsx rax, cx
inc cx
or dword [rsp + rax*4 + 0x20], 0xffffffff
cmp cx, 4
jb 0x3a385
and dword [rsp + 0x20], 0x1ffff
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
xor dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x3a3a2
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.00039ecc
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x3a3cc
lea rcx, [rsp + 0x40]
call fcn.00039e48
movsx rcx, bx
inc bx
mov eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x40]
mov dword [rsi + rcx*4 + 0x10], eax
cmp bx, 4
jb 0x3a3eb
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x3a420
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor r13d, r13d
mov r12, r9
mov rsi, r8
lea r14d, [r13 + 1]
mov rbp, rdx
movzx r10d, r13w
movsx r8, r10w
add r10w, r14w
mov eax, dword [rcx + r8*4]
mov dword [rsp + r8*4 + 0x20], eax
cmp r10w, 4
jb 0x3a45f
mov edx, r13d
movzx ecx, r13w
movsx rax, cx
add cx, r14w
or edx, dword [rsp + rax*4 + 0x20]
cmp cx, 4
jb 0x3a47e
cmp edx, r13d
jne 0x3a4c7
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsi + rax*4], r13d
cmp cx, 4
jb 0x3a499
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsi + rax*4 + 0x10], r13d
cmp cx, 4
jb 0x3a4af
jmp 0x3a663
movzx ebx, r13w
mov r11d, 3
test byte [rsp + 0x2c], r14b
je 0x3a507
mov al, byte [rsp + 0x2c]
mov ecx, 2
and al, r11b
sub cl, al
movsx rax, bx
mov byte [rsp + rax + 0x60], cl
jns 0x3a510
movzx ecx, r11w
movsx rax, cx
add dword [rsp + rax*4 + 0x20], r14d
jne 0x3a510
add cx, 0xffff
jns 0x3a4f4
jmp 0x3a510
movsx rax, bx
mov byte [rsp + rax + 0x60], r13b
and dword [rsp + 0x2c], 0xfffffffe
lea rcx, [rsp + 0x20]
call fcn.00039e88
add bx, r14w
mov edx, r13d
movzx ecx, r13w
movsx rax, cx
add cx, r14w
or edx, dword [rsp + rax*4 + 0x20]
cmp cx, 4
jb 0x3a52a
cmp edx, r13d
jne 0x3a4d1
dec bx
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x3a548
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4 + 0x10]
mov dword [rsi + rcx*4 + 0x10], eax
cmp dx, 4
jb 0x3a561
cmp bx, r13w
jle 0x3a663
movsx rax, bx
lea rdi, [rsp + rax + 0x60]
lea rdx, [rsp + 0x20]
mov r8, r12
mov rcx, rsi
call fcn.0003a2c8
sub rdi, r14
dec bx
cmp byte [rdi], 0xff
je 0x3a5f5
cmp byte [rdi], r13b
je 0x3a5c0
cmp byte [rdi], r14b
jne 0x3a659
lea rdx, [rsp + 0x20]
mov rcx, rbp
jmp 0x3a64e
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rsp + rcx*4 + 0x20]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x3a5c4
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4 + 0x10], eax
cmp dx, 4
jb 0x3a5dd
jmp 0x3a659
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x3a5f9
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsp + rax*4 + 0x50], r13d
cmp cx, 4
jb 0x3a613
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4 + 0x10]
xor eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x50], eax
cmp dx, 4
jb 0x3a62a
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
mov r9, r12
mov r8, rsi
call fcn.0003a150
cmp bx, r13w
jg 0x3a58a
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.0003ac70
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x3a774
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x1f0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov esi, 1
xor ebp, ebp
lea r12d, [rsi + 0x70]
mov cx, si
movzx r8d, bp
movsx rax, cx
movsx ecx, cx
mov word [rsp + rax*2 + 0x10], r8w
add ecx, ecx
mov eax, 0x24168e19
add r8w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r8w, r12w
jl 0x3a7b4
mov r8d, 0xe2
cmp cx, si
jne 0x3a82e
movzx r9d, bp
movsx rax, r8w
movsx ecx, r8w
mov word [rsp + rax*2 + 0x10], r9w
add ecx, ecx
mov eax, 0x24168e19
add r9w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r9w, r12w
mov r8w, cx
jl 0x3a7f5
jmp 0x3a864
movzx r9d, r12w
movsx rax, cx
movsx ecx, cx
mov word [rsp + rax*2 + 0x10], r9w
add ecx, ecx
mov eax, 0x24168e19
add r9w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r9w, r8w
jl 0x3a832
or eax, 0xffffffff
mov word [0x0004ce00], si
mov bx, si
lea r11d, [rax + 0x71]
mov word [0x0004cfc6], ax
mov r8, rsi
mov r10, r11
movsx ebx, bx
mov eax, 0x24168e19
add ebx, ebx
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ebx, edx
movsx rdx, bx
mov rcx, rdx
neg rcx
movzx eax, word [rsp + rcx*2 + 0x1d8]
mov word [rsp], ax
movzx eax, word [rsp + rcx*2 + 0x1d4]
movzx ecx, bp
mov word [rsp + 2], ax
movzx eax, word [rsp + rdx*2 + 0xe]
mov word [rsp + 4], ax
movzx eax, word [rsp + rdx*2 + 0x12]
movzx edx, bp
mov word [rsp + 6], ax
movsx rax, dx
movzx r9d, word [rsp + rax*2]
cmp r9w, r12w
jge 0x3a909
movsx rax, cx
lea rdi, [0x0004ce00]
imul rax, rax, 0xe3
add rax, r8
add cx, si
mov word [rdi + rax*2], r9w
add dx, si
cmp cx, 2
jl 0x3a8dd
add r8, rsi
sub r10, rsi
jne 0x3a882
lea edx, [r10 + 0x10]
movzx r8d, bp
mov word [0x0004cde4], bp
mov r10d, edx
mov r9d, 0xffff0000
mov ecx, r9d
and ecx, r11d
je 0x3a945
add r8w, dx
mov r11d, ecx
mov eax, r10d
cdq
sub eax, edx
sar eax, 1
movsx edx, ax
mov eax, r9d
mov ecx, edx
mov r10d, edx
shr eax, cl
xor r9d, eax
cmp dx, bp
jne 0x3a936
mov word [0x0004cde4], r8w
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.0003ac70
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x3a9a0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x230
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r12, rcx
movsxd r13, edx
xor ebx, ebx
lea rcx, [rsp + 0x20]
jmp 0x3aa01
mov al, byte [r8]
cmp al, 0x20
je 0x3a9fe
cmp al, 9
je 0x3a9fe
cmp al, 0xd
je 0x3a9fe
cmp al, 0xa
je 0x3a9fe
cmp al, 0x61
jl 0x3a9f9
cmp al, 0x7a
jg 0x3a9f9
sub al, 0x20
mov byte [rcx], al
inc rcx
inc r8
cmp byte [r8], bl
jne 0x3a9dc
mov r10, qword [0x0004dd90]
mov byte [rcx], bl
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
or esi, 0xffffffff
repne scasb al, byte [rdi]
not rcx
lea rbp, [rcx - 1]
cmp r10, rbx
jne 0x3aab2
mov edx, 0x400
xor ecx, ecx
mov r8d, 0xcc4d5053
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r9d, ebx
mov r8, rbx
mov r10, rax
mov qword [0x0004dd90], rax
mov eax, 1
mov ecx, ebx
lea edx, [rax + 0x7f]
test r9d, eax
je 0x3aa63
or ecx, edx
add eax, eax
shr edx, 1
jne 0x3aa5c
shl ecx, 0x18
mov eax, 8
bt ecx, 0x1f
jae 0x3aa81
add ecx, ecx
xor ecx, 0x4c11db7
jmp 0x3aa83
add ecx, ecx
sub rax, 1
jne 0x3aa71
lea edi, [rax + 1]
mov edx, ebx
mov eax, 0x80000000
test ecx, edi
je 0x3aa99
or edx, eax
add edi, edi
shr eax, 1
jne 0x3aa93
mov dword [r10 + r8*4], edx
inc r8
inc r9d
cmp r8, 0x100
jl 0x3aa52
mov eax, ebp
lea rdi, [rsp + 0x20]
lea rdx, [rsp + rax + 0x20]
lea rax, [rsp + 0x20]
cmp rax, rdx
jae 0x3aae6
movsx ecx, byte [rdi]
mov eax, esi
inc rdi
xor rcx, rax
movzx eax, cl
mov ecx, esi
mov esi, dword [r10 + rax*4]
shr ecx, 8
xor esi, ecx
cmp rdi, rdx
jb 0x3aac8
cmp r13, rbx
mov dword [0x0004cdf8], esi
jle 0x3ab07
mov ecx, 0x100
call fcn.00038b98
xor byte [rbx + r12], al
inc rbx
cmp rbx, r13
jl 0x3aaf1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.0003ac70
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x2e5ce3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov r10b, 0xb3
mov qword [rsp + 0x10], rdi
neg r10b
xor edi, edi
movzx ebx, r8b
mov r11, rcx
sets r9b
mov r8, rdi
xchg r9w, r10w
dec r10b
nop
movzx r10, r12w
movsx r10d, cx
movzx r10w, cl
movzx r9d, byte [r11]
movzx r10w, sil
movsx r10, r14w
xchg r10, r10
movzx r10d, byte [rdx]
inc r11
jmp 0x2e5d50
rol eax, cl
stc
test rdi, rdx
add al, r8b
cmp r10w, 0x1e80
test al, r11b
stc
xor r9b, al
jmp 0x2e5d6d
inc rdx
test bl, bl
je 0x2e5d75
mov ecx, r8d
bts ax, r12w
mov eax, 0x6a0e27ff
jmp 0x2e5d35
inc r8
test cx, 0x5938
test r9b, r9b
jmp 0x2e5d7d
je 0x2e5d91
cmp r9b, r10b
jmp 0x2e5d8b
je 0x2e5d18
cmp r9b, r10b
jmp 0x2e5d99
jae 0x2e5dc6
or eax, 0xffffffff
setnp dil
mov bl, r10b
jmp 0x2e5dae
mov rbx, qword [rsp + 8]
movsx di, spl
movzx edi, cx
mov rdi, qword [rsp + 0x10]
jmp 0x2e5dc5
ret
mov rbx, qword [rsp + 8]
seta dil
movzx rax, r13w
mov eax, edi
cmovae di, di
mov edi, 0x7ff963d2
mov rdi, qword [rsp + 0x10]
jmp 0x2e5de8
ret
Function at 0x180002d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x90]
sub eax, 0x821
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x16b3
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x80]
xor eax, 0xf16
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x248
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
add eax, 0x119d
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
xor eax, 0x36cd
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
add eax, 0x7ab
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x21d2
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x88]
xor eax, 0x492
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x80]
add eax, 0xb1f
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x3b23
cmp dword [rsp + 0x28], eax
je 0x180002e59
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x9c]
sub eax, 0x962ff
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x24]
add eax, 0xfcc
mov dword [rsp + 0x24], eax
jmp 0x180002ef8
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x90]
mov dword [rsp + 0x20], eax
jmp 0x180002e75
mov eax, dword [rsp + 0x20]
add eax, 3
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x20], eax
jge 0x180002ef8
mov eax, dword [rsp + 0x38]
sub eax, 0x16b3
sub eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0x3c]
mov ecx, dword [rcx + 0x38]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x78]
and eax, dword [rdx + rcx + 0xa4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x48]
sub eax, 0x1f55
mov dword [rsp + 0x3c], eax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x180002e6a
mov eax, dword [rsp + 0x2c]
add eax, 0x8e1
add rsp, 0x68
ret