joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c301c
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0x68], r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0xf0]
mov r12, qword [rdx + 8]
mov r13, qword [rdx + 0x10]
mov ebp, 0xffffffff
cmp rax, rbp
cmovb rbp, rax
mov rdi, qword [rdx + 0x18]
xorps xmm6, xmm6
lea rcx, [rsp + 0x38]
mov rdx, r12
mov r8, rbx
mov r9b, 1
call fcn.1400c2144
mov al, byte [rsp + 0x41]
cmp al, 3
je 0x1400c3193
mov rcx, qword [rsp + 0x38]
cmp al, 2
je 0x1400c31a1
mov dl, byte [rsp + 0x40]
lea r9, [rsp + 0x42]
movzx r8d, word [r9 + 4]
lea r10, [rsp + 0x62]
mov word [r10 + 4], r8w
mov r8d, dword [r9]
mov dword [r10], r8d
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], dl
mov byte [rsp + 0x61], al
cmp r13, 0xffffffffffffffff
je 0x1400c31fa
xor eax, eax
mov dword [rsp + 0x4c], eax
movups xmmword [rsp + 0x28], xmm6
mov dword [rsp + 0x20], eax
mov rcx, r13
mov rdx, qword [rsp + 0x68]
mov r8d, ebp
lea r9, [rsp + 0x4c]
call qword [sym.imp.ws2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x1400c31b3
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov r15d, eax
shl r15, 0x20
or r15, 2
mov rcx, r15
call fcn.1400101a1
cmp al, 0xd
jne 0x1400c315d
test rdi, rdi
je 0x1400c315d
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
lock inc qword [rdx]
jle 0x1400c3212
add rcx, 0x10
mov r8, qword [rdi + 0x10]
mov r9b, byte [rdi + 0x18]
call fcn.14003deac
test rax, rax
je 0x1400c315d
mov rsi, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 1
mov rcx, r15
call fcn.140010048
mov r15, rsi
jmp 0x1400c316b
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], r15
mov rcx, r15
call fcn.1400101a1
cmp al, 0xd
jne 0x1400c31d1
mov rcx, r14
lea rdx, [rsp + 0x58]
call fcn.1400c2384
lea rcx, [rsp + 0x40]
call fcn.1400d1102
jmp 0x1400c3067
mov rax, qword [rsp + 0x50]
mov qword [rax], 2
jmp 0x1400c31e1
mov rax, qword [rsp + 0x50]
mov qword [rax], 1
mov qword [rax + 8], rcx
jmp 0x1400c31e1
mov edx, dword [rsp + 0x4c]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
mov rax, qword [rsp + 0x50]
mov qword [rax], rcx
mov qword [rax + 8], rdx
jmp 0x1400c31e1
mov rax, qword [rsp + 0x50]
mov qword [rax], 1
mov qword [rax + 8], r15
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.C:Usersigame.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_1.38.0_srciopoll_evented.rs
mov edx, 0x2b
call fcn.1400ff740
ud2

Function at 0x1400ca590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov ebx, r9d
retf
mov r14, rdx
Function at 0x1400cad36
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
mov r13, r8
mov rsi, rdx
mov rbp, rcx
mov r14, qword [rsp + 0x178]
mov r15b, byte [rsp + 0x170]
lea rdi, [rsp + 0x98]
mov qword [rdi], r8
mov qword [rsp + 0x78], r9
mov qword [rdi + 8], r9
mov rcx, rdi
call fcn.1400c7a6b
mov rbx, qword [rdi]
mov r12, qword [rdi + 8]
cmp eax, 0x3e
jle 0x1400caddc
cmp eax, 0x3f
je 0x1400caf5a
cmp eax, 0x5c
je 0x1400cadee
cmp eax, 0x110000
jne 0x1400caf9e
cmp dword [r14 + 0x20], 0
je 0x1400cb00b
cmp eax, 0x23
je 0x1400caf6e
cmp eax, 0x2f
jne 0x1400caf9e
mov byte [rsp + 0x77], r15b
mov qword [rsp + 0x80], rsi
add byte [rax], al
cmp dword [r14 + 0x18], 0
je 0x1400cb018
lea rax, [r14 + 0x1c]
jmp 0x1400cb027
lea rdx, [rsp + 0x98]
mov ecx, 9
mov rdi, rdx
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov r8, r14
mov r9, r13
call fcn.1400cb5a9
jmp 0x1400cb579
cmp dword [r14 + 0x18], 0
je 0x1400cb053
mov r12, r13
mov ebx, r15d
lea rax, [r14 + 0x1c]
jmp 0x1400cb068
cmp dword [r14 + 0x20], 0
je 0x1400cb303
lea rax, [r14 + 0x24]
mov r9d, dword [rax]
mov rdx, qword [r14 + 8]
test r9, r9
je 0x1400cb091
mov r8, qword [r14 + 0x10]
cmp r8, r9
jbe 0x1400cb1de
cmp byte [rdx + r9], 0xbf
jle 0x1400cb1e4
mov r8, r9
jmp 0x1400cb30b
cmp dword [r14 + 0x20], 0
je 0x1400cb3f3
mov r12, r13
mov ebx, r15d
lea rax, [r14 + 0x24]
mov r9d, dword [rax]
mov rdi, qword [r14 + 8]
mov r13, qword [r14 + 0x10]
test r9, r9
je 0x1400cb099
cmp r13, r9
jbe 0x1400cb1fb
cmp byte [rdi + r9], 0xbf
jg 0x1400cb404
jmp 0x1400cb445
xor r8d, r8d
jmp 0x1400cb30b
xor r9d, r9d
jmp 0x1400cb404
je 0x1400cb30b
lea rax, [0x140152228]
mov qword [rsp + 0x20], rax
mov rcx, rdx
mov rdx, r8
jmp 0x1400cb5a0
je 0x1400cb401
jmp 0x1400cb445
Function at 0x1400d2210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rdi, rcx
cmp r8, 0x20
jb 0x1400d229d
mov rcx, qword [rcx + 0x20]
mov edx, 0x12
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rcx, qword [rdi + 0x18]
mov edx, 0xc
mov rbx, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rcx, qword [rdi + 0x10]
mov edx, 7
add rbx, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rcx, qword [rdi + 8]
mov edx, 1
add rbx, rax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotl64
mov rdx, qword [rdi + 8]
lea rcx, [rbx + rax]
call fcn.1400d21a4
mov rdx, qword [rdi + 0x10]
mov rcx, rax
call fcn.1400d21a4
mov rdx, qword [rdi + 0x18]
mov rcx, rax
call fcn.1400d21a4
mov rdx, qword [rdi + 0x20]
mov rcx, rax
call fcn.1400d21a4
mov r8, qword [rdi]
jmp 0x1400d22ae
mov rax, qword [rcx + 0x18]
movabs rcx, 0x27d4eb2f165667c5
add rax, rcx
lea rdx, [rdi + 0x28]
xor r9d, r9d
lea rcx, [r8 + rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400d2030
Function at 0x22d9f1550
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov rbx, rcx
lea rax, [rbp + 0x28]
mov ecx, 2
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
mov qword [rbp - 8], rax
call fcn.22d9f2150
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rbp - 8]
mov ecx, 2
call fcn.22d9f2150
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x22d9f15c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
movsxd rsi, dword [0x22da1c064]
mov rbx, rcx
test esi, esi
jle 0x22d9f16f0
mov rax, qword [0x22da1c068]
xor r9d, r9d
add rax, 0x18
nop dword [rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x22d9f160b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x22d9f1693
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x22d9f15f0
mov rcx, rbx
call fcn.22d9f1e60
mov rdi, rax
test rax, rax
je 0x22d9f1712
mov rax, qword [0x22da1c068]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.22d9f1fa0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x22da1c068]
lea rdx, [rbp - 0x30]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x22d9f16f7
mov eax, dword [rbp - 0xc]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x22d9f168c
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x22d9f16a0
add dword [0x22da1c064], 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 2
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x22da1c068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x22d9f168c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.22d9f1550
nop word [rax + rax]
xor esi, esi
jmp 0x22d9f1618
mov rax, qword [0x22da1c068]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.22d9f1550
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.22d9f1550
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x22d9f1a90
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
lea r13, [0x22da1c0a0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x22da1c080]
test rbx, rbx
je 0x22d9f1af5
mov r12, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, dword [rbx]
call r12
mov rsi, rax
call rdi
test rsi, rsi
je 0x22d9f1aec
test eax, eax
jne 0x22d9f1aec
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x22d9f1ad0
mov rcx, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x22d9f1e60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x22da12ed0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x22d9f1e80
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x22d9f1e88
ret
cmp word [r8 + 0x18], 0x20b
jne 0x22d9f1e80
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x22d9f1edd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x22d9f1ed4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x22d9f1e80
add rax, 0x28
cmp rax, r9
jne 0x22d9f1ec0
xor eax, eax
ret

Function at 0x22d9f1ee0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x22da12ed0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x22d9f1eff
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x22d9f1f08
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x22d9f1eff
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x22d9f1fa0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x22da12ed0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x22d9f1fbf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x22d9f1fc8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x22d9f24c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, r9d
shr eax, 4
and r9d, 0xf
jne 0x22d9f256c
test eax, eax
je 0x22d9f2569
push r13
shl rax, 4
xor r13d, r13d
push r12
mov r12, r8
push rbp
lea rbp, [rdx + rax]
push rdi
lea rdi, [rcx + 0x1e4]
push rsi
mov rsi, rdx
push rbx
mov rbx, rcx
sub rsp, 0x28
nop
xor eax, eax
nop word [rax + rax]
movzx edx, byte [rsi + rax]
xor byte [rbx + rax + 0x1e4], dl
add rax, 1
cmp rax, 0x10
jne 0x22d9f2508
mov rcx, rbx
mov r8, rdi
mov rdx, rdi
call fcn.22d9f2aa0
lea rcx, [r12 + r13]
xor eax, eax
nop dword [rax]
movzx edx, byte [rbx + rax + 0x1e4]
mov byte [rcx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x22d9f2538
add rsi, 0x10
add r13, 0x10
cmp rsi, rbp
jne 0x22d9f2500
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor eax, eax
ret
mov eax, 0xffffffff
ret
Function at 0x22d9f92d0
Capabilities:
Hash data using sha256

Disassembly:
push rbp
mov rbp, rsp
push r14
mov r14, rcx
push r13
lea r13, [r8 + 0x40]
push r12
mov r12, rdx
mov rdx, 0xffffffffffffffff
push rdi
mov rdi, r9
mov r9d, 4
push rsi
mov rsi, r8
mov r8d, r13d
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0xb0
mov rax, qword [0x22da12e60]
mov rax, qword [rax]
mov ecx, dword [rax + 0x2e0]
test ecx, ecx
jne 0x22d9f9321
mov ecx, 2
call fcn.22d9fae90
mov rbx, rax
xor eax, eax
nop dword [rax + rax]
movzx edx, byte [r14 + rax]
mov byte [rbx + rax], dl
add rax, 1
cmp rax, 0x40
jne 0x22d9f9330
test rsi, rsi
je 0x22d9f9362
xor eax, eax
nop dword [rax]
movzx edx, byte [r12 + rax]
mov byte [rbx + rax + 0x40], dl
add rax, 1
cmp rsi, rax
jne 0x22d9f9350
movdqu xmm0, xmmword [0x22da12c70]
lea rsi, [rsp + 0x40]
mov r8d, r13d
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x68], 0
movups xmmword [rsp + 0x48], xmm0
movdqu xmm0, xmmword [0x22da12c80]
mov qword [rsp + 0x40], 0
movups xmmword [rsp + 0x58], xmm0
call fcn.22d9fdbc0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.22d9fda60
movdqu xmm1, xmmword [rsp + 0x20]
mov rdx, rbx
movdqu xmm2, xmmword [rsp + 0x30]
mov rcx, 0xffffffffffffffff
movups xmmword [rdi], xmm1
movups xmmword [rdi + 0x10], xmm2
lea rsp, [rbp - 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
jmp fcn.22d9faf80
Function at 0x22d9fd080
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov esi, dword [0x22da0d2a0]
test esi, esi
jne 0x22d9fd28d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx + 0x30]
test rax, rax
je 0x22d9fd2a3
xor r9d, r9d
nop
mov rbx, rax
movsxd rax, dword [rax + 0x3c]
mov eax, dword [rbx + rax + 0x88]
test eax, eax
je 0x22d9fd0fc
lea r9, [rbx + rax]
mov eax, dword [r9 + 0xc]
add rax, rbx
mov ecx, dword [rax]
or ecx, 0x20202020
cmp ecx, 0x6c64746e
jne 0x22d9fd0fc
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x22d9fd111
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
test rax, rax
jne 0x22d9fd0c0
test r9, r9
je 0x22d9fd2a3
mov ebp, dword [r9 + 0x1c]
mov r8d, dword [r9 + 0x24]
xor edi, edi
lea r12, [0x22da0d2a8]
lea rax, [rbp + rbx]
lea rbp, [r8 + rbx]
mov qword [rsp + 0x28], rax
mov eax, dword [r9 + 0x18]
lea edx, [rax - 1]
mov eax, dword [r9 + 0x20]
lea r13, [rbp + rdx*2]
add rax, rbx
lea r14, [rax + rdx*4]
jmp 0x22d9fd164
sub r14, 4
lea rax, [r13 - 2]
cmp rbp, r13
je 0x22d9fd200
mov r13, rax
mov eax, dword [r14]
add rax, rbx
cmp word [rax], 0x775a
jne 0x22d9fd150
mov r15d, edi
shl r15, 4
add r15, r12
cmp byte [rax], 0
je 0x22d9fd2a7
cmp byte [rax + 1], 0
mov ecx, 0x630f932c
mov edx, 1
mov r9d, 1
je 0x22d9fd1bd
nop word [rax + rax]
mov r10d, ecx
movzx edx, word [rax + rdx]
add r9d, 1
ror r10d, 8
add edx, r10d
xor ecx, edx
mov edx, r9d
cmp byte [rax + rdx], 0
jne 0x22d9fd1a0
mov dword [r15], ecx
movzx eax, word [r13]
add edi, 1
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
mov dword [r15 + 4], eax
lea rcx, [rax + rbx]
call fcn.22d9fcef0
mov qword [r15 + 8], rax
cmp edi, 0x258
jne 0x22d9fd150
mov dword [0x22da0d2a0], 0x258
mov r9d, 0x257
jmp 0x22d9fd20f
mov dword [0x22da0d2a0], edi
lea r9d, [rdi - 1]
cmp edi, 1
je 0x22d9fd28d
lea r11d, [rdi - 2]
lea r10, [0x22da0d2b8]
nop word [rax + rax]
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x22d9fd285
mov r8d, r11d
lea rax, [0x22da0d2a8]
sub r8d, esi
shl r8, 4
add r8, r10
nop dword [rax]
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0x14]
cmp ecx, edx
jae 0x22d9fd27c
movd xmm2, edx
movd xmm3, ecx
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x18]
movd xmm0, dword [rax]
movd xmm1, dword [rax + 0x10]
mov qword [rax + 8], rcx
mov qword [rax + 0x18], rdx
punpckldq xmm0, xmm2
punpckldq xmm1, xmm3
movq qword [rax], xmm1
movq qword [rax + 0x10], xmm0
add rax, 0x10
cmp r8, rax
jne 0x22d9fd240
add esi, 1
cmp esi, r9d
jb 0x22d9fd220
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x22d9fd292
mov ecx, 0x101f0573
jmp 0x22d9fd1bd
Function at 0x22da01640
Capabilities:
Encode data using base64

Disassembly:
push r12
mov r9d, 4
movabs rax, 0xaaaaaaaaaaaaaaab
push rbp
push rdi
mov rdi, r8
push rsi
mov rsi, rcx
push rbx
mov rbx, rdx
add rdx, 2
mul rdx
sub rsp, 0x20
mov rax, qword [0x22da12e60]
shr rdx, 1
mov rax, qword [rax]
shl rdx, 2
mov qword [r8], rdx
lea r8d, [rdx + 1]
mov rdx, 0xffffffffffffffff
mov ecx, dword [rax + 0x2e0]
test ecx, ecx
jne 0x22da01698
mov ecx, 2
call fcn.22d9fae90
mov r8, rax
test rax, rax
je 0x22da017af
test rbx, rbx
je 0x22da017a7
mov r10, rax
xor r9d, r9d
lea rcx, [0x22da17580]
xor edx, edx
jmp 0x22da01741
movzx ebp, byte [rsi + rdx]
lea r11d, [r9 + 2]
movsxd rdx, r11d
shl ebp, 8
cmp rdx, rbx
jae 0x22da017bd
add r9d, 3
movzx r11d, byte [rsi + rdx]
movsxd rdx, r9d
add r11d, ebp
shl eax, 0x10
add r10, 4
add eax, r11d
mov r12d, eax
mov r11d, eax
mov ebp, eax
and eax, 0x3f
shr r12d, 6
movzx eax, byte [rcx + rax]
shr ebp, 0xc
and r12d, 0x3f
and ebp, 0x3f
shr r11d, 0x12
movzx r12d, byte [rcx + r12]
shl eax, 8
movzx ebp, byte [rcx + rbp]
movzx r11d, byte [rcx + r11]
or eax, r12d
shl eax, 8
or eax, ebp
shl eax, 8
or eax, r11d
mov dword [r10 - 4], eax
cmp rdx, rbx
jae 0x22da01760
lea r11d, [r9 + 1]
movzx eax, byte [rsi + rdx]
movsxd rdx, r11d
cmp rdx, rbx
jb 0x22da016c8
mov r9d, r11d
xor ebp, ebp
xor r11d, r11d
jmp 0x22da016eb
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov rax, rdx
and rdx, 0xfffffffffffffffe
shr rax, 1
add rdx, rax
lea rax, [0x22da180f0]
sub rbx, rdx
movsxd rcx, dword [rax + rbx*4]
test ecx, ecx
jle 0x22da017a7
xor eax, eax
nop
mov rdx, rax
add rax, 1
not rdx
add rdx, qword [rdi]
mov byte [r8 + rdx], 0x3d
cmp rcx, rax
jne 0x22da01790
mov rax, qword [rdi]
mov byte [r8 + rax], 0
add rsp, 0x20
mov rax, r8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9d, r11d
xor r11d, r11d
jmp 0x22da016eb
Function at 0x22da017d0
Capabilities:
Encode data using base64

Disassembly:
push r12
mov r9d, 4
movabs rax, 0xaaaaaaaaaaaaaaab
push rbp
push rdi
mov rdi, r8
push rsi
mov rsi, rcx
push rbx
lea rbx, [rdx + rdx]
lea rdx, [rbx + 2]
mul rdx
sub rsp, 0x20
mov rax, qword [0x22da12e60]
mov rax, qword [rax]
shr rdx, 1
lea r8, [rdx*4 + 1]
mov rdx, 0xffffffffffffffff
mov ecx, dword [rax + 0x2e0]
mov qword [rdi], r8
mov r8d, r8d
test ecx, ecx
jne 0x22da0182c
mov ecx, 2
call fcn.22d9fae90
mov r8, rax
test rax, rax
je 0x22da0194f
test rbx, rbx
je 0x22da01947
mov r10, rax
xor r9d, r9d
lea rcx, [0x22da17580]
xor edx, edx
jmp 0x22da018d9
movzx ebp, byte [rsi + rdx]
lea r11d, [r9 + 2]
movsxd rdx, r11d
shl ebp, 8
cmp rdx, rbx
jae 0x22da0195d
add r9d, 3
movzx r11d, byte [rsi + rdx]
movsxd rdx, r9d
add r11d, ebp
shl eax, 0x10
add r10, 4
add eax, r11d
mov r12d, eax
mov r11d, eax
mov ebp, eax
and eax, 0x3f
shr r12d, 6
movzx eax, byte [rcx + rax]
shr ebp, 0xc
and r12d, 0x3f
and ebp, 0x3f
shr r11d, 0x12
movzx r12d, byte [rcx + r12]
shl eax, 8
movzx ebp, byte [rcx + rbp]
movzx r11d, byte [rcx + r11]
or eax, r12d
shl eax, 8
or eax, ebp
shl eax, 8
or eax, r11d
mov dword [r10 - 4], eax
cmp rdx, rbx
jae 0x22da01900
lea r11d, [r9 + 1]
movzx eax, byte [rsi + rdx]
movsxd rdx, r11d
cmp rdx, rbx
jb 0x22da01860
mov r9d, r11d
xor ebp, ebp
xor r11d, r11d
jmp 0x22da01883
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
mov rax, rdx
and rdx, 0xfffffffffffffffe
shr rax, 1
add rdx, rax
lea rax, [0x22da180f0]
sub rbx, rdx
movsxd rcx, dword [rax + rbx*4]
test ecx, ecx
jle 0x22da01947
xor eax, eax
nop
mov rdx, rax
add rax, 1
not rdx
add rdx, qword [rdi]
mov byte [r8 + rdx], 0x3d
cmp rcx, rax
jne 0x22da01930
mov rax, qword [rdi]
mov byte [r8 + rax], 0
add rsp, 0x20
mov rax, r8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9d, r11d
xor r11d, r11d
jmp 0x22da01883
Function at 0x22da039f0
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
push rbp
pxor xmm0, xmm0
mov rbp, rsp
push r15
push r14
mov r14, r9
push r13
mov r13, r8
push r12
push rdi
push rsi
mov rsi, rcx
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x170
mov rbx, qword [rbp + 0x30]
mov r12, qword [rbp + 0x38]
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
movdqu xmm0, xmmword [0x22da107e0]
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movdqu xmm0, xmmword [0x22da107f0]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
cmp rdx, 0x40
ja 0x22da03b60
lea rax, [rcx + rdx]
lea rcx, [rsp + 0xc0]
mov rdi, rcx
test rdx, rdx
je 0x22da03aae
nop dword [rax]
movsb byte [rdi], byte [rsi]
cmp rsi, rax
jne 0x22da03aa8
lea rdi, [rsp + 0x100]
lea rsi, [rsp + 0x20]
lea r10, [rsp + 0x80]
lea r15, [rsp + 0x40]
mov r8, rcx
mov rax, r10
mov rdx, r15
movdqu xmm1, xmmword [rax]
add rax, 0x10
add rdx, 0x10
add r8, 0x10
movdqu xmm0, xmmword [r8 - 0x10]
pxor xmm1, xmm0
movups xmmword [rax - 0x10], xmm1
pxor xmm0, xmmword [rdx - 0x10]
movups xmmword [rdx - 0x10], xmm0
cmp rcx, rax
jne 0x22da03ad1
mov rcx, r10
mov r9, rdi
mov r8, r14
mov rdx, r13
call fcn.22d9f92d0
mov rdx, rdi
mov r9, rsi
mov rcx, r15
mov r8d, 0x20
call fcn.22d9f92d0
mov eax, 0x20
cmp r12, rax
cmovbe rax, r12
mov rdx, rax
test r12, r12
je 0x22da03b4c
lea rax, [rsi + rax]
nop word [rax + rax]
mov rdi, rbx
movsb byte [rdi], byte [rsi]
mov rbx, rdi
cmp rsi, rax
jne 0x22da03b40
lea rsp, [rbp - 0x38]
mov rax, rdx
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movdqu xmm0, xmmword [0x22da107c0]
mov r8d, edx
mov rdx, rcx
mov dword [rsp + 0x128], 0
lea rdi, [rsp + 0x100]
lea rsi, [rsp + 0x20]
mov qword [rsp + 0x100], 0
movups xmmword [rsp + 0x108], xmm0
movdqu xmm0, xmmword [0x22da107d0]
mov rcx, rdi
movups xmmword [rsp + 0x118], xmm0
call fcn.22d9fdbc0
mov rcx, rdi
mov rdx, rsi
call fcn.22d9fda60
movdqu xmm2, xmmword [rsp + 0x20]
movdqu xmm3, xmmword [rsp + 0x30]
lea rcx, [rsp + 0xc0]
movups xmmword [rsp + 0xc0], xmm2
movups xmmword [rsp + 0xd0], xmm3
jmp 0x22da03abb