joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10113c20
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [0x10151300]
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
mov qword [rsp + 0x20], rax
mov rax, qword [0x10151308]
mov qword [r11 - 0x10], r13
mov qword [rsp + 0x28], rax
mov rax, qword [0x10151310]
mov qword [r11 - 0x18], r14
mov qword [rsp + 0x30], rax
mov rax, qword [0x10151318]
mov qword [r11 - 0x20], r15
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [r11 + 8], rbx
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], eax
mov dword [r11 - 0x58], eax
xor dword [rsp + 0x20], 0x2080020
xor dword [rsp + 0x2c], 0x20010000
mov qword [r11 + 0x10], rbp
mov r15, rdx
mov dword [r11 - 0x54], 0xffffffff
mov edi, eax
lea r13, [rcx + 0x24]
lea r14d, [rax + 8]
lea r12d, [rax + 0x40]
mov qword [r11 + 0x18], rsi
nop
nop
mov ecx, dword [r13 + 0x4c]
mov eax, dword [r13 + 0x50]
mov r8d, r12d
add dword [r13 - 4], ecx
cmp dword [r13 - 4], ecx
mov dword [r13 + 4], 0xffffffff
adc dword [r13], 0
sub r8d, ecx
lea rcx, [rcx + r13 + 0xc]
xor edx, edx
mov dword [r13 + 8], eax
call sub.msvcrt.dll_memset
lea rcx, [r13 - 0x24]
call fcn.101135b0
mov rax, qword [r13 - 0x24]
lea rbp, [rsp + 0xa0]
mov qword [rsp + 0xa0], rax
mov rax, qword [r13 - 0x1c]
mov esi, 0x20
mov qword [rsp + 0xa8], rax
mov rax, qword [r13 - 0x14]
mov qword [rsp + 0xb0], rax
mov rax, qword [r13 - 0xc]
mov qword [rsp + 0xb8], rax
nop
nop
mov ebx, r12d
sub ebx, edi
cmp rsi, rbx
jbe 0x10113d8e
mov eax, edi
mov r8, rbx
mov rdx, rbp
lea rcx, [rsp + rax + 0x50]
call sub.msvcrt.dll_memcpy
mov r11d, dword [rsp + 0x40]
lea rcx, [rsp + 0x20]
add r11d, r12d
cmp r11d, r12d
mov dword [rsp + 0x40], r11d
adc dword [rsp + 0x44], 0
call fcn.101135b0
xor edi, edi
add rbp, rbx
sub rsi, rbx
mov dword [rsp + 0x90], edi
jne 0x10113d40
jmp 0x10113db0
mov eax, edi
mov r8, rsi
mov rdx, rbp
lea rcx, [rsp + rax + 0x50]
call sub.msvcrt.dll_memcpy
mov edi, dword [rsp + 0x90]
add edi, esi
mov dword [rsp + 0x90], edi
sub r13, 0xffffffffffffff80
dec r14
jne 0x10113cc0
mov eax, dword [rsp + 0x40]
lea rcx, [rsp + rdi + 0x50]
mov dword [rsp + 0x48], 0xffffffff
add eax, edi
cmp eax, edi
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x94]
adc dword [rsp + 0x44], r14d
sub r12d, edi
xor edx, edx
mov r8d, r12d
mov dword [rsp + 0x4c], eax
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
call fcn.101135b0
mov r14, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0xf0]
lea r11, [rsp + 0x20]
mov rax, qword [r11]
mov qword [r15], rax
mov rax, qword [r11 + 8]
mov qword [r15 + 8], rax
mov rax, qword [r11 + 0x10]
mov qword [r15 + 0x10], rax
mov rax, qword [r11 + 0x18]
mov qword [r15 + 0x18], rax
mov r15, qword [rsp + 0xc8]
add rsp, 0xe8
ret
Function at 0x10114100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r10d, dword [r9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rdi
xor esi, esi
mov qword [rsp + 0x10], r12
and r10d, 7
cmp rdx, 5
mov qword [rsp + 8], r13
mov r13, r9
mov r12d, r8d
mov rdi, rcx
mov r11, rsi
jae 0x1011413a
xor eax, eax
jmp 0x1011429d
mov qword [rsp + 0x28], rbp
mov ebp, dword [rsp + 0x60]
lea r9, [rcx + rdx - 4]
mov qword [rsp + 0x30], rbx
nop
lea rdx, [r11 + rdi]
cmp rdx, r9
jae 0x10114171
nop
nop
movzx eax, byte [rdx]
and al, 0xfe
cmp al, 0xe8
je 0x10114171
inc rdx
cmp rdx, r9
jb 0x10114160
mov rax, rdx
sub rax, r11
mov r11, rdx
sub r11, rdi
sub rax, rdi
cmp rdx, r9
jae 0x1011427e
cmp rax, 2
jbe 0x101141d6
mov r10d, esi
movzx r8d, byte [rdx + 4]
lea eax, [r8 + 1]
test al, 0xfe
jne 0x1011426f
movzx eax, byte [rdx + 3]
shl r8d, 8
lea ebx, [r11 + r12 + 5]
or r8d, eax
movzx eax, byte [rdx + 2]
add r11, 5
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 1]
shl r8d, 8
or r8d, eax
test ebp, ebp
je 0x1011420c
add r8d, ebx
jmp 0x1011420f
mov ecx, eax
shr r10d, cl
test r10d, r10d
je 0x10114192
cmp r10d, 4
ja 0x101141fd
cmp r10d, 3
je 0x101141fd
mov eax, r10d
shr rax, 1
mov cl, byte [rax + rdx + 1]
inc ecx
test cl, 0xfe
jne 0x10114192
or r10d, 8
shr r10d, 1
inc r11
jmp 0x10114150
sub r8d, ebx
test r10d, r10d
je 0x10114245
and r10d, 6
mov eax, r8d
shl r10d, 2
mov ecx, r10d
shr eax, cl
inc eax
test al, 0xfe
jne 0x10114242
mov eax, 0x100
shl eax, cl
dec eax
xor r8d, eax
test ebp, ebp
je 0x1011423f
add r8d, ebx
jmp 0x10114242
sub r8d, ebx
mov r10d, esi
mov eax, r8d
mov byte [rdx + 1], r8b
shr eax, 8
mov byte [rdx + 2], al
mov eax, r8d
shr r8d, 0x18
shr eax, 0x10
and r8b, 1
neg r8b
mov byte [rdx + 3], al
mov byte [rdx + 4], r8b
jmp 0x10114150
or r10d, 8
shr r10d, 1
inc r11
jmp 0x10114150
cmp rax, 2
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
ja 0x10114296
mov ecx, eax
shr r10d, cl
mov esi, r10d
mov dword [r13], esi
mov rax, r11
mov r13, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x10115360
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
xor edi, edi
cmp dword [rcx + 0x1c], edi
mov rbx, rcx
je 0x101153aa
cmp dword [rcx + 0x24], edi
je 0x10115387
lea ecx, [rdi + 1]
call qword [sym.imp.msvcrt.dll_exit]
int3
mov dword [rcx], 1
mov dword [rcx + 0x1c], edi
mov dword [rcx + 0x2c], edi
mov dword [rcx + 0x28], edi
add rcx, 0x38
call fcn.10127a70
lea rcx, [rbx + 0x30]
call fcn.10127a40
jmp 0x101153d8
cmp dword [rcx + 0x24], edi
jne 0x101153bb
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
int3
add rcx, 0x50
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rbx + 0x24], edi
mov edi, dword [rbx]
lea eax, [rdi + 1]
lea rcx, [rbx + 0x40]
mov dword [rbx], eax
call fcn.10127c70
mov rcx, qword [rbx + 0x48]
call fcn.10127890
cmp dword [rbx + 0x24], 0
je 0x101153f3
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
int3
lea rcx, [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rbx + 0x24], 1
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret

Function at 0x10116230
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
xor esi, esi
mov qword [rsp + 0x48], rdi
mov rbx, rcx
nop
nop
mov rcx, qword [rbx + 0x80]
mov edi, esi
call fcn.10127890
nop
cmp dword [rbx + 0x78], esi
jne 0x10116319
mov rcx, qword [rbx + 0x90]
call fcn.10127890
cmp dword [rbx + 0x7c], esi
jne 0x101162e4
cmp dword [rbx + 0x1b4], esi
jne 0x10116301
cmp dword [rbx + 0x1ac], esi
jne 0x101162a1
lea rcx, [rbx + 0x1e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [rbx + 0x1b4], 1
mov edx, edi
mov rcx, rbx
and edx, 0xf
shl rdx, 0x12
add rdx, qword [rbx + 8]
call fcn.10115f40
cmp dword [rbx + 0x1b4], esi
je 0x1011630d
lea rcx, [rbx + 0x1e0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbx + 0x98]
mov dword [rbx + 0x1b4], esi
inc edi
call fcn.10127c70
jmp 0x10116260
lea rcx, [rbx + 0x190]
call fcn.10115420
lea rcx, [rbx + 0x88]
call fcn.10127a40
jmp 0x10116250
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
int3
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
int3
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
Function at 0x1011e470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax - 8], r12
lea rbx, [rcx + 0x318]
xor r12d, r12d
mov qword [rcx + 0xa0], r12
mov qword [rcx + 0x98], r12
mov rbp, rcx
mov rcx, rbx
call fcn.10133370
lea rcx, [rbp + 0x100]
mov qword [rbp + 0x310], rbx
call fcn.10116330
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov dword [rsp + 0x20], 5
mov dword [rsp + 0x44], r12d
mov dword [rsp + 0x24], r12d
mov qword [rsp + 0x50], 0xffffffffffffffff
mov dword [rsp + 0x4c], 0xffffffff
mov dword [rsp + 0x40], 0xffffffff
mov dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x34], 0xffffffff
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x2c], 0xffffffff
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x58], r12
call fcn.1011b1d0
lea rsi, [rbp + 0x2d70]
mov ebx, 2
mov qword [rsp + 0x88], rdi
mov byte [rsi], r12b
mov byte [rsi + 1], 1
add rsi, 2
nop
mov ecx, ebx
mov edi, 1
shr ecx, 1
add ecx, 0xffffffff
shl rdi, cl
test rdi, rdi
je 0x1011e572
mov r8, rdi
movzx edx, bl
mov rcx, rsi
call sub.msvcrt.dll_memset
inc ebx
add rsi, rdi
cmp ebx, 0x1c
jb 0x1011e550
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov r8d, 8
lea r9, [rbp + 0x820]
nop
mov eax, r8d
mov ecx, r12d
mov edx, 4
nop
nop
imul eax, eax
add ecx, ecx
cmp eax, 0x10000
jb 0x1011e5cb
nop
shr eax, 1
inc ecx
cmp eax, 0x10000
jae 0x1011e5c0
dec rdx
jne 0x1011e5b0
mov eax, 0xa1
add r8d, 0x10
add r9, 4
sub eax, ecx
cmp r8d, 0x808
mov dword [r9 - 4], eax
jb 0x1011e5a0
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x1f578], r12
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x68
ret
Function at 0x10122fc0
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rax, qword [rcx]
mov rbx, rcx
movzx edx, byte [r8 + 1]
add word [rax + 2], 4
movzx eax, byte [r8 - 5]
add edx, 4
cmp edx, eax
mov byte [r8 + 1], dl
jbe 0x10123035
cmp edx, 0x7c
mov eax, dword [r8]
lea rcx, [rsp + 0x30]
mov dword [rcx], eax
movzx eax, word [r8 + 4]
mov word [rcx + 4], ax
mov eax, dword [r8 - 6]
lea rcx, [r8 - 6]
mov dword [r8], eax
movzx eax, word [rcx + 4]
mov word [r8 + 4], ax
lea r8, [rsp + 0x30]
mov eax, dword [r8]
mov dword [rcx], eax
movzx eax, word [r8 + 4]
mov word [rcx + 4], ax
mov qword [rbx + 0x10], rcx
jbe 0x10123035
mov rcx, rbx
call fcn.10122c50
mov rcx, qword [rbx + 0x10]
movzx edx, word [rcx + 4]
movzx eax, word [rcx + 2]
shl edx, 0x10
or rdx, rax
add rdx, qword [rbx + 0x40]
cmp dword [rbx + 0x18], 0
jne 0x10123064
cmp rdx, qword [rbx + 0x58]
jbe 0x10123064
mov qword [rbx], rdx
mov qword [rbx + 8], rdx
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.10122790

Function at 0x10123080
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov r11, qword [rcx + 0x10]
mov r9, qword [rcx]
xor edx, edx
movzx r10d, byte [r11 + 1]
movzx r8d, word [r9 + 2]
mov rbx, rcx
lea eax, [r10 + r10]
cmp eax, r8d
seta dl
add r8w, 4
add r10d, 4
add dword [rcx + 0x2c], edx
cmp r10d, 0x7c
mov dword [rcx + 0x20], edx
mov word [r9 + 2], r8w
mov byte [r11 + 1], r10b
jbe 0x101230c9
call fcn.10122c50
mov rcx, qword [rbx + 0x10]
movzx edx, word [rcx + 4]
movzx eax, word [rcx + 2]
shl edx, 0x10
or rdx, rax
add rdx, qword [rbx + 0x40]
cmp dword [rbx + 0x18], 0
jne 0x101230f8
cmp rdx, qword [rbx + 0x58]
jbe 0x101230f8
mov qword [rbx], rdx
mov qword [rbx + 8], rdx
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.10122790

Function at 0x10123110
Capabilities:
Encrypt data using rc4 ksa
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x30]
mov r8, qword [rcx + 0x10]
mov rbx, rcx
movzx edx, byte [r8 + 1]
mov dword [rcx + 0x2c], eax
mov rax, qword [rcx]
add word [rax + 2], 4
add edx, 4
cmp edx, 0x7c
mov byte [r8 + 1], dl
jbe 0x10123141
call fcn.10122c50
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.10122790

Function at 0x10127940
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov r9, r8
mov rbx, rcx
mov r8, rdx
mov qword [rsp + 0x28], rax
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
je 0x1012797b
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
mov eax, ecx
add rsp, 0x30
pop rbx
ret
Function at 0x101279a0
Capabilities:
Create thread
Resume thread

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rsi
mov rsi, r9
mov r9, r8
mov rbx, rcx
mov r8, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
mov rbx, qword [rsp + 0x58]
mov rdi, rax
je 0x10127a05
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10127a26
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
test eax, eax
cmovne ecx, eax
mov eax, ecx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x48
ret

Function at 0x10127d60
Capabilities:
Hash data using sha256

Disassembly:
mov dword [rcx], edx
dec edx
je 0x10127d82
sub edx, 3
je 0x10127d79
cmp edx, 6
jne 0x10127d89
add rcx, 0x10
jmp fcn.10130200
mov qword [rcx + 8], 0xffffffffffffffff
ret
mov dword [rcx + 4], 0xffffffff
ret 0
Function at 0x1012e2e0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 8
mov r11d, r8d
mov qword [rsp + 0x20], rsi
lea r9, [rcx + 0x10]
shr r11d, 2
mov esi, 1
mov eax, r11d
shr eax, 1
add eax, 3
test r11d, r11d
mov dword [rcx], eax
je 0x1012e322
mov rcx, r9
mov r8d, r11d
nop
mov eax, dword [rdx]
add rcx, 4
add rdx, 4
dec r8
mov dword [rcx - 4], eax
jne 0x1012e310
mov r8d, dword [r9 + r11*4 - 4]
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
lea rax, [r11 + r11*2]
xor r10d, r10d
mov qword [rsp + 0x28], rdi
mov qword [rsp], r12
lea rbp, str.cw
lea rbx, [r9 + rax*4 + 0x70]
lea r12d, [r10 + 0x1b]
test r10d, r10d
jne 0x1012e3ac
mov edx, r8d
movzx eax, r8b
mov r10d, r11d
movzx r8d, byte [rax + rbp]
mov rax, rdx
shr rax, 0x18
shl r8d, 8
movzx eax, byte [rax + rbp]
or r8d, eax
mov rax, rdx
shr rdx, 8
shr rax, 0x10
shl r8d, 8
movzx ecx, al
movzx eax, byte [rcx + rbp]
or r8d, eax
movzx eax, dl
movzx ecx, byte [rax + rbp]
shl r8d, 8
xor ecx, esi
add esi, esi
or r8d, ecx
bt esi, 8
cmovb esi, r12d
jmp 0x1012e3fe
cmp r10d, 4
jne 0x1012e3fe
cmp r11d, 6
jbe 0x1012e3fe
mov edx, r8d
mov eax, r8d
shr rax, 0x10
movzx ecx, al
mov rax, rdx
movzx r8d, byte [rcx + rbp]
shr rax, 0x18
movzx eax, byte [rax + rbp]
shl eax, 8
or r8d, eax
mov rax, rdx
shr rax, 8
shl r8d, 8
movzx ecx, al
movzx eax, byte [rcx + rbp]
or r8d, eax
movzx eax, dl
movzx eax, byte [rax + rbp]
shl r8d, 8
or r8d, eax
xor r8d, dword [r9]
add r9, 4
add r10d, 0xffffffff
cmp r9, rbx
mov dword [r9 + r11*4 - 4], r8d
jne 0x1012e351
mov r12, qword [rsp]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
add rsp, 8
ret

Function at 0x1012f3e0
Capabilities:
Encode data using xor

Disassembly:
lea r11, [rdx + r8]
mov r10d, ecx
cmp rdx, r11
je 0x1012f410
nop
movzx r8d, byte [rdx]
mov ecx, r10d
inc rdx
xor r8b, r10b
shr ecx, 8
movzx eax, r8b
mov r10d, dword [r9 + rax*4]
xor r10d, ecx
cmp rdx, r11
jne 0x1012f3f0
mov eax, r10d
ret
Function at 0x1012ff20
Capabilities:
Hash data using sha1

Disassembly:
sub rsp, 0x28
mov r9d, dword [rcx + 8]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
and r9d, 0x3f
mov rsi, rdx
mov rdi, rcx
mov byte [r9 + rcx + 0x40], 0x80
inc r9d
cmp r9d, 0x38
jbe 0x1012ff7c
cmp r9d, 0x40
movsxd rax, r9d
je 0x1012ff69
mov r8d, 0x40
lea rcx, [rax + rcx + 0x40]
xor edx, edx
sub r8d, r9d
call sub.msvcrt.dll_memset
lea rdx, [rdi + 0x40]
lea rcx, [rdi + 0x20]
mov r8d, 1
call qword [rdi]
xor r9d, r9d
mov r8d, 0x38
lea rcx, [r9 + rdi + 0x40]
xor edx, edx
sub r8d, r9d
mov qword [rsp + 0x38], rbx
call sub.msvcrt.dll_memset
mov r11, qword [rdi + 8]
lea rdx, [rdi + 0x40]
shl r11, 3
lea rcx, [rdi + 0x20]
mov r8d, 1
mov rax, r11
bswap r11d
shr rax, 0x20
mov dword [rdi + 0x7c], r11d
bswap eax
mov dword [rdi + 0x78], eax
call qword [rdi]
mov r11d, dword [rdi + 0x20]
mov rbx, qword [rsp + 0x38]
bswap r11d
mov dword [rsi], r11d
mov eax, dword [rdi + 0x24]
bswap eax
mov dword [rsi + 4], eax
mov eax, dword [rdi + 0x28]
bswap eax
mov dword [rsi + 8], eax
mov eax, dword [rdi + 0x2c]
bswap eax
mov dword [rsi + 0xc], eax
mov eax, dword [rdi + 0x30]
bswap eax
mov dword [rsi + 0x10], eax
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 8], 0
mov dword [rdi + 0x20], 0x67452301
mov dword [rdi + 0x24], 0xefcdab89
mov dword [rdi + 0x28], 0x98badcfe
mov dword [rdi + 0x2c], 0x10325476
mov dword [rdi + 0x30], 0xc3d2e1f0
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret

Function at 0x10130780
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov edx, dword [rcx + 8]
mov rbx, rcx
and edx, 0x3f
mov byte [rdx + rcx + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x101307d5
cmp edx, 0x40
movsxd rax, edx
je 0x101307c3
mov r8d, 0x40
lea rcx, [rax + rcx + 0x40]
sub r8d, edx
xor edx, edx
call sub.msvcrt.dll_memset
lea rdx, [rbx + 0x40]
lea rcx, [rbx + 0x20]
mov r8d, 1
call qword [rbx]
xor edx, edx
mov r8d, 0x38
lea rcx, [rdx + rbx + 0x40]
mov qword [rsp + 0x40], rsi
sub r8d, edx
xor edx, edx
call sub.msvcrt.dll_memset
mov r11, qword [rbx + 8]
lea rdx, [rbx + 0x40]
shl r11, 3
lea rcx, [rbx + 0x20]
mov r8d, 1
mov rax, r11
bswap r11d
shr rax, 0x20
mov dword [rbx + 0x7c], r11d
bswap eax
mov dword [rbx + 0x78], eax
call qword [rbx]
lea r11, [rbx + 0x20]
mov edx, 4
nop
nop
nop
nop
mov ecx, dword [r11 + 4]
mov eax, dword [r11]
add rdi, 8
bswap eax
bswap ecx
add r11, 8
dec rdx
mov dword [rdi - 8], eax
mov dword [rdi - 4], ecx
jne 0x10130830
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 8], rdx
mov dword [rbx + 0x20], 0x6a09e667
mov dword [rbx + 0x24], 0xbb67ae85
mov dword [rbx + 0x28], 0x3c6ef372
mov dword [rbx + 0x2c], 0xa54ff53a
mov dword [rbx + 0x30], 0x510e527f
mov dword [rbx + 0x34], 0x9b05688c
mov dword [rbx + 0x38], 0x1f83d9ab
mov dword [rbx + 0x3c], 0x5be0cd19
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
Function at 0x101316a0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x70
mov r9d, dword [rcx + 0x14]
mov rbx, rdx
mov r11, rcx
cmp r9d, 3
jae 0x101316c4
call fcn.10133940
mov rax, rbx
add rsp, 0x70
pop rbx
ret
mov r8, qword [rcx]
mov qword [rsp + 0x88], rbp
xor ebp, ebp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8]
shl rcx, 8
or rcx, rax
mov qword [rsp + 0x58], r12
movzx eax, byte [r8 + 1]
movzx edx, cx
mov qword [rsp + 0x50], r13
mov r13d, 2
mov qword [rsp + 0x48], r14
movzx ecx, word [r11 + rax*4 + 0x78]
mov rax, qword [r11 + 0x28]
xor rdx, rcx
mov edi, dword [rax + rdx*4]
lea rcx, [rax + rdx*4]
mov eax, dword [r11 + 8]
mov dword [rcx], eax
mov ecx, ebp
mov rax, qword [r11 + 0x30]
mov edx, dword [r11 + 8]
mov esi, dword [r11 + 0x1c]
mov r8d, dword [r11 + 0x18]
mov r12d, dword [r11 + 0x3c]
mov r10, qword [r11]
mov qword [rsp + 0x30], rax
lea r14, [rax + r8*8]
mov qword [rsp + 0x40], r15
mov eax, edx
mov dword [rsp + 0x20], esi
sub eax, esi
mov qword [rsp + 0x38], r8
cmp edx, esi
mov dword [rsp + 0x24], edx
lea r15, [r14 + 4]
mov dword [rsp + 0x90], ebp
cmova ecx, eax
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x98], ecx
cmp ecx, edi
jae 0x1013187a
xor eax, eax
mov ebp, edx
sub ebp, edi
mov edx, ebp
cmp rdx, r8
cmova eax, esi
mov ecx, eax
mov rax, qword [rsp + 0x30]
sub rcx, rdx
add rcx, r8
mov r8, r10
sub r8, rdx
mov edx, dword [rsp + 0x80]
cmp dword [rsp + 0x90], edx
lea rsi, [rax + rcx*8]
mov eax, edx
cmovb eax, dword [rsp + 0x90]
mov ecx, dword [rsi]
mov dword [rsp + 0x28], ecx
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jne 0x1013181b
inc eax
cmp eax, r9d
je 0x10131802
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jne 0x10131802
inc eax
cmp eax, r9d
je 0x10131802
nop word [rax + rax]
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jne 0x10131802
inc eax
cmp eax, r9d
jne 0x101317f0
cmp r13d, eax
jae 0x1013181b
mov dword [rbx], eax
lea ecx, [rbp - 1]
mov dword [rbx + 4], ecx
mov r13d, eax
add rbx, 8
cmp eax, r9d
je 0x10131869
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jae 0x10131839
mov dword [r14], edi
lea r14, [rsi + 4]
mov edi, dword [r14]
mov dword [rsp + 0x80], eax
jmp 0x10131848
mov dword [r15], edi
mov r15, rsi
mov edi, dword [rsi]
mov dword [rsp + 0x90], eax
add r12d, 0xffffffff
je 0x10131878
cmp dword [rsp + 0x98], edi
jae 0x10131878
mov r8, qword [rsp + 0x38]
mov esi, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
jmp 0x10131780
mov eax, dword [rsp + 0x28]
mov dword [r14], eax
mov eax, dword [rsi + 4]
mov dword [r15], eax
jmp 0x10131880
xor ebp, ebp
mov dword [r14], ebp
mov dword [r15], ebp
mov ecx, dword [r11 + 8]
inc dword [r11 + 0x18]
inc ecx
inc qword [r11]
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x88]
mov dword [r11 + 8], ecx
cmp ecx, dword [r11 + 0xc]
jne 0x101318c5
mov rcx, r11
call fcn.101332c0
mov rax, rbx
add rsp, 0x70
pop rbx
ret
Function at 0x101318d0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rbx, rcx
nop word [rax + rax]
mov r9d, dword [rbx + 0x14]
cmp r9d, 3
jae 0x10131907
mov rcx, rbx
call fcn.10133940
jmp 0x10131a67
mov r8, qword [rbx]
xor r13d, r13d
xor r15d, r15d
xor r12d, r12d
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 + 1]
movzx edx, cx
movzx ecx, word [rbx + rax*4 + 0x78]
mov rax, qword [rbx + 0x28]
xor rdx, rcx
mov r11d, dword [rax + rdx*4]
lea rcx, [rax + rdx*4]
mov eax, dword [rbx + 8]
mov dword [rcx], eax
mov edx, dword [rbx + 8]
mov eax, edx
mov ecx, dword [rbx + 0x1c]
sub eax, ecx
mov r8d, dword [rbx + 0x18]
cmp edx, ecx
mov rdi, qword [rbx + 0x30]
mov ebp, dword [rbx + 0x3c]
cmova r13d, eax
mov r10, qword [rbx]
mov dword [rsp + 0x80], ecx
mov qword [rsp + 0x98], r8
lea rsi, [rdi + r8*8]
mov qword [rsp + 0x20], rdi
lea r14, [rsi + 4]
mov dword [rsp + 0x90], edx
cmp r13d, r11d
jae 0x10131a3f
nop
xor eax, eax
sub edx, r11d
cmp rdx, r8
cmova eax, ecx
mov ecx, eax
mov eax, r12d
sub rcx, rdx
add rcx, r8
mov r8, r10
sub r8, rdx
cmp r15d, r12d
cmovb eax, r15d
lea rdi, [rdi + rcx*8]
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jne 0x101319ee
inc eax
cmp eax, r9d
je 0x101319e2
nop dword [rax]
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jne 0x101319ee
inc eax
cmp eax, r9d
jne 0x101319d0
mov eax, dword [rdi]
mov dword [rsi], eax
mov eax, dword [rdi + 4]
mov dword [r14], eax
jmp 0x10131a4c
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jae 0x10131a09
mov dword [rsi], r11d
mov r12d, eax
mov r11d, dword [rdi + 4]
lea rsi, [rdi + 4]
jmp 0x10131a15
mov dword [r14], r11d
mov r15d, eax
mov r11d, dword [rdi]
mov r14, rdi
add ebp, 0xffffffff
je 0x10131a3f
cmp r13d, r11d
jae 0x10131a3f
mov r8, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x80]
mov edx, dword [rsp + 0x90]
mov rdi, qword [rsp + 0x20]
jmp 0x10131990
mov dword [rsi], 0
mov dword [r14], 0
mov eax, dword [rbx + 8]
inc dword [rbx + 0x18]
inc eax
inc qword [rbx]
mov dword [rbx + 8], eax
cmp eax, dword [rbx + 0xc]
jne 0x10131a67
mov rcx, rbx
call fcn.101332c0
add dword [rsp + 0x88], 0xffffffff
jne 0x101318f0
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret