joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10063638
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
xor ebx, ebx
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
mov r12, rdx
mov r13, r8
lea esi, [rbx + 8]
lea rdx, [rsp + 0x30]
mov r8, rsi
mov dword [rsp + 0x38], ebx
call fcn.1000abc8
cmp eax, ebx
jne 0x10063861
mov edx, dword [rsp + 0x38]
mov ebp, ebx
mov r8d, ebx
mov eax, edx
mov ecx, r8d
inc edx
movzx eax, byte [rsp + rax + 0x30]
add r8d, esi
mov dword [rsp + 0x38], edx
shl eax, cl
or ebp, eax
cmp r8d, 0x20
jl 0x10063679
movzx r9d, bx
mov r8d, ebx
movzx eax, byte [rsp + rdx + 0x30]
mov ecx, r8d
inc edx
shl ax, cl
add r8d, esi
mov dword [rsp + 0x38], edx
or r9w, ax
cmp r8d, 0x10
jl 0x1006369d
movzx eax, r9w
movzx r8d, bx
mov r9d, ebx
mov dword [r12], eax
movzx eax, byte [rsp + rdx + 0x30]
mov ecx, r9d
inc edx
shl ax, cl
add r9d, esi
mov dword [rsp + 0x38], edx
or r8w, ax
cmp r9d, 0x10
jl 0x100636ca
movzx eax, r8w
mov dword [r13], eax
cmp dword [rdi + 0x2c], ebx
je 0x1006370e
mov r8d, dword [rdi + 0x2c]
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call fcn.1000abc8
cmp eax, ebx
jne 0x10063861
cmp byte [rdi + 0x31], bl
mov dword [rdi + 0x20], ebx
mov esi, dword [r12]
mov edx, ebx
mov dword [rsp + 0x20], ebx
mov r8d, ebx
mov dword [rsp + 0x24], ebx
je 0x10063794
cmp dword [rdi + 0x24], ebx
jne 0x10063794
cmp esi, 2
jb 0x100637f6
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x80]
mov r8d, 2
call fcn.1000abc8
cmp eax, ebx
jne 0x10063861
cmp byte [rsp + 0x80], 0x43
jne 0x100637f6
cmp byte [rsp + 0x81], 0x4b
jne 0x100637f6
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
mov r8d, 2
add esi, 0xfffffffe
call fcn.10063554
mov r8d, dword [rsp + 0x24]
mov edx, dword [rsp + 0x20]
mov eax, 0x10000
sub eax, dword [rdi + 0x24]
cmp eax, esi
jb 0x100637f6
cmp esi, ebx
je 0x10063806
mov edx, dword [rdi + 0x24]
mov rcx, qword [rdi + 0x10]
lea r8, [rsp + 0x80]
add rdx, qword [rdi + 0x18]
mov qword [rsp + 0x80], rsi
call fcn.1000ab5c
cmp eax, ebx
jne 0x10063861
mov edx, dword [rdi + 0x24]
mov r8d, dword [rsp + 0x80]
lea rcx, [rsp + 0x20]
add rdx, qword [rdi + 0x18]
call fcn.10063554
mov r11, qword [rsp + 0x80]
add dword [rdi + 0x24], r11d
cmp r11, rsi
je 0x100637fd
mov eax, 1
jmp 0x10063861
mov r8d, dword [rsp + 0x24]
mov edx, dword [rsp + 0x20]
cmp r8d, ebx
mov eax, dword [rdi + 0x24]
mov r9d, ebx
mov dword [rdi + 0x28], eax
jle 0x1006383d
lea r10, [rsp + 0x28]
movzx eax, byte [r10]
mov ecx, r8d
inc r10
sub ecx, r9d
inc r9d
lea ecx, [rcx*8 - 8]
shl eax, cl
xor edx, eax
cmp r9d, r8d
mov dword [rsp + 0x20], edx
jl 0x10063819
cmp ebp, ebx
jne 0x10063845
mov al, bl
jmp 0x10063857
mov ecx, dword [r13]
shl ecx, 0x10
or ecx, dword [r12]
xor edx, ecx
cmp edx, ebp
setne al
or byte [rdi + 0x30], al
cmp al, bl
setne bl
mov eax, ebx
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100897ac
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
movzx r9d, cx
je 0x100897e2
mov ax, r9w
lea r10, [0x1013e0e0]
shr rax, 8
xor al, byte [rdx]
inc rdx
movzx ecx, al
movzx eax, r9w
mov r9w, word [r10 + rcx*2]
shl ax, 8
xor r9w, ax
dec r8
jne 0x100897b5
mov ax, r9w
ret

Function at 0x10090c08
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
lea rdx, [0x100fc770]
mov rcx, rdi
mov r8d, 8
call sub.msvcrt.dll_memcpy
mov dword [rdi + 8], 0xd0
mov eax, dword [rbx]
mov dword [rdi + 0xc], eax
mov eax, dword [rbx + 4]
lea rdx, [rbx + 0xc]
mov dword [rdi + 0x10], eax
mov eax, dword [rbx + 8]
lea rcx, [rdi + 0x18]
mov r8d, 0x10
mov dword [rdi + 0x14], eax
call sub.msvcrt.dll_memcpy
movzx r11d, word [rbx + 0x1c]
xor edx, edx
mov word [rdi + 0x28], r11w
movzx eax, word [rbx + 0x1e]
lea rcx, [rdi + 0x94]
mov word [rdi + 0x2a], ax
mov eax, dword [rbx + 0x20]
lea r8d, [rdx + 0x3c]
mov dword [rdi + 0x2c], eax
mov rax, qword [rbx + 0x28]
mov qword [rdi + 0x30], rax
mov al, byte [rbx + 0x40]
mov byte [rdi + 0x37], al
mov rax, qword [rbx + 0x30]
mov qword [rdi + 0x38], rax
mov rax, qword [rbx + 0x38]
mov qword [rdi + 0x40], rax
mov rax, qword [rbx + 0x48]
mov qword [rdi + 0x48], rax
mov al, byte [rbx + 0x60]
mov byte [rdi + 0x4f], al
mov rax, qword [rbx + 0x50]
mov qword [rdi + 0x50], rax
mov rax, qword [rbx + 0x58]
mov qword [rdi + 0x58], rax
mov rax, qword [rbx + 0x68]
mov qword [rdi + 0x60], rax
mov al, byte [rbx + 0x80]
mov byte [rdi + 0x67], al
mov rax, qword [rbx + 0x70]
mov qword [rdi + 0x68], rax
mov rax, qword [rbx + 0x78]
mov qword [rdi + 0x70], rax
mov rax, qword [rbx + 0x88]
mov qword [rdi + 0x7c], rax
mov al, byte [rbx + 0xa0]
mov byte [rdi + 0x83], al
mov rax, qword [rbx + 0x90]
mov qword [rdi + 0x84], rax
mov rax, qword [rbx + 0x98]
mov qword [rdi + 0x8c], rax
mov eax, dword [rbx + 0xa8]
mov dword [rdi + 0x78], eax
add rsp, 0x28
pop rdi
pop rbx
jmp sub.msvcrt.dll_memset
Function at 0x100a273c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x48
cmp byte [r8 + 1], 0
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov rbp, rcx
je 0x100a28c8
mov al, byte [r9 + 2]
shr al, 3
test al, 1
je 0x100a2776
mov eax, 0x80004001
jmp 0x100a2939
mov eax, dword [r9 + 0xb8]
movzx ecx, word [r9 + 0xbc]
lea rdx, [r8 + 0x20]
add rcx, rax
mov rax, qword [r9 + 0x10]
add rcx, qword [r9 + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
lea rcx, [r9 + 0x20]
call fcn.10004d38
mov dl, byte [rsi + 4]
mov rcx, rbx
call fcn.100a0d7c
mov r11d, dword [rsi + 0x14]
mov dword [rbx + 8], r11d
mov rax, qword [rsi + 0x30]
mov qword [rbx + 0x60], rax
mov rax, qword [rsi + 0x38]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x40]
mov qword [rbx + 0x70], rax
mov al, byte [rsi + 3]
mov byte [rbx + 0xb2], al
mov esi, dword [rbx + 0x84]
dec esi
movsxd r12, esi
js 0x100a2819
shl r12, 3
mov rax, qword [rbx + 0x88]
mov rcx, qword [r12 + rax]
cmp word [rcx], 0x9901
je 0x100a2811
mov rax, qword [rbx + 0x78]
lea rcx, [rbx + 0x78]
mov r8d, 1
mov edx, esi
call qword [rax + VariantCopy]
sub r12, 8
dec esi
jns 0x100a27ec
mov esi, dword [rbx + 0x3c]
dec esi
movsxd r13, esi
js 0x100a2852
shl r13, 3
mov rax, qword [rbx + 0x40]
mov rcx, qword [r13 + rax]
cmp word [rcx], 0x9901
je 0x100a284a
mov rax, qword [rbx + 0x30]
lea rcx, [rbx + 0x30]
mov r8d, 1
mov edx, esi
call qword [rax + VariantCopy]
sub r13, 8
dec esi
jns 0x100a2827
lea rdx, [rsp + 0x90]
lea rcx, [rbx + 0x30]
call fcn.10098c3c
mov r9, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
movzx edx, word [rbx + 0x28]
mov rcx, rbp
mov byte [rsp + 0x20], al
call fcn.100a0ecc
mov r11, qword [rbp + 0x40]
mov rcx, rbp
mov qword [rbx + 0x58], r11
call fcn.100a10cc
mov r9, qword [rsp + 0xa0]
lea r8, [rsp + 0x30]
mov rdx, rbp
mov rcx, r14
call fcn.100a2310
test eax, eax
jne 0x100a2939
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x38]
mov rdx, rbx
add qword [rcx], rax
mov rcx, rbp
call fcn.100a1160
jmp 0x100a2937
mov rax, qword [r9 + 0x58]
lea r8, [rsp + 0x30]
mov rdx, rbp
mov qword [rsp + 0x30], rax
movzx eax, word [r9 + 0xbc]
add eax, dword [r9 + 0xb8]
mov ecx, eax
mov al, byte [r9 + 2]
shr al, 3
and eax, 1
shl eax, 4
add rcx, rax
mov rax, qword [rbp + 0x40]
add rcx, qword [r9 + 0x10]
mov qword [r9 + 0x58], rax
mov r9, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rcx
mov rcx, r14
call fcn.100a2310
test eax, eax
jne 0x100a2939
mov rax, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x38]
mov rcx, rbp
add qword [rax], rdx
call fcn.100a0e8c
xor eax, eax
add rsp, 0x48
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x100ad000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
sub rsp, 0x58
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 0x10], r13
mov qword [rax - 0x18], r14
mov qword [rax - 0x20], r15
xor r13d, r13d
mov qword [rax + 8], rbx
mov r14, r8
mov r15, rdx
mov rsi, r13
mov rdi, rcx
mov byte [rdx], 0
mov qword [rax + 0x10], rbp
nop
nop
nop
mov r8d, dword [rdi + 0x150]
mov edx, dword [rdi + 0x154]
mov ecx, 8
sub ecx, r8d
lea eax, [r8 + 8]
shr edx, cl
mov dword [rdi + 0x150], eax
shr edx, 0x10
cmp eax, 8
movzx ebp, dl
jb 0x100ad0c4
nop
mov rax, qword [rdi + 0x158]
cmp rax, qword [rdi + 0x160]
jb 0x100ad092
lea rcx, [rdi + 0x158]
call fcn.100068fc
movzx r11d, al
jmp 0x100ad09f
mov r11b, byte [rax]
inc rax
mov qword [rdi + 0x158], rax
mov ecx, dword [rdi + 0x154]
add dword [rdi + 0x150], 0xfffffff8
movzx eax, r11b
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x154], ecx
cmp dword [rdi + 0x150], 8
jae 0x100ad070
mov byte [rsp + rsi + 0x20], bpl
inc rsi
cmp rsi, 6
jl 0x100ad040
mov esi, r13d
mov ebp, 4
mov qword [rsp + 0x50], r12
mov r8d, dword [rdi + 0x150]
mov edx, dword [rdi + 0x154]
mov ecx, 8
sub ecx, r8d
lea eax, [r8 + 8]
shl esi, 8
shr edx, cl
mov dword [rdi + 0x150], eax
shr edx, 0x10
cmp eax, 8
movzx r12d, dl
jb 0x100ad174
nop
nop
nop
nop
mov rax, qword [rdi + 0x158]
cmp rax, qword [rdi + 0x160]
jb 0x100ad142
lea rcx, [rdi + 0x158]
call fcn.100068fc
movzx r11d, al
jmp 0x100ad14f
mov r11b, byte [rax]
inc rax
mov qword [rdi + 0x158], rax
mov ecx, dword [rdi + 0x154]
add dword [rdi + 0x150], 0xfffffff8
movzx eax, r11b
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x154], ecx
cmp dword [rdi + 0x150], 8
jae 0x100ad120
or esi, r12d
dec rbp
mov eax, r12d
jne 0x100ad0e3
movzx eax, byte [rsp + 0x20]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
cmp al, 0x17
mov rbx, qword [rsp + 0x60]
mov dword [r14], esi
jne 0x100ad1d7
cmp byte [rsp + 0x21], 0x72
jne 0x100ad212
cmp byte [rsp + 0x22], 0x45
jne 0x100ad212
cmp byte [rsp + 0x23], 0x38
jne 0x100ad212
cmp byte [rsp + 0x24], 0x50
jne 0x100ad212
cmp byte [rsp + 0x25], 0x90
jne 0x100ad212
mov byte [r15], 1
mov ecx, dword [rdi + 0x700c]
cmp dword [r14], ecx
setne r13b
mov eax, r13d
jmp 0x100ad217
cmp al, 0x31
jne 0x100ad212
cmp byte [rsp + 0x21], 0x41
jne 0x100ad212
cmp byte [rsp + 0x22], 0x59
jne 0x100ad212
cmp byte [rsp + 0x23], 0x26
jne 0x100ad212
cmp byte [rsp + 0x24], 0x53
jne 0x100ad212
cmp byte [rsp + 0x25], 0x59
jne 0x100ad212
mov eax, dword [rdi + 0x700c]
rol eax, 1
xor eax, esi
mov dword [rdi + 0x700c], eax
xor eax, eax
jmp 0x100ad217
mov eax, 1
mov r15, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
add rsp, 0x58
ret
Function at 0x100b05e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x58], rbx
xor ebx, ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x28]
mov dword [rsp + 0x28], ebx
mov qword [rcx + 0x20], rax
mov rax, qword [rcx + 0x8cf8]
mov dword [rsp + 0x2c], 8
mov byte [rsp + 0x30], bl
mov dword [rcx + 0x8ce8], ebx
mov r9d, dword [rax + 0x194]
mov r8d, edx
mov rdx, qword [rcx]
mov qword [rsp + 0x68], rdi
mov rdi, rcx
call fcn.100afd60
mov rcx, qword [rdi + 0x8cf8]
cmp byte [rcx + 0x1dc], bl
je 0x100b0664
mov eax, dword [rdi + 0x8cec]
mov rcx, qword [rcx + 0x1a0]
imul rax, rax, 0x8e28
mov rcx, qword [rax + rcx + 0x8d18]
call fcn.100e7bf0
cmp dword [rdi + 0x8ce8], ebx
mov edx, ebx
jbe 0x100b06a7
lea r8, [rdi + 0x7ce8]
nop
nop
nop
mov rcx, qword [rdi + 0x8cf8]
inc edx
add r8, 4
mov eax, dword [rcx + 0x198]
rol eax, 1
xor eax, dword [r8 - 4]
mov dword [rcx + 0x198], eax
cmp edx, dword [rdi + 0x8ce8]
jb 0x100b0680
mov eax, dword [rsp + 0x28]
movzx r9d, byte [rsp + 0x30]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x8cf8]
lea r8d, [rax*8 + 8]
sub r8d, dword [rsp + 0x2c]
call fcn.100afff0
mov rax, qword [rdi + 0x8cf8]
cmp byte [rax + 0x1dc], bl
je 0x100b0770
mov qword [rsp + 0x60], rsi
mov esi, dword [rdi + 0x8cec]
inc esi
cmp esi, dword [rax + 0x1d8]
cmove esi, ebx
cmp qword [rax + 0x1f8], rbx
je 0x100b0746
lea rbx, [rax + 0x150]
mov rcx, rbx
call fcn.10009a70
mov ecx, 0xf
lea rdx, [rdi + 0x8d20]
sub ecx, dword [rbx + 0x38]
lea r8, [rsp + 0x20]
shr rcx, 3
lea r11, [rcx + rax]
mov rax, qword [rdi + 0x8cf8]
mov qword [rsp + 0x20], r11
mov rcx, qword [rax + 0x1f8]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
mov rcx, qword [rdi + 0x8cf8]
mov r8d, esi
mov rdx, qword [rcx + 0x1a0]
imul r8, r8, 0x8e28
lea rcx, [r8 + rdx + 0x8d18]
call fcn.100e7c60
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x100cbab0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
xor bl, bl
cmp r8d, 1
mov qword [rsp + 0x68], rdi
mov rbp, rdx
mov rsi, rcx
mov edi, r8d
jbe 0x100cbaec
lea r9, [rdx + 1]
lea r10d, [rdi - 1]
xor bl, byte [r9]
inc r9
dec r10
jne 0x100cbae1
mov qword [rsp + 0x40], r12
call fcn.10001a14
mov dword [rsi + 0x20], 0xffffffff
xor r12d, r12d
cmp bl, byte [rbp]
mov rbx, qword [rsp + 0x50]
jne 0x100cbb57
test edi, edi
je 0x100cbb57
mov rdx, rdi
mov rcx, rbp
call fcn.100ec0a0
mov edx, r12d
lea rcx, [0x100ffa20]
cmp dword [rcx + 4], eax
jne 0x100cbb2c
cmp dword [rcx], edi
je 0x100cbb3c
inc edx
add rcx, 0xc
cmp edx, 7
jb 0x100cbb23
mov edx, 0xffffffff
test edx, edx
mov dword [rsi + 0x20], edx
jns 0x100cbbe9
lea r8d, [rdi - 1]
lea rdx, [rbp + 1]
mov rcx, rsi
call fcn.100cb430
mov rcx, rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x2c], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], 3
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x3c], r12d
call fcn.10001a24
movsxd rdx, dword [rsi + 0xc]
mov rcx, qword [rsi + 0x10]
shl rdx, 5
lea r8, [rsp + 0x20]
mov eax, dword [r8]
mov dword [rdx + rcx], eax
mov eax, dword [r8 + 4]
mov dword [rdx + rcx + 4], eax
mov eax, dword [r8 + 8]
mov dword [rdx + rcx + 8], eax
mov eax, dword [r8 + 0xc]
mov dword [rdx + rcx + 0xc], eax
mov eax, dword [r8 + 0x10]
mov dword [rdx + rcx + 0x10], eax
mov eax, dword [r8 + 0x14]
mov dword [rdx + rcx + 0x14], eax
mov eax, dword [r8 + 0x18]
mov dword [rdx + rcx + 0x18], eax
mov eax, dword [r8 + 0x1c]
mov dword [rdx + rcx + 0x1c], eax
inc dword [rsi + 0xc]
movsxd rcx, dword [rsi + 0xc]
mov rax, qword [rsi + 0x10]
shl rcx, 5
mov dword [rcx + rax - 0x20], 0x16
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x100cef10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
xor ebp, ebp
cmp r8, 0x40
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 0x48], rbp
mov qword [rax - 0x40], rbp
mov qword [rax - 0x38], rbp
mov qword [rax - 0x30], rbp
mov qword [rax - 0x28], rbp
mov qword [rax - 0x20], rbp
mov qword [rax - 0x18], rbp
mov qword [rax - 0x10], rbp
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
jbe 0x100cef7d
call fcn.100d06b0
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
mov dword [rdi + 0x20], ebp
call fcn.100d0e90
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.100d10e0
jmp 0x100cef8c
test rbx, rbx
je 0x100cef8c
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0x80]
mov rax, rbp
nop
nop
nop
xor byte [rsp + rax + 0x20], 0x36
xor byte [rsp + rax + 0x21], 0x36
add rax, 2
cmp rax, 0x40
jb 0x100cefa0
mov rcx, rdi
call fcn.100d06b0
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rdi
mov dword [rdi + 0x20], ebp
call fcn.100d0e90
mov r11, rbp
nop
nop
nop
xor byte [rsp + r11 + 0x20], 0x6a
xor byte [rsp + r11 + 0x21], 0x6a
add r11, 2
cmp r11, 0x40
jb 0x100cefe0
lea rcx, [rdi + 0x68]
call fcn.100d06b0
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
mov r8d, 0x40
mov dword [rdi + 0x88], ebp
call fcn.100d0e90
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x100cf0b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xf8
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
xor ebp, ebp
cmp r8, 0x40
mov qword [rax + 0x18], rsi
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rbp
mov qword [rax + 0x20], rdi
mov qword [rax - 0x80], rbp
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
jbe 0x100cf208
lea rcx, [rax - 0x78]
call fcn.100d06b0
lea rcx, [rsp + 0x80]
mov r8, rbx
mov rdx, rdi
mov dword [rsp + 0xa0], ebp
call fcn.100d0e90
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call fcn.100d10e0
movzx eax, byte [rsp + 0x21]
movzx r11d, byte [rsp + 0x20]
movzx ecx, byte [rsp + 0x24]
shl r11d, 8
shl ecx, 8
or r11d, eax
movzx eax, byte [rsp + 0x22]
shl r11d, 8
or r11d, eax
movzx eax, byte [rsp + 0x23]
shl r11d, 8
or r11d, eax
movzx eax, byte [rsp + 0x25]
or ecx, eax
movzx eax, byte [rsp + 0x26]
mov dword [rsp + 0x40], r11d
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x27]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x29]
mov dword [rsp + 0x44], ecx
movzx ecx, byte [rsp + 0x28]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x2a]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x2b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x2d]
mov dword [rsp + 0x48], ecx
movzx ecx, byte [rsp + 0x2c]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x2e]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x2f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x31]
mov dword [rsp + 0x4c], ecx
movzx ecx, byte [rsp + 0x30]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x32]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x33]
shl ecx, 8
or ecx, eax
mov dword [rsp + 0x50], ecx
jmp 0x100cf23b
test rbx, rbx
mov r8, rbp
je 0x100cf23b
mov eax, r8d
mov rdx, r8
mov ecx, 3
and eax, 3
shr rdx, 2
inc r8
sub ecx, eax
movzx eax, byte [r8 + rdi - 1]
shl ecx, 3
shl eax, cl
or dword [rsp + rdx*4 + 0x40], eax
cmp r8, rbx
jb 0x100cf210
mov rdi, qword [rsp + 0x118]
mov rax, rbp
nop
nop
nop
xor dword [rsp + rax*4 + 0x40], 0x36363636
inc rax
cmp rax, 0x10
jb 0x100cf250
mov rcx, rsi
call fcn.100d06b0
lea rdx, [rsp + 0x40]
mov r8d, 0x10
mov rcx, rsi
mov dword [rsi + 0x20], ebp
call fcn.100d1280
mov r11, rbp
nop
nop
nop
nop
xor dword [rsp + r11*4 + 0x40], 0x6a6a6a6a
inc r11
cmp r11, 0x10
jb 0x100cf290
lea rcx, [rsi + 0x68]
call fcn.100d06b0
lea rdx, [rsp + 0x40]
lea rcx, [rsi + 0x68]
mov r8d, 0x10
mov dword [rsi + 0x88], ebp
call fcn.100d1280
mov rsi, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x100]
add rsp, 0xf8
ret
Function at 0x100cf370
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov qword [rax + 0x20], rdi
mov edi, r8d
lea rdx, [rsp + 0x20]
mov r8d, 5
mov rsi, rcx
call fcn.100d0df0
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x68]
mov r8d, 5
call fcn.100d0df0
test edi, edi
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x30], eax
je 0x100cf434
nop
nop
nop
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov rcx, rsi
call fcn.100d06e0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x68]
xor r9d, r9d
call fcn.100d06e0
mov eax, dword [rsp + 0x24]
mov r11d, dword [rsp + 0x20]
xor dword [rbx + 4], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx], r11d
xor dword [rbx + 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x30]
xor dword [rbx + 0x10], eax
dec rdi
jne 0x100cf3e0
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa8
ret
Function at 0x100cfbd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov r11d, dword [rcx + 0x104]
mov qword [rsp + 0x40], rbx
mov ebx, dword [rcx + 0x100]
xor r11d, dword [rdx + 4]
mov qword [rsp + 0x48], rbp
mov ebp, dword [rcx + 0x108]
xor ebp, dword [rdx + 8]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x30], r12
mov r12d, dword [rdx + 0xc]
mov edi, ebx
xor edi, dword [rdx]
xor r12d, dword [rcx + 0x10c]
test r8b, r8b
movzx esi, r8b
mov r10, rdx
mov r9, rcx
jne 0x100cfc37
mov rax, qword [rdx]
lea rcx, [rsp]
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x18], r15
xor r15d, r15d
mov qword [rsp + 0x28], r13
mov r14d, 0x1f
nop
mov eax, r14d
test sil, sil
mov edx, r12d
cmovne eax, r15d
dec r14d
inc r15d
and eax, 3
rol edx, 0xb
mov r8d, dword [r9 + rax*4 + 0x100]
add edx, ebp
xor edx, r8d
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx r13d, byte [rax + r9]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [rax + r9]
mov eax, edx
shr eax, 8
shl ecx, 8
movzx eax, al
or r13d, ecx
movzx ecx, dl
movzx eax, byte [rax + r9]
shl r13d, 8
mov edx, ebp
or r13d, eax
movzx eax, byte [rcx + r9]
shl r13d, 8
or r13d, eax
xor r13d, edi
rol edx, 0x11
mov edi, ebp
xor edx, r12d
mov ebp, r13d
add edx, r8d
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx r8d, byte [rax + r9]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [rax + r9]
mov eax, edx
shr eax, 8
shl ecx, 8
or r8d, ecx
movzx eax, al
movzx ecx, dl
movzx eax, byte [rax + r9]
shl r8d, 8
or r8d, eax
movzx eax, byte [rcx + r9]
shl r8d, 8
or r8d, eax
xor r8d, r11d
cmp r14d, 0xffffffff
mov r11d, r12d
mov r12d, r8d
jg 0x100cfc50
mov r15, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
xor ebx, r13d
mov r13, qword [rsp + 0x28]
mov dword [r10], ebx
mov eax, dword [r9 + 0x104]
mov rbx, qword [rsp + 0x40]
xor eax, r8d
lea rcx, [rsp]
mov edx, 4
mov dword [r10 + 4], eax
mov eax, dword [r9 + 0x108]
lea r8, [0x10142da0]
xor eax, edi
mov rdi, qword [rsp + 0x58]
mov dword [r10 + 8], eax
xor r11d, dword [r9 + 0x10c]
test sil, sil
mov rsi, qword [rsp + 0x50]
cmovne rcx, r10
mov dword [r10 + 0xc], r11d
inc rcx
nop
nop
movzx eax, byte [rcx - 1]
add rcx, 4
mov eax, dword [r8 + rax*4]
xor dword [r9 + 0x100], eax
movzx eax, byte [rcx - 4]
mov eax, dword [r8 + rax*4]
xor dword [r9 + 0x104], eax
movzx eax, byte [rcx - 3]
mov eax, dword [r8 + rax*4]
xor dword [r9 + 0x108], eax
movzx eax, byte [rcx - 2]
mov eax, dword [r8 + rax*4]
xor dword [r9 + 0x10c], eax
dec rdx
jne 0x100cfd90
add rsp, 0x38
ret

Function at 0x100d06b0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x18], 0
ret