joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ed50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, r8
mov r14, rdx
mov rbp, rcx
xor ebx, ebx
mov qword [rax - 0x40], rbx
mov qword [rax - 0x38], rbx
mov qword [rax - 0x30], rbx
mov qword [rax - 0x28], rbx
mov cl, 1
call fcn.14001d0b0
mov r15, rax
mov qword [rsp + 0x40], rax
mov r8, qword [rax]
lea edx, [rbx + 0x40]
mov rcx, rax
call qword [r8]
mov rdi, rax
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1402b7460
nop
shr rsi, 1
je 0x14002ede5
mov rcx, rdi
sub r14, rdi
nop word [rax + rax]
movzx eax, word [r14 + rcx]
rol ax, 8
mov word [rcx], ax
lea rcx, [rcx + 2]
dec rsi
jne 0x14002edd0
mov r11d, 1
lea r10, [rdi + 0x10]
lea esi, [r11 + 7]
lea r14, [0x140000000]
mov r12d, 0x1ff
movzx eax, word [r10 - 0x10]
movzx edx, ax
and dx, 0x7f
mov ecx, eax
shr rcx, 7
movzx r8d, word [r14 + rcx*2 + 0x311490]
xor r8w, dx
mov rax, r11
and eax, 7
movzx r9d, word [rdi + rax*2]
movzx eax, dx
movzx eax, byte [rax + r14 + 0x3102d0]
and al, 0x7f
movzx ecx, al
movzx eax, r9w
shr ax, 9
xor ax, r8w
and ax, 0x7f
xor cx, ax
and r9, r12
movzx eax, r8w
xor r9, rax
movzx eax, word [r14 + r9*2 + 0x311490]
xor ax, cx
shl cx, 9
or ax, cx
mov word [r10], ax
shr ax, 9
mov word [r10 + 0x10], ax
movzx eax, word [r10]
and ax, r12w
mov word [r10 + 0x20], ax
lea r10, [r10 + 2]
inc r11
dec rsi
jne 0x14002ee00
nop word [rax + rax]
movzx eax, byte [rbx + r14 + 0x342500]
mov rcx, qword [rbp + 8]
movzx eax, word [rdi + rax*2]
mov word [rcx + rbx*2], ax
movzx eax, byte [rbx + r14 + 0x3432f0]
mov rcx, qword [rbp + 0x28]
movzx eax, word [rdi + rax*2]
mov word [rcx + rbx*2], ax
inc rbx
cmp rbx, 0x64
jne 0x14002eea0
test rdi, rdi
je 0x14002eee8
mov rax, qword [r15]
lea r8d, [rbx - 0x24]
mov rdx, rdi
mov rcx, r15
call qword [rax + 8]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14002f040
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x14002f2e1
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
sub rsp, 0x48
mov qword [rax + 0x10], rbx
mov qword [rax - 8], rbp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
lea r15, [r8 + 8]
sub r8, rdx
mov r10, rcx
lea r14, [rdx + 8]
lea rax, [r8 - 8]
mov qword [rsp], r15
mov qword [rsp + 8], rax
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14 - 8]
mov ecx, dword [r14 + 4]
mov rsi, qword [r10 + 8]
mov r12d, dword [rsi + 4]
mov r13d, dword [rsi + 0xc]
mov edi, eax
rol eax, 8
lea r15, [0x14031e100]
and eax, 0xff00ff
ror edi, 8
and edi, 0xff00ff00
or edi, eax
mov eax, dword [r14 - 4]
mov r11d, eax
rol eax, 8
and eax, 0xff00ff
ror r11d, 8
and r11d, 0xff00ff00
or r11d, eax
mov eax, dword [r14]
mov ebx, eax
rol eax, 8
and eax, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, eax
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
xor ebp, ebp
nop dword [rax]
movzx ecx, byte [r15 + rbp]
mov r9d, dword [rsi + 8]
mov r8d, ebx
xor edi, ecx
inc rbp
xor r8d, edi
mov edx, r8d
mov ecx, r8d
rol ecx, 8
ror edx, 8
xor edx, ecx
mov ecx, r12d
xor r8d, edx
xor ecx, r8d
xor r11d, ecx
mov ecx, r13d
xor ecx, r8d
xor eax, ecx
mov r10d, eax
xor r10d, r11d
rol eax, 2
mov r8d, eax
mov edx, r10d
rol r11d, 1
mov ecx, r10d
ror edx, 8
rol ecx, 8
xor edx, ecx
xor r10d, edx
mov edx, eax
not edx
xor r9d, r10d
xor r9d, ebx
mov ebx, r8d
rol r9d, 5
mov ecx, r9d
mov eax, r9d
not ecx
and edx, ecx
xor r11d, edx
and eax, r11d
xor eax, dword [rsi]
xor eax, r10d
xor eax, edi
xor ebx, eax
mov edx, eax
xor ebx, r9d
not edx
xor ebx, r11d
ror eax, 2
mov ecx, ebx
mov edi, ebx
ror ebx, 5
not ecx
and edx, ecx
xor r11d, edx
and edi, r11d
xor edi, r8d
ror r11d, 1
cmp rbp, 0x10
jne 0x14002f120
mov r9d, dword [rsi + 8]
mov r15, qword [rsp]
mov r10, qword [rsp + 0x50]
xor edi, 0xd4
mov r8d, ebx
xor r8d, edi
mov edx, r8d
mov ecx, r8d
rol ecx, 8
ror edx, 8
xor edx, ecx
mov ecx, r12d
xor r8d, edx
xor ecx, r8d
xor r11d, ecx
mov ecx, r13d
xor ecx, r8d
xor eax, ecx
mov r8d, eax
xor r8d, r11d
mov edx, r8d
mov ecx, r8d
rol ecx, 8
ror edx, 8
xor edx, ecx
xor r8d, edx
mov edx, dword [rsi]
xor edx, r8d
xor r9d, r8d
xor edx, edi
xor r9d, ebx
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov rdx, qword [rsp + 8]
mov dword [r14 + rdx], ecx
mov ecx, r11d
add r14, rbp
ror ecx, 8
and ecx, 0xff00ff00
rol r11d, 8
and r11d, 0xff00ff
or ecx, r11d
mov dword [r15 - 4], ecx
mov ecx, r9d
ror ecx, 8
and ecx, 0xff00ff00
rol r9d, 8
and r9d, 0xff00ff
or ecx, r9d
mov dword [r15], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov dword [r15 + 4], ecx
add r15, rbp
dec qword [rsp + 0x68]
mov qword [rsp], r15
jne 0x14002f0a0
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x14002f2f0
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x14002f58f
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
sub rsp, 0x48
mov qword [rax + 0x10], rbx
mov qword [rax - 8], rbp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
lea r15, [r8 + 8]
sub r8, rdx
mov r10, rcx
lea r14, [rdx + 8]
lea rax, [r8 - 8]
mov qword [rsp], r15
mov qword [rsp + 8], rax
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14 - 8]
mov ecx, dword [r14 + 4]
mov rsi, qword [r10 + 0x28]
mov r12d, dword [rsi + 4]
mov r13d, dword [rsi + 0xc]
mov edi, eax
rol eax, 8
mov ebp, 0x10
lea r15, [0x14031e100]
ror edi, 8
and eax, 0xff00ff
and edi, 0xff00ff00
or edi, eax
mov eax, dword [r14 - 4]
mov r11d, eax
rol eax, 8
and eax, 0xff00ff
ror r11d, 8
and r11d, 0xff00ff00
or r11d, eax
mov eax, dword [r14]
mov ebx, eax
rol eax, 8
and eax, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, eax
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
nop
mov r9d, dword [rsi + 8]
mov r8d, ebx
xor r8d, edi
mov edx, r8d
mov ecx, r8d
rol ecx, 8
ror edx, 8
xor edx, ecx
mov ecx, r12d
xor r8d, edx
xor ecx, r8d
xor r11d, ecx
mov ecx, r13d
xor ecx, r8d
xor eax, ecx
mov r10d, eax
xor r10d, r11d
rol eax, 2
mov r8d, eax
mov edx, r10d
rol r11d, 1
mov ecx, r10d
ror edx, 8
rol ecx, 8
xor edx, ecx
xor r10d, edx
mov edx, eax
movzx eax, byte [r15 + rbp]
not edx
xor r9d, r10d
xor r9d, ebx
mov ebx, r8d
rol r9d, 5
mov ecx, r9d
not ecx
and edx, ecx
mov ecx, r9d
xor r11d, edx
and ecx, r11d
xor eax, ecx
xor eax, dword [rsi]
xor eax, r10d
xor eax, edi
xor ebx, eax
mov edx, eax
xor ebx, r9d
not edx
ror eax, 2
xor ebx, r11d
mov ecx, ebx
mov edi, ebx
not ecx
and edx, ecx
xor r11d, edx
ror ebx, 5
and edi, r11d
xor edi, r8d
ror r11d, 1
dec rbp
jne 0x14002f3d0
mov r9d, dword [rsi + 8]
mov r15, qword [rsp]
mov r10, qword [rsp + 0x50]
mov r8d, ebx
add r15, 0x10
add r14, 0x10
xor r8d, edi
mov qword [rsp], r15
mov edx, r8d
mov ecx, r8d
rol ecx, 8
ror edx, 8
xor edx, ecx
mov ecx, r12d
xor r8d, edx
xor ecx, r8d
xor r11d, ecx
mov ecx, r13d
xor ecx, r8d
xor eax, ecx
mov r8d, eax
xor r8d, r11d
mov edx, r8d
mov ecx, r8d
rol ecx, 8
ror edx, 8
xor edx, ecx
xor r8d, edx
mov edx, dword [rsi]
xor edx, r8d
xor r9d, r8d
xor edx, edi
xor r9d, ebx
btc edx, 7
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov rdx, qword [rsp + 8]
mov dword [r14 + rdx - 0x10], ecx
mov ecx, r11d
ror ecx, 8
and ecx, 0xff00ff00
rol r11d, 8
and r11d, 0xff00ff
or ecx, r11d
mov dword [r15 - 0x14], ecx
mov ecx, r9d
ror ecx, 8
and ecx, 0xff00ff00
rol r9d, 8
and r9d, 0xff00ff
or ecx, r9d
mov dword [r15 - 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
dec qword [rsp + 0x68]
mov dword [r15 - 0xc], ecx
jne 0x14002f350
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x14002f590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, dword [rdx]
mov rsi, rcx
mov ecx, dword [rdx + 0xc]
mov edi, eax
rol eax, 8
lea r14, [0x14031e100]
and eax, 0xff00ff
ror edi, 8
and edi, 0xff00ff00
or edi, eax
mov eax, dword [rdx + 4]
mov r11d, eax
rol eax, 8
and eax, 0xff00ff
ror r11d, 8
and r11d, 0xff00ff00
or r11d, eax
mov eax, dword [rdx + 8]
mov ebx, eax
rol eax, 8
and eax, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, eax
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
xor ebp, ebp
nop word [rax + rax]
movzx ecx, byte [r14 + rbp]
mov r8d, ebx
inc rbp
xor edi, ecx
xor r8d, edi
mov edx, r8d
mov ecx, r8d
ror edx, 8
rol ecx, 8
xor edx, ecx
xor r8d, edx
xor eax, r8d
xor r11d, r8d
mov r10d, eax
xor r10d, r11d
rol eax, 2
mov r8d, eax
mov edx, r10d
rol r11d, 1
mov ecx, r10d
ror edx, 8
rol ecx, 8
xor edx, ecx
xor r10d, edx
mov edx, eax
not edx
mov r9d, r10d
xor r9d, ebx
mov ebx, r8d
rol r9d, 5
mov ecx, r9d
mov eax, r9d
not ecx
and edx, ecx
xor r11d, edx
and eax, r11d
xor eax, r10d
xor eax, edi
xor ebx, eax
mov edx, eax
ror eax, 2
xor ebx, r9d
not edx
xor ebx, r11d
mov ecx, ebx
mov edi, ebx
not ecx
ror ebx, 5
and edx, ecx
xor r11d, edx
and edi, r11d
xor edi, r8d
ror r11d, 1
cmp rbp, 0x10
jne 0x14002f620
mov rcx, qword [rsi + 0x28]
mov rbp, qword [rsp + 0x18]
xor edi, 0xd4
mov dword [rcx], edi
mov rcx, qword [rsi + 0x28]
mov r8d, ebx
mov dword [rcx + 4], r11d
mov rcx, qword [rsi + 0x28]
xor r8d, edi
mov dword [rcx + 8], ebx
mov rcx, qword [rsi + 0x28]
mov edx, r8d
ror edx, 8
mov dword [rcx + 0xc], eax
mov ecx, r8d
rol ecx, 8
xor edx, ecx
xor r8d, edx
xor eax, r8d
xor r11d, r8d
mov r8d, eax
xor r8d, r11d
mov ecx, r8d
mov edx, r8d
rol ecx, 8
ror edx, 8
xor edx, ecx
mov rcx, qword [rsi + 8]
xor r8d, edx
mov edx, r8d
xor edx, edi
mov rdi, qword [rsp + 0x28]
xor r8d, ebx
mov rbx, qword [rsp + 0x10]
mov dword [rcx], edx
mov rcx, qword [rsi + 8]
mov dword [rcx + 4], r11d
mov rcx, qword [rsi + 8]
mov dword [rcx + 8], r8d
mov rcx, qword [rsi + 8]
mov rsi, qword [rsp + 0x20]
mov dword [rcx + 0xc], eax
pop r14
ret
Function at 0x140031530
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov cl, 1
call fcn.14001d0b0
mov qword [rsp + 0x40], rax
mov edi, 0x80
mov edx, edi
lea rcx, [rsp + 0x28]
call fcn.1400bf6b0
nop
mov qword [rsp + 0x80], rsi
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0x80]
cmp rax, rsi
cmovae r8, rcx
mov r8, qword [r8]
mov rdx, rbx
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.1402b7460
lea r9, [0x1403450a0]
cmp rsi, rdi
je 0x140031610
lea rcx, [rbx - 1]
add rcx, rsi
mov r8d, 1
sub r8, rsi
sub rdi, rsi
nop dword [rax + rax]
lea rdx, [rcx + 1]
movzx eax, byte [r8 + rcx]
movzx ecx, byte [rcx]
add eax, ecx
and eax, 0x800000ff
jge 0x1400315fe
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
movzx eax, byte [rcx + r9]
mov byte [rdx], al
mov rcx, rdx
dec rdi
jne 0x1400315e0
mov rcx, rbx
sub rcx, rsi
movzx eax, byte [rcx + 0x80]
movzx eax, byte [rax + r9]
mov byte [rcx + 0x80], al
mov eax, 0x7f
sub eax, esi
movsxd r8, eax
js 0x14003165e
lea rax, [rbx + 1]
add rax, r8
inc r8
nop
lea rdx, [rax - 1]
movzx ecx, byte [rsi + rax - 1]
movzx eax, byte [rax]
xor rcx, rax
movzx eax, byte [rcx + r9]
mov byte [rdx], al
lea rax, [rdx]
dec r8
jne 0x140031640
mov rax, qword [rbp + 8]
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rbx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rbx + 0x60]
movups xmmword [rax + 0x60], xmm0
movups xmm1, xmmword [rbx + 0x70]
movups xmmword [rax + 0x70], xmm1
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400316c2
test rbx, rbx
je 0x1400316c2
mov r8, qword [rsp + 0x38]
test r8, r8
je 0x1400316c2
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140045750
Capabilities:
Encode data using xor
Encrypt data using skipjack

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rcx
xor r9d, r9d
lea r10, [rdx + 9]
lea rbx, [0x140342050]
nop word [rax + rax]
xor eax, eax
movzx r8d, byte [r10]
mov rdx, qword [r11 + 8]
xor r8, rax
add rdx, r9
inc rax
movzx ecx, byte [r8 + rbx]
mov byte [rdx + rax - 1], cl
cmp rax, 0x100
jne 0x140045772
add r9, rax
dec r10
cmp r9, 0xa00
jne 0x140045770
mov rbx, qword [rsp + 8]
ret
Function at 0x140046660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
mov rbx, rcx
xor r11d, r11d
lea rdi, [0x140000000]
nop word [rax + rax]
xor eax, eax
mov byte [rsp + 0x10], 0
mov word [rsp + 0x11], ax
mov byte [rsp + 0x13], al
mov eax, dword [rbx + r11*4]
mov ecx, eax
rol eax, 8
and eax, 0xff00ff
ror ecx, 8
and ecx, 0xff00ff00
or ecx, eax
xor r10d, r10d
mov dword [rsp + 0x18], ecx
lea r9, [rdi + 0x3448d0]
xor ecx, ecx
add r9, r10
nop dword [rax]
movzx edx, byte [rsp + rcx + 0x18]
movzx eax, byte [r9]
test dl, dl
je 0x140046719
test al, al
je 0x140046719
movzx eax, al
movzx r8d, byte [rax + rdi + 0x31ed40]
movzx eax, dl
movzx eax, byte [rax + rdi + 0x31ed40]
add r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
movsxd rax, r8d
movzx eax, byte [rax + rdi + 0x3264d0]
xor byte [rsp + r10 + 0x10], al
inc rcx
add r9, 4
cmp rcx, 4
jne 0x1400466c0
inc r10
cmp r10, rcx
jne 0x1400466b0
mov eax, dword [rsp + 0x10]
inc r11
mov ecx, eax
rol eax, 8
and eax, 0xff00ff
ror ecx, 8
and ecx, 0xff00ff00
or ecx, eax
mov dword [rbx + r11*4 - 4], ecx
cmp r11, 4
jne 0x140046680
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x140046770
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x14004689d
push r13
push r14
push r15
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbp
mov r15, rdx
mov qword [rsp + 0x30], rsi
mov r14, r9
mov r10, r8
sub r15, r8
mov r13, rcx
mov qword [rsp + 0x38], rdi
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r15 + r10 + 4]
mov eax, dword [r15 + r10]
mov r8d, eax
rol eax, 8
and eax, 0xff00ff
ror r8d, 8
and r8d, 0xff00ff00
or r8d, eax
mov eax, ecx
ror eax, 8
and eax, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or eax, ecx
mov rcx, qword [r13 + 8]
xor r9d, r9d
mov ebx, dword [rcx]
mov edi, dword [rcx + 4]
mov esi, dword [rcx + 8]
mov ebp, dword [rcx + 0xc]
lea r11d, [r9 + 0x20]
nop dword [rax]
mov edx, eax
mov ecx, eax
lea r9d, [r9 - 0x61c88647]
shr edx, 5
shl ecx, 4
add edx, edi
add ecx, ebx
xor edx, ecx
lea ecx, [r9 + rax]
xor edx, ecx
add r8d, edx
mov edx, r8d
mov ecx, r8d
shr edx, 5
shl ecx, 4
add edx, ebp
add ecx, esi
xor edx, ecx
lea ecx, [r9 + r8]
xor edx, ecx
add eax, edx
dec r11
jne 0x140046800
mov ecx, r8d
rol r8d, 8
add r10, 8
and r8d, 0xff00ff
ror ecx, 8
and ecx, 0xff00ff00
or ecx, r8d
mov dword [r10 - 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov dword [r10 - 4], ecx
dec r14
jne 0x1400467b0
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
pop r15
pop r14
pop r13
ret
Function at 0x14004ae60
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x20
mov rsi, r9
xor ebx, ebx
mov rdi, r8
mov r9, rdx
mov rbp, rcx
movabs r12, 0xaaaaaaaaaaaaaaab
mov qword [rsi], rbx
lea r15, [0x140310450]
cmp r8, 3
jb 0x14004af3f
mov rax, r12
lea r10, [rcx + 2]
mul rdi
shr rdx, 1
imul rax, rdx, 0xfffffffffffffffd
lea rbx, [rdx*4]
add rdi, rax
mov r8, qword [rsi]
lea r10, [r10 + 4]
movzx eax, byte [r8 + r9]
shr rax, 2
movzx eax, byte [rax + r15]
mov byte [r10 - 6], al
movzx eax, byte [r8 + r9]
and eax, 3
shl eax, 4
movsxd rcx, eax
movzx eax, byte [r8 + r9 + 1]
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [r10 - 5], al
movzx eax, byte [r8 + r9 + 1]
and eax, 0xf
shl eax, 2
movsxd rcx, eax
movzx eax, byte [r8 + r9 + 2]
shr eax, 6
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [r10 - 4], al
movzx eax, byte [r8 + r9 + 2]
and eax, 0x3f
movzx eax, byte [rax + r15]
mov byte [r10 - 3], al
lea rax, [r8 + 3]
mov qword [rsi], rax
dec rdx
jne 0x14004aec0
cmp byte [rsp + 0x60], 0
je 0x14004b021
test rdi, rdi
je 0x14004b021
xor eax, eax
mov qword [rsp + 0x40], r14
mov r14, qword [rsi]
lea rcx, [rsp + 0x60]
lea rdx, [r14 + r9]
mov r8, rdi
mov byte [rsp + 0x60], 0
mov word [rsp + 0x61], ax
call fcn.1402b7460
movzx ecx, byte [rsp + 0x60]
movzx edx, byte [rsp + 0x61]
mov eax, ecx
shr rax, 2
movzx eax, byte [rax + r15]
mov byte [rbx + rbp], al
mov eax, ecx
and eax, 3
shl eax, 4
movsxd rcx, eax
mov eax, edx
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [rbx + rbp + 1], al
mov eax, edx
movzx edx, byte [rsp + 0x62]
and eax, 0xf
shl eax, 2
movsxd rcx, eax
mov eax, edx
shr eax, 6
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [rbx + rbp + 2], al
mov eax, edx
mov edx, 3
and eax, 0x3f
sub rdx, rdi
movzx eax, byte [rax + r15]
shl rdx, 3
mov byte [rbx + rbp + 3], al
cmp rdx, 8
jb 0x14004b00f
add rdx, 0xfffffffffffffffe
mov rax, r12
lea rcx, [rbp + 3]
add rcx, rbx
mul rdx
shr rdx, 2
mov byte [rcx], 0x3d
lea rcx, [rcx - 1]
dec rdx
jne 0x14004b003
lea rcx, [r14 + rdi]
mov r14, qword [rsp + 0x40]
lea rax, [rbx + 4]
mov qword [rsi], rcx
jmp 0x14004b024
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x140051ec0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r15, rdx
mov rdi, rcx
mov edx, 0x20
lea rcx, [r15 + 8]
call fcn.1400bf6b0
xor ebx, ebx
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi + 8]
test rax, 0xfffffffffffffff8
je 0x140051fe5
lea ebp, [rbx + 1]
nop dword [rax]
mov rax, qword [rdi + 8]
mov r9, qword [rax + rbx*8]
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
movzx ecx, byte [rsp + 0x40]
test eax, eax
cmovne ecx, ebp
mov byte [rsp + 0x40], cl
mov rsi, qword [r15 + 0x10]
test cl, cl
je 0x140051f6a
mov r8, qword [r15 + 8]
mov edx, esi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140051f65
test rsi, rsi
jne 0x140051f94
movzx ecx, byte [rsp + 0x40]
test cl, cl
je 0x140051f7b
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
inc rbx
mov rax, qword [rdi + 0x10]
sub rax, qword [rdi + 8]
sar rax, 3
cmp rbx, rax
je 0x140051fe5
jmp 0x140051f10
mov rbx, qword [r15 + 0x10]
mov rax, qword [r15]
mov r8, rbx
mov rdx, qword [r15 + 8]
mov rcx, r15
call qword [rax + 8]
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
test rbx, rbx
jns 0x140051fbd
addsd xmm0, qword [0x1403721a0]
mulsd xmm0, qword [0x140372000]
addsd xmm0, qword [r15 + 0x30]
movsd qword [r15 + 0x30], xmm0
cmp byte [rsp + 0x40], 0
je 0x140051fe5
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x14005e1c0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x14005e1dd
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402bfa30
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov r8, qword [rbx + 0x50]
test r8, r8
je 0x14005e203
mov rcx, qword [rbx + 0x48]
lea r8, [r8*4]
xor edx, edx
call fcn.1402bfa30
mov rax, qword [rbx + 0x68]
mov dword [rax], 0x67452301
mov rax, qword [rbx + 0x68]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rbx + 0x68]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rbx + 0x68]
mov dword [rax + 0xc], 0x10325476
mov rax, qword [rbx + 0x68]
mov dword [rax + 0x10], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret

Function at 0x14005eb90
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x14005ecd2
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
sub rsp, 0x20
mov qword [rsp + 0x40], rbp
mov rsi, r8
mov rdi, rdx
xor ebp, ebp
mov rbx, rcx
nop word [rax + rax]
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x50]
shr rcx, 3
sub rcx, qword [rbx + 0x40]
cmp rcx, rsi
mov qword [rsp + 0x58], rcx
cmovae rax, rdx
mov r9, qword [rax]
sub rsi, r9
mov qword [rsp + 0x50], rsi
test r9, r9
je 0x14005eca2
nop word [rax + rax]
mov rdx, qword [rbx + 0x40]
mov rcx, rdx
and ecx, 7
je 0x14005ec32
mov rax, qword [rbx + 0x20]
shr rdx, 3
shl cl, 3
lea r8, [rax + rdx*8]
movzx edx, byte [rdi]
inc rdi
shl rdx, cl
xor qword [r8], rdx
inc qword [rbx + 0x40]
dec r9
jne 0x14005ec00
jmp 0x14005eca2
test r9, r9
je 0x14005eca2
test r9b, 7
jne 0x14005ec65
mov rcx, qword [rbx + 0x40]
mov rax, qword [rbx + 0x20]
add rdi, 8
shr rcx, 3
lea rcx, [rax + rcx*8]
mov rax, qword [rdi - 8]
xor qword [rcx], rax
add qword [rbx + 0x40], 8
sub r9, 8
jne 0x14005ec37
jmp 0x14005eca2
test r9, r9
je 0x14005eca2
nop word [rax + rax]
mov rdx, qword [rbx + 0x40]
mov rax, qword [rbx + 0x20]
inc rdi
mov rcx, rdx
and dl, 7
shr rcx, 3
lea r8, [rax + rcx*8]
movzx ecx, dl
movzx edx, byte [rdi - 1]
shl cl, 3
shl rdx, cl
xor qword [r8], rdx
inc qword [rbx + 0x40]
dec r9
jne 0x14005ec70
mov rax, qword [rbx + 0x18]
shr rax, 3
cmp qword [rbx + 0x40], rax
jne 0x14005ecbd
mov rcx, qword [rbx + 0x20]
call fcn.14005e240
mov qword [rbx + 0x40], rbp
test rsi, rsi
jne 0x14005ebc0
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret