joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4159b0
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rbx
sub rsp, 0x68
mov rbx, rcx
test rcx, rcx
je 0x415aa2
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x415a78
xor eax, eax
vmovdqu xmm3, xmmword [0x005d4480]
mov qword [rsp + 0x29], 0
vinsertf128 ymm0, ymm3, xmmword [0x005d4490], 1
lea r8, [rcx + 0x40]
mov word [rsp + 0x3e], ax
mov ecx, 0x16
xor eax, eax
mov rdi, r8
mov byte [rsp + 0x20], dl
vmovdqu xmm4, xmmword [0x005d44a0]
rep stosq qword [rdi], rax
mov byte [rsp + 0x31], 0
mov qword [rsp + 0x21], 0x10100
vmovdqu xmm2, xmmword [rsp + 0x20]
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
vinsertf128 ymm1, ymm2, xmmword [rsp + 0x30], 1
vxorps ymm0, ymm0, ymm1
vextractf128 xmmword [rbx + 0x10], ymm0, 1
vmovups xmmword [rbx], xmm0
vinsertf128 ymm0, ymm4, xmmword [0x005d44b0], 1
vextractf128 xmmword [rbx + 0x30], ymm0, 1
vmovups xmmword [rbx + 0x20], xmm0
mov dword [rbx + 0xe4], edx
vzeroupper
add rsp, 0x68
pop rbx
pop rdi
ret
mov edx, 0xf0
call fcn.00417ed0
cmp byte [rbx + 0xe8], 0
je 0x415a93
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x415a6a
mov eax, 0xffffffff
jmp 0x415a6a

Function at 0x415ab0
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
push rdi
sub rsp, 0xe0
mov r10, r8
mov r12, rcx
mov r8, r9
test rcx, rcx
je 0x415c39
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x415c08
lea rax, [r9 - 1]
cmp rax, 0x3f
ja 0x415c08
test r10, r10
je 0x415c08
mov byte [rsp + 0x21], r9b
xor eax, eax
vmovdqu xmm3, xmmword [0x005d4480]
vinsertf128 ymm0, ymm3, xmmword [0x005d4490], 1
lea r9, [rcx + 0x40]
mov word [rsp + 0x3e], ax
xor eax, eax
mov ecx, 0x16
lea r13, [rsp + 0x60]
mov rdi, r9
mov byte [rsp + 0x20], dl
vmovdqu xmm4, xmmword [0x005d44a0]
rep stosq qword [rdi], rax
mov rdi, r13
mov ecx, 0x10
mov qword [rsp + 0x2a], 0
rep stosq qword [rdi], rax
mov rcx, r13
mov qword [rsp + 0x22], 0x101
vmovdqu xmm2, xmmword [rsp + 0x20]
mov dword [r12 + 0xe4], edx
mov rdx, r10
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
vinsertf128 ymm1, ymm2, xmmword [rsp + 0x30], 1
vxorps ymm0, ymm0, ymm1
vextractf128 xmmword [r12 + 0x10], ymm0, 1
vmovups xmmword [r12], xmm0
vinsertf128 ymm0, ymm4, xmmword [0x005d44b0], 1
vextractf128 xmmword [r12 + 0x30], ymm0, 1
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
vmovups xmmword [r12 + 0x20], xmm0
vzeroupper
call sub.msvcrt.dll_memcpy
mov r8d, pe_nt_image_headers64
mov rdx, r13
mov rcx, r12
call fcn.00415700
mov edx, pe_nt_image_headers64
mov rcx, r13
call fcn.00417ed0
xor eax, eax
add rsp, 0xe0
pop rdi
pop r12
pop r13
ret
mov edx, 0xf0
mov rcx, r12
call fcn.00417ed0
cmp byte [r12 + 0xe8], 0
je 0x415c29
mov qword [r12 + 0x58], 0xffffffffffffffff
mov qword [r12 + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x415bf4
mov eax, 0xffffffff
jmp 0x415bf4
Function at 0x41ba10
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r9, r8
test rcx, rcx
je 0x41ba60
test rdx, rdx
je 0x41ba60
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
sete al
movzx eax, al
neg eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xffffffff
jmp 0x41ba51
Function at 0x431140
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
sub rsp, 0x28
vmovdqu xmm1, xmmword [0x005d4e00]
vpxor xmm0, xmm0, xmm0
vmovdqu xmm2, xmmword [0x005d4e10]
vmovdqu xmm3, xmmword [0x005d4e20]
vmovdqu xmm4, xmmword [0x005d4e30]
mov r12, rcx
mov r13, rdx
vmovups xmmword [rcx + 0x80], xmm1
mov rdx, r8
vmovups xmmword [rcx + 0x90], xmm2
mov r8, r9
vmovups xmmword [rcx + 0xa0], xmm3
vmovups xmmword [rcx + 0xb0], xmm4
vmovups xmmword [rcx + 0xc0], xmm0
mov qword [rcx + 0xd0], 0
call fcn.00430d80
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp fcn.00430e90
Function at 0x43adb0
Capabilities:
Hash data using sha256

Disassembly:
push rdi
sub rsp, 0x20
lea eax, [rdx - 1]
mov r8, rcx
cmp al, 0x1f
ja 0x43ae30
mov byte [rsp], dl
mov eax, 0x101
lea rdx, [rcx + 0x20]
mov word [rsp + 2], ax
mov ecx, 0x14
xor eax, eax
mov rdi, rdx
mov byte [rsp + 1], 0
rep stosq qword [rdi], rax
mov dword [rsp + 4], 0
mov qword [rsp + 8], 0
vmovdqu xmm1, xmmword [rsp]
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
vinsertf128 ymm0, ymm1, xmmword [rsp + 0x10], 1
vxorps ymm0, ymm0, ymmword [0x005d5240]
vmovdqu ymmword [r8], ymm0
vzeroupper
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffffff
jmp 0x43ae22

Function at 0x43bcc0
Capabilities:
Hash data using sha256

Disassembly:
push rdi
push rbx
sub rsp, 0x88
mov eax, edx
mov r10, rcx
movzx edx, r9b
lea ecx, [rax - 1]
cmp cl, 0x1f
ja 0x43be76
lea ecx, [r9 - 1]
cmp cl, 7
ja 0x43be6f
test r8, r8
je 0x43be6f
mov byte [rsp + 0x20], al
mov eax, 0x101
mov ecx, 0x14
mov byte [rsp + 0x21], r9b
lea r9, [r10 + 0x20]
mov word [rsp + 0x22], ax
mov rdi, r9
xor eax, eax
rep stosq qword [rdi], rax
lea rbx, [rsp + 0x40]
mov rax, r8
mov dword [rsp + 0x24], 0
mov qword [rsp + 0x28], 0
mov r9, rbx
vmovdqu xmm1, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
vinsertf128 ymm0, ymm1, xmmword [rsp + 0x30], 1
vxorps ymm0, ymm0, ymmword [0x005d5240]
mov qword [rsp + 0x40], 0
vmovdqu ymmword [r10], ymm0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
cmp edx, 8
jae 0x43be48
xor ecx, ecx
test dl, 4
jne 0x43be30
test dl, 2
jne 0x43be18
and edx, 1
jne 0x43be08
mov r8d, 0x40
mov rdx, rbx
mov rcx, r10
vzeroupper
call fcn.0043bbc0
mov rax, rbx
nop word [rax + rax]
lea rdi, [rsp + 0x80]
mov rdx, rax
add rax, 1
mov byte [rdx], 0
cmp rax, rdi
jne 0x43bde0
xor eax, eax
add rsp, 0x88
pop rbx
pop rdi
ret
movzx eax, byte [rax + rcx]
mov byte [r9 + rcx], al
jmp 0x43bdc3
movzx r8d, word [rax + rcx]
mov word [r9 + rcx], r8w
add rcx, 2
and edx, 1
je 0x43bdc3
jmp 0x43be08
mov ecx, dword [rax]
mov dword [r9], ecx
mov ecx, 4
test dl, 2
je 0x43bdbe
jmp 0x43be18
mov r11d, edx
xor eax, eax
and r11d, 0xfffffff8
mov ecx, eax
add eax, 8
mov r9, qword [r8 + rcx]
mov qword [rbx + rcx], r9
cmp eax, r11d
jb 0x43be51
lea r9, [rbx + rax]
add rax, r8
jmp 0x43bdb2
mov eax, 0xffffffff
jmp 0x43bdf9
mov eax, 0xffffffff
jmp 0x43bdf9
Function at 0x4c93f0
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0x48
jmp fcn.004c6510
Function at 0x4cd700
Capabilities:
Encode data using base64

Disassembly:
mov r9d, 0x88
jmp fcn.004c9a20

Function at 0x4cd920
Capabilities:
Encode data using base64

Disassembly:
mov r9d, 0x48
jmp fcn.004c9a20
Function at 0x5075e0
Capabilities:
Hash data using sha256

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x140
xor eax, eax
vmovdqu xmm3, xmmword [0x0060d9c0]
vinsertf128 ymm0, ymm3, xmmword [0x0060d9d0], 1
vmovdqu xmm4, xmmword [rdx]
vmovdqu xmm5, xmmword [rdx + 0x10]
mov rsi, r8
mov r13, rcx
mov ecx, 0x12
mov qword [rsp + 0x20], 0x1012020
lea r8, [rsp + 0xa0]
vmovups xmmword [rsp + 0x40], xmm4
mov rdi, r8
vmovups xmmword [rsp + 0x50], xmm5
rep stosq qword [rdi], rax
lea r12, [rsp + 0x80]
mov qword [rsp + 0x28], 0
vmovdqu xmm2, xmmword [rsp + 0x20]
lea r8, [rsp + 0x40]
mov rcx, r12
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rdx, r8
vinsertf128 ymm1, ymm2, xmmword [rsp + 0x30], 1
vxorps ymm0, ymm0, ymm1
mov qword [rsp + 0x60], 0
vextractf128 xmmword [rsp + 0x90], ymm0, 1
vmovups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], 0
mov dword [rdi], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
vzeroupper
call fcn.00507130
mov rdx, r13
mov rcx, r12
call fcn.00507130
mov eax, dword [rsp + 0x130]
lea r13, [rsp + 0xb0]
cmp eax, 0x40
ja 0x507778
add dword [rsp + 0xa0], eax
mov ebx, pe_nt_image_headers64
mov ecx, eax
mov dword [rsp + 0xa8], 0xffffffff
sub ebx, eax
add rcx, r13
mov eax, ebx
shr eax, 2
je 0x50771c
sub eax, 1
xor edx, edx
lea r8, [rax*4 + 4]
call sub.msvcrt.dll_memset
mov rcx, rax
mov edx, ebx
and edx, 3
je 0x50773c
mov eax, ebx
sub eax, edx
cmp ebx, eax
jbe 0x50773c
sub edx, 1
add rcx, rax
lea r8, [rdx + 1]
xor edx, edx
call sub.msvcrt.dll_memset
mov rdx, r13
mov rcx, r12
call fcn.00505ec0
vmovdqu xmm1, xmmword [rsp + 0x80]
vmovdqu xmm2, xmmword [rsp + 0x90]
vmovups xmmword [rsi], xmm1
vmovups xmmword [rsi + 0x10], xmm2
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
add dword [rsp + 0xa0], 0x40
mov rdx, r13
mov rcx, r12
call fcn.00505ec0
mov edi, dword [rsp + 0x130]
lea ebx, [rdi - 0x40]
mov eax, ebx
mov dword [rsp + 0x130], ebx
shr eax, 2
je 0x5077be
lea rdx, [rsp + 0xf0]
sub eax, 1
mov rcx, r13
lea r8, [rax*4 + 4]
call sub.msvcrt.dll_memmove
mov edx, ebx
and edx, 3
je 0x5077ea
mov eax, ebx
sub eax, edx
cmp ebx, eax
jbe 0x5077ea
lea rcx, [r13 + rax]
sub edx, ebx
lea r8d, [rdi + rdx - 0x41]
lea rdx, [rsp + rax + 0xf0]
add r8, 1
call sub.msvcrt.dll_memmove
mov eax, dword [rsp + 0x130]
jmp 0x5076e2
Function at 0x514800
Capabilities:
Hash data using sha256

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
vmovdqu xmm0, xmmword [0x0060da20]
vmovdqu xmm1, xmmword [0x0060da30]
lea rbx, [rsp + 0x5f]
mov rsi, rcx
and rbx, 0xffffffffffffffc0
mov rcx, rbx
vmovups xmmword [rbx + 0x40], xmm0
vmovups xmmword [rbx + 0x50], xmm1
mov qword [rbx + 0x60], 0
call fcn.00514050
mov rax, qword [rbx + 0x60]
mov ecx, eax
and ecx, 0x3f
lea edx, [rcx + 1]
mov byte [rbx + rcx], pe_nt_image_headers64
cmp edx, 0x38
jbe 0x514930
mov ecx, edx
mov eax, 0x40
add rcx, rbx
sub eax, edx
mov edx, eax
je 0x51487c
xor eax, eax
mov r8d, eax
add eax, 1
mov byte [rcx + r8], 0
cmp eax, edx
jb 0x51486d
lea r12, [rbx + 0x40]
mov rcx, rbx
mov rdx, r12
call fcn.0050c680
mov rax, qword [rbx + 0x60]
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov qword [rbx + 0x30], 0
shl rax, 3
bswap rax
mov rdx, r12
mov rcx, rbx
mov qword [rbx + 0x38], rax
call fcn.0050c680
mov eax, dword [rbx + 0x40]
bswap eax
mov dword [rsi], eax
mov eax, dword [rbx + 0x44]
bswap eax
mov dword [rsi + 4], eax
mov eax, dword [rbx + 0x48]
bswap eax
mov dword [rsi + 8], eax
mov eax, dword [rbx + 0x4c]
bswap eax
mov dword [rsi + 0xc], eax
mov eax, dword [rbx + 0x50]
bswap eax
mov dword [rsi + 0x10], eax
mov eax, dword [rbx + 0x54]
bswap eax
mov dword [rsi + 0x14], eax
mov eax, dword [rbx + 0x58]
bswap eax
mov dword [rsi + 0x18], eax
mov eax, dword [rbx + 0x5c]
bswap eax
mov dword [rsi + 0x1c], eax
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
ret
mov ecx, 0x38
sub ecx, edx
add rdx, rbx
cmp ecx, 8
jae 0x514968
test cl, 4
jne 0x514990
lea r12, [rbx + 0x40]
test ecx, ecx
je 0x5148c6
mov byte [rdx], 0
test cl, 2
jne 0x5149b0
mov rax, qword [rbx + 0x60]
jmp 0x5148c6
lea r12, [rbx + 0x40]
mov eax, ecx
sub ecx, 1
mov qword [rdx + rax - 8], 0
shr ecx, 3
xor eax, eax
mov rdi, rdx
rep stosq qword [rdi], rax
mov rax, qword [rbx + 0x60]
jmp 0x5148c6
mov dword [rdx], 0
lea r12, [rbx + 0x40]
mov dword [rdx + rcx - 4], 0
mov rax, qword [rbx + 0x60]
jmp 0x5148c6
xor eax, eax
mov word [rdx + rcx - 2], ax
jmp 0x514958
Function at 0x5219a0
Capabilities:
Hash data using sha256

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
movsxd r8, r8d
call fcn.00514800
mov r8d, 0x20
mov rdx, r12
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.00514800
Function at 0x560e90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x278
lea rdi, [rsp + 0x5f]
mov r12, r8
mov rsi, rcx
and rdi, 0xffffffffffffffc0
mov rcx, r12
mov rbp, r9
lea r13, [rdi + 0x200]
mov r9d, 0x20
lea rbx, [rdx - 0x20]
mov r8, r13
mov edx, 0x50
call fcn.00563b50
mov rdx, qword [r12 + 0x48]
mov rcx, rdi
shr rbx, 4
add ebx, 1
call fcn.00560b80
vmovdqu xmm1, xmmword [rdi + 0x200]
mov rcx, rdi
mov r9d, 0x811c9dc5
vmovdqu xmm0, xmmword [rdi + 0x210]
vmovdqu xmm2, xmmword [0x00619a80]
nop word [rax + rax]
mov eax, dword [rcx]
xor edx, edx
add rcx, 4
xor eax, r9d
imul eax, eax, 0x1000193
div ebx
mov rax, rdx
shl rax, 4
add rax, rsi
xor r9d, dword [rax]
vpxor xmm1, xmm1, xmmword [rax]
vpxor xmm0, xmm0, xmmword [rax + 0x10]
vpmulld xmm1, xmm2, xmm1
vpmulld xmm0, xmm2, xmm0
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 4]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 8]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 0xc]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 0x10]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 0x14]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 0x18]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 0x1c]
imul r9d, r9d, 0x1000193
cmp r13, rcx
jne 0x560f10
mov r11d, 1
mov ecx, r11d
mov r10, rdi
nop dword [rax]
mov eax, dword [r10]
xor edx, edx
add r10, 4
rol eax, cl
xor eax, r9d
imul eax, eax, 0x1000193
div ebx
shl rdx, 4
add rdx, rsi
xor r9d, dword [rdx]
vpxor xmm1, xmm1, xmmword [rdx]
vpxor xmm0, xmm0, xmmword [rdx + 0x10]
vpmulld xmm4, xmm2, xmm1
vpmulld xmm3, xmm2, xmm0
vmovdqu xmm1, xmm4
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 4]
vmovdqu xmm0, xmm3
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 8]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 0xc]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 0x10]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 0x14]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 0x18]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 0x1c]
imul r9d, r9d, 0x1000193
cmp r13, r10
jne 0x560fb0
add r11, 1
cmp r11, 0x20
jne 0x560fa6
vmovups xmmword [rdi + 0x200], xmm4
vmovups xmmword [rdi + 0x210], xmm3
vmovups xmmword [rbp], xmm4
vmovups xmmword [rbp + 0x10], xmm3
add rsp, 0x278
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x5664d0
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x80]
and eax, 0x3f
mov rbx, rcx
mov rsi, rdx
lea ecx, [rax + 1]
mov byte [rbx + rax], pe_nt_image_headers64
lea rdi, [rbx + 0x40]
mov eax, ecx
add rax, rbx
cmp ecx, 0x20
jbe 0x5665f0
mov edx, 0x40
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x566660
mov ecx, edx
sub edx, 1
mov qword [rax + rcx - 8], 0
cmp edx, 8
jb 0x566538
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov qword [rax + r8], r9
cmp ecx, edx
jb 0x56652a
mov rdx, rdi
mov rcx, rbx
call fcn.00563d20
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rdx, rax
shr rdx, 0x3d
bswap rdx
mov qword [rbx + 0x30], rdx
shl rax, 3
bswap rax
mov qword [rbx + 0x38], rax
mov rdx, rdi
mov rcx, rbx
call fcn.00563d20
lea rax, [rsi + 0x20]
cmp rdi, rax
jae 0x5665b3
lea rax, [rbx + 0x60]
cmp rsi, rax
jb 0x566690
vmovdqu xmm1, xmmword [rbx + 0x40]
vinsertf128 ymm0, ymm1, xmmword [rbx + 0x50], 1
vmovups xmmword [rsi], xmm0
vextractf128 xmmword [rsi + 0x10], ymm0, 1
vmovdqu xmm2, xmmword [rbx + 0x60]
vinsertf128 ymm0, ymm2, xmmword [rbx + 0x70], 1
vmovups xmmword [rsi + 0x20], xmm0
vextractf128 xmmword [rsi + 0x30], ymm0, 1
vzeroupper
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x20
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x566630
mov ecx, edx
sub edx, 1
mov qword [rax + rcx - 8], 0
cmp edx, 8
jb 0x566562
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov qword [rax + r8], r9
cmp ecx, edx
jb 0x56661b
jmp 0x566562
test dl, 4
jne 0x5666d7
test edx, edx
je 0x566562
mov byte [rax], 0
test dl, 2
je 0x566562
xor ecx, ecx
mov word [rax + rdx - 2], cx
jmp 0x566562
test dl, 4
jne 0x5666ea
test edx, edx
je 0x566538
mov byte [rax], 0
test dl, 2
je 0x566538
xor r8d, r8d
mov word [rax + rdx - 2], r8w
jmp 0x566538
mov rax, qword [rbx + 0x40]
mov qword [rsi], rax
mov rax, qword [rbx + 0x48]
mov qword [rsi + 8], rax
mov rax, qword [rbx + 0x50]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x58]
mov qword [rsi + 0x18], rax
mov rax, qword [rbx + 0x60]
mov qword [rsi + 0x20], rax
mov rax, qword [rbx + 0x68]
mov qword [rsi + 0x28], rax
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x30], rax
mov rax, qword [rbx + 0x78]
mov qword [rsi + 0x38], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x566562
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x566538
Function at 0x566930
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x80]
and eax, 0x3f
mov rbx, rcx
mov rsi, rdx
lea ecx, [rax + 1]
mov byte [rbx + rax], pe_nt_image_headers64
lea rdi, [rbx + 0x40]
mov eax, ecx
add rax, rbx
cmp ecx, 0x20
jbe 0x566a50
mov edx, 0x40
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x566ac0
mov ecx, edx
sub edx, 1
mov qword [rax + rcx - 8], 0
cmp edx, 8
jb 0x566998
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov qword [rax + r8], r9
cmp ecx, edx
jb 0x56698a
mov rdx, rdi
mov rcx, rbx
call fcn.00565340
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rdx, rax
shr rdx, 0x3d
bswap rdx
mov qword [rbx + 0x30], rdx
shl rax, 3
bswap rax
mov qword [rbx + 0x38], rax
mov rdx, rdi
mov rcx, rbx
call fcn.00565340
lea rax, [rsi + 0x20]
cmp rdi, rax
jae 0x566a13
lea rax, [rbx + 0x60]
cmp rsi, rax
jb 0x566af0
vmovdqu xmm1, xmmword [rbx + 0x40]
vinsertf128 ymm0, ymm1, xmmword [rbx + 0x50], 1
vmovups xmmword [rsi], xmm0
vextractf128 xmmword [rsi + 0x10], ymm0, 1
vmovdqu xmm2, xmmword [rbx + 0x60]
vinsertf128 ymm0, ymm2, xmmword [rbx + 0x70], 1
vmovups xmmword [rsi + 0x20], xmm0
vextractf128 xmmword [rsi + 0x30], ymm0, 1
vzeroupper
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x20
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x566a90
mov ecx, edx
sub edx, 1
mov qword [rax + rcx - 8], 0
cmp edx, 8
jb 0x5669c2
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov qword [rax + r8], r9
cmp ecx, edx
jb 0x566a7b
jmp 0x5669c2
test dl, 4
jne 0x566b37
test edx, edx
je 0x5669c2
mov byte [rax], 0
test dl, 2
je 0x5669c2
xor ecx, ecx
mov word [rax + rdx - 2], cx
jmp 0x5669c2
test dl, 4
jne 0x566b4a
test edx, edx
je 0x566998
mov byte [rax], 0
test dl, 2
je 0x566998
xor r8d, r8d
mov word [rax + rdx - 2], r8w
jmp 0x566998
mov rax, qword [rbx + 0x40]
mov qword [rsi], rax
mov rax, qword [rbx + 0x48]
mov qword [rsi + 8], rax
mov rax, qword [rbx + 0x50]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x58]
mov qword [rsi + 0x18], rax
mov rax, qword [rbx + 0x60]
mov qword [rsi + 0x20], rax
mov rax, qword [rbx + 0x68]
mov qword [rsi + 0x28], rax
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x30], rax
mov rax, qword [rbx + 0x78]
mov qword [rsi + 0x38], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x5669c2
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x566998
Function at 0x58e2c4
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
xor rcx, rcx
mov ecx, edx
shr ecx, 6
mov rax, 0x40
movdqa xmm0, xmmword [rdi]
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm4, xmmword [rsi]
movdqa xmm5, xmmword [rsi + 0x10]
movdqa xmm8, xmmword [rsi + 0x20]
movdqa xmm9, xmmword [rsi + 0x30]
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm8
pxor xmm3, xmm9
movdqa xmmword [rdi], xmm0
movdqa xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi + 0x20], xmm2
movdqa xmmword [rdi + 0x30], xmm3
add rdi, rax
add rsi, rax
dec ecx
jne 0x58e2e2
mov rdi, r10
mov rsi, r11
ret

Function at 0x58e340
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
xor rcx, rcx
mov ecx, esi
shr ecx, 1
movdqa xmm0, xmmword [rdi]
movdqa xmm12, xmm0
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm13, xmm1
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm14, xmm2
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm15, xmm3
movdqa xmm4, xmm1
paddd xmm4, xmm0
movdqa xmm5, xmm4
pslld xmm4, 7
psrld xmm5, 0x19
pxor xmm3, xmm4
movdqa xmm4, xmm0
pxor xmm3, xmm5
paddd xmm4, xmm3
movdqa xmm5, xmm4
pslld xmm4, 9
psrld xmm5, 0x17
pxor xmm2, xmm4
movdqa xmm4, xmm3
pxor xmm2, xmm5
pshufd xmm3, xmm3, 0x93
paddd xmm4, xmm2
movdqa xmm5, xmm4
pslld xmm4, 0xd
psrld xmm5, 0x13
pxor xmm1, xmm4
movdqa xmm4, xmm2
pxor xmm1, xmm5
pshufd xmm2, xmm2, 0x4e
paddd xmm4, xmm1
movdqa xmm5, xmm4
pslld xmm4, 0x12
psrld xmm5, 0xe
pxor xmm0, xmm4
movdqa xmm4, xmm3
pxor xmm0, xmm5
pshufd xmm1, xmm1, 0x39
paddd xmm4, xmm0
movdqa xmm5, xmm4
pslld xmm4, 7
psrld xmm5, 0x19
pxor xmm1, xmm4
movdqa xmm4, xmm0
pxor xmm1, xmm5
paddd xmm4, xmm1
movdqa xmm5, xmm4
pslld xmm4, 9
psrld xmm5, 0x17
pxor xmm2, xmm4
movdqa xmm4, xmm1
pxor xmm2, xmm5
pshufd xmm1, xmm1, 0x93
paddd xmm4, xmm2
movdqa xmm5, xmm4
pslld xmm4, 0xd
psrld xmm5, 0x13
pxor xmm3, xmm4
movdqa xmm4, xmm2
pxor xmm3, xmm5
pshufd xmm2, xmm2, 0x4e
paddd xmm4, xmm3
movdqa xmm5, xmm4
pslld xmm4, 0x12
psrld xmm5, 0xe
pxor xmm0, xmm4
pshufd xmm3, xmm3, 0x39
pxor xmm0, xmm5
dec ecx
jne 0x58e37a
paddd xmm0, xmm12
movdqa xmmword [rdi], xmm0
paddd xmm1, xmm13
movdqa xmmword [rdi + 0x10], xmm1
paddd xmm2, xmm14
movdqa xmmword [rdi + 0x20], xmm2
paddd xmm3, xmm15
movdqa xmmword [rdi + 0x30], xmm3
mov rdi, r10
mov rsi, r11
ret
Function at 0x58e52c
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
xor rcx, rcx
mov ecx, esi
shr ecx, 1
movdqa xmm0, xmmword [rdi]
movdqa xmm12, xmm0
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm13, xmm1
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm14, xmm2
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm15, xmm3
paddd xmm0, xmm1
pxor xmm3, xmm0
pshuflw xmm3, xmm3, 0xb1
pshufhw xmm3, xmm3, 0xb1
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm3
pslld xmm3, 8
psrld xmm4, 0x18
pxor xmm3, xmm4
pshufd xmm0, xmm0, 0x93
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x39
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
pshuflw xmm3, xmm3, 0xb1
pshufhw xmm3, xmm3, 0xb1
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm3
pslld xmm3, 8
psrld xmm4, 0x18
pxor xmm3, xmm4
pshufd xmm0, xmm0, 0x39
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x93
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
dec ecx
jne 0x58e566
paddd xmm0, xmm12
movdqa xmmword [rdi], xmm0
paddd xmm1, xmm13
movdqa xmmword [rdi + 0x10], xmm1
paddd xmm2, xmm14
movdqa xmmword [rdi + 0x20], xmm2
paddd xmm3, xmm15
movdqa xmmword [rdi + 0x30], xmm3
mov rdi, r10
mov rsi, r11
ret
Function at 0x590c10
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rdx
movsx rdx, byte [rdx]
test rdx, rdx
je 0x590cd0
mov r8, rbp
mov esi, 0x1505
mov rax, rsi
add r8, 1
shl rax, 5
add rax, rdx
movsx rdx, byte [r8]
add rsi, rax
test rdx, rdx
jne 0x590c30
mov r8, qword [rcx + 0x10]
lea rdi, [0x00626e20]
mov rax, rsi
xor edx, edx
add rcx, 0x18
div qword [rdi + r8*8]
mov rdi, qword [rcx - 0x10]
shl rdx, 4
add rdi, rdx
mov rbx, qword [rdi]
cmp rbx, rcx
jne 0x590c8a
jmp 0x590cc0
cmp rbx, qword [rdi + 8]
je 0x590cb0
mov rbx, qword [rbx + 8]
cmp qword [rbx - 8], rsi
jne 0x590c80
mov rdx, rbp
lea rcx, [rbx + 0x20]
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x590c80
mov rax, qword [rbx + 0x10]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
cmp rbx, qword [rdi + 8]
jne 0x590c8a
jmp 0x590ca4
mov esi, 0x1505
jmp 0x590c4a

Function at 0x593af0
Capabilities:
Hash data using djb2

Disassembly:
test rcx, rcx
je 0x593b08
mov eax, dword [rcx]
test eax, eax
jne 0x593b08
add rcx, 0x10
jmp fcn.00590c10
xor eax, eax
ret