joyce8/EMBER2024-capa huggingface dataset:
Function at 0x34750
Capabilities:
Find process by pid

Disassembly:
push rdi
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x34774
lea rax, [0x0003b5e0]
jmp 0x347e4
mov rcx, qword [rsp + 0x38]
call sub.ntoskrnl.exe_PsGetProcessImageFileName
mov r11, rax
test rax, rax
jne 0x34793
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x3476b
lea rdi, [0x0004ed70]
mov byte [0x0004ee73], 0
mov edx, 0x103
mov rcx, rdi
sub r11, rdi
lea rax, [rdx + 0x7ffffefb]
test rax, rax
je 0x347cb
mov al, byte [r11 + rcx]
test al, al
je 0x347cb
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x347ac
test rdx, rdx
jne 0x347d3
dec rcx
mov byte [rcx], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x34b08
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x0004ee98]
and dword [rsp + 0x30], 0
test rax, rax
jne 0x34be9
lea edi, [rax + 0xb]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov ecx, edi
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x34b4f
xor eax, eax
jmp 0x34be9
mov edx, dword [rsp + 0x30]
mov ecx, 1
call fcn.000365b8
mov rbx, rax
test rax, rax
je 0x34b48
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
jns 0x34b88
mov rcx, rbx
call fcn.00036630
jmp 0x34b48
xor edi, edi
cmp dword [rbx], edi
jbe 0x34bda
lea rsi, [rbx + 0x2e]
movzx ecx, word [rsi]
mov eax, edi
lea rdx, [0x0003ea40]
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call sub.ntoskrnl.exe__stricmp
test eax, eax
je 0x34bc5
inc edi
add rsi, 0x128
cmp edi, dword [rbx]
jb 0x34b92
jmp 0x34bda
mov eax, edi
imul rax, rax, 0x128
mov rax, qword [rax + rbx + 0x18]
mov qword [0x0004ee98], rax
mov rcx, rbx
call fcn.00036630
mov rax, qword [0x0004ee98]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x3523c
Capabilities:
Attach user process memory
Find process by pid
Get system information on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov byte [rax + 8], 0
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
xor ebx, ebx
and dword [rsp + 0x88], ebx
mov esi, 0x4000
mov rbp, rax
mov edi, esi
xor r12b, r12b
test rbx, rbx
je 0x35276
mov rcx, rbx
call fcn.00036630
mov edx, edi
mov ecx, 1
call fcn.000365b8
mov rbx, rax
test rax, rax
je 0x35354
lea r9, [rsp + 0x88]
mov r8d, edi
mov rdx, rax
mov ecx, 0x10
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
add edi, esi
cmp eax, 0xc0000004
je 0x35269
test eax, eax
js 0x3534c
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
cmp rbp, rax
je 0x35305
and qword [rsp + 0x90], 0
lea rdx, [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x3534c
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov r12b, 1
xor esi, esi
cmp dword [rbx], esi
jbe 0x3533c
lea rdi, [rbx + 0xe]
cmp ebp, dword [rdi - 6]
jne 0x35332
movzx edx, word [rdi]
lea r9, [rsp + 0x80]
lea r8, [fcn.000351d8]
mov rcx, rbp
call fcn.00037168
test al, al
je 0x3533c
inc esi
add rdi, 0x18
cmp esi, dword [rbx]
jb 0x3530f
test r12b, r12b
je 0x3534c
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, rbx
call fcn.00036630
mov al, byte [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x35b10
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rbp, rdx
lea rdx, [rsp + 0x30]
mov rsi, r8
mov rdi, rcx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x35c4b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
test rax, rax
je 0x35c40
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.000359e8
and qword [rsp + 0xd8], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x60], 0
and qword [rsp + 0x70], 0
and qword [rsp + 0x78], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xd8]
mov edx, 0x400
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 0x30
mov dword [rsp + 0x68], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
js 0x35c32
mov rcx, qword [rsp + 0xd8]
and qword [rsp + 0x20], 0
mov r9d, 8
lea edx, [r9 + 0x12]
lea r8, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov rcx, qword [rsp + 0xd8]
xor ebx, ebx
test eax, eax
cmovns rbx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rbx, rbx
je 0x35c32
mov r9, rsi
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.00035c6c
lea rcx, [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x361f0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0x38
lea r9, [rax - 0x18]
lea r8, [rax + 8]
lea rdx, [rax + 0x10]
lea rcx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov r11d, dword [rsp + 0x50]
cmp r11d, 5
jne 0x3622c
cmp dword [rsp + 0x48], 2
jne 0x36369
lea eax, [r11 - 2]
jmp 0x3636b
cmp r11d, 6
jne 0x362d1
mov ecx, dword [rsp + 0x48]
xor eax, eax
cmp ecx, eax
jne 0x36248
mov eax, r11d
jmp 0x3636b
cmp ecx, 1
jne 0x36273
cmp dword [rsp + 0x40], 0x1b58
jne 0x3625f
lea eax, [rcx + 7]
jmp 0x3636b
cmp dword [rsp + 0x40], 0x1bbc
sbb eax, eax
not eax
and eax, 0xa
jmp 0x3636b
cmp ecx, 2
jne 0x362b3
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x203a
jne 0x3628e
mov eax, 0xe
jmp 0x3636b
cmp ecx, 0x20d0
jne 0x362a0
mov eax, 0xf
jmp 0x3636b
mov edx, 0x11
cmp ecx, 0x23f0
cmove eax, edx
jmp 0x3636b
cmp ecx, 3
jne 0x36369
cmp dword [rsp + 0x40], 0x2580
mov ecx, 0x14
cmove eax, ecx
jmp 0x3636b
cmp r11d, 0xa
jne 0x36369
xor eax, eax
cmp dword [rsp + 0x48], eax
jne 0x36369
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x2b5e
jne 0x362f9
lea eax, [r11 + 0x1b]
jmp 0x3636b
cmp ecx, 0x2b5b
jne 0x36308
mov eax, 0x23
jmp 0x3636b
cmp ecx, 0x2b4a
jne 0x36317
mov eax, 0x21
jmp 0x3636b
cmp ecx, 0x295a
jne 0x36326
mov eax, 0x1f
jmp 0x3636b
cmp ecx, 0x2945
jne 0x36335
mov eax, 0x1d
jmp 0x3636b
cmp ecx, 0x2933
jne 0x36344
mov eax, 0x1b
jmp 0x3636b
cmp ecx, 0x2924
jne 0x36353
mov eax, 0x19
jmp 0x3636b
add ecx, 0xffffd800
mov edx, 0x17
cmp ecx, 0x124
cmovbe eax, edx
jmp 0x3636b
xor eax, eax
add rsp, 0x38
ret

Function at 0x36378
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
xor esi, esi
mov qword [rax + 0x10], rsi
mov rbx, rsi
mov qword [rax - 0x48], rbx
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, esi
jl 0x36457
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea ebx, [rsi + 1]
mov r8d, ebx
lea edx, [rsi + 0x28]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rdi, qword [rdi + 0x20]
mov r8d, ebx
lea edx, [rbx + 0x7f]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
mov r8d, ebx
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rdi + 0x60]
add rdx, 2
mov ecx, ebx
call fcn.000365b8
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, rsi
je 0x3643a
movzx r8d, word [rdi + 0x60]
mov rdx, qword [rdi + 0x68]
mov rcx, rax
call fcn.0003ad80
movzx r11d, word [rdi + 0x60]
shr r11w, 1
movzx ecx, r11w
mov word [rbx + rcx*2], si
jmp 0x36441
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x36474
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x70
xor r12d, r12d
mov qword [rax + 0x10], r12
mov rsi, r12
mov qword [rax - 0x58], r12
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r12d
jl 0x36596
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea edx, [r12 + 0x28]
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rbx, qword [rbx + 0x20]
mov edx, 0x80
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rbx + 0x60]
lea r8d, [r12 + 1]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov word [rsp + 0x28], r12w
mov word [rsp + 0x2a], r12w
mov r8b, 1
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
cmp eax, r12d
jl 0x36576
movzx edx, word [rsp + 0x28]
inc rdx
lea ecx, [r12 + 1]
call fcn.000365b8
mov rsi, rax
mov qword [rsp + 0x20], rax
cmp rax, r12
je 0x3656b
movzx r8d, word [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.0003ad80
movzx r11d, word [rsp + 0x28]
mov byte [r11 + rsi], r12b
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x3657d
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x36a4c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rcx
xor r9d, r9d
mov ecx, edx
movzx eax, word [rbx + 0x14]
movzx r11d, word [rbx + 6]
lea r8, [rax + rbx + 0x18]
test r11d, r11d
je 0x36a8d
mov r10d, dword [r8 + 0xc]
cmp rcx, r10
jb 0x36a81
mov eax, dword [r8 + 8]
add eax, r10d
cmp rcx, rax
jb 0x36a90
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x36a6c
xor r8d, r8d
test r8, r8
je 0x36aa8
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x36aaa
mov eax, edx
mov rbx, qword [rsp + 8]
ret

Function at 0x36ab8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, word [rcx + 0x14]
movzx r11d, word [rcx + 6]
xor r9d, r9d
lea r8, [rax + rcx + 0x18]
mov rbx, rcx
test r11d, r11d
je 0x36af7
mov r10d, dword [r8 + 0xc]
cmp edx, r10d
jb 0x36aeb
mov eax, dword [r8 + 8]
lea ecx, [r10 + rax]
cmp edx, ecx
jb 0x36afa
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x36ad6
xor r8d, r8d
test r8, r8
je 0x36b12
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x36b14
mov eax, edx
mov rbx, qword [rsp + 8]
ret
Function at 0x36b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov eax, 0x5a4d
mov r12b, r8b
mov rbx, rcx
cmp word [rcx], ax
jne 0x36c98
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
je 0x36c98
mov edx, dword [rsi + 0x78]
test edx, edx
je 0x36c98
test r8b, r8b
jne 0x36b74
mov rcx, rsi
call fcn.00036ab8
mov edx, eax
mov edi, edx
add rdi, rbx
je 0x36c98
mov ebp, dword [rsi + 0x50]
mov rax, rdi
sub rax, rbx
mov qword [rsp + 0x88], rax
cmp rbp, rax
jb 0x36c98
mov eax, dword [rsi + 0x7c]
sub rax, rbx
add rax, rdi
cmp rbp, rax
jb 0x36c98
mov edx, dword [rdi + 0x20]
test r12b, r12b
jne 0x36bbd
mov rcx, rsi
call fcn.00036ab8
mov edx, eax
mov eax, edx
mov edx, dword [rdi + 0x1c]
add rax, rbx
mov qword [rsp + 0x20], rax
test r12b, r12b
jne 0x36bd9
mov rcx, rsi
call fcn.00036ab8
mov edx, eax
mov r14d, edx
mov edx, dword [rdi + 0x24]
add r14, rbx
test r12b, r12b
jne 0x36bf1
mov rcx, rsi
call fcn.00036ab8
mov edx, eax
movsxd rcx, dword [rdi + 0x18]
mov r13d, edx
mov edx, dword [rdi + 0x14]
add r13, rbx
mov dword [rsp + 0x70], edx
cmp r13, rbx
jb 0x36c98
lea rax, [rbx + rbp]
cmp r13, rax
ja 0x36c98
xor edi, edi
mov r15, rcx
test ecx, ecx
jle 0x36c98
cmp rdi, r15
movzx ebp, word [r13 + rdi*2]
jge 0x36c98
cmp ebp, edx
jge 0x36c98
movsxd rax, ebp
mov ecx, dword [r14 + rax*4]
mov rax, qword [rsp + 0x88]
cmp rcx, rax
jb 0x36c50
mov r8d, dword [rsi + 0x7c]
add rax, r8
cmp rcx, rax
jb 0x36c90
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + rdi*4]
test r12b, r12b
jne 0x36c67
mov rcx, rsi
call fcn.00036ab8
mov edx, eax
mov r8d, edx
mov rdx, qword [rsp + 0x78]
add r8, rbx
sub r8, rdx
movzx eax, byte [rdx]
movzx ecx, byte [rdx + r8]
sub eax, ecx
jne 0x36c88
inc rdx
test ecx, ecx
jne 0x36c75
test eax, eax
je 0x36cb2
mov edx, dword [rsp + 0x70]
inc rdi
cmp rdi, r15
jl 0x36c21
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, dword [r14 + rbp*4]
test r12b, r12b
jne 0x36cc5
mov rcx, rsi
call fcn.00036ab8
mov edx, eax
mov eax, edx
add rax, rbx
jmp 0x36c9a

Function at 0x36cd4
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x36d1a
movsxd r9, dword [rcx + 0x3c]
add r9, rcx
je 0x36d1a
movzx eax, word [r9 + 0x14]
movzx r11d, word [r9 + 6]
xor r10d, r10d
lea r8, [rax + r9 + 0x18]
cmp r11d, r10d
jbe 0x36d1a
mov ecx, dword [r8 + 0x14]
cmp edx, ecx
jb 0x36d0e
add ecx, dword [r8 + 0x10]
cmp edx, ecx
jb 0x36d1d
inc r10d
add r8, 0x28
cmp r10d, r11d
jb 0x36cfe
xor eax, eax
ret
mov eax, dword [r8 + 0xc]
sub eax, dword [r8 + 0x14]
add eax, edx
ret
Function at 0x36ee4
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x440
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r12, rcx
call sub.ntoskrnl.exe_PsGetCurrentProcessSessionId
xor ebx, ebx
lea edi, [rbx + 5]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov ecx, edi
mov ebp, eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x36fae
mov edx, dword [rsp + 0x20]
mov ecx, 1
call fcn.000365b8
mov rsi, rax
cmp rax, rbx
je 0x36fae
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x36f76
mov rcx, rsi
call fcn.00036630
jmp 0x36f3a
cmp eax, ebx
jl 0x36fa6
mov rdi, rsi
mov rcx, qword [rdi + 0x40]
cmp rcx, rbx
je 0x36f97
mov rdx, r12
call fcn.0003ad4e
cmp eax, ebx
jne 0x36f97
cmp dword [rdi + 0x64], ebp
je 0x36fa2
cmp dword [rdi], ebx
je 0x36fa6
mov eax, dword [rdi]
add rdi, rax
jmp 0x36f7d
mov rbx, qword [rdi + 0x50]
mov rcx, rsi
call fcn.00036630
mov rax, rbx
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.0003acb0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x37284
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
mov r13, rdx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x3737b
movsxd rax, dword [rcx + 0x3c]
mov ebx, dword [rax + rcx + 0x8c]
mov dword [rsp + 0x50], ebx
mov edx, dword [rax + rcx + 0x88]
cmp edx, r8d
je 0x3737b
mov rax, rdx
add rax, rcx
je 0x3737b
mov rsi, rax
sub rsi, rcx
mov r14d, dword [rax + 0x1c]
add r14, rcx
mov r12d, dword [rax + 0x24]
add r12, rcx
mov r11d, dword [rax + 0x20]
add r11, rcx
mov qword [rsp + 0x58], r11
mov r15d, dword [rax + 0x18]
mov r9d, dword [rax + 0x14]
mov dword [rsp + 0x50], r9d
mov edx, r8d
mov dword [rsp], edx
cmp edx, r15d
jae 0x37379
mov r10d, edx
movsx eax, word [r12 + r10*2]
cmp eax, r9d
jae 0x37375
mov r9d, dword [r14 + rax*4]
cmp r9, rsi
jb 0x37331
lea rax, [rsi + rbx]
cmp r9, rax
jb 0x37369
mov eax, dword [r11 + r10*4]
add rax, rcx
mov rdi, r13
sub rdi, rax
movzx r10d, byte [rax]
movzx r11d, byte [rax + rdi]
sub r10d, r11d
jne 0x37354
inc rax
test r11d, r11d
jne 0x3733e
cmp r10d, r8d
jne 0x37364
lea r8, [r9 + rcx]
mov qword [rsp + 8], r8
jmp 0x37379
mov r11, qword [rsp + 0x58]
inc edx
mov dword [rsp], edx
mov r9d, dword [rsp + 0x50]
jmp 0x3730d
xor eax, eax
jmp 0x3738a
jmp 0x37387
xor eax, eax
jmp 0x3738a
mov rax, r8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x38a60
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xb0
mov rax, qword [0x00046100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
mov r12d, r8d
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp r8d, 0x40
jbe 0x38acf
lea ebx, [r8 - 0x41]
shr ebx, 6
inc ebx
mov rdx, rbp
mov rcx, rsi
call fcn.00038210
add r12d, 0xffffffc0
add rbp, 0x40
sub rbx, 1
jne 0x38ab6
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x80
call fcn.0003b2d0
lea rcx, [rsp + 0x20]
mov r8d, r12d
mov rdx, rbp
mov ebx, r12d
call fcn.0003ad80
lea eax, [r12 + 1]
mov byte [rsp + rbx + 0x20], 0x80
cmp eax, 0x38
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov eax, edi
ja 0x38b4b
shl eax, 3
shr edi, 0x1d
mov byte [rsp + 0x58], al
shr eax, 8
mov byte [rsp + 0x5c], dil
shr edi, 8
mov byte [rsp + 0x59], al
shr eax, 8
mov byte [rsp + 0x5d], dil
shr edi, 8
mov byte [rsp + 0x5a], al
shr eax, 8
mov byte [rsp + 0x5e], dil
shr edi, 8
mov byte [rsp + 0x5f], dil
mov byte [rsp + 0x5b], al
jmp 0x38bac
shl eax, 3
shr edi, 0x1d
mov byte [rsp + 0x98], al
mov byte [rsp + 0x9c], dil
shr eax, 8
shr edi, 8
mov byte [rsp + 0x99], al
shr eax, 8
mov byte [rsp + 0x9d], dil
shr edi, 8
mov byte [rsp + 0x9a], al
mov byte [rsp + 0x9e], dil
shr eax, 8
shr edi, 8
mov byte [rsp + 0x9b], al
mov byte [rsp + 0x9f], dil
call fcn.00038210
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.00038210
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.0003acb0
add rsp, 0xb0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x391f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9d, dword [rcx]
mov eax, dword [rdx]
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
lea edx, [r9 + rax + 1]
xor r8d, r8d
mov rcx, rbp
call fcn.00038c88
mov r11, qword [rdi + 0x10]
movsxd rsi, dword [rdi]
add rsi, r11
xor r13d, r13d
cmp r11, rsi
jae 0x392fa
lea r15d, [r13 + 1]
mov r9, qword [rbx + 0x10]
movsxd r10, dword [rbx]
add r10, r9
cmp r9, r10
jae 0x392eb
mov r14, r13
mov rax, qword [rbp + 0x10]
movzx r8d, byte [r9]
xor edx, edx
lea r12, [r14 + rax]
movzx eax, byte [r11]
imul r8w, ax
mov eax, 0xff
movzx ecx, r8w
and cx, ax
movzx eax, byte [r12]
add cx, ax
mov eax, 0x100
cmp cx, ax
mov byte [r12], cl
mov ecx, 0x100
cmovae edx, r15d
add r12, r15
shr r8w, 8
movzx eax, byte [r12]
add r8w, ax
xor eax, eax
add r8w, dx
cmp r8w, cx
mov byte [r12], r8b
setae al
add r12, r15
test eax, eax
je 0x392dc
movzx eax, byte [r12]
add ax, r15w
mov byte [r12], al
add r12, r15
cmp ax, cx
jae 0x392c7
add r9, r15
add r14, r15
cmp r9, r10
jb 0x3925e
add r11, r15
add r13, r15
cmp r11, rsi
jb 0x39248
mov eax, dword [rdi + 8]
mov rcx, rbp
xor eax, dword [rbx + 8]
mov dword [rbp + 8], eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.00038d84
Function at 0x39f0c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x740
xor r14d, r14d
mov rbp, r8
mov r10, rdx
lea r12d, [r14 + 1]
lea r13d, [r14 + 4]
mov r11, rcx
movzx r9d, r14w
movsx rax, r9w
add r9w, r12w
mov dword [r8 + rax*4], r14d
cmp r9w, r13w
jb 0x39f44
movzx edx, r14w
movsx rcx, dx
add dx, r12w
mov eax, dword [r10 + rcx*4]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, r13w
jb 0x39f5a
movzx edx, r14w
movsx rcx, dx
add dx, r12w
mov eax, dword [r11 + rcx*4]
mov dword [rsp + rcx*4 + 0x30], eax
cmp dx, r13w
jb 0x39f74
mov edi, 0x70
mov r11, r13
lea rbx, [rsp + 0x40]
mov rsi, rdi
movzx r8d, r14w
movsx rax, r8w
add r8w, r12w
lea rdx, [r11 + rax]
lea rcx, [r11 + rax - 4]
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rdx*4 + 0x30], eax
cmp r8w, r13w
jb 0x39f9e
mov rcx, rbx
call fcn.00039ec8
add r11, r13
add rbx, 0x10
sub rsi, r12
jne 0x39f9a
movsx r9, word [0x0004df80]
movzx r8d, r14w
movsx rdx, r8w
add r8w, r12w
lea rax, [rdx + r9*4]
mov ecx, dword [rsp + rax*4 + 0x30]
and ecx, dword [rsp + rdx*4 + 0x20]
mov dword [rbp + rdx*4], ecx
cmp r8w, r13w
jb 0x39fdd
lea r11, [0x0004e148]
lea rcx, [rsp + 0x20]
call fcn.00039ec8
movsx r10, word [r11]
movsx rbx, word [r11 - 0x1c6]
movzx r9d, r14w
movsx r8, r9w
add r9w, r12w
lea rcx, [r8 + r10*4]
lea rax, [r8 + rbx*4]
mov edx, dword [rsp + rcx*4 + 0x30]
xor edx, dword [rsp + rax*4 + 0x30]
and edx, dword [rsp + r8*4 + 0x20]
xor dword [rbp + r8*4], edx
cmp r9w, r13w
jb 0x3a01c
add r11, 2
sub rdi, r12
jne 0x3a002
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x3a190
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x60
xor ebx, ebx
mov rbp, r9
mov rdi, r8
mov r12, rdx
mov rsi, rcx
movzx r10d, bx
movsx rax, r10w
inc r10w
mov dword [rsp + rax*4 + 0x40], ebx
cmp r10w, 4
jb 0x3a1bb
movzx ecx, bx
movsx rax, cx
inc cx
mov dword [rsp + rax*4 + 0x20], ebx
cmp cx, 4
jb 0x3a1d1
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
mov eax, dword [rsi + rcx*4 + 0x10]
xor eax, dword [r12 + rcx*4 + 0x10]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x3a1e5
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.0003a078
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.00039f0c
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x3a230
lea rcx, [rsp + 0x20]
call fcn.00039e88
movzx edx, bx
cmp word [rbp], bx
je 0x3a27d
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
xor eax, dword [rbp + rcx*4 + 4]
xor eax, dword [rsp + rcx*4 + 0x20]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rdi + rcx*4], eax
cmp dx, 4
jb 0x3a258
jmp 0x3a29c
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rdi + rcx*4], eax
cmp dx, 4
jb 0x3a27d
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [rdi + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x3a29f
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.00039f0c
movsx rcx, bx
inc bx
mov eax, dword [rsi + rcx*4 + 0x10]
xor eax, dword [rdi + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
mov dword [rdi + rcx*4 + 0x10], eax
cmp bx, 4
jb 0x3a2ca
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret