joyce8/EMBER2024-capa huggingface dataset:
Function at 0x34d94
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r10, qword [rcx + 0xb0]
mov rsi, rdx
mov rbx, rcx
test r10, r10
jne 0x34def
cmp qword [rcx + 0x248], r10
je 0x34dd9
cmp qword [rcx + 0x258], r10
je 0x34dd9
cmp qword [rcx + 0x260], r10
je 0x34dd9
cmp qword [rcx + 0x250], r10
jne 0x34def
lea rcx, str.got_no_pre_shared_key
call fcn.00044148
mov eax, 0xffff8a00
jmp 0x34eed
mov rdx, qword [rdx]
lea rcx, [rdx + 2]
cmp rcx, r8
ja 0x34edc
movzx eax, byte [rdx]
mov qword [rsi], rcx
shl eax, 8
movsxd rdi, eax
movzx eax, byte [rdx + 1]
or rdi, rax
lea rax, [rdi - 1]
cmp rax, 0xfffe
ja 0x34edc
lea rax, [rcx + rdi]
cmp rax, r8
ja 0x34edc
test r10, r10
je 0x34e9d
mov r8, rcx
mov rcx, qword [rbx + 0xb8]
mov r9, rdi
mov rdx, rbx
call r10
test eax, eax
je 0x34ed5
mov rax, qword [rsi]
mov qword [rsp + 0x30], rdi
lea r8, str.f:driver_
mov qword [rsp + 0x28], rax
lea rax, str.Unknown_PSK_identity
mov r9d, 0xbc7
mov edx, 3
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00044260
mov r8b, 0x73
mov dl, 2
mov rcx, rbx
call fcn.0002b8c8
mov ecx, 0xffff9380
test eax, eax
cmovne ecx, eax
mov eax, ecx
jmp 0x34eed
cmp rdi, qword [rbx + 0x260]
jne 0x34e4f
mov rdx, qword [rbx + 0x258]
xor r8b, r8b
test rdi, rdi
je 0x34ed5
sub rcx, rdx
mov r9, rdi
mov al, byte [rcx + rdx]
xor al, byte [rdx]
inc rdx
or r8b, al
sub r9, 1
jne 0x34ebb
test r8b, r8b
jne 0x34e4f
add qword [rsi], rdi
xor eax, eax
jmp 0x34eed
lea rcx, str.bad_client_key_exchange_message
call fcn.00044148
mov eax, 0xffff8400
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x3716c
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [0x0006d210]
mov rcx, rbx
test rdi, rdi
je 0x371c1
cmp qword [0x0006d210], 0
je 0x371c1
mov rsi, qword [rdi + 8]
cmp qword [rcx + 8], rsi
jne 0x371b4
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rcx]
mov r8, rsi
call fcn.0005d730
test eax, eax
je 0x371d3
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x3719b
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
jmp 0x371c3

Function at 0x37a00
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
xor eax, eax
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x54], eax
mov qword [r11 - 0x10], rax
cmp rcx, 0xffffffffffffffff
je 0x37a56
cmp rcx, rbx
je 0x37a56
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x30], rbx
lea rax, [r11 - 0x18]
mov dword [rsp + 0x30], 0x400
mov qword [r11 - 0x40], rdx
xor r9d, r9d
xor edx, edx
xor r8d, r8d
mov qword [r11 - 0x48], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, ebx
cmovge ebx, dword [rsp + 0x58]
mov eax, ebx
add rsp, 0x60
pop rbx
ret
Function at 0x3972c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x98]
mov r14, r9
mov r13d, edx
mov r15, rcx
test r8b, 0xf
je 0x39778
mov eax, 0xffffffde
jmp 0x39849
test edx, edx
jne 0x397dc
test r8, r8
je 0x39847
mov r12, qword [rsp + 0x90]
lea rdi, [r8 - 1]
mov rsi, r9
shr rdi, 4
sub rsi, rbx
inc rdi
movdqu xmm6, xmmword [r12]
mov r9, rbx
mov r8, r12
xor edx, edx
mov rcx, r15
call fcn.00038c68
mov ecx, 0x10
mov al, byte [rsi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x397b9
add r12, 0x10
sub rsi, 0x10
sub rdi, 1
movdqu xmmword [r14], xmm6
jne 0x3979e
jmp 0x39847
test r8, r8
je 0x39847
mov rsi, qword [rsp + 0x90]
lea rdi, [r8 - 1]
mov r12, r9
shr rdi, 4
sub r12, rsi
inc rdi
mov rdx, rbx
mov rcx, rsi
mov r8d, 0x10
sub rdx, rsi
mov al, byte [r12 + rcx]
xor al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
sub r8, 1
jne 0x39809
mov r9, rbx
mov r8, rbx
mov edx, r13d
mov rcx, r15
call fcn.00038c68
add rsi, 0x10
sub r12, 0x10
movdqu xmm5, xmmword [rbx]
add rbx, 0x10
sub rdi, 1
movdqu xmmword [r14], xmm5
jne 0x397fa
xor eax, eax
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.0005cf80
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [rsp + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x39a38
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
and qword [rcx], 0
and qword [rcx + 8], 0
test edx, edx
jne 0x39ab3
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
jmp 0x39b1f
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx + 0x10], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 0x18], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x20], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x28], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x30], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x38], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x40], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x48], rax
mov dword [rcx + 0x1d0], edx
ret
Function at 0x3a658
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebx, 0x40
mov r12d, r9d
mov rdi, r8
lea r15d, [rbx + 0x40]
mov rbp, rdx
mov r13, rcx
cmp r8, r15
jbe 0x3a6ba
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rbp
call fcn.0003a4c4
mov r11d, r12d
lea rbp, [rsp + 0x20]
neg r11d
sbb rdi, rdi
and rdi, 0xfffffffffffffff0
add rdi, rbx
lea rcx, [r13 + 0xd0]
mov r8, r15
mov edx, 0x36
call fcn.0005d630
lea rsi, [r13 + 0x150]
mov r8, r15
mov rcx, rsi
mov edx, 0x5c
call fcn.0005d630
test rdi, rdi
je 0x3a701
mov al, byte [rbp]
xor byte [rsi - 0x80], al
mov al, byte [rbp]
inc rbp
xor byte [rsi], al
inc rsi
sub rdi, 1
jne 0x3a6ea
mov edx, r12d
mov rcx, r13
call fcn.00039a38
lea rdx, [r13 + 0xd0]
mov r8, r15
call fcn.0003a07c
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
sub rbx, 1
jne 0x3a720
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x3c384
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rcx
mov rsi, r8
mov rdi, rdx
mov ebp, 0xdc
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, rbp
call fcn.0005d630
and dword [rsp + 0x20], 0
and dword [rsp + 0x24], 0
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
mov dword [rsp + 0x38], 0xc3d2e1f0
call fcn.0003c148
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.0003c220
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
sub rbp, 1
jne 0x3c416
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x148]
add rsp, 0x110
pop rdi
pop rsi
pop rbp
ret
Function at 0x3c44c
Capabilities:
Authenticate hmac
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, 0x14
mov rbp, r8
mov rsi, rdx
lea r15d, [rdi + 0x2c]
mov rbx, rcx
cmp r8, r15
jbe 0x3c499
lea r8, [rsp + 0x20]
mov rdx, rbp
mov rcx, rsi
call fcn.0003c384
mov rbp, rdi
lea rsi, [rsp + 0x20]
lea rcx, [rbx + 0x5c]
mov r8, r15
mov edx, 0x36
call fcn.0005d630
lea r12, [rbx + 0x9c]
mov r8, r15
mov rcx, r12
mov edx, 0x5c
call fcn.0005d630
test rbp, rbp
je 0x3c4df
mov al, byte [rsi]
xor byte [r12 - 0x40], al
mov al, byte [rsi]
inc rsi
xor byte [r12], al
inc r12
sub rbp, 1
jne 0x3c4c6
and dword [rbx], 0
and dword [rbx + 4], 0
lea rdx, [rbx + 0x5c]
mov r8, r15
mov rcx, rbx
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
mov dword [rbx + 0x18], 0xc3d2e1f0
call fcn.0003c148
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
sub rdi, 1
jne 0x3c51d
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.0005cf80
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x3c54c
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
lea rdx, [rsp + 0x20]
mov rbx, rcx
call fcn.0003c220
and dword [rbx], 0
and dword [rbx + 4], 0
lea rdx, [rbx + 0x9c]
mov r8d, 0x40
mov rcx, rbx
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
mov dword [rbx + 0x18], 0xc3d2e1f0
call fcn.0003c148
mov esi, 0x14
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, rsi
call fcn.0003c148
mov rdx, rdi
mov rcx, rbx
call fcn.0003c220
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
sub rsi, 1
jne 0x3c5de
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x3e93c
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
and dword [rcx], 0
and dword [rcx + 4], 0
test edx, edx
jne 0x3e981
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
jmp 0x3e9b9
mov dword [rcx + 8], 0xc1059ed8
mov dword [rcx + 0xc], 0x367cd507
mov dword [rcx + 0x10], 0x3070dd17
mov dword [rcx + 0x14], 0xf70e5939
mov dword [rcx + 0x18], 0xffc00b31
mov dword [rcx + 0x1c], 0x68581511
mov dword [rcx + 0x20], 0x64f98fa7
mov dword [rcx + 0x24], 0xbefa4fa4
mov dword [rcx + 0xe8], edx
ret
Function at 0x41530
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x00078100]
mov eax, dword [0x00078100]
Function at 0x43de8
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rcx
mov rsi, r8
mov rdi, rdx
mov ebp, 0xd8
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, rbp
call fcn.0005d630
and dword [rsp + 0x20], 0
and dword [rsp + 0x24], 0
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rbx
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.00043bd4
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.00043cac
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
sub rbp, 1
jne 0x43e72
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x148]
add rsp, 0x110
pop rdi
pop rsi
pop rbp
ret

Function at 0x43ea8
Capabilities:
Authenticate hmac
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 0x10
mov rbp, r8
mov rsi, rdx
lea r15d, [rbx + 0x30]
mov rdi, rcx
cmp r8, r15
jbe 0x43ef5
lea r8, [rsp + 0x20]
mov rdx, rbp
mov rcx, rsi
call fcn.00043de8
mov rbp, rbx
lea rsi, [rsp + 0x20]
lea rcx, [rdi + 0x58]
mov r8, r15
mov edx, 0x36
call fcn.0005d630
lea r12, [rdi + 0x98]
mov r8, r15
mov rcx, r12
mov edx, 0x5c
call fcn.0005d630
test rbp, rbp
je 0x43f3b
mov al, byte [rsi]
xor byte [r12 - 0x40], al
mov al, byte [rsi]
inc rsi
xor byte [r12], al
inc r12
sub rbp, 1
jne 0x43f22
and dword [rdi], 0
and dword [rdi + 4], 0
lea rdx, [rdi + 0x58]
mov r8, r15
mov rcx, rdi
mov dword [rdi + 8], 0x67452301
mov dword [rdi + 0xc], 0xefcdab89
mov dword [rdi + 0x10], 0x98badcfe
mov dword [rdi + 0x14], 0x10325476
call fcn.00043bd4
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
sub rbx, 1
jne 0x43f72
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.0005cf80
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x43fa0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
lea rdx, [rsp + 0x20]
mov rbx, rcx
call fcn.00043cac
and dword [rbx], 0
and dword [rbx + 4], 0
lea rdx, [rbx + 0x98]
mov r8d, 0x40
mov rcx, rbx
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
call fcn.00043bd4
mov esi, 0x10
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rbx
call fcn.00043bd4
mov rdx, rdi
mov rcx, rbx
call fcn.00043cac
lea rax, [rsp + 0x20]
mov byte [rax], 0
inc rax
sub rsi, 1
jne 0x4402b
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x454b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r13, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov r14, r9
mov r15, rcx
test r8b, 7
je 0x45500
mov eax, 0xffffffce
jmp 0x455b4
cmp edx, 1
jne 0x45565
test r8, r8
je 0x455b2
lea rbp, [r8 - 1]
mov rbx, rdi
sub r13, r9
shr rbp, 3
sub rbx, r9
inc rbp
mov rcx, r14
mov edx, 8
mov al, byte [r13 + rcx]
xor al, byte [rcx]
mov byte [rbx + rcx], al
inc rcx
sub rdx, 1
jne 0x4552a
mov r8, rdi
mov rdx, rdi
mov rcx, r15
call fcn.000451d8
mov r11, qword [rdi]
add r13, 8
add rdi, 8
add rbx, 8
sub rbp, 1
mov qword [r14], r11
jne 0x45522
jmp 0x455b2
test r8, r8
je 0x455b2
lea rbp, [r8 - 1]
mov r12, r9
shr rbp, 3
sub r12, rdi
inc rbp
mov rbx, qword [r13]
mov r8, rdi
mov rdx, r13
mov rcx, r15
call fcn.000451d8
mov ecx, 8
mov al, byte [r12 + rdi]
xor byte [rdi], al
inc rdi
sub rcx, 1
jne 0x45592
add r13, 8
sub r12, 8
sub rbp, 1
mov qword [r14], rbx
jne 0x4557b
xor eax, eax
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x45b44
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r13, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov r14, r9
mov r15, rcx
test r8b, 7
je 0x45b90
mov eax, 0xffffffce
jmp 0x45c44
cmp edx, 1
jne 0x45bf5
test r8, r8
je 0x45c42
lea rbp, [r8 - 1]
mov rbx, rdi
sub r13, r9
shr rbp, 3
sub rbx, r9
inc rbp
mov rcx, r14
mov edx, 8
mov al, byte [r13 + rcx]
xor al, byte [rcx]
mov byte [rbx + rcx], al
inc rcx
sub rdx, 1
jne 0x45bba
mov r8, rdi
mov rdx, rdi
mov rcx, r15
call fcn.000455e0
mov r11, qword [rdi]
add r13, 8
add rdi, 8
add rbx, 8
sub rbp, 1
mov qword [r14], r11
jne 0x45bb2
jmp 0x45c42
test r8, r8
je 0x45c42
lea rbp, [r8 - 1]
mov r12, r9
shr rbp, 3
sub r12, rdi
inc rbp
mov rbx, qword [r13]
mov r8, rdi
mov rdx, r13
mov rcx, r15
call fcn.000455e0
mov ecx, 8
mov al, byte [r12 + rdi]
xor byte [rdi], al
inc rdi
sub rcx, 1
jne 0x45c22
add r13, 8
sub r12, 8
sub rbp, 1
mov qword [r14], rbx
jne 0x45c0b
xor eax, eax
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x45c70
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
mov r10, r9
mov rdi, rdx
mov rbx, r9
mov ebx, ecx
Function at 0x45e1c
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
mov rdi, rdx
xor r11d, r11d
xor r10d, r10d
xor edx, edx
mov rbx, r8
mov rsi, rcx
test r9, r9
je 0x45f91
lea r13, [0x000633e0]
xor ecx, ecx
jmp 0x45e60
cmp byte [r10 + r8], 0x20
jne 0x45e65
inc r10
inc ecx
cmp r10, r9
jb 0x45e54
cmp r10, r9
je 0x45ed8
mov rax, r9
sub rax, r10
cmp rax, 2
jb 0x45e85
cmp byte [r10 + r8], 0xd
jne 0x45e85
cmp byte [r10 + r8 + 1], 0xa
je 0x45ecc
mov al, byte [r10 + r8]
cmp al, 0xa
je 0x45ecc
test ecx, ecx
jne 0x45fa8
cmp al, 0x3d
jne 0x45ea4
inc edx
cmp edx, 2
ja 0x45fa8
cmp al, 0x7f
ja 0x45fa8
movzx eax, al
cmp byte [rax + r13], 0x7f
je 0x45fa8
cmp byte [rax + r13], 0x40
jae 0x45ec9
test edx, edx
jne 0x45fa8
inc r11
inc r10
cmp r10, r9
jb 0x45e50
test r11, r11
je 0x45f91
lea rax, [r11 + r11*2]
lea rcx, [rax + rax + 7]
mov eax, edx
shr rcx, 3
sub rcx, rax
test rsi, rsi
je 0x45faf
add byte [rax], al
invalid
cmp qword [rdi], rcx
jb 0x45faf
xor r9d, r9d
xor r11d, r11d
mov r8d, 3
mov rdx, rsi
test r10, r10
je 0x45f8b
mov eax, 0xffffffd4
jmp 0x45f93
mov qword [rdi], rcx
mov eax, 0xffffffd6
jmp 0x45f93
Function at 0x47c14
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x48], rax
and qword [rsp + 0x30], 0
movabs rax, 0xe000000000000000
mov rsi, r9
mov r14, r8
mov rdi, rcx
mov r12d, 0xd
test rax, r9
jne 0x47de0
xor eax, eax
mov qword [rcx + 0x178], rax
mov qword [rcx + 0x180], rax
mov qword [rcx + 0x188], rax
mov qword [rcx + 0x190], rax
and qword [rcx + 0x158], rax
and qword [rcx + 0x160], rax
mov dword [rcx + 0x198], edx
cmp r9, 0xc
jne 0x47cb2
mov rax, qword [r8]
mov qword [rcx + 0x178], rax
mov eax, dword [r8 + 8]
mov dword [rcx + 0x180], eax
mov byte [rcx + 0x187], 1
jmp 0x47d60
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov rcx, r9
shl rcx, 3
mov rax, rcx
shr rax, 0x18
mov byte [rsp + 0x44], al
mov rax, rcx
shr rcx, 8
shr rax, 0x10
mov byte [rsp + 0x46], cl
mov byte [rsp + 0x45], al
mov al, r9b
shl al, 3
mov byte [rsp + 0x47], al
test r9, r9
je 0x47d34
mov ebp, 0x10
cmp rsi, rbp
cmovb rbp, rsi
xor ecx, ecx
test rbp, rbp
je 0x47d16
mov al, byte [rcx + r14]
inc rcx
xor byte [rdi + rcx + 0x177], al
cmp rcx, rbp
jb 0x47d03
lea r8, [rdi + 0x178]
lea rdx, [rdi + 0x178]
mov rcx, rdi
call fcn.00047a70
add r14, rbp
sub rsi, rbp
jne 0x47cf0
xor ecx, ecx
mov al, byte [rsp + rcx + 0x38]
inc rcx
xor byte [rdi + rcx + 0x177], al
cmp rcx, 0x10
jb 0x47d36
lea r8, [rdi + 0x178]
lea rdx, [rdi + 0x178]
mov rcx, rdi
call fcn.00047a70
lea rax, [rsp + 0x30]
lea r9, [rdi + 0x168]
lea rdx, [rdi + 0x178]
mov r8d, 0x10
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.00041910
test eax, eax
jne 0x47de5
mov rsi, qword [rsp + 0xb0]
mov qword [rdi + 0x160], r12
mov ebx, 0x10
cmp r12, rbx
cmovb rbx, r12
xor ecx, ecx
test rbx, rbx
je 0x47dbe
mov al, byte [rcx + rsi]
inc rcx
xor byte [rdi + rcx + 0x187], al
cmp rcx, rbx
jb 0x47dac
lea r8, [rdi + 0x188]
lea rdx, [rdi + 0x188]
mov rcx, rdi
call fcn.00047a70
add rsi, rbx
sub r12, rbx
jne 0x47d99
xor eax, eax
jmp 0x47de5
mov eax, 0xffffffec
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.0005cf80
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x47f80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rcx + 0x158]
mov r12, qword [rcx + 0x160]
lea rax, [r8 - 4]
shl rsi, 3
shl r12, 3
mov rdi, r8
mov r13, rdx
mov rbp, rcx
cmp rax, 0xc
ja 0x480ea
xor ebx, ebx
cmp r8, rbx
je 0x47fe2
lea rdx, [rcx + 0x168]
mov rcx, r13
call fcn.0005d130
cmp rsi, rbx
jne 0x47ff0
cmp r12, rbx
je 0x480e6
xor eax, eax
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov rax, r12
shr rax, 0x38
mov byte [rsp + 0x27], r12b
mov byte [rsp + 0x2f], sil
mov byte [rsp + 0x20], al
mov rax, r12
shr rax, 0x30
mov byte [rsp + 0x21], al
mov rax, r12
shr rax, 0x28
mov byte [rsp + 0x22], al
mov rax, r12
shr rax, 0x20
mov byte [rsp + 0x23], al
mov rax, r12
shr rax, 0x18
mov byte [rsp + 0x24], al
mov rax, r12
shr rax, 0x10
mov byte [rsp + 0x25], al
mov rax, r12
shr rax, 8
mov byte [rsp + 0x26], al
mov rax, rsi
shr rax, 0x38
mov byte [rsp + 0x28], al
mov rax, rsi
shr rax, 0x30
mov byte [rsp + 0x29], al
mov rax, rsi
shr rax, 0x28
mov byte [rsp + 0x2a], al
mov rax, rsi
shr rax, 0x20
mov byte [rsp + 0x2b], al
mov rax, rsi
shr rax, 0x18
mov byte [rsp + 0x2c], al
mov rax, rsi
shr rax, 0x10
mov byte [rsp + 0x2d], al
mov rax, rsi
shr rax, 8
mov byte [rsp + 0x2e], al
mov al, byte [rsp + rdx + 0x20]
inc rdx
xor byte [rbp + rdx + 0x187], al
cmp rdx, 0x10
jb 0x480a3
lea r8, [rbp + 0x188]
lea rdx, [rbp + 0x188]
mov rcx, rbp
call fcn.00047a70
cmp rdi, rbx
jbe 0x480e6
mov al, byte [rbp + rbx + 0x188]
xor byte [r13 + rbx], al
inc rbx
cmp rbx, rdi
jb 0x480d2
xor eax, eax
jmp 0x480ef
mov eax, 0xffffffec
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x48194
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xe8]
mov rbx, rdx
mov r10, r8
mov r8, qword [rsp + 0xc0]
lea rdx, [r11 - 0x38]
mov qword [r11 - 0x48], rdx
mov qword [r11 - 0x50], rsi
mov qword [r11 - 0x58], rdi
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x68], 0xd
mov qword [r11 - 0x70], r8
mov qword [r11 - 0x78], r9
mov r8, rbx
xor edx, edx
mov r9, r10
call fcn.00048118
test eax, eax
jne 0x4825e
xor r8d, r8d
xor edx, edx
test rsi, rsi
je 0x4825c
mov r9, qword [rsp + 0xd0]
lea rax, [rsp + 0x60]
sub r9, rax
lea rax, [rsp + rdx + 0x60]
inc rdx
movzx ecx, byte [r9 + rax]
movzx eax, byte [rax]
xor ecx, eax
or r8d, ecx
cmp rdx, rsi
jb 0x48225
test r8d, r8d
je 0x4825c
test rbx, rbx
je 0x48255
mov byte [rdi], 0
inc rdi
sub rbx, 1
jne 0x48249
mov eax, 0xffffffee
jmp 0x4825e
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.0005cf80
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x492d0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xd8]
mov qword [r11 - 0x48], rsi
mov rbx, rdx
lea rdx, [r11 - 0x38]
mov qword [r11 - 0x50], rdx
mov qword [r11 - 0x58], rdi
mov qword [r11 - 0x60], rax
mov r10, r9
mov r9, r8
mov r8, qword [rsp + 0xc0]
mov qword [r11 - 0x68], 0xd
mov qword [r11 - 0x70], r8
mov edx, 1
mov r8, rbx
mov qword [r11 - 0x78], r10
call fcn.00048ec0
test eax, eax
jne 0x49396
xor edx, edx
xor r8b, r8b
test rsi, rsi
je 0x49394
mov r9, qword [rsp + 0xe0]
xor eax, eax
movzx ecx, byte [rax + r9]
movzx eax, byte [rsp + rax + 0x60]
inc r8b
xor ecx, eax
movzx eax, r8b
or edx, ecx
cmp rax, rsi
jb 0x4935e
test edx, edx
je 0x49394
test rbx, rbx
je 0x4938d
mov byte [rdi], 0
inc rdi
sub rbx, 1
jne 0x49381
mov eax, 0xfffffff1
jmp 0x49396
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.0005cf80
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret