joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f838
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [rcx]
mov rbx, r9
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x58]
test eax, eax
setne al
mov dword [rbx], ecx
add rsp, 0x30
pop rbx
ret

Function at 0x40f874
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [0x004cd380]
cmp r8d, eax
cmova r8d, eax
jmp fcn.0040f838

Function at 0x40f910
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x004cd380]
mov rcx, qword [rcx]
mov rbx, r9
cmp r8d, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
cmova r8d, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
mov dword [rbx], ecx
setne al
add rsp, 0x30
pop rbx
ret

Function at 0x40f9b8
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.0040f6a4
xor ebx, ebx
cmp al, bl
je 0x40f9e0
cmp qword [rsp + 0x50], rdi
je 0x40f9e4
xor al, al
jmp 0x40f9f2
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x4106e8
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x410713
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
cmovb rax, qword [rsp + 0x48]
add rsp, 0x68
ret
Function at 0x416570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x004ced40]
mov qword [rsp + 0x28], rax
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
xor r13d, r13d
mov qword [r11 + 0x20], rbx
mov r14, r8
mov r15, rdx
mov rsi, r13
mov rdi, rcx
mov byte [rdx], 0
mov qword [r11 - 8], rbp
mov r8d, dword [rdi + 0x150]
mov edx, dword [rdi + 0x154]
mov ecx, 8
sub ecx, r8d
lea eax, [r8 + 8]
shr edx, cl
mov dword [rdi + 0x150], eax
shr edx, 0x10
cmp eax, 8
movzx ebp, dl
jb 0x416634
nop
mov rax, qword [rdi + 0x158]
cmp rax, qword [rdi + 0x160]
jb 0x416602
lea rcx, [rdi + 0x158]
call fcn.00412ca4
movzx r11d, al
jmp 0x41660f
mov r11b, byte [rax]
inc rax
mov qword [rdi + 0x158], rax
mov ecx, dword [rdi + 0x154]
add dword [rdi + 0x150], 0xfffffff8
movzx eax, r11b
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x154], ecx
cmp dword [rdi + 0x150], 8
jae 0x4165e0
mov byte [rsp + rsi + 0x20], bpl
inc rsi
cmp rsi, 6
jl 0x4165b1
mov esi, r13d
mov ebp, 4
mov qword [rsp + 0x48], r12
mov r8d, dword [rdi + 0x150]
mov edx, dword [rdi + 0x154]
mov ecx, 8
sub ecx, r8d
lea eax, [r8 + 8]
shl esi, 8
shr edx, cl
mov dword [rdi + 0x150], eax
shr edx, 0x10
cmp eax, 8
movzx r12d, dl
jb 0x4166e4
nop
nop
nop
nop
mov rax, qword [rdi + 0x158]
cmp rax, qword [rdi + 0x160]
jb 0x4166b2
lea rcx, [rdi + 0x158]
call fcn.00412ca4
movzx r11d, al
jmp 0x4166bf
mov r11b, byte [rax]
inc rax
mov qword [rdi + 0x158], rax
mov ecx, dword [rdi + 0x154]
add dword [rdi + 0x150], 0xfffffff8
movzx eax, r11b
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x154], ecx
cmp dword [rdi + 0x150], 8
jae 0x416690
or esi, r12d
dec rbp
mov eax, r12d
jne 0x416653
movzx eax, byte [rsp + 0x20]
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
cmp al, 0x17
mov rbx, qword [rsp + 0x88]
mov dword [r14], esi
jne 0x41674a
cmp byte [rsp + 0x21], 0x72
jne 0x416785
cmp byte [rsp + 0x22], 0x45
jne 0x416785
cmp byte [rsp + 0x23], 0x38
jne 0x416785
cmp byte [rsp + 0x24], 0x50
jne 0x416785
cmp byte [rsp + 0x25], 0x90
jne 0x416785
mov byte [r15], 1
mov ecx, dword [rdi + 0x700c]
cmp dword [r14], ecx
setne r13b
mov eax, r13d
jmp 0x41678a
cmp al, 0x31
jne 0x416785
cmp byte [rsp + 0x21], 0x41
jne 0x416785
cmp byte [rsp + 0x22], 0x59
jne 0x416785
cmp byte [rsp + 0x23], 0x26
jne 0x416785
cmp byte [rsp + 0x24], 0x53
jne 0x416785
cmp byte [rsp + 0x25], 0x59
jne 0x416785
mov eax, dword [rdi + 0x700c]
rol eax, 1
xor eax, esi
mov dword [rdi + 0x700c], eax
xor eax, eax
jmp 0x41678a
mov eax, 1
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
call fcn.0049b2e0
add rsp, 0x68
ret
Function at 0x419720
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x58], rbx
xor ebx, ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x28]
mov dword [rsp + 0x28], ebx
mov qword [rcx + 0x20], rax
mov rax, qword [rcx + 0x8cf8]
mov dword [rsp + 0x2c], 8
mov byte [rsp + 0x30], bl
mov dword [rcx + 0x8ce8], ebx
mov r9d, dword [rax + 0x1a0]
mov r8d, edx
mov rdx, qword [rcx]
mov qword [rsp + 0x68], rdi
mov rdi, rcx
call fcn.00418f10
mov rcx, qword [rdi + 0x8cf8]
cmp byte [rcx + 0x1e4], bl
je 0x4197a4
mov eax, dword [rdi + 0x8cec]
mov rcx, qword [rcx + 0x1a8]
imul rax, rax, 0x8e28
mov rcx, qword [rax + rcx + 0x8d18]
call fcn.0049aa68
cmp dword [rdi + 0x8ce8], ebx
mov edx, ebx
jbe 0x4197e7
lea r8, [rdi + 0x7ce8]
nop
nop
nop
mov rcx, qword [rdi + 0x8cf8]
inc edx
add r8, 4
mov eax, dword [rcx + 0x1a4]
rol eax, 1
xor eax, dword [r8 - 4]
mov dword [rcx + 0x1a4], eax
cmp edx, dword [rdi + 0x8ce8]
jb 0x4197c0
mov eax, dword [rsp + 0x28]
movzx r9d, byte [rsp + 0x30]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 0x8cf8]
lea r8d, [rax*8 + 8]
sub r8d, dword [rsp + 0x2c]
call fcn.004191a0
mov rax, qword [rdi + 0x8cf8]
cmp byte [rax + 0x1e4], bl
je 0x4198b0
mov qword [rsp + 0x60], rsi
mov esi, dword [rdi + 0x8cec]
inc esi
cmp esi, dword [rax + 0x1e0]
cmove esi, ebx
cmp qword [rax + 0x200], rbx
je 0x419886
lea rbx, [rax + 0x160]
mov rcx, rbx
call fcn.00413f98
mov ecx, 0xf
lea rdx, [rdi + 0x8d20]
sub ecx, dword [rbx + 0x38]
lea r8, [rsp + 0x20]
shr rcx, 3
lea r11, [rcx + rax]
mov rax, qword [rdi + 0x8cf8]
mov qword [rsp + 0x20], r11
mov rcx, qword [rax + 0x200]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov ebx, eax
mov rcx, qword [rdi + 0x8cf8]
mov r8d, esi
mov rdx, qword [rcx + 0x1a8]
imul r8, r8, 0x8e28
lea rcx, [r8 + rdx + 0x8d18]
call fcn.0049aae4
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
Function at 0x4557ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x48
cmp byte [r8 + 1], 0
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov rbp, rcx
je 0x455938
mov al, byte [r9 + 2]
shr al, 3
test al, 1
je 0x4557e6
mov eax, 0x80004001
jmp 0x4559a9
mov eax, dword [r9 + 0xb8]
movzx ecx, word [r9 + 0xbc]
lea rdx, [r8 + 0x20]
add rcx, rax
mov rax, qword [r9 + 0x10]
add rcx, qword [r9 + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
lea rcx, [r9 + 0x20]
call fcn.0040bfd0
mov dl, byte [rsi + 4]
mov rcx, rbx
call fcn.00453afc
mov r11d, dword [rsi + 0x14]
mov dword [rbx + 8], r11d
mov rax, qword [rsi + 0x30]
mov qword [rbx + 0x60], rax
mov rax, qword [rsi + 0x38]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x40]
mov qword [rbx + 0x70], rax
mov al, byte [rsi + 3]
mov byte [rbx + 0xb2], al
mov esi, dword [rbx + 0x84]
dec esi
movsxd r12, esi
js 0x455889
shl r12, 3
mov rax, qword [rbx + 0x88]
mov rcx, qword [r12 + rax]
cmp word [rcx], 0x9901
je 0x455881
mov rax, qword [rbx + 0x78]
lea rcx, [rbx + 0x78]
mov r8d, 1
mov edx, esi
call qword [rax + VariantCopy]
sub r12, 8
dec esi
jns 0x45585c
mov esi, dword [rbx + 0x3c]
dec esi
movsxd r13, esi
js 0x4558c2
shl r13, 3
mov rax, qword [rbx + 0x40]
mov rcx, qword [r13 + rax]
cmp word [rcx], 0x9901
je 0x4558ba
mov rax, qword [rbx + 0x30]
lea rcx, [rbx + 0x30]
mov r8d, 1
mov edx, esi
call qword [rax + VariantCopy]
sub r13, 8
dec esi
jns 0x455897
lea rdx, [rsp + 0x90]
lea rcx, [rbx + 0x30]
call fcn.0044b46c
mov r9, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
movzx edx, word [rbx + 0x28]
mov rcx, rbp
mov byte [rsp + 0x20], al
call fcn.00453c2c
mov r11, qword [rbp + 0x40]
mov rcx, rbp
mov qword [rbx + 0x58], r11
call fcn.00453e2c
mov r9, qword [rsp + 0xa0]
lea r8, [rsp + 0x30]
mov rdx, rbp
mov rcx, r14
call fcn.004552b0
test eax, eax
jne 0x4559a9
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x38]
mov rdx, rbx
add qword [rcx], rax
mov rcx, rbp
call fcn.00453ec0
jmp 0x4559a7
mov rax, qword [r9 + 0x58]
lea r8, [rsp + 0x30]
mov rdx, rbp
mov qword [rsp + 0x30], rax
movzx eax, word [r9 + 0xbc]
add eax, dword [r9 + 0xb8]
mov ecx, eax
mov al, byte [r9 + 2]
shr al, 3
and eax, 1
shl eax, 4
add rcx, rax
mov rax, qword [rbp + 0x40]
add rcx, qword [r9 + 0x10]
mov qword [r9 + 0x58], rax
mov r9, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rcx
mov rcx, r14
call fcn.004552b0
test eax, eax
jne 0x4559a9
mov rax, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0x38]
mov rcx, rbp
add qword [rax], rdx
call fcn.00453bec
xor eax, eax
add rsp, 0x48
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x45e974
Capabilities:
Encode data using xor

Disassembly:
mov r11d, dword [rcx]
mov r9, rcx
jmp 0x45e9c0
cmp dword [r9 + 4], 0
je 0x45e9c5
mov al, byte [rdx]
movsxd rcx, dword [r9 + 4]
add r8d, 0xffffffff
mov byte [rcx + r9 + 8], al
mov eax, dword [r9 + 4]
inc rdx
inc eax
and eax, 3
test eax, eax
mov dword [r9 + 4], eax
jne 0x45e9c0
xor ecx, ecx
lea r10, [r9 + 8]
movzx eax, byte [r10]
inc r10
shl eax, cl
add ecx, 8
xor r11d, eax
cmp ecx, 0x20
jl 0x45e9ac
test r8d, r8d
jne 0x45e97c
mov r10d, r8d
shr r10d, 2
je 0x45e9f8
movzx eax, byte [rdx + 1]
movzx ecx, byte [rdx]
add rdx, 4
shl eax, 8
or ecx, eax
movzx eax, byte [rdx - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [rdx - 1]
shl eax, 0x18
or ecx, eax
xor r11d, ecx
dec r10d
jne 0x45e9ce
and r8d, 3
mov dword [r9], r11d
je 0x45ea22
mov al, byte [rdx]
movsxd rcx, dword [r9 + 4]
inc rdx
mov byte [rcx + r9 + 8], al
mov eax, dword [r9 + 4]
inc eax
and eax, 3
add r8d, 0xffffffff
mov dword [r9 + 4], eax
jne 0x45ea01
ret
Function at 0x45eaa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x68
mov rax, qword [0x004ced40]
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
mov r12, rdx
mov r13, r8
lea esi, [rbx + 8]
lea rdx, [rsp + 0x40]
mov r8, rsi
mov dword [rsp + 0x48], ebx
call fcn.00414f0c
cmp eax, ebx
jne 0x45ecb5
mov edx, dword [rsp + 0x48]
mov ebp, ebx
mov r8d, ebx
mov eax, edx
mov ecx, r8d
inc edx
movzx eax, byte [rsp + rax + 0x40]
add r8d, esi
mov dword [rsp + 0x48], edx
shl eax, cl
or ebp, eax
cmp r8d, 0x20
jl 0x45eaed
movzx r9d, bx
mov r8d, ebx
movzx eax, byte [rsp + rdx + 0x40]
mov ecx, r8d
inc edx
shl ax, cl
add r8d, esi
mov dword [rsp + 0x48], edx
or r9w, ax
cmp r8d, 0x10
jl 0x45eb11
movzx eax, r9w
movzx r8d, bx
mov r9d, ebx
mov dword [r12], eax
movzx eax, byte [rsp + rdx + 0x40]
mov ecx, r9d
inc edx
shl ax, cl
add r9d, esi
mov dword [rsp + 0x48], edx
or r8w, ax
cmp r9d, 0x10
jl 0x45eb3e
movzx eax, r8w
mov dword [r13], eax
cmp dword [rdi + 0x2c], ebx
je 0x45eb82
mov r8d, dword [rdi + 0x2c]
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
call fcn.00414f0c
cmp eax, ebx
jne 0x45ecb5
cmp byte [rdi + 0x31], bl
mov dword [rdi + 0x20], ebx
mov esi, dword [r12]
mov edx, ebx
mov dword [rsp + 0x30], ebx
mov r8d, ebx
mov dword [rsp + 0x34], ebx
je 0x45ebf4
cmp dword [rdi + 0x24], ebx
jne 0x45ebf4
cmp esi, 2
jb 0x45ec4a
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov r8d, 2
call fcn.00414f0c
cmp eax, ebx
jne 0x45ecb5
cmp byte [rsp + 0x20], 0x43
jne 0x45ec4a
cmp byte [rsp + 0x21], 0x4b
jne 0x45ec4a
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8d, 2
add esi, 0xfffffffe
call fcn.0045e974
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
mov eax, 0x10000
sub eax, dword [rdi + 0x24]
cmp eax, esi
jb 0x45ec4a
cmp esi, ebx
je 0x45ec5a
mov edx, dword [rdi + 0x24]
mov rcx, qword [rdi + 0x10]
lea r8, [rsp + 0x28]
add rdx, qword [rdi + 0x18]
mov qword [rsp + 0x28], rsi
call fcn.00414ea0
cmp eax, ebx
jne 0x45ecb5
mov edx, dword [rdi + 0x24]
mov r8d, dword [rsp + 0x28]
lea rcx, [rsp + 0x30]
add rdx, qword [rdi + 0x18]
call fcn.0045e974
mov r11, qword [rsp + 0x28]
add dword [rdi + 0x24], r11d
cmp r11, rsi
je 0x45ec51
mov eax, 1
jmp 0x45ecb5
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
cmp r8d, ebx
mov eax, dword [rdi + 0x24]
mov r9d, ebx
mov dword [rdi + 0x28], eax
jle 0x45ec91
lea r10, [rsp + 0x38]
movzx eax, byte [r10]
mov ecx, r8d
inc r10
sub ecx, r9d
inc r9d
lea ecx, [rcx*8 - 8]
shl eax, cl
xor edx, eax
cmp r9d, r8d
mov dword [rsp + 0x30], edx
jl 0x45ec6d
cmp ebp, ebx
jne 0x45ec99
mov al, bl
jmp 0x45ecab
mov ecx, dword [r13]
shl ecx, 0x10
or ecx, dword [r12]
xor edx, ecx
cmp edx, ebp
setne al
or byte [rdi + 0x30], al
cmp al, bl
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x50]
call fcn.0049b2e0
add rsp, 0x68
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x474204
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
mov r10, rcx
je 0x47424e
mov r11, rcx
mov ebx, edx
mov r9d, dword [r8]
mov ecx, dword [r8 + 4]
movzx eax, r9w
shr r9d, 0x10
imul eax, eax, 0x9069
add eax, r9d
mov dword [r8], eax
movzx eax, cx
shr ecx, 0x10
imul eax, eax, 0x4650
add eax, ecx
mov dword [r8 + 4], eax
mov byte [r11], al
inc r11
dec rbx
jne 0x474216
mov rcx, r10
add rsp, 0x20
pop rbx
jmp fcn.004741c8

Function at 0x4748d8
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor ecx, ecx
call fcn.0048bfd0
mov ecx, 0x500
call fcn.0048bfa4
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
setne cl
cmp cl, bl
je 0x4749dd
mov eax, ebx
mov rcx, rdi
mov r9d, 0x100
mov byte [rcx], al
inc eax
inc rcx
cmp eax, r9d
jb 0x474912
mov r8d, 0xffffffff
mov r10, rdi
mov cl, byte [r10]
mov eax, r8d
inc r10
xor cl, r8b
shr eax, 8
movzx edx, cl
lea rcx, [0x004d2140]
mov r8d, dword [rcx + rdx*4]
xor r8d, eax
dec r9
jne 0x474927
not r8d
cmp r8d, 0x29058c73
jne 0x4749dd
mov edx, 0x1f123bb5
mov r9d, 0x159a55e5
lea r8, [rdi + 0x100]
mov r10d, 0x400
movzx ecx, r9w
shr r9d, 0x10
imul ecx, ecx, 0x9069
add r9d, ecx
movzx ecx, dx
shr edx, 0x10
imul ecx, ecx, 0x4650
add edx, ecx
mov byte [r8], dl
inc r8
dec r10
mov dword [rsp + 0x54], edx
mov al, dl
jne 0x474974
mov esi, ebx
mov r12d, esi
mov ebp, ebx
add r12, rdi
mov edx, ebp
mov rcx, r12
call fcn.0048abc0
mov edx, ebp
mov rcx, r12
mov r11d, eax
call fcn.004741c8
cmp eax, r11d
jne 0x4749dd
inc ebp
cmp ebp, 0x20
jb 0x4749ae
inc esi
cmp esi, 0x4e0
jb 0x4749a6
mov bl, 1
mov rcx, rdi
call fcn.0048bfd0
mov al, bl
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x47ece0
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, qword [rbx]
add rsp, 0x20
pop rbx
jmp sub.msvcrt.dll_free
Function at 0x486814
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x004ced40]
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov rdi, r8
mov rsi, rdx
mov ebp, 0x40
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8, rbp
call sub.msvcrt.dll_memset
cmp rdi, rbp
jbe 0x486877
mov rcx, rbx
call fcn.004870d4
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov dword [rbx + 0x20], 0
call fcn.004877a4
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.00487824
jmp 0x48688c
test rdi, rdi
je 0x48688c
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rsi
call sub.msvcrt.dll_memcpy
xor eax, eax
xor byte [rsp + rax + 0x20], 0x36
inc rax
cmp rax, rbp
jb 0x48688e
mov rcx, rbx
call fcn.004870d4
lea rdx, [rsp + 0x20]
mov r8, rbp
mov rcx, rbx
mov dword [rbx + 0x20], 0
call fcn.004877a4
xor r11d, r11d
xor byte [rsp + r11 + 0x20], 0x6a
inc r11
cmp r11, rbp
jb 0x4868bd
lea rcx, [rbx + 0x68]
call fcn.004870d4
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x68]
mov r8, rbp
mov dword [rbx + 0x88], 0
call fcn.004877a4
mov rcx, qword [rsp + 0x60]
call fcn.0049b2e0
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x486974
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x004ced40]
mov qword [rsp + 0xe8], rax
mov rsi, rdx
xor edx, edx
mov rbx, r8
mov rdi, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x40]
call sub.msvcrt.dll_memset
cmp rbx, 0x40
jbe 0x486a32
lea rcx, [rsp + 0x60]
call fcn.004870d4
lea rcx, [rsp + 0x60]
mov r8, rbx
mov rdx, rsi
mov dword [rsp + 0x80], 0
call fcn.004877a4
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x60]
call fcn.00487824
xor r11d, r11d
lea edx, [r11 + 5]
movzx eax, byte [rsp + r11 + 0xd1]
movzx ecx, byte [rsp + r11 + 0xd0]
add r11, 4
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + r11 + 0xce]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + r11 + 0xcf]
shl ecx, 8
or ecx, eax
dec rdx
mov dword [rsp + r11 + 0x1c], ecx
jne 0x4869ef
jmp 0x486a64
xor r8d, r8d
test rbx, rbx
je 0x486a64
mov eax, r8d
mov rdx, r8
mov ecx, 3
and eax, 3
shr rdx, 2
sub ecx, eax
movzx eax, byte [rsi + r8]
inc r8
shl ecx, 3
shl eax, cl
or dword [rsp + rdx*4 + 0x20], eax
cmp r8, rbx
jb 0x486a3a
xor eax, eax
lea esi, [rax + 0x10]
xor dword [rsp + rax*4 + 0x20], 0x36363636
inc rax
cmp rax, rsi
jb 0x486a69
mov rcx, rdi
call fcn.004870d4
lea rdx, [rsp + 0x20]
mov r8, rsi
mov rcx, rdi
mov dword [rdi + 0x20], 0
call fcn.00487924
xor r11d, r11d
xor dword [rsp + r11*4 + 0x20], 0x6a6a6a6a
inc r11
cmp r11, rsi
jb 0x486a9b
lea rcx, [rdi + 0x68]
call fcn.004870d4
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
mov r8, rsi
mov dword [rdi + 0x88], 0
call fcn.00487924
mov rcx, qword [rsp + 0xe8]
call fcn.0049b2e0
add rsp, 0xf0
pop rdi
pop rsi
pop rbx
ret
Function at 0x486b48
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xa0
mov rsi, rdx
mov edi, r8d
lea rdx, [rsp + 0x20]
mov r8d, 5
mov rbp, rcx
call fcn.00487730
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x68]
mov r8d, 5
call fcn.00487730
test edi, edi
mov rax, qword [rsi]
mov qword [rsp + 0x20], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x30], eax
je 0x486bef
lea rbx, [rsp + 0x20]
sub rbx, rsi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov rcx, rbp
call fcn.00487100
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x68]
xor r9d, r9d
call fcn.00487100
mov r11, rsi
mov ecx, 5
mov eax, dword [rbx + r11]
xor dword [r11], eax
add r11, 4
dec rcx
jne 0x486bda
dec rdi
jne 0x486ba7
add rsp, 0xa0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4870d4
Capabilities:
Hash data using sha1

Disassembly:
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x18], 0
ret
Function at 0x487824
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
mov edi, dword [rcx + 0x20]
mov rbp, qword [rcx + 0x18]
mov rbx, rcx
shl rbp, 6
mov r8d, edi
mov ecx, 3
add rbp, rdi
shr edi, 2
mov rsi, rdx
shl rbp, 3
and r8d, ecx
jne 0x48785a
mov dword [rbx + rdi*4 + 0x24], r8d
sub ecx, r8d
mov eax, 0x80
shl ecx, 3
shl eax, cl
or dword [rbx + rdi*4 + 0x24], eax
jmp 0x487890
and edi, 0xf
jne 0x487888
lea rdx, [rbx + 0x24]
xor r9d, r9d
mov r8, rbx
mov rcx, rbx
call fcn.00487100
inc qword [rbx + 0x18]
mov dword [rbx + rdi*4 + 0x24], 0
inc edi
cmp edi, 0xe
jne 0x48786d
lea eax, [rdi + 1]
mov rcx, rbp
lea rdx, [rbx + 0x24]
shr rcx, 0x20
xor r9d, r9d
mov r8, rbx
mov dword [rbx + rdi*4 + 0x24], ecx
mov rcx, rbx
mov dword [rbx + rax*4 + 0x24], ebp
call fcn.00487100
inc qword [rbx + 0x18]
mov rdx, rbx
lea r8d, [rdi - 9]
mov ecx, dword [rdx]
add rdx, 4
mov eax, ecx
shr eax, 0x18
mov byte [rsi], al
mov eax, ecx
add rsi, 4
shr eax, 0x10
mov byte [rsi - 3], al
mov eax, ecx
shr eax, 8
dec r8
mov byte [rsi - 2], al
mov byte [rsi - 1], cl
jne 0x4878c6
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov qword [rbx + 0x18], r8
mov dword [rbx + 0x20], r8d
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x487980
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [rcx + 0x18]
mov edi, dword [rcx + 0x20]
mov rbp, rdx
shl rsi, 4
mov rbx, rcx
mov dword [rcx + rdi*4 + 0x24], 0x80000000
add rsi, rdi
shl rsi, 5
jmp 0x4879ce
and edi, 0xf
jne 0x4879c6
lea rdx, [rbx + 0x24]
xor r9d, r9d
mov r8, rbx
mov rcx, rbx
call fcn.00487100
inc qword [rbx + 0x18]
mov dword [rbx + rdi*4 + 0x24], 0
inc edi
cmp edi, 0xe
jne 0x4879ab
lea eax, [rdi + 1]
mov rcx, rsi
lea rdx, [rbx + 0x24]
shr rcx, 0x20
xor r9d, r9d
mov r8, rbp
mov dword [rbx + rdi*4 + 0x24], ecx
mov rcx, rbx
mov dword [rbx + rax*4 + 0x24], esi
call fcn.00487100
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov qword [rbx + 0x18], 0
mov dword [rbx + 0x20], 0
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x488248
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [0x004ced40]
mov qword [rsp + 0xd0], rax
mov rbx, rcx
mov rdi, r8
lea rcx, [r11 - 0x58]
movzx edx, dl
mov r8d, 0x40
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x90]
lea r11, [rsp + 0x90]
sub rbx, rax
mov r9d, 0x14
mov al, byte [rbx + r11]
xor byte [r11], al
inc r11
dec r9
jne 0x488295
lea rcx, [rsp + 0x20]
call fcn.004870d4
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
mov dword [rsp + 0x40], 0
call fcn.004877a4
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.00487824
mov rcx, qword [rsp + 0xd0]
call fcn.0049b2e0
add rsp, 0xe8
pop rdi
pop rbx
ret