joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bb10
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x140
vpxor xmm0, xmm0, xmm0
mov qword [rsp + 0x40], 0
mov rsi, rcx
mov rdi, rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
vmovdqu xmmword [rsp + 0x20], xmm0
vmovdqu xmmword [rsp + 0x30], xmm0
call qword [sym.imp.libcurl_4.dll_curl_easy_init]
mov rbx, rax
test rax, rax
je 0x14000be30
lea rbp, [rsp + 0x40]
mov r8, rsi
mov edx, 0x2712
mov rcx, rax
mov rsi, qword [sym.imp.libcurl_4.dll_curl_easy_setopt]
call rsi
mov r8d, 1
mov edx, 0x4a
mov rcx, rbx
call rsi
mov r8d, 0xf
mov edx, 0x4e
mov rcx, rbx
call rsi
mov r8, rbp
mov edx, 0x271a
mov rcx, rbx
call rsi
mov r8d, 1
mov edx, 0x63
mov rcx, rbx
call rsi
mov r8d, 1
mov edx, 0x79
mov rcx, rbx
call rsi
lea r8, [sym.all_data_cb]
mov edx, 0x4e2b
mov rcx, rbx
call rsi
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, rbx
call rsi
mov rax, qword [0x140311d00]
mov r8, qword [rax]
test r8, r8
je 0x14000bdc0
mov edx, 0x2714
mov rcx, rbx
call rsi
mov rax, qword [0x140311d10]
mov edx, 0x65
mov rcx, rbx
mov r8d, dword [rax]
call rsi
mov rcx, rbx
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
jne 0x14000be10
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000bd83
cmp qword [rsp + 0x28], 0
jne 0x14000bdb0
lea rdx, str.Empty_data_received_for_config
mov ecx, 1
call sym.applog.constprop.1
xor esi, esi
mov rcx, rbx
call qword [sym.imp.libcurl_4.dll_curl_easy_cleanup]
mov rax, rsi
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, rdi
xor edx, edx
call sym.json_loads
mov rsi, rax
jmp 0x14000bd96
lea rcx, str.http_proxy
call sym.getenv
test rax, rax
je 0x14000bd60
lea r12, str.all_proxy
mov rcx, r12
call sym.getenv
test rax, rax
je 0x14000be50
mov rcx, r12
call sym.getenv
mov rcx, rbx
mov edx, 0x2714
mov r8, rax
call rsi
mov rcx, rbx
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
je 0x14000bd71
nop dword [rax + rax]
mov r8, rbp
lea rdx, str.Remote_config_read_failed:__s
mov ecx, 1
call sym.applog.constprop.1
jmp 0x14000bd94
lea rdx, str.Remote_config_init_failed_
mov ecx, 1
xor esi, esi
call sym.applog.constprop.1
jmp 0x14000bd9f
lea r12, str.ALL_PROXY
mov rcx, r12
call sym.getenv
test rax, rax
jne 0x14000bde5
lea r8, [0x1402b7cb8]
mov edx, 0x2714
mov rcx, rbx
call rsi
jmp 0x14000bd60
Function at 0x14000e8b0
Capabilities:
Get socket status

Disassembly:
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x14000e8c8
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp sym.socket_full
Function at 0x14000e8e0
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa98
vmovups xmmword [rsp + 0xa80], xmm6
mov edx, 0xa
mov rdi, qword [rcx + 0x128]
mov rbx, rcx
mov rcx, rdi
call sym.strchr
test rax, rax
je 0x14000e9a0
mov rcx, rdi
call sym.strlen
mov rcx, rdi
lea rdx, [0x1402b82b8]
mov rbp, rax
call sym.strtok
mov rcx, rax
test rax, rax
je 0x14000ebd0
call sym.strdup
mov rcx, rax
mov rsi, rax
call sym.strlen
lea rdx, [rax + 1]
cmp rdx, rbp
jl 0x14000ea48
mov rax, qword [rbx + 0x128]
mov byte [rax], 0
mov rax, qword [str._f2_]
cmp byte [rax], 0
jne 0x14000ea28
vmovups xmm6, xmmword [rsp + 0xa80]
mov rax, rsi
add rsp, 0xa98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x58]
mov rbp, qword [sym.imp.msvcrt.dll__time64]
lea rsi, [rsp + 0x280]
call rbp
mov rax, qword [0x1402b9220]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbx + 0x118]
mov rdx, rsi
mov dword [rsp + 0x280], 1
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.WS2_32.dll_select]
mov qword [rsp + 0x288], rcx
add ecx, 1
mov qword [rsp + 0x40], rax
call rax
test eax, eax
jg 0x14000ea68
lea rdx, str.stratum_recv_line_timed_out
mov ecx, 2
xor esi, esi
call sym.applog
jmp 0x14000e979
mov r8, rsi
lea rdx, str.___s
mov ecx, 5
call sym.applog.constprop.0
jmp 0x14000e979
mov rcx, qword [rbx + 0x128]
sub rbp, rax
lea r8, [rbp + 1]
add rdx, rcx
call sym.memmove
jmp 0x14000e969
lea rax, [rsp + 0x68]
mov r13, qword [sym.imp.libcurl_4.dll_curl_easy_recv]
lea r14, [rsp + 0x60]
xor r12d, r12d
mov qword [rsp + 0x48], rax
vmovq xmm6, qword [0x1402b9228]
jmp 0x14000eb04
cmp qword [rsp + 0x60], 0
je 0x14000eb73
mov rdi, qword [rbx + 0x128]
mov rcx, rdi
call sym.strlen
mov rcx, rsi
mov r15, rax
call sym.strlen
lea rdx, [r15 + rax + 1]
cmp rdx, qword [rbx + 0x120]
jae 0x14000eb90
lea rcx, [rdi + r15]
mov rdx, rsi
call sym.strcpy
xor ecx, ecx
call rbp
sub rax, qword [rsp + 0x58]
cmp rax, 0x3b
jg 0x14000ebc0
mov rdi, qword [rbx + 0x128]
mov edx, 0xa
mov rcx, rdi
call sym.strchr
test rax, rax
jne 0x14000e91c
mov ecx, 0x100
mov rdi, rsi
mov rax, r12
mov r9, r14
rep stosq qword [rdi], rax
mov r8d, 0x7fc
mov rcx, qword [rbx + 8]
mov rdx, rsi
call r13
test eax, eax
je 0x14000ea90
cmp eax, 0x51
jne 0x14000eb73
mov rax, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rbx + 0x118]
mov dword [rsp + 0x70], 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rcx
add ecx, 1
vmovq qword [rsp + 0x68], xmm6
call rax
test eax, eax
jg 0x14000ead4
lea rdx, str.stratum_recv_line_failed
mov ecx, 2
xor esi, esi
call sym.applog
jmp 0x14000e979
and rdx, 0xfffffffffffff800
mov rcx, rdi
add rdx, 0x800
mov qword [rbx + 0x120], rdx
call sym.realloc
mov qword [rbx + 0x128], rax
mov rdi, rax
jmp 0x14000eac8
mov rdi, qword [rbx + 0x128]
jmp 0x14000e91c
lea rdx, str.stratum_recv_line_failed_to_parse_a_newline_terminated_string
mov ecx, 1
xor esi, esi
call sym.applog.constprop.1
jmp 0x14000e979
Function at 0x140015b60
Capabilities:
Hash data using sha512

Disassembly:
push rdi
mov r8, rcx
test rdx, rdx
je 0x140015cf3
test rcx, rcx
je 0x140015cf3
lea rdi, [rcx + 0x48]
mov eax, ecx
mov qword [rcx + 0x40], 0
movabs r9, 0x6a09e667f3bcc908
mov qword [rcx + 0xe8], 0
and rdi, 0xfffffffffffffff8
movabs r10, 0xbb67ae8584caa73b
sub eax, edi
lea ecx, [rax + 0xf0]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
mov qword [r8], r9
mov rax, rdx
movabs r9, 0x3c6ef372fe94f82b
mov qword [r8 + 8], r10
not rax
movabs r10, 0xa54ff53a5f1d36f1
mov qword [r8 + 0x10], r9
add rax, r8
movabs r9, 0x510e527fade682d1
mov qword [r8 + 0x18], r10
movabs r10, 0x9b05688c2b3e6c1f
mov qword [r8 + 0x20], r9
movabs r9, 0x1f83d9abfb41bd6b
mov qword [r8 + 0x28], r10
movabs r10, 0x5be0cd19137e2179
mov qword [r8 + 0x30], r9
mov qword [r8 + 0x38], r10
cmp rax, 0x1e
jbe 0x140015c60
vmovdqu ymm0, ymmword [0x1402ba640]
vpxor ymm0, ymm0, ymmword [rdx]
vmovdqu ymmword [r8], ymm0
vmovdqu ymm0, ymmword [0x1402ba660]
vpxor ymm0, ymm0, ymmword [rdx + 0x20]
vmovdqu ymmword [r8 + 0x20], ymm0
vzeroupper
movzx eax, byte [rdx]
mov dword [r8 + 0xe4], eax
xor eax, eax
pop rdi
ret
movabs rax, 0x6a09e667f3bcc908
xor rax, qword [rdx]
mov qword [r8], rax
movabs rax, 0xbb67ae8584caa73b
xor rax, qword [rdx + 8]
mov qword [r8 + 8], rax
movabs rax, 0x3c6ef372fe94f82b
xor rax, qword [rdx + 0x10]
mov qword [r8 + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
xor rax, qword [rdx + 0x18]
mov qword [r8 + 0x18], rax
movabs rax, 0x510e527fade682d1
xor rax, qword [rdx + 0x20]
mov qword [r8 + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
xor rax, qword [rdx + 0x28]
mov qword [r8 + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
xor rax, qword [rdx + 0x30]
mov qword [r8 + 0x30], rax
movabs rax, 0x5be0cd19137e2179
xor rax, qword [rdx + 0x38]
mov qword [r8 + 0x38], rax
jmp 0x140015c48
mov eax, 0xffffffff
pop rdi
ret

Function at 0x140015d00
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rbx
sub rsp, 0x68
mov rbx, rcx
test rcx, rcx
je 0x140015df7
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x140015dd4
lea rdi, [rcx + 0x48]
mov eax, ecx
mov qword [rsp + 0x32], 0
movabs r8, 0x510e527fade682d1
and rdi, 0xfffffffffffffff8
mov byte [rsp + 0x31], 0
movabs r9, 0x9b05688c2b3e6c1f
movabs r10, 0x1f83d9abfb41bd6b
sub eax, edi
mov byte [rsp + 0x20], dl
movabs r11, 0x5be0cd19137e2179
vmovdqu ymm0, ymmword [0x1402ba640]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x29], 0
mov qword [rsp + 0x21], 0x10100
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xe8], 0
lea ecx, [rax + 0xf0]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
mov qword [rbx + 0x20], r8
mov qword [rbx + 0x28], r9
mov qword [rbx + 0x30], r10
mov qword [rbx + 0x38], r11
vpxor ymm0, ymm0, ymmword [rsp + 0x20]
mov dword [rbx + 0xe4], edx
vmovdqu ymmword [rbx], ymm0
vzeroupper
add rsp, 0x68
pop rbx
pop rdi
ret
mov edx, 0xf0
call sym.clear_internal_memory
cmp byte [rbx + 0xe8], 0
je 0x140015def
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x140015dcd
Function at 0x140016070
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xe0
mov r10, r8
mov rbx, rcx
mov r8, r9
test rcx, rcx
je 0x1400161c8
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x1400161a2
lea rax, [r9 - 1]
cmp rax, 0x3f
ja 0x1400161a2
test r10, r10
je 0x1400161a2
lea rdi, [rcx + 0x48]
mov byte [rsp + 0x21], r9b
xor eax, eax
movabs rsi, 0x510e527fade682d1
and rdi, 0xfffffffffffffff8
mov byte [rsp + 0x20], dl
vmovdqu ymm0, ymmword [0x1402ba640]
mov qword [rsp + 0x32], 0
mov qword [rsp + 0x2a], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x22], 0x101
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xe8], 0
sub ecx, edi
add ecx, 0xf0
shr ecx, 3
rep stosq qword [rdi], rax
mov qword [rbx + 0x20], rsi
mov ecx, 0x10
movabs rdi, 0x9b05688c2b3e6c1f
movabs rsi, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x28], rdi
movabs rdi, 0x5be0cd19137e2179
mov qword [rbx + 0x30], rsi
lea rsi, [rsp + 0x60]
mov qword [rbx + 0x38], rdi
mov rdi, rsi
vpxor ymm0, ymm0, ymmword [rsp + 0x20]
rep stosq qword [rdi], rax
mov dword [rbx + 0xe4], edx
mov rcx, rsi
mov rdx, r10
vmovdqu ymmword [rbx], ymm0
vzeroupper
call sym.memcpy
mov rdx, rsi
mov rcx, rbx
mov r8d, pe_nt_image_headers64
call sym.blake2b_update
mov edx, pe_nt_image_headers64
mov rcx, rsi
call sym.clear_internal_memory
xor eax, eax
add rsp, 0xe0
pop rbx
pop rsi
pop rdi
ret
mov edx, 0xf0
mov rcx, rbx
call sym.clear_internal_memory
cmp byte [rbx + 0xe8], 0
je 0x1400161c0
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x140016197

Function at 0x140018f30
Capabilities:
Encode data using xor

Disassembly:
lea r8, [rdx + 8]
mov rax, rcx
sub rax, r8
cmp rax, 0x10
mov eax, 0
jbe 0x140018f70
nop dword [rax]
vmovdqu ymm1, ymmword [rcx + rax]
vpxor ymm0, ymm1, ymmword [rdx + rax]
vmovdqu ymmword [rcx + rax], ymm0
add rax, 0x20
cmp rax, 0x400
jne 0x140018f48
vzeroupper
ret
mov r8, qword [rdx + rax]
xor qword [rcx + rax], r8
add rax, 8
cmp rax, 0x400
jne 0x140018f70
jmp 0x140018f66

Function at 0x14001b140
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r9, r8
test rcx, rcx
je 0x14001b188
test rdx, rdx
je 0x14001b188
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
cmp rax, 1
mov qword [rbx], rax
sbb eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xffffffff
jmp 0x14001b17c
Function at 0x140042310
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rbx
sub rsp, 0x28
vpxor xmm0, xmm0, xmm0
movabs r10, 0x6a09e667f3bcc908
movabs r11, 0xbb67ae8584caa73b
mov qword [rcx + 0x80], r10
mov rsi, rdx
movabs r10, 0xa54ff53a5f1d36f1
mov rdx, r8
mov r8, r9
mov rbx, rcx
movabs r9, 0x3c6ef372fe94f82b
mov qword [rcx + 0x98], r10
mov qword [rcx + 0x90], r9
movabs r10, 0x9b05688c2b3e6c1f
movabs r9, 0x510e527fade682d1
mov qword [rcx + 0xa0], r9
movabs r9, 0x1f83d9abfb41bd6b
mov qword [rcx + 0xa8], r10
movabs r10, 0x5be0cd19137e2179
mov qword [rcx + 0x88], r11
mov qword [rcx + 0xb0], r9
mov qword [rcx + 0xb8], r10
mov qword [rcx + 0xd0], 0
vmovdqu xmmword [rcx + 0xc0], xmm0
call sym.blake512_update
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp sym.blake512_close
Function at 0x140055db0
Capabilities:
Hash data using sha256

Disassembly:
push rdi
vmovdqu ymm0, ymmword [0x1402baf80]
lea rdi, [rcx + 0x28]
mov eax, ecx
mov r8, rcx
mov qword [rcx + 0x20], 0
mov qword [rcx + 0xb8], 0
and rdi, 0xfffffffffffffff8
sub eax, edi
lea ecx, [rax + 0xc0]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
mov rax, rdx
vmovdqu ymmword [r8], ymm0
not rax
add rax, r8
cmp rax, 0x1e
jbe 0x140055e10
vpxor ymm0, ymm0, ymmword [rdx]
xor eax, eax
vmovdqu ymmword [r8], ymm0
vzeroupper
pop rdi
ret
mov eax, dword [rdx]
xor eax, 0x6a09e667
mov dword [r8], eax
mov eax, dword [rdx + 4]
xor eax, 0xbb67ae85
mov dword [r8 + 4], eax
mov eax, dword [rdx + 8]
xor eax, 0x3c6ef372
mov dword [r8 + 8], eax
mov eax, dword [rdx + 0xc]
xor eax, 0xa54ff53a
mov dword [r8 + 0xc], eax
mov eax, dword [rdx + 0x10]
xor eax, 0x510e527f
mov dword [r8 + 0x10], eax
mov eax, dword [rdx + 0x14]
xor eax, 0x9b05688c
mov dword [r8 + 0x14], eax
mov eax, dword [rdx + 0x18]
xor eax, 0x1f83d9ab
mov dword [r8 + 0x18], eax
mov eax, dword [rdx + 0x1c]
xor eax, 0x5be0cd19
mov dword [r8 + 0x1c], eax
xor eax, eax
vzeroupper
pop rdi
ret

Function at 0x140055e80
Capabilities:
Hash data using sha256

Disassembly:
push rdi
sub rsp, 0x20
lea eax, [rdx - 1]
mov r8, rcx
cmp al, 0x1f
ja 0x140055f0c
mov eax, 0x101
lea rdi, [rcx + 0x28]
mov byte [rsp], dl
vmovdqu ymm0, ymmword [0x1402baf80]
mov word [rsp + 2], ax
and rdi, 0xfffffffffffffff8
mov eax, ecx
sub eax, edi
mov byte [rsp + 1], 0
mov dword [rsp + 4], 0
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
mov qword [rcx + 0x20], 0
mov qword [rcx + 0xb8], 0
lea ecx, [rax + 0xc0]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
vpxor ymm0, ymm0, ymmword [rsp]
vmovdqu ymmword [r8], ymm0
vzeroupper
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffffff
jmp 0x140055f06
Function at 0x140056d00
Capabilities:
Hash data using sha256

Disassembly:
push rdi
push rbx
sub rsp, 0x88
lea eax, [rdx - 1]
mov r10, rcx
cmp al, 0x1f
ja 0x140056e9f
lea eax, [r9 - 1]
cmp al, 7
ja 0x140056e9f
test r8, r8
je 0x140056e9f
mov rax, qword [0x1402bafb0]
lea rdi, [rcx + 0x28]
mov byte [rsp + 0x20], dl
lea rbx, [rsp + 0x40]
and rdi, 0xfffffffffffffff8
mov byte [rsp + 0x21], r9b
vmovdqu ymm0, ymmword [0x1402baf80]
movzx r9d, r9b
mov qword [rsp + 0x22], rax
mov eax, ecx
sub eax, edi
mov word [rsp + 0x2e], 0
mov dword [rsp + 0x2a], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rcx + 0x20], 0
mov qword [rcx + 0xb8], 0
lea ecx, [rax + 0xc0]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
mov rcx, rbx
mov rax, r8
vpxor ymm0, ymm0, ymmword [rsp + 0x20]
vmovdqu ymmword [r10], ymm0
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rsp + 0x40], xmm0
vmovdqu xmmword [rsp + 0x50], xmm0
vmovdqu xmmword [rsp + 0x60], xmm0
vmovdqu xmmword [rsp + 0x70], xmm0
cmp r9d, 8
jae 0x140056e78
xor edx, edx
test r9b, 4
jne 0x140056e60
test r9b, 2
jne 0x140056e48
and r9d, 1
jne 0x140056e38
mov r8d, 0x40
mov rdx, rbx
mov rcx, r10
vzeroupper
call sym.blake2s_update
mov rax, rbx
nop word cs:[rax + rax]
mov rdx, rax
lea rdi, [rsp + 0x80]
add rax, 1
mov byte [rdx], 0
cmp rax, rdi
jne 0x140056e10
xor eax, eax
add rsp, 0x88
pop rbx
pop rdi
ret
movzx eax, byte [rax + rdx]
mov byte [rcx + rdx], al
jmp 0x140056def
movzx r8d, word [rax + rdx]
mov word [rcx + rdx], r8w
add rdx, 2
and r9d, 1
je 0x140056def
jmp 0x140056e38
mov edx, dword [rax]
mov dword [rcx], edx
mov edx, 4
test r9b, 2
je 0x140056de9
jmp 0x140056e48
mov r11d, r9d
xor eax, eax
and r11d, 0xfffffff8
mov edx, eax
add eax, 8
mov rcx, qword [r8 + rdx]
mov qword [rbx + rdx], rcx
cmp eax, r11d
jb 0x140056e81
lea rcx, [rbx + rax]
add rax, r8
jmp 0x140056dd7
mov eax, 0xffffffff
jmp 0x140056e29
Function at 0x14008da60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl rdx, 3
jmp sym.groestl

Function at 0x14008da70
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash
Function at 0x14008e460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl rdx, 3
jmp sym.groestl

Function at 0x14008e470
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash
Function at 0x14008ee60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl rdx, 3
jmp sym.groestl

Function at 0x14008ee70
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash
Function at 0x14008f860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl rdx, 3
jmp sym.groestl

Function at 0x14008f870
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash
Function at 0x140090290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl rdx, 3
jmp sym.groestl

Function at 0x1400902a0
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash
Function at 0x140090c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl rdx, 3
jmp sym.groestl

Function at 0x140090ca0
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash

Function at 0x140091750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl rdx, 3
jmp sym.groestl

Function at 0x140091760
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash
Function at 0x140092150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl rdx, 3
jmp sym.groestl

Function at 0x140092160
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash
Function at 0x140092b50
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
test rcx, rcx
je 0x140092deb
mov rax, qword [rcx]
test rax, rax
je 0x140092dda
mov rdx, qword [rax]
shr rdx, 2
mov qword [rax + 0x28], rdx
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x28]
add rax, 7
mov qword [rdx + 0x20], rax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
shl rax, 4
mov qword [rdx + 0x10], rax
mov rbx, qword [rcx]
mov edx, 1
mov rcx, qword [rbx + 0x10]
call sym.calloc
mov qword [rbx + 0x18], rax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x140092de1
mov rdx, qword [rax + 8]
mov r8, qword [rax]
call sym.memcpy
mov rax, qword [rsi]
mov rdi, qword [rax + 0x20]
mov rcx, qword [rax + 0x28]
lea rdx, [rdi*4]
cmp rcx, rdx
jae 0x140092d60
lea r8, [rcx*4 - 4]
mov r9, rcx
lea rbp, [0x1402befe0]
lea r12, [0x1402bf0e0]
jmp 0x140092cb3
mov r13d, ebx
mov r14d, ebx
movzx eax, bh
shr r13d, 0x10
shr r14d, 0x18
mov r11d, eax
mov r15d, r13d
mov eax, r14d
cmp r9, 6
jbe 0x140092c3a
cmp rdx, 4
je 0x140092d78
mov rdx, rcx
mov rbx, rcx
sub rdx, r9
xor r10b, byte [rdi + rdx*4]
mov byte [rdi + rcx*4], r10b
mov r9, qword [rsi]
mov rdi, rcx
mov rdx, qword [r9 + 0x18]
sub rdi, qword [r9 + 0x28]
xor r11b, byte [rdx + rdi*4 + 1]
mov rdi, rcx
add rcx, 1
mov byte [rdx + r8 + 5], r11b
mov r9, qword [rsi]
mov rdx, qword [r9 + 0x18]
sub rbx, qword [r9 + 0x28]
xor r15b, byte [rdx + rbx*4 + 2]
mov byte [rdx + r8 + 6], r15b
mov r9, qword [rsi]
mov rdx, qword [r9 + 0x18]
sub rdi, qword [r9 + 0x28]
xor al, byte [rdx + rdi*4 + 3]
mov byte [rdx + r8 + 7], al
mov rax, qword [rsi]
add r8, 4
mov rbx, qword [rax + 0x20]
lea rdx, [rbx*4]
cmp rcx, rdx
jae 0x140092d60
mov r9, qword [rax + 0x28]
mov rdi, qword [rax + 0x18]
xor edx, edx
mov rax, rcx
div r9
mov ebx, dword [rdi + r8]
mov dword [rsp + 0x28], ebx
mov r10d, ebx
mov r13, rax
test rdx, rdx
jne 0x140092c10
movzx eax, word [rsp + 0x29]
mov byte [rsp + 0x2f], bl
mov word [rsp + 0x2c], ax
movzx eax, byte [rsp + 0x2b]
mov byte [rsp + 0x2e], al
mov edx, dword [rsp + 0x2c]
movzx eax, dh
mov r10, rax
and eax, 0xf0
and r10d, 0xf
add rax, rbp
movzx r11d, byte [rax + r10]
mov eax, edx
shr eax, 0x10
mov r10d, eax
and eax, 0xf0
and r10d, 0xf
add rax, rbp
movzx r15d, byte [rax + r10]
mov eax, edx
shr eax, 0x18
mov r10d, eax
and eax, 0xf0
and r10d, 0xf
add rax, rbp
movzx eax, byte [rax + r10]
mov r10d, edx
and edx, 0xf0
and r10d, 0xf
add rdx, rbp
movzx r10d, byte [rdx + r10]
xor r10b, byte [r12 + r13 - 1]
jmp 0x140092c3a
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [0x1402befe0]
mov r10d, ebx
and ebx, 0xf0
lea rax, [rdx + rbx]
and r10d, 0xf
mov rbx, r11
and r11d, 0xf0
and ebx, 0xf
movzx r10d, byte [rax + r10]
lea rax, [rdx + r11]
movzx r11d, byte [rax + rbx]
mov ebx, r13d
and r13d, 0xf0
lea rax, [rdx + r13]
and ebx, 0xf
movzx r15d, byte [rax + rbx]
mov eax, r14d
and r14d, 0xf0
and eax, 0xf
add rdx, r14
movzx eax, byte [rdx + rax]
jmp 0x140092c3a
mov eax, 7
jmp 0x140092d62
mov eax, 8
jmp 0x140092d62
mov eax, 2
jmp 0x140092d62
Function at 0x140095e60
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
test rcx, rcx
je 0x140095e6f
test rdx, rdx
je 0x140095e75
jmp sym.oaes_encryption_round.part.0
mov eax, 2
ret
mov eax, 3
ret
Function at 0x1400bdf80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.fugue4_close
Function at 0x140109cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval3_close

Function at 0x140109d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval4_close

Function at 0x140109d80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval5_close

Function at 0x140109de0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval3_close

Function at 0x140109e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval4_close

Function at 0x140109ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval5_close

Function at 0x140109f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval3_close

Function at 0x140109f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval4_close

Function at 0x140109fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval5_close

Function at 0x14010a020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval3_close

Function at 0x14010a080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval4_close

Function at 0x14010a0e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval5_close

Function at 0x14010a140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval3_close

Function at 0x14010a1a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval4_close

Function at 0x14010a200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.haval5_close

Function at 0x140138e60
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0x48
jmp sym.keccak_core