joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c480
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
mov dword [rsp + 0x44], r9d
mov r12, rdx
mov ebp, r8d
xor edx, edx
mov r10d, r9d
mov r9, qword [rsp + 0x150]
mov r8d, edx
movzx eax, byte [rsi + 0x325]
mov r14d, edx
movzx r15d, byte [rsi + 0x329]
mov ecx, edx
mov qword [rsp + 0x48], r9
cmp al, 1
jne 0x14001c674
movzx r9d, word [rsi + 0x448]
bt r9w, 0xe
jae 0x14001c4fd
movzx r8d, word [rsi + 0x320]
mov eax, r8d
mov rcx, rbp
sub rcx, rax
mov dword [rsp + 0x40], 1
bt r9w, 0xd
mov rdi, rbp
movzx r14d, byte [rcx + r12 - 1]
mov ecx, r14d
mov r13d, r14d
jae 0x14001c601
sub ebp, r8d
mov eax, 0xff
movsxd r8, ebp
dec r8
add r8, r12
lea ecx, [rbp - 1]
movzx r10d, byte [r8]
mov edi, r10d
sub edi, ebp
add edi, r15d
shr edi, 0x1f
dec dil
cmp ecx, eax
cmovg ecx, eax
movsxd r9, ecx
test ecx, ecx
jle 0x14001c583
nop dword [rax + rax]
mov ecx, r10d
lea r8, [r8 - 1]
sub ecx, edx
movzx eax, r10b
xor al, byte [r8 + 1]
inc edx
shr ecx, 0x1f
dec cl
and cl, al
or dil, cl
sub r9, 1
jne 0x14001c560
mov eax, dword [rsp + 0x44]
lea rdx, [rsp + 0x90]
mov r9d, ebp
mov dword [rsp + 0x30], 1
sub r9d, r15d
mov dword [rsp + 0x28], eax
sub r9d, r14d
mov dword [rsp + 0x20], r14d
dec r9d
mov r8, r12
mov rcx, rsi
call qword [rsi + 0xf0]
movzx r8d, byte [rsi + 0x329]
lea r9, [rsp + 0x90]
mov edx, ebp
mov rcx, r12
mov ebx, eax
call fcn.14001bf50
or al, dil
not al
movzx ecx, al
shr cl, 4
and al, cl
movzx ecx, al
mov edx, ecx
shr edx, 2
and edx, ecx
mov eax, edx
shr eax, 1
and eax, edx
dec eax
add eax, ebx
je 0x14001c66e
mov eax, 0xfffffecf
jmp 0x14001c6f2
sub ebp, r15d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
mov r8, r12
lea eax, [rbp - 1]
cmp r14d, eax
mov dword [rsp + 0x44], eax
cmova r14d, edx
cmp r13d, eax
cmovbe edx, ecx
mov rcx, rsi
sub ebp, edx
mov ebx, edx
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], ebx
lea r9d, [rbp - 1]
call qword [rsi + 0xf0]
sub rdi, rbx
lea rdx, [r12 - 1]
sub rdi, r15
lea rcx, [rsp + 0x50]
add rdx, rdi
mov r8d, r15d
mov ebp, eax
call fcn.140017540
test eax, eax
jne 0x14001c5f7
test ebp, ebp
jne 0x14001c5f7
cmp r13d, dword [rsp + 0x44]
ja 0x14001c5f7
mov ecx, dword [rsp + 0x40]
jmp 0x14001c6cf
test al, al
jne 0x14001c6d4
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
lea rdx, [rsp + 0x50]
sub r9d, r15d
mov dword [rsp + 0x20], 0xffffffff
mov r8, r12
mov rcx, rsi
call qword [rsi + 0xf0]
mov rdx, rbp
lea rcx, [rsp + 0x50]
sub rdx, r15
mov r8d, r15d
add rdx, r12
mov ebx, eax
call fcn.140017540
test eax, eax
jne 0x14001c5f7
test ebx, ebx
jne 0x14001c5f7
mov ecx, r14d
mov r9, qword [rsp + 0x48]
cmp byte [rsi + 0x325], 2
jne 0x14001c6e6
movzx eax, word [rsi + 0x322]
jmp 0x14001c6ed
lea eax, [r15 + rcx]
add eax, r14d
mov dword [r9], eax
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140095720
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140022ca0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140022dfe
test rdx, rdx
je 0x140022dfe
call fcn.140022730
test eax, eax
jne 0x140022e03
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0x18], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002f960
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, rdx
mov r14, r9
mov edx, dword [rbp + 0x100]
mov rdi, rcx
sub edx, 4
je 0x14002faa8
cmp edx, 1
je 0x14002f9ae
mov eax, 0xffffff18
jmp 0x14002fb50
movdqa xmm0, xmmword [0x1400e3f40]
xor ebx, ebx
mov rax, qword [rcx + 0xa8]
xor r8d, r8d
movdqa xmm1, xmmword [0x1400e3fa0]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x1c0], r12
xor edx, edx
movdqa xmmword [rbp - 0x50], xmm0
movabs r12, 0x629a292a367cd507
movdqa xmm0, xmmword [0x1400e3f70]
mov qword [rsp + 0x1d0], r15
movabs r15, 0xcbbb9d5dc1059ed8
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp + 0x78], rax
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r12
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
call fcn.14000da00
test eax, eax
jne 0x14002fa8e
lea rcx, [rbp - 0x60]
call fcn.14000e450
test eax, eax
jne 0x14002fa8e
movaps xmm0, xmmword [rbp - 0x60]
mov eax, ebx
movaps xmm1, xmmword [rbp - 0x50]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1400e3f40]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1400e3f70]
movaps xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x1400e3fa0]
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r12
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
mov r15, qword [rsp + 0x1d0]
mov edx, 0x30
mov r12, qword [rsp + 0x1c0]
lea ecx, [rdx - 0x29]
jmp 0x14002fb08
mov rax, qword [rcx + 0xa8]
lea rdx, [rsp + 0x60]
xor ebx, ebx
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x60]
mov qword [rbp], rbx
mov dword [rbp + 8], ebx
mov dword [rbp - 0x60], 0x6a09e667
mov dword [rbp - 0x5c], 0xbb67ae85
mov dword [rbp - 0x58], 0x3c6ef372
mov dword [rbp - 0x54], 0xa54ff53a
mov dword [rbp - 0x50], 0x510e527f
mov dword [rbp - 0x4c], 0x9b05688c
mov dword [rbp - 0x48], 0x1f83d9ab
mov dword [rbp - 0x44], 0x5be0cd19
call fcn.140022ca0
lea edx, [rbx + 0x20]
lea ecx, [rbx + 6]
test eax, eax
jne 0x14002fb50
cmp byte [rdi + 0x319], 4
je 0x14002fb1c
mov eax, 0xfffffeba
jmp 0x14002fb50
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], edx
mov r9d, edx
mov qword [rsp + 0x40], rax
mov r8, r14
lea rax, str.derived
mov dword [rsp + 0x38], 7
mov rcx, rsi
mov qword [rsp + 0x30], rax
call fcn.14002f850
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140095720
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140030e50
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rbp], rax
mov r9, rdx
mov rdi, rcx
mov edx, dword [rbp + 0x50]
mov ecx, 0xffffff53
sub edx, 4
je 0x140031020
sub edx, 1
je 0x140030f60
cmp edx, 1
jne 0x1400310a4
movdqa xmm0, xmmword [0x1400e3fc0]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400e3fb0]
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x20], rax
movabs rax, 0xbb67ae8584caa73b
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x1400e3f80]
mov qword [rsp + 0x28], rax
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rbp - 8], rbx
movdqa xmmword [rsp + 0x40], xmm1
mov dword [rbp - 0x20], ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
test r9, r9
jne 0x140030efa
test r8d, r8d
jne 0x140030f56
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14000da00
mov ecx, eax
test eax, eax
jne 0x140030f56
test rdi, rdi
je 0x140030f51
lea rcx, [rsp + 0x20]
call fcn.14000e450
mov ecx, eax
test eax, eax
jne 0x140030f56
movaps xmm0, xmmword [rsp + 0x20]
mov ecx, ebx
movaps xmm1, xmmword [rsp + 0x30]
mov eax, 0x40
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm1
jmp 0x1400310a0
mov ecx, 0xffffff53
mov eax, 0x40
jmp 0x1400310a0
movdqa xmm0, xmmword [0x1400e3f40]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400e3fa0]
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rsp + 0x20], rax
movabs rax, 0x629a292a367cd507
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x1400e3f70]
mov qword [rsp + 0x28], rax
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rbp - 8], rbx
movdqa xmmword [rsp + 0x40], xmm1
mov dword [rbp - 0x20], ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
test r9, r9
jne 0x140030fc3
test r8d, r8d
jne 0x140031016
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14000da00
mov ecx, eax
test eax, eax
jne 0x140031016
test rdi, rdi
je 0x140031011
lea rcx, [rsp + 0x20]
call fcn.14000e450
mov ecx, eax
test eax, eax
jne 0x140031016
movaps xmm0, xmmword [rsp + 0x20]
mov ecx, ebx
movaps xmm1, xmmword [rsp + 0x30]
mov eax, 0x30
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi + 0x20], xmm0
jmp 0x1400310a0
mov ecx, 0xffffff53
mov eax, 0x30
jmp 0x1400310a0
xor ebx, ebx
mov dword [rsp + 0x20], 0x6a09e667
mov qword [rbp - 0x70], rbx
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [rbp - 0x80], rbx
mov dword [rbp - 0x78], ebx
test r9, r9
jne 0x140031079
test r8d, r8d
je 0x14003108c
jmp 0x14003109b
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140022230
mov ecx, eax
test eax, eax
jne 0x14003109b
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140022ca0
mov ecx, eax
mov eax, 0x20
test ecx, ecx
je 0x1400310a6
mov eax, ecx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140095720
add rsp, 0x110
pop rdi
pop rbx
pop rbp
ret
Function at 0x140034d00
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xf0
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rbp - 9], rax
mov r15, qword [rbp + 0x67]
mov eax, 0x1b8
mov r12, qword [rbp + 0x77]
mov ecx, eax
ror ecx, 8
mov r14d, 0x37
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
mov byte [rsp + 0x28], r9b
or ecx, eax
mov byte [rsp + 0x20], 1
mov dword [rsp + 0x30], ecx
lea r13d, [r14 - 0x35]
xor esi, esi
mov rdi, rdx
nop dword [rax]
mov r8d, 1
mov qword [rbp - 0x39], rsi
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x40], 0x6a09e667
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0xbb67ae85
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
mov qword [rbp - 0x49], rsi
mov dword [rbp - 0x41], esi
call fcn.140022230
mov ebx, eax
test eax, eax
jne 0x140034ea7
lea r8d, [rax + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140022230
mov ebx, eax
test eax, eax
jne 0x140034ea7
cmp byte [rsp + 0x28], 4
je 0x140034e1b
lea r8d, [rax + 1]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.140022230
mov ebx, eax
test eax, eax
jne 0x140034ea7
test r15, r15
jne 0x140034e2c
cmp dword [rbp + 0x6f], esi
jbe 0x140034e43
mov ebx, 0xffffff53
jmp 0x140034ea7
mov r8d, dword [rbp + 0x6f]
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.140022230
mov ebx, eax
test eax, eax
jne 0x140034ea7
test r12, r12
je 0x140034e65
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x140034e65
mov r8d, eax
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.140022230
mov ebx, eax
test eax, eax
jne 0x140034ea7
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x40]
call fcn.140022ca0
mov ebx, eax
test eax, eax
jne 0x140034ea7
cmp r14d, 0x20
jbe 0x140034e98
movups xmm0, xmmword [rbp - 0x29]
add r14d, 0xffffffe0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
add rdi, 0x20
jmp 0x140034ea7
mov r8d, r14d
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.140097850
inc byte [rsp + 0x20]
sub r13, 1
jne 0x140034d70
mov ecx, 0x20
lea rdx, [rbp - 0x29]
nop
mov byte [rdx], sil
lea rdx, [rdx + 1]
add ecx, 0xffffffff
jne 0x140034ec0
test ebx, ebx
setne sil
mov eax, esi
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140095720
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140035020
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rbp + 8], rax
movups xmm0, xmmword [r9]
test r8d, r8d
mov esi, 0
movups xmm1, xmmword [r9 + 0x10]
mov r14, rcx
mov r12d, 1
mov ecx, esi
mov edi, r12d
cmovne edi, r8d
lea ebx, [rsi + 0x37]
test dil, 0x1f
mov eax, edi
movups xmmword [rbp - 0x30], xmm0
setne cl
shr eax, 5
movups xmm0, xmmword [r9 + 0x20]
add ecx, eax
mov r15, rdx
mov eax, dword [r9 + 0x30]
mov r13d, esi
mov dword [rbp], eax
movzx eax, word [r9 + 0x34]
mov word [rbp + 4], ax
movzx eax, byte [r9 + 0x36]
mov byte [rbp + 6], al
mov dword [rsp + 0x20], ecx
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm0
je 0x1400351f3
mov r8d, ebx
mov qword [rbp - 0x40], rsi
lea rdx, [rbp - 0x30]
mov dword [rsp + 0x50], 0x6a09e667
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x54], 0xbb67ae85
mov dword [rsp + 0x58], 0x3c6ef372
mov dword [rsp + 0x5c], 0xa54ff53a
mov dword [rsp + 0x60], 0x510e527f
mov dword [rsp + 0x64], 0x9b05688c
mov dword [rsp + 0x68], 0x1f83d9ab
mov dword [rsp + 0x6c], 0x5be0cd19
mov qword [rbp - 0x50], rsi
mov dword [rbp - 0x48], esi
call fcn.140022230
mov r12d, eax
test eax, eax
jne 0x1400351e5
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140022ca0
mov r12d, eax
test eax, eax
jne 0x1400351e5
cmp dword [r14], 1
mov eax, dword [rsp + 0x28]
jbe 0x140035165
cmp eax, dword [r14 + 4]
jne 0x140035165
cmp byte [r14 + 0x76], 1
je 0x140035235
mov edx, dword [rsp + 0x20]
mov cl, 1
cmp r13d, edx
lea eax, [rdx + 1]
cmovne eax, edx
mov dword [rsp + 0x20], eax
jmp 0x14003516b
mov dword [r14 + 4], eax
xor cl, cl
mov byte [r14 + 0x76], cl
test r15, r15
je 0x1400351e5
test edi, edi
je 0x1400351e5
cmp edi, 0x20
jb 0x1400351d3
movups xmm0, xmmword [rsp + 0x28]
add edi, 0xffffffe0
lea rcx, [rbp + 4]
movups xmm1, xmmword [rsp + 0x38]
mov edx, 0x36
lea rax, [rbp + 4]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
add r15, 0x20
sub rdx, rcx
add byte [rax + 2], 1
jne 0x1400351e5
add byte [rax + 1], 1
jne 0x1400351e5
add byte [rax], 1
jne 0x1400351e5
add byte [rax - 1], 1
jne 0x1400351e5
add byte [rax - 2], 1
jne 0x1400351e5
sub rax, 5
lea rcx, [rdx + rax]
test rcx, rcx
jns 0x1400351a7
jmp 0x1400351e5
mov r8d, edi
lea rdx, [rsp + 0x28]
mov rcx, r15
call fcn.140097850
mov edi, esi
inc r13d
cmp r13d, dword [rsp + 0x20]
jl 0x1400350b4
lea rcx, [rbp - 0x30]
nop word [rax + rax]
mov byte [rcx], sil
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x140035200
test r12d, r12d
setne sil
mov eax, esi
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140095720
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 3
jmp 0x140035215
Function at 0x140035940
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
sub rsp, 0xa0
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
test rcx, rcx
jne 0x14003596a
mov eax, 0xffffff53
jmp 0x140035b45
mov qword [rcx + 8], r9
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rbp
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov byte [rcx + 0x18], bpl
xor ecx, ecx
call fcn.140035fe0
test eax, eax
jne 0x140035b2a
mov rax, qword [0x14036e0a0]
lea ecx, [rbp + 0x78]
mov qword [rsp + 0xc8], rdi
test rax, rax
je 0x1400359b2
call rax
jmp 0x1400359b7
call fcn.14009bf18
mov qword [rsi + 0x10], rax
mov edi, 0x34
test rax, rax
jne 0x1400359cd
lea ebx, [rax - 0x7d]
jmp 0x140035aef
mov ebx, 1
mov dword [rsp + 0x20], 0xf0000000
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140035acd
mov rcx, qword [rsi]
lea r8, [rsp + 0x40]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140035acd
mov rcx, qword [rsi]
xor edx, edx
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], r15
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r12d, 4
mov ebx, ebp
mov r14d, ebp
mov r8d, r12d
mov r15, rbp
lea r13d, [r12 - 1]
nop dword [rax]
mov eax, r8d
lea rdx, [rsp + 0x40]
add rax, r15
lea rcx, [rsp + 0x40]
add rdx, rax
add rcx, r15
call fcn.140017540
test eax, eax
mov r8d, edi
cmove ebx, r13d
add r14d, r12d
sub r8d, r14d
add r15, r12
cmp r8d, r12d
cmova r8d, r12d
cmp r14d, 0x30
jb 0x140035a50
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
test ebx, ebx
jne 0x140035acd
mov rcx, qword [rsi + 0x10]
lea r8d, [rbx + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x44]
call fcn.140035890
mov ebx, eax
test eax, eax
je 0x140035aef
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140035aeb
mov rax, qword [0x14036e090]
test rax, rax
je 0x140035ae6
call rax
jmp 0x140035aeb
call fcn.14009bf04
mov qword [rsi + 0x10], rbp
lea rax, [rsp + 0x40]
mov byte [rax], bpl
lea rax, [rax + 1]
add edi, 0xffffffff
jne 0x140035af4
mov rdi, qword [rsp + 0xc8]
test ebx, ebx
jne 0x140035b12
mov byte [rsi + 0x18], 1
jmp 0x140035b33
cmp ebx, 3
je 0x140035b2a
cmp ebx, 1
mov byte [rsi + 0x18], 2
mov eax, 0xffffff39
cmove ebx, eax
mov ebp, ebx
jmp 0x140035b33
mov byte [rsi + 0x18], 3
mov ebp, 0xffffff2f
mov rbx, qword [rsp + 0xb8]
mov eax, ebp
mov rbp, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140095720
add rsp, 0xa0
pop rsi
ret
Function at 0x140035b60
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push r12
push r13
sub rsp, 0x90
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], r8d
mov rsi, rcx
mov qword [rsp + 0x38], rdx
test rcx, rcx
je 0x140035d27
test rdx, rdx
je 0x140035d27
cmp r8d, 0x10000
ja 0x140035d27
cmp byte [rcx + 0x18], 1
je 0x140035bb8
mov eax, 0xffffff39
jmp 0x140035d2c
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
call fcn.140035240
xor ebp, ebp
mov edi, eax
cmp eax, 2
jne 0x140035cf6
mov edi, 1
mov ecx, edi
call fcn.140035fe0
test eax, eax
jne 0x140035cff
mov r9d, edi
mov qword [rsp + 0xc8], rbx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea ebx, [rbp + 0x24]
test eax, eax
je 0x140035cdd
mov rcx, qword [rsi]
lea r8, [rsp + 0x40]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140035cdd
mov rcx, qword [rsi]
xor edx, edx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r15
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8d, 4
lea r13d, [rbp + 3]
mov r12d, r8d
mov edi, ebp
mov r14d, ebp
mov r15d, ebp
mov eax, r8d
lea rdx, [rsp + 0x40]
add rax, r15
lea rcx, [rsp + 0x40]
add rdx, rax
add rcx, r15
call fcn.140017540
test eax, eax
mov r8d, ebx
cmove edi, r13d
add r14d, r12d
sub r8d, r14d
add r15, r12
cmp r8d, r12d
cmova r8d, r12d
cmp r14d, 0x20
jb 0x140035c60
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x30]
test edi, edi
jne 0x140035cdd
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x44]
mov r8d, 0x20
call fcn.140034f00
mov edi, eax
test eax, eax
jne 0x140035cdd
mov rcx, qword [rsi + 0x10]
mov r8d, r13d
mov rdx, r12
call fcn.140035240
mov edi, eax
lea rax, [rsp + 0x40]
mov byte [rax], bpl
lea rax, [rax + 1]
add ebx, 0xffffffff
jne 0x140035ce2
mov rbx, qword [rsp + 0xc8]
test edi, edi
je 0x140035d13
cmp edi, 3
jne 0x140035d0a
mov ebp, 0xffffff2f
mov byte [rsi + 0x18], 3
jmp 0x140035d13
mov ebp, 0xffffff39
mov byte [rsi + 0x18], 2
mov rdi, qword [rsp + 0x80]
mov eax, ebp
mov rbp, qword [rsp + 0x88]
jmp 0x140035d2c
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140095720
add rsp, 0x90
pop r13
pop r12
pop rsi
ret
Function at 0x14003fed0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, r8d
mov r9, rdx
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x14003ffc3
shr r8d, 3
xor eax, eax
test r8d, r8d
je 0x1400400d1
cmp r8d, 8
jb 0x14003ffa0
lea ecx, [r8 - 1]
lea r11, [r10 + rcx*8]
lea rcx, [rdx + rcx*8]
cmp r10, rcx
ja 0x14003ff1a
cmp r11, rdx
jae 0x14003ffa0
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
nop word [rax + rax]
movdqu xmm0, xmmword [r10 + rax*8]
lea ecx, [rbx - 2]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rax*8], xmm1
add eax, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
mov ecx, ebx
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
lea ecx, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
cmp eax, r11d
jb 0x14003ff30
cmp eax, r8d
jae 0x1400400d1
sub r9, r10
lea rdx, [r10 + rax*8]
sub r8d, eax
mov ecx, r8d
nop dword [rax]
mov rax, qword [r9 + rdx]
xor qword [rdx], rax
lea rdx, [rdx + 8]
sub rcx, 1
jne 0x14003ffb0
pop rbx
ret
xor eax, eax
test r8d, r8d
je 0x1400400d1
cmp r8d, 8
jb 0x1400400b2
lea ecx, [r8 - 1]
lea r11, [rcx + r10]
add rcx, rdx
cmp r10, rcx
ja 0x14003fff1
cmp r11, r9
jae 0x1400400b2
cmp r8d, 0x40
jb 0x140040085
mov qword [rsp + 0x10], rdi
mov ebx, r8d
and ebx, 0x3f
mov edi, r8d
sub edi, ebx
mov r11d, 0x20
movdqu xmm0, xmmword [rax + r10]
lea ecx, [r11 - 0x10]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + r10], xmm1
add eax, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
mov ecx, r11d
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
lea ecx, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
cmp eax, edi
jb 0x140040011
mov rdi, qword [rsp + 0x10]
cmp ebx, 8
jb 0x1400400ad
mov edx, r8d
and edx, 0xfffffff8
nop dword [rax + rax]
movq xmm0, qword [rax + r10]
movq xmm1, qword [rax + r9]
pxor xmm1, xmm0
movq qword [rax + r10], xmm1
add eax, 8
cmp eax, edx
jb 0x140040090
cmp eax, r8d
jae 0x1400400d1
mov edx, eax
sub r9, r10
add rdx, r10
sub r8d, eax
mov ecx, r8d
movzx eax, byte [rdx + r9]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x1400400c0
pop rbx
ret