joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f502ab0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rax, qword [0x6f7534a0]
mov r15, rcx
mov rdi, rdx
mov r12, r9
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
xor ecx, ecx
test r8d, r8d
sete dl
test r9, r9
sete al
or dl, al
jne 0x6f502c51
test rdi, rdi
je 0x6f502c51
mov eax, r8d
movzx ecx, byte [r15 + 0xf0]
sar eax, 0x1f
shr eax, 0x1c
lea ebp, [r8 + rax]
mov byte [rsp + 0x20], cl
and ebp, 0xf
sub ebp, eax
cmp cl, 1
je 0x6f502b24
xor eax, eax
test ebp, ebp
jne 0x6f502c53
mov rax, qword [r15 + 0xf1]
mov rdx, qword [r15 + 0xf9]
cmp r8d, 0xf
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
jle 0x6f502c75
sub r8d, 0x10
lea rbx, [rsp + 0x30]
mov r14, r12
shr r8d, 4
mov rsi, rdi
mov eax, r8d
mov dword [rsp + 0x24], r8d
mov rdx, rax
mov qword [rsp + 0x28], rax
shl rdx, 4
lea r13, [r12 + rdx + 0x10]
xor eax, eax
movzx edx, byte [rsi + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x6f502b74
mov r8, r14
mov edx, 0xe
mov r9, rbx
mov rcx, r15
add r14, 0x10
add rsi, 0x10
call dbg.AES_encrypt
mov rax, qword [r14 - 0x10]
mov rdx, qword [r14 - 8]
cmp r14, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
jne 0x6f502b72
mov r14, qword [rsp + 0x28]
mov eax, dword [rsp + 0x24]
add r14, 1
add eax, 1
shl r14, 4
shl eax, 4
add rdi, r14
cmp byte [rsp + 0x20], 0
je 0x6f502c53
test ebp, ebp
lea rbx, [rsp + 0x30]
je 0x6f502c00
lea r8d, [rbp - 1]
lea rbx, [rsp + 0x30]
xor edx, edx
add r8, 1
movzx ecx, byte [rdi + rdx]
xor byte [rbx + rdx], cl
add rdx, 1
cmp rdx, r8
jne 0x6f502bf0
movsxd rcx, ebp
mov r9d, 0xf
mov r8d, 0x10
lea rdx, [rbx + rcx]
lea rcx, [rbx + rcx + 1]
sub r9d, ebp
sub r8d, ebp
add rcx, r9
xor byte [rdx], r8b
add rdx, 1
cmp rcx, rdx
jne 0x6f502c21
movsxd rdx, eax
mov r9, rbx
mov rcx, r15
lea r8, [r12 + rdx]
mov edx, 0xe
mov dword [rsp + 0x20], eax
call dbg.AES_encrypt
mov eax, dword [rsp + 0x20]
add eax, 0x10
jmp 0x6f502c53
xor eax, eax
mov rcx, qword [0x6f7534a0]
mov rdi, qword [rsp + 0x48]
xor rdi, qword [rcx]
jne 0x6f502c7c
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x6f502bd1
call sym.__stack_chk_fail
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x6f502d30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [0x6f7534a0]
mov rdi, rcx
mov r15d, r8d
mov r12, r9
mov rsi, qword [rax]
mov qword [rsp + 0x38], rsi
xor esi, esi
test rdx, rdx
sete cl
test r8d, r8d
sete al
or cl, al
mov eax, 0
jne 0x6f502e52
test r9, r9
je 0x6f502e52
test r8b, 0xf
jne 0x6f502e52
movzx eax, byte [rdi + 0xf0]
lea rsi, [rdi + 0xf1]
mov r14, rdx
mov rbx, r9
mov byte [rsp + 0x27], al
lea eax, [r8 - 0x10]
lea r13, [rdx + rax + 0x10]
mov qword [rsp + 0x28], rax
nop dword [rax]
mov edx, 0xe
mov r9, r14
mov r8, rbx
mov rcx, rdi
mov rbp, r14
call dbg.AES_decrypt
xor edx, edx
nop dword [rax + rax]
movzx ecx, byte [rbx + rdx]
xor cl, byte [rsi + rdx]
mov byte [rbx + rdx], cl
add rdx, 1
cmp rdx, 0x10
jne 0x6f502dd0
add r14, 0x10
add rbx, 0x10
mov rsi, rbp
cmp r14, r13
jne 0x6f502db0
cmp byte [rsp + 0x27], 0
mov rax, qword [rsp + 0x28]
lea r11, [r12 + rax + 0xf]
mov eax, 1
je 0x6f502e4e
lea eax, [rcx - 1]
mov ebx, 0x10
cmp al, 0xf
setbe al
seta r9b
imul eax, ecx
movzx edi, al
sub ebx, edi
jmp 0x6f502e29
movzx ecx, byte [r11]
sub r11, 1
cmp ebx, edx
setl r8b
cmp al, cl
setne cl
and ecx, r8d
or r9d, ecx
sub edx, 1
jne 0x6f502e25
xor r9d, 1
sub r15d, edi
movzx eax, r9b
imul eax, r15d
mov rdi, qword [0x6f7534a0]
mov rsi, qword [rsp + 0x38]
xor rsi, qword [rdi]
jne 0x6f502e74
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.__stack_chk_fail
nop
nop word [rax + rax]
Function at 0x6f502f50
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rax, qword [0x6f7534a0]
mov r15, rcx
mov rdi, rdx
mov r12, r9
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
xor ecx, ecx
test r8d, r8d
sete dl
test r9, r9
sete al
or dl, al
jne 0x6f5030f1
test rdi, rdi
je 0x6f5030f1
mov eax, r8d
movzx ecx, byte [r15 + 0xb0]
sar eax, 0x1f
shr eax, 0x1c
lea ebp, [r8 + rax]
mov byte [rsp + 0x20], cl
and ebp, 0xf
sub ebp, eax
cmp cl, 1
je 0x6f502fc4
xor eax, eax
test ebp, ebp
jne 0x6f5030f3
mov rax, qword [r15 + 0xb1]
mov rdx, qword [r15 + 0xb9]
cmp r8d, 0xf
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
jle 0x6f503115
sub r8d, 0x10
lea rbx, [rsp + 0x30]
mov r14, r12
shr r8d, 4
mov rsi, rdi
mov eax, r8d
mov dword [rsp + 0x24], r8d
mov rdx, rax
mov qword [rsp + 0x28], rax
shl rdx, 4
lea r13, [r12 + rdx + 0x10]
xor eax, eax
movzx edx, byte [rsi + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x6f503014
mov r8, r14
mov edx, 0xa
mov r9, rbx
mov rcx, r15
add r14, 0x10
add rsi, 0x10
call dbg.AES_encrypt
mov rax, qword [r14 - 0x10]
mov rdx, qword [r14 - 8]
cmp r14, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
jne 0x6f503012
mov r14, qword [rsp + 0x28]
mov eax, dword [rsp + 0x24]
add r14, 1
add eax, 1
shl r14, 4
shl eax, 4
add rdi, r14
cmp byte [rsp + 0x20], 0
je 0x6f5030f3
test ebp, ebp
lea rbx, [rsp + 0x30]
je 0x6f5030a0
lea r8d, [rbp - 1]
lea rbx, [rsp + 0x30]
xor edx, edx
add r8, 1
movzx ecx, byte [rdi + rdx]
xor byte [rbx + rdx], cl
add rdx, 1
cmp rdx, r8
jne 0x6f503090
movsxd rcx, ebp
mov r9d, 0xf
mov r8d, 0x10
lea rdx, [rbx + rcx]
lea rcx, [rbx + rcx + 1]
sub r9d, ebp
sub r8d, ebp
add rcx, r9
xor byte [rdx], r8b
add rdx, 1
cmp rcx, rdx
jne 0x6f5030c1
movsxd rdx, eax
mov r9, rbx
mov rcx, r15
lea r8, [r12 + rdx]
mov edx, 0xa
mov dword [rsp + 0x20], eax
call dbg.AES_encrypt
mov eax, dword [rsp + 0x20]
add eax, 0x10
jmp 0x6f5030f3
xor eax, eax
mov rcx, qword [0x6f7534a0]
mov rdi, qword [rsp + 0x48]
xor rdi, qword [rcx]
jne 0x6f50311c
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x6f503071
call sym.__stack_chk_fail
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x6f5031d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [0x6f7534a0]
mov rdi, rcx
mov r15d, r8d
mov r12, r9
mov rsi, qword [rax]
mov qword [rsp + 0x38], rsi
xor esi, esi
test rdx, rdx
sete cl
test r8d, r8d
sete al
or cl, al
mov eax, 0
jne 0x6f5032f2
test r9, r9
je 0x6f5032f2
test r8b, 0xf
jne 0x6f5032f2
movzx eax, byte [rdi + 0xb0]
lea rsi, [rdi + 0xb1]
mov r14, rdx
mov rbx, r9
mov byte [rsp + 0x27], al
lea eax, [r8 - 0x10]
lea r13, [rdx + rax + 0x10]
mov qword [rsp + 0x28], rax
nop dword [rax]
mov edx, 0xa
mov r9, r14
mov r8, rbx
mov rcx, rdi
mov rbp, r14
call dbg.AES_decrypt
xor edx, edx
nop dword [rax + rax]
movzx ecx, byte [rbx + rdx]
xor cl, byte [rsi + rdx]
mov byte [rbx + rdx], cl
add rdx, 1
cmp rdx, 0x10
jne 0x6f503270
add r14, 0x10
add rbx, 0x10
mov rsi, rbp
cmp r14, r13
jne 0x6f503250
cmp byte [rsp + 0x27], 0
mov rax, qword [rsp + 0x28]
lea r11, [r12 + rax + 0xf]
mov eax, 1
je 0x6f5032ee
lea eax, [rcx - 1]
mov ebx, 0x10
cmp al, 0xf
setbe al
seta r9b
imul eax, ecx
movzx edi, al
sub ebx, edi
jmp 0x6f5032c9
movzx ecx, byte [r11]
sub r11, 1
cmp ebx, edx
setl r8b
cmp al, cl
setne cl
and ecx, r8d
or r9d, ecx
sub edx, 1
jne 0x6f5032c5
xor r9d, 1
sub r15d, edi
movzx eax, r9b
imul eax, r15d
mov rdi, qword [0x6f7534a0]
mov rsi, qword [rsp + 0x38]
xor rsi, qword [rdi]
jne 0x6f503314
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
Function at 0x6f503320
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xe8
mov r12, qword [0x6f7534a0]
mov rbp, rcx
mov rbx, r8
mov rsi, rdx
lea r13, [rbp + 0x68]
mov rax, qword [r12]
mov qword [rsp + 0xd8], rax
xor eax, eax
call dbg.CSHA256::CSHA256()
mov rcx, r13
call dbg.CSHA256::CSHA256()
cmp rbx, 0x40
ja 0x6f5033d0
lea rdi, [rsp + 0x90]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sym.memcpy
mov eax, 0x40
xor r8d, r8d
sub rax, rbx
add rbx, rdi
cmp eax, 8
jb 0x6f50348b
lea rcx, [rbx + 8]
mov edx, eax
mov qword [rbx], 0
mov qword [rbx + rdx - 8], 0
and rcx, 0xfffffffffffffff8
sub rbx, rcx
add eax, ebx
and eax, 0xfffffff8
cmp eax, 8
jb 0x6f503426
and eax, 0xfffffff8
xor edx, edx
mov r9d, edx
add edx, 8
cmp edx, eax
mov qword [rcx + r9], r8
jb 0x6f5033bd
jmp 0x6f503426
lea rdi, [rsp + 0x20]
mov rcx, rdi
call dbg.CSHA256::CSHA256()
mov rcx, rdi
lea rdi, [rsp + 0x90]
mov r8, rbx
mov rdx, rsi
call dbg.CSHA256::Write(unsigned char const*, unsigned long long)
mov rdx, rdi
mov rcx, rax
call dbg.CSHA256::Finalize(unsigned char*)
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rdi + 0x30], 0
mov qword [rdi + 0x38], 0
lea rax, [rdi + 0x40]
mov rsi, rdi
mov rbx, rdi
xor byte [rbx], 0x5c
add rbx, 1
cmp rbx, rax
jne 0x6f503430
mov r8d, 0x40
mov rdx, rdi
mov rcx, rbp
call dbg.CSHA256::Write(unsigned char const*, unsigned long long)
nop dword [rax]
xor byte [rsi], 0x6a
add rsi, 1
cmp rsi, rbx
jne 0x6f503450
mov r8d, 0x40
mov rdx, rdi
mov rcx, r13
call dbg.CSHA256::Write(unsigned char const*, unsigned long long)
mov rax, qword [rsp + 0xd8]
xor rax, qword [r12]
jne 0x6f5034ba
add rsp, 0xe8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
test al, 4
jne 0x6f5034a5
test eax, eax
je 0x6f503426
test al, 2
mov byte [rbx], 0
je 0x6f503426
mov eax, eax
xor edx, edx
mov word [rbx + rax - 2], dx
jmp 0x6f503426
mov eax, eax
mov dword [rbx], 0
mov dword [rbx + rax - 4], 0
jmp 0x6f503426
call sym.__stack_chk_fail
nop
Function at 0x6f503530
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x180
mov r13, qword [0x6f7534a0]
mov r12, rcx
mov rbx, r8
mov rsi, rdx
lea r14, [r12 + 0xc8]
mov rax, qword [r13]
mov qword [rsp + 0x178], rax
xor eax, eax
call dbg.CSHA512::CSHA512()
mov rcx, r14
call dbg.CSHA512::CSHA512()
cmp rbx, 0x80
ja 0x6f5035d0
lea rbp, [rsp + 0xf0]
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call sym.memcpy
mov eax, pe_nt_image_headers64
lea rcx, [rbp + rbx]
sub rax, rbx
cmp eax, 8
jae 0x6f5036ad
test al, 4
jne 0x6f5036d9
test eax, eax
je 0x6f503646
test al, 2
mov byte [rcx], 0
je 0x6f503646
mov eax, eax
xor edx, edx
mov word [rcx + rax - 2], dx
jmp 0x6f503646
lea rbp, [rsp + 0x20]
mov rcx, rbp
call dbg.CSHA512::CSHA512()
mov rcx, rbp
lea rbp, [rsp + 0xf0]
mov r8, rbx
mov rdx, rsi
call dbg.CSHA512::Write(unsigned char const*, unsigned long long)
mov rdx, rbp
mov rcx, rax
call dbg.CSHA512::Finalize(unsigned char*)
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
lea rax, [rbp + 0x80]
mov rsi, rbp
mov rbx, rbp
xor byte [rbx], 0x5c
add rbx, 1
cmp rbx, rax
jne 0x6f503653
mov r8d, pe_nt_image_headers64
mov rdx, rbp
mov rcx, r12
call dbg.CSHA512::Write(unsigned char const*, unsigned long long)
xor byte [rsi], 0x6a
add rsi, 1
cmp rsi, rbx
jne 0x6f503670
mov r8d, pe_nt_image_headers64
mov rdx, rbp
mov rcx, r14
call dbg.CSHA512::Write(unsigned char const*, unsigned long long)
mov rax, qword [rsp + 0x178]
xor rax, qword [r13]
jne 0x6f5036ee
add rsp, 0x180
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
lea rdi, [rcx + 8]
mov edx, eax
mov qword [rcx], 0
mov qword [rcx + rdx - 8], 0
and rdi, 0xfffffffffffffff8
sub rcx, rdi
add ecx, eax
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
jmp 0x6f503646
mov eax, eax
mov dword [rcx], 0
mov dword [rcx + rax - 4], 0
jmp 0x6f503646
call sym.__stack_chk_fail
nop
nop
nop word cs:[rax + rax]
Function at 0x6f50d2c0
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x38
mov rax, qword [0x6f7534a0]
mov qword [rcx + 0xc0], 0
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
xor edx, edx
movabs rdx, 0x6a09e667f3bcc908
mov qword [rcx], rdx
movabs rdx, 0xbb67ae8584caa73b
mov qword [rcx + 8], rdx
movabs rdx, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rdx
movabs rdx, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rdx
movabs rdx, 0x510e527fade682d1
mov qword [rcx + 0x20], rdx
movabs rdx, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rdx
movabs rdx, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rdx
movabs rdx, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rdx
mov rcx, qword [rsp + 0x28]
xor rcx, qword [rax]
jne 0x6f50d35e
add rsp, 0x38
ret
call sym.__stack_chk_fail
nop
nop
nop word cs:[rax + rax]

Function at 0x6f50d680
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x38
mov rdx, qword [0x6f7534a0]
mov rax, rcx
mov qword [rax + 0xc0], 0
mov rcx, qword [rdx]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
mov rcx, qword [rsp + 0x28]
xor rcx, qword [rdx]
jne 0x6f50d721
add rsp, 0x38
ret
call sym.__stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x6f513670
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [rdx]
mov r10, qword [0x6f7534a0]
mov r8d, ecx
mov rcx, qword [rdx + 8]
mov rax, qword [r10]
mov qword [rsp + 0x28], rax
xor eax, eax
sub rcx, rbx
mov r9, rcx
mov r11, rcx
shr r9, 2
test r9d, r9d
jle 0x6f5136d6
lea eax, [r9 - 1]
mov rdx, rbx
lea rsi, [rbx + rax*4 + 4]
nop
imul eax, dword [rdx], 0xcc9e2d51
add rdx, 4
rol eax, 0xf
imul ecx, eax, 0x1b873593
xor ecx, r8d
rol ecx, 0xd
cmp rsi, rdx
lea r8d, [rcx + rcx*4 - 0x19ab949c]
jne 0x6f5136b0
shl r9d, 2
mov rax, r11
movsxd r9, r9d
and eax, 3
add r9, rbx
cmp rax, 2
je 0x6f513764
cmp rax, 3
je 0x6f513750
cmp rax, 1
je 0x6f513730
mov ecx, r8d
xor ecx, r11d
mov eax, ecx
shr eax, 0x10
xor ecx, eax
imul ecx, ecx, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor eax, edx
mov rbx, qword [rsp + 0x28]
xor rbx, qword [r10]
jne 0x6f513768
add rsp, 0x38
pop rbx
pop rsi
ret
xor edx, edx
movzx eax, byte [r9]
xor eax, edx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor r8d, eax
jmp 0x6f5136f8
movzx edx, byte [r9 + 2]
shl edx, 0x10
movzx eax, byte [r9 + 1]
shl eax, 8
xor edx, eax
jmp 0x6f513732
xor edx, edx
jmp 0x6f513758
call sym.__stack_chk_fail
nop
nop
Function at 0x6f51dbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x30
mov r9, qword [rcx]
mov rdx, qword [rcx + 8]
mov r8, qword [0x6f7534a0]
sub rdx, r9
lea rcx, [rdx - 9]
mov rax, qword [r8]
mov qword [rsp + 0x28], rax
xor eax, eax
cmp rcx, 0x40
jbe 0x6f51dc20
mov rbx, qword [rsp + 0x28]
xor rbx, qword [r8]
jne 0x6f51dcbc
add rsp, 0x30
pop rbx
ret
cmp byte [r9], 0x30
jne 0x6f51dc0a
movzx r10d, byte [r9 + 1]
lea rcx, [rdx - 3]
cmp r10, rcx
jne 0x6f51dc0a
movzx r10d, byte [r9 + 3]
lea ecx, [r10 + 5]
cmp rcx, rdx
jae 0x6f51dc0a
movzx ebx, byte [r9 + rcx]
lea r11d, [r10 + 7]
lea ecx, [rbx + r11]
cmp rcx, rdx
jne 0x6f51dc0a
cmp byte [r9 + 2], 2
setne dl
test r10d, r10d
sete al
or al, dl
je 0x6f51dc6a
xor eax, eax
jmp 0x6f51dc0a
cmp byte [r9 + 4], 0
js 0x6f51dc0a
jne 0x6f51dc80
cmp r10d, 1
je 0x6f51dc80
cmp byte [r9 + 5], 0
jns 0x6f51dc0a
lea edx, [r10 + 4]
cmp byte [r9 + rdx], 2
setne cl
test ebx, ebx
sete dl
or cl, dl
jne 0x6f51dc0a
lea eax, [r10 + 6]
movzx eax, byte [r9 + rax]
test al, al
js 0x6f51dc66
sub ebx, 1
je 0x6f51dcc1
test al, al
jne 0x6f51dcc1
movzx eax, byte [r9 + r11]
shr al, 7
jmp 0x6f51dc0a
call sym.__stack_chk_fail
mov eax, 1
jmp 0x6f51dc0a
Function at 0x6f527f70
Capabilities:
Decode data using base64 via dword translation table
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r14, qword [0x6f7534a0]
mov rdi, rcx
mov rbx, rdx
mov r13, r8
mov rax, qword [r14]
mov qword [rsp + 0x28], rax
xor eax, eax
test r8, r8
je 0x6f527fa3
mov byte [r8], 0
mov rcx, rbx
mov qword [rdi], 0
mov qword [rdi + 8], 0
mov qword [rdi + 0x10], 0
call sym.strlen
lea rdx, [rax + rax*2]
mov rcx, rdi
shr rdx, 2
call dbg.std::vector<unsigned char, std::allocator<unsigned char> >::reserve(unsigned long long)
movzx eax, byte [rbx]
lea rsi, [0x6f6f70c0]
mov eax, dword [rsi + rax*4]
cmp eax, 0xffffffff
je 0x6f5280a0
movzx edx, byte [rbx + 1]
lea rbp, [rbx + 1]
mov ebx, dword [rsi + rdx*4]
cmp ebx, 0xffffffff
je 0x6f528096
lea r12, [rsp + 0x27]
mov edx, ebx
shl eax, 2
mov rcx, rdi
sar edx, 4
or eax, edx
mov rdx, r12
mov byte [rsp + 0x27], al
call dbg.void std::vector<unsigned char, std::allocator<unsigned char> >::emplace_back<unsigned char>(unsigned char&&)
movzx edx, byte [rbp + 1]
and ebx, 0xf
mov r15d, dword [rsi + rdx*4]
mov rax, rdx
cmp r15d, 0xffffffff
je 0x6f5280d1
mov eax, r15d
shl ebx, 4
mov rdx, r12
sar eax, 2
mov rcx, rdi
or ebx, eax
mov byte [rsp + 0x27], bl
call dbg.void std::vector<unsigned char, std::allocator<unsigned char> >::emplace_back<unsigned char>(unsigned char&&)
movzx eax, byte [rbp + 2]
and r15d, 3
mov rdx, rax
mov eax, dword [rsi + rax*4]
cmp eax, 0xffffffff
je 0x6f5280c0
shl r15d, 6
mov rdx, r12
mov rcx, rdi
or r15d, eax
mov byte [rsp + 0x27], r15b
call dbg.void std::vector<unsigned char, std::allocator<unsigned char> >::emplace_back<unsigned char>(unsigned char&&)
movzx eax, byte [rbp + 3]
mov eax, dword [rsi + rax*4]
cmp eax, 0xffffffff
je 0x6f5280a0
add rbp, 4
movzx edx, byte [rbp]
mov ebx, dword [rsi + rdx*4]
cmp ebx, 0xffffffff
jne 0x6f528001
test r13, r13
je 0x6f5280a0
mov byte [r13], 1
mov rcx, qword [rsp + 0x28]
xor rcx, qword [r14]
mov rax, rdi
jne 0x6f5280f0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r13, r13
je 0x6f5280a0
test r15d, r15d
jne 0x6f52809b
cmp dl, 0x3d
jne 0x6f52809b
jmp 0x6f5280e4
test r13, r13
je 0x6f5280a0
cmp al, 0x3d
jne 0x6f52809b
test ebx, ebx
jne 0x6f52809b
cmp byte [rbp + 2], 0x3d
jne 0x6f52809b
movzx eax, byte [rbp + 3]
cmp dword [rsi + rax*4], 0xffffffff
jne 0x6f52809b
jmp 0x6f5280a0
call sym.__stack_chk_fail
mov rcx, qword [rdi]
mov rbx, rax
test rcx, rcx
je 0x6f528105
call sym.operator_delete_void_
mov rcx, rbx
call sym._Unwind_Resume
nop
nop
Function at 0x6f534da0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 8
mov rbx, rcx
call dbg.blake32_close
mov rax, qword [0x6f6fb680]
mov rdx, qword [0x6f6fb688]
mov qword [rbx + 0x78], 0
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rdx
mov rax, qword [0x6f6fb690]
mov rdx, qword [0x6f6fb698]
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x60], rdx
mov rax, qword [0x6f6fb5e0]
mov rdx, qword [0x6f6fb5e8]
mov qword [rbx + 0x68], rax
mov qword [rbx + 0x70], rdx
add rsp, 0x30
pop rbx
ret

Function at 0x6f534e10
Capabilities:
Hash data using sha256

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp dbg.sph_blake256_addbits_and_close

Function at 0x6f534e20
Capabilities:
Hash data using sha384

Disassembly:
lea rdx, [0x6f6fb640]
jmp sym.blake64_init.constprop.0

Function at 0x6f534e40
Capabilities:
Hash data using sha384

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 6
mov rbx, rcx
call dbg.blake64_close
lea rdx, [0x6f6fb640]
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp sym.blake64_init.constprop.0

Function at 0x6f534e70
Capabilities:
Hash data using sha384

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp dbg.sph_blake384_addbits_and_close

Function at 0x6f534e80
Capabilities:
Hash data using sha512

Disassembly:
lea rdx, [0x6f6fb600]
jmp sym.blake64_init.constprop.0

Function at 0x6f534ea0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 8
mov rbx, rcx
call dbg.blake64_close
lea rdx, [0x6f6fb600]
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp sym.blake64_init.constprop.0

Function at 0x6f534ed0
Capabilities:
Hash data using sha512

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp dbg.sph_blake512_addbits_and_close
Function at 0x6f551800
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0x48
jmp dbg.keccak_core
Function at 0x6f5551e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp dbg.sph_luffa384_addbits_and_close
Function at 0x6f558540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp dbg.sph_luffa512_addbits_and_close
Function at 0x6f58a880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp dbg.fugue3_close
Function at 0x6f58b9d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp dbg.fugue4_close

Function at 0x6f58b9f0
Capabilities:
Hash data using sha256

Disassembly:
mov rax, qword [0x6f7342c0]
mov rdx, qword [0x6f7342c8]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov rax, qword [0x6f7342d0]
mov rdx, qword [0x6f7342d8]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdx
ret
Function at 0x6f58d570
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xc0], xmm9
cmp r8d, 0xfffffff8
mov r13, rcx
lea rsi, [rsp + 0x70]
movdqa xmm9, xmmword [0x6f7342c0]
lea r14, [rsp + 0x30]
movdqa xmm7, xmmword [0x6f7342d0]
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x40], xmm7
jl 0x6f58d6ec
lea eax, [r8*8]
mov rbp, rdx
lea rdx, [r8 + 8]
lea rsi, [rsp + 0x70]
lea r14, [rsp + 0x30]
mov dword [rsp + 0x2c], eax
movsxd rax, r8d
and edx, 0xffffffc0
lea rdi, [rax - 0x40]
mov qword [rsp + 0x120], rcx
mov r15, rdi
sub r15, rdx
nop dword [rax]
cmp eax, 0x3f
movsxd r12, eax
jle 0x6f58d78c
cmp eax, 0x40
je 0x6f58d7cb
mov ecx, 0x40
cmp ecx, 8
mov r8d, ecx
mov r9, rsi
mov rdx, rbp
jae 0x6f58d6c0
xor ecx, ecx
test r8b, 4
je 0x6f58d63e
mov ecx, dword [rdx]
mov dword [r9], ecx
mov ecx, 4
test r8b, 2
je 0x6f58d652
movzx r10d, word [rdx + rcx]
mov word [r9 + rcx], r10w
add rcx, 2
and r8d, 1
je 0x6f58d660
movzx edx, byte [rdx + rcx]
mov byte [r9 + rcx], dl
cmp eax, 0x3f
ja 0x6f58d669
mov byte [rsi + rax], pe_nt_image_headers64
lea rbx, [rsp + 0xb0]
mov r13, rsi
mov rcx, r13
add r13, 4
call dbg.be32dec
mov dword [r13 - 4], eax
cmp rbx, r13
jne 0x6f58d674
cmp r12d, 0x37
jle 0x6f58d77c
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call dbg.sha256_transform
add rbp, 0x40
cmp rdi, r15
mov rax, rdi
je 0x6f58d6e4
sub rdi, 0x40
jmp 0x6f58d600
and ecx, 0xfffffff8
xor edx, edx
mov r9d, edx
add edx, 8
mov r10, qword [rbp + r9]
cmp edx, ecx
mov qword [rsi + r9], r10
jb 0x6f58d6c5
lea r9, [rsi + rdx]
add rdx, rbp
jmp 0x6f58d62c
mov r13, qword [rsp + 0x120]
mov rdx, qword [0x6f7342a8]
mov rax, qword [0x6f7342a0]
xor r8d, r8d
mov rcx, rsi
xor ebx, ebx
movaps xmmword [rsp + 0x70], xmm9
mov qword [rsp + 0x58], rdx
mov rdx, qword [0x6f7342b8]
movaps xmmword [rsp + 0x80], xmm7
mov qword [rsp + 0x50], rax
mov rax, qword [0x6f7342b0]
mov qword [r14 + 0x38], rdx
mov rdx, r14
mov qword [r14 + 0x30], rax
call dbg.sha256_transform
nop dword [rax + rax]
mov edx, dword [rsi + rbx]
lea rcx, [r13 + rbx]
add rbx, 4
call dbg.be32enc
cmp rbx, 0x20
jne 0x6f58d740
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm9, xmmword [rsp + 0xc0]
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x2c]
mov dword [rsp + 0xac], eax
jmp 0x6f58d693
mov qword [rsi], 0
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0
mov qword [rsi + 0x20], 0
mov qword [rsi + 0x28], 0
mov qword [rsi + 0x30], 0
mov qword [rsi + 0x38], 0
test r12d, r12d
mov ecx, 0
cmovns rcx, r12
jmp 0x6f58d61a