joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18012a8a0
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov rdi, r9
mov rbx, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
call fcn.18012ab30
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18012a9f0

Function at 0x18012a8f0
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov rsi, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov rbp, r8
mov dword [rcx + 0x10], 0x98badcfe
mov rdi, rdx
mov dword [rcx + 0x14], 0x10325476
mov rcx, rdx
call fcn.1800be430
mov rcx, rdi
mov ebx, eax
call fcn.1800bdfb0
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call fcn.18012ab30
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18012a9f0

Function at 0x18012a970
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov rsi, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov rbp, r8
mov dword [rcx + 0x10], 0x98badcfe
mov rdi, rdx
mov dword [rcx + 0x14], 0x10325476
mov rcx, rdx
call fcn.1800d6d70
mov rcx, rdi
mov ebx, eax
call fcn.1800d6d80
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call fcn.18012ab30
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18012a9f0

Function at 0x18012ab00
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x18012bce0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r8
mov esi, ecx
test ecx, ecx
js 0x18012bd82
test rbx, rbx
je 0x18012bd82
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
lea r8, str.getEntropy
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180105b50
nop
xor bpl, bpl
call fcn.180104260
mov rdi, rax
test rax, rax
jne 0x18012bd4b
xor bl, bl
jmp 0x18012bd73
mov r8, rbx
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
movzx ebx, bpl
mov ecx, 1
test eax, eax
cmovne ebx, ecx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
lea rcx, [rsp + 0x28]
call fcn.180105c80
movzx eax, bl
jmp 0x18012bd84
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801310c0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 0x10], 0x67452301
mov dword [rcx + 0x24], eax
mov qword [rcx + 8], rax
mov dword [rcx + 0x14], 0xefcdab89
mov dword [rcx + 0x18], 0x98badcfe
mov dword [rcx + 0x1c], 0x10325476
mov dword [rcx + 0x20], 0xc3d2e1f0
ret
Function at 0x180131990
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x90], rax
xorps xmm1, xmm1
lea rax, vtable._ckSha1.0
xor ebx, ebx
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x44], ebx
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x40], 0xc3d2e1f0
movups xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x30], 0x67452301
movups xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x34], 0xefcdab89
movups xmmword [rsp + 0x68], xmm1
mov dword [rsp + 0x38], 0x98badcfe
movups xmmword [rsp + 0x78], xmm1
mov qword [rsp + 0x28], rbx
cmp dword [rcx + 0xc08], ebx
jbe 0x180131a44
mov edx, ebx
lea rcx, [rsp + 0x20]
mov r8d, dword [rdi + rdx*4 + 0x808]
mov rdx, qword [rdi + rdx*8 + 8]
call fcn.1801310f0
inc ebx
cmp ebx, dword [rdi + 0xc08]
jb 0x180131a21
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.180130ec0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18007b140
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180131a80
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x90], rax
xorps xmm1, xmm1
lea rax, vtable._ckSha1.0
mov rbx, r8
mov qword [rsp + 0x20], rax
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov r8d, edx
mov qword [rsp + 0x3c], 0x10325476
mov rdx, rcx
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
movups xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x30], 0x67452301
movups xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x34], 0xefcdab89
movups xmmword [rsp + 0x68], xmm1
mov dword [rsp + 0x38], 0x98badcfe
movups xmmword [rsp + 0x78], xmm1
mov dword [rsp + 0x40], 0xc3d2e1f0
call fcn.1801310f0
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.180130ec0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18007b140
add rsp, 0xa0
pop rbx
ret
Function at 0x180131cb0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
lea r8, [rcx + 0x38]
mov r9d, reloc.WS2_32.dll_recv
nop dword [rax]
movzx edx, byte [r8 + 0x10]
movzx eax, byte [r8 - 0x20]
mov byte [r8 - 0x10], dl
lea r8, [r8 + 1]
xor al, dl
mov byte [r8 - 1], al
sub r9, 1
jne 0x180131cc0
xor cl, cl
lea r9, str._.C
xor edx, edx
nop dword [rax]
lea rax, [r10 + 0x19]
mov r8d, 2
nop word [rax + rax]
movzx ecx, cl
lea rax, [rax + 0x18]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0x19], cl
movzx ecx, byte [rax - 0x19]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0x18], cl
movzx ecx, byte [rax - 0x18]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0x17], cl
movzx ecx, byte [rax - 0x17]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0x16], cl
movzx ecx, byte [rax - 0x16]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0x15], cl
movzx ecx, byte [rax - 0x15]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0x14], cl
movzx ecx, byte [rax - 0x14]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0x13], cl
movzx ecx, byte [rax - 0x13]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0x12], cl
movzx ecx, byte [rax - 0x12]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0x11], cl
movzx ecx, byte [rax - 0x11]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0x10], cl
movzx ecx, byte [rax - 0x10]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0xf], cl
movzx ecx, byte [rax - 0xf]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0xe], cl
movzx ecx, byte [rax - 0xe]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0xd], cl
movzx ecx, byte [rax - 0xd]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0xc], cl
movzx ecx, byte [rax - 0xc]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0xb], cl
movzx ecx, byte [rax - 0xb]
movzx ecx, byte [rcx + r9]
xor byte [rax - 0xa], cl
movzx ecx, byte [rax - 0xa]
movzx ecx, byte [rcx + r9]
xor byte [rax - 9], cl
movzx ecx, byte [rax - 9]
movzx ecx, byte [rcx + r9]
xor byte [rax - 8], cl
movzx ecx, byte [rax - 8]
movzx ecx, byte [rcx + r9]
xor byte [rax - 7], cl
movzx ecx, byte [rax - 7]
movzx ecx, byte [rcx + r9]
xor byte [rax - 6], cl
movzx ecx, byte [rax - 6]
movzx ecx, byte [rcx + r9]
xor byte [rax - 5], cl
movzx ecx, byte [rax - 5]
movzx ecx, byte [rcx + r9]
xor byte [rax - 4], cl
movzx ecx, byte [rax - 4]
movzx ecx, byte [rcx + r9]
xor byte [rax - 3], cl
movzx ecx, byte [rax - 3]
movzx ecx, byte [rcx + r9]
xor byte [rax - 2], cl
movzx ecx, byte [rax - 2]
sub r8, 1
jne 0x180131d00
add cl, dl
inc edx
cmp edx, 0x12
jl 0x180131cf0
ret
Function at 0x180133560
Capabilities:
Hash data with md5

Disassembly:
test rdx, rdx
je 0x18013346f
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x50]
mov rbx, rcx
mov rdi, rdx
lea ecx, [r8*8]
add qword [rbx + 8], rcx
mov byte [r8 + rbx + 0x10], pe_nt_image_headers64
inc dword [rbx + 0x50]
mov eax, dword [rbx + 0x50]
cmp eax, 0x38
jbe 0x180133381
cmp eax, 0x40
jae 0x180133370
nop
mov byte [rax + rbx + 0x10], 0
inc dword [rbx + 0x50]
mov eax, dword [rbx + 0x50]
cmp eax, 0x40
jb 0x180133360
mov rcx, rbx
call fcn.180132230
mov dword [rbx + 0x50], 0
jmp 0x180133390
jae 0x1801333a1
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
mov byte [rax + rbx + 0x10], 0
inc dword [rbx + 0x50]
cmp dword [rbx + 0x50], 0x38
jb 0x180133390
mov rcx, qword [rbx + 8]
mov rax, rcx
mov byte [rbx + 0x48], cl
sar rax, 0x38
mov byte [rbx + 0x4f], al
mov rax, rcx
sar rax, 0x30
mov byte [rbx + 0x4e], al
mov rax, rcx
sar rax, 0x28
mov byte [rbx + 0x4d], al
mov rax, rcx
sar rax, 0x20
mov byte [rbx + 0x4c], al
mov rax, rcx
sar rax, 0x18
mov byte [rbx + 0x4b], al
mov rax, rcx
sar rax, 0x10
mov byte [rbx + 0x4a], al
mov rax, rcx
sar rax, 8
mov rcx, rbx
mov byte [rbx + 0x49], al
call fcn.180132230
movzx eax, byte [rbx + 0x57]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0x56]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 0x55]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 0x54]
mov byte [rdi], al
movzx eax, byte [rbx + 0x5b]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x5a]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0x59]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0x58]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0x5f]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x5e]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x5d]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x5c]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x63]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x62]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x61]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x60]
mov rbx, qword [rsp + 0x30]
mov byte [rdi + 0xc], al
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
call fcn.180133470
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180133320
Function at 0x1801350f0
Capabilities:
Hash data using sha1

Disassembly:
test rdx, rdx
je 0x180134ffb
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x50]
mov rbx, rcx
mov rdi, rdx
lea ecx, [r8*8]
add qword [rbx + 8], rcx
mov byte [r8 + rbx + 0x10], pe_nt_image_headers64
inc dword [rbx + 0x50]
mov eax, dword [rbx + 0x50]
cmp eax, 0x38
jbe 0x180134ef1
cmp eax, 0x40
jae 0x180134ee0
nop
mov byte [rax + rbx + 0x10], 0
inc dword [rbx + 0x50]
mov eax, dword [rbx + 0x50]
cmp eax, 0x40
jb 0x180134ed0
mov rcx, rbx
call fcn.180133610
mov dword [rbx + 0x50], 0
jmp 0x180134f00
jae 0x180134f11
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
mov byte [rax + rbx + 0x10], 0
inc dword [rbx + 0x50]
cmp dword [rbx + 0x50], 0x38
jb 0x180134f00
mov rcx, qword [rbx + 8]
mov rax, rcx
mov byte [rbx + 0x48], cl
sar rax, 0x38
mov byte [rbx + 0x4f], al
mov rax, rcx
sar rax, 0x30
mov byte [rbx + 0x4e], al
mov rax, rcx
sar rax, 0x28
mov byte [rbx + 0x4d], al
mov rax, rcx
sar rax, 0x20
mov byte [rbx + 0x4c], al
mov rax, rcx
sar rax, 0x18
mov byte [rbx + 0x4b], al
mov rax, rcx
sar rax, 0x10
mov byte [rbx + 0x4a], al
mov rax, rcx
sar rax, 8
mov rcx, rbx
mov byte [rbx + 0x49], al
call fcn.180133610
movzx eax, byte [rbx + 0x57]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0x56]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 0x55]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 0x54]
mov byte [rdi], al
movzx eax, byte [rbx + 0x5b]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x5a]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0x59]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0x58]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0x5f]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x5e]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x5d]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x5c]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x63]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x62]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x61]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x60]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x67]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x66]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x65]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x64]
mov rbx, qword [rsp + 0x30]
mov byte [rdi + 0x10], al
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
call fcn.180135000
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180134e90
Function at 0x180138310
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable._ckMd4.0
mov dword [rcx + 8], 0x67452301
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 0x18], rax
mov rax, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x180138490
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x28]
call fcn.1800ba7a0
nop
lea r8, [rsp + 0x28]
xor edx, edx
mov rcx, rbx
call fcn.1800c2af0
xor eax, eax
mov qword [rdi + 0x18], rax
mov dword [rdi + 8], 0x67452301
mov dword [rdi + 0xc], 0xefcdab89
mov dword [rdi + 0x10], 0x98badcfe
mov dword [rdi + 0x14], 0x10325476
lea rcx, [rsp + 0x28]
call fcn.1800be430
mov ebx, eax
lea rcx, [rsp + 0x28]
call fcn.1800bdfb0
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
call fcn.180138b60
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.180138380
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.1800baf90
nop
lea rcx, [rsp + 0x28]
call fcn.1800ba970
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x180138eb0
Capabilities:
Hash data using sha1
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.18013a590
jmp fcn.18013c600

Function at 0x180138ed0
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov edx, dword [rcx + 0x10]
sub edx, 0xa0
je 0x180138ffa
sub edx, 0x60
je 0x180138fbb
sub edx, 0x80
je 0x180138f52
cmp edx, 0x80
jne 0x180139023
mov rax, qword [0x180388aa0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x180388aa8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x180388ab0]
mov qword [rcx + 0x50], rax
mov rax, qword [0x180388ab8]
mov qword [rcx + 0x58], rax
mov rax, qword [0x180388ac0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x180388ac8]
mov qword [rcx + 0x68], rax
mov rax, qword [0x180388ad0]
mov qword [rcx + 0x70], rax
mov rax, qword [0x180388ad8]
jmp 0x180138fa6
mov rax, qword [0x1803887e0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1803887e8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1803887f0]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1803887f8]
mov qword [rcx + 0x58], rax
mov rax, qword [0x180388800]
mov qword [rcx + 0x60], rax
mov rax, qword [0x180388808]
mov qword [rcx + 0x68], rax
mov rax, qword [0x180388810]
mov qword [rcx + 0x70], rax
mov rax, qword [0x180388818]
mov qword [rcx + 0x78], rax
xor eax, eax
mov qword [rcx + 0x80], rax
mov qword [rcx + 0x88], rax
ret
mov dword [rcx + 0x14], 0x6a09e667
xor eax, eax
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov qword [rcx + 0x30], 0x5be0cd19
mov dword [rcx + 0x38], eax
ret
mov dword [rcx + 0x14], 0x67452301
xor eax, eax
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], rax
ret
Function at 0x180139b80
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rsi
mov edi, ecx
xor esi, esi
mov qword [rsp + 0x48], rsi
mov ecx, 0x110
call fcn.18007b16c
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180139d3b
mov rcx, rax
call fcn.180103000
nop
lea rax, vtable._ckSha2.0
mov qword [rbx], rax
call fcn.1800da930
mov byte [reloc.WS2_32.dll_accept], al
call fcn.180139690
test edi, edi
jle 0x180139d36
mov ecx, edi
sub ecx, 0xa0
je 0x180139d0f
sub ecx, 0x60
je 0x180139cd1
sub ecx, 0x80
je 0x180139c69
cmp ecx, 0x80
jne 0x180139d36
mov rax, qword [0x180388aa0]
mov qword [rbx + 0x40], rax
mov rax, qword [0x180388aa8]
mov qword [rbx + 0x48], rax
mov rax, qword [0x180388ab0]
mov qword [rbx + 0x50], rax
mov rax, qword [0x180388ab8]
mov qword [rbx + 0x58], rax
mov rax, qword [0x180388ac0]
mov qword [rbx + 0x60], rax
mov rax, qword [0x180388ac8]
mov qword [rbx + 0x68], rax
mov rax, qword [0x180388ad0]
mov qword [rbx + 0x70], rax
mov rax, qword [0x180388ad8]
jmp 0x180139cbd
mov rax, qword [0x1803887e0]
mov qword [rbx + 0x40], rax
mov rax, qword [0x1803887e8]
mov qword [rbx + 0x48], rax
mov rax, qword [0x1803887f0]
mov qword [rbx + 0x50], rax
mov rax, qword [0x1803887f8]
mov qword [rbx + 0x58], rax
mov rax, qword [0x180388800]
mov qword [rbx + 0x60], rax
mov rax, qword [0x180388808]
mov qword [rbx + 0x68], rax
mov rax, qword [0x180388810]
mov qword [rbx + 0x70], rax
mov rax, qword [0x180388818]
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
jmp 0x180139d36
mov dword [rbx + 0x14], 0x6a09e667
mov dword [rbx + 0x18], 0xbb67ae85
mov dword [rbx + 0x1c], 0x3c6ef372
mov dword [rbx + 0x20], 0xa54ff53a
mov dword [rbx + 0x24], 0x510e527f
mov dword [rbx + 0x28], 0x9b05688c
mov dword [rbx + 0x2c], 0x1f83d9ab
mov qword [rbx + 0x30], 0x5be0cd19
mov dword [rbx + 0x38], esi
jmp 0x180139d36
mov dword [rbx + 0x14], 0x67452301
mov dword [rbx + 0x18], 0xefcdab89
mov dword [rbx + 0x1c], 0x98badcfe
mov dword [rbx + 0x20], 0x10325476
mov dword [rbx + 0x24], 0xc3d2e1f0
mov qword [rbx + 0x34], rsi
mov dword [rbx + 0x10], edi
jmp 0x180139d3e
mov rbx, rsi
mov qword [rsp + 0x48], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x180139d70
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov ecx, 0x100
jmp fcn.180139b80

Function at 0x180139d80
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov ecx, 0x180
jmp fcn.180139b80

Function at 0x180139d90
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov ecx, 0x200
jmp fcn.180139b80
Function at 0x180145770
Capabilities:
Hash data using crc32b

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [0x180388b78], 0
jne 0x180145992
movzx eax, byte [0x180388b79]
mov qword [rsp + 0x30], rbx
test al, al
jne 0x180145961
cmp qword [0x180388b80], 0
jne 0x18014598d
mov ecx, 0x100
mov byte [0x180388b79], 1
call fcn.1800daa20
mov rdi, rax
test rax, rax
je 0x18014598d
xor ebx, ebx
mov r11, rax
mov r10d, ebx
nop word [rax + rax]
mov ecx, r10d
mov r8d, r10d
and ecx, 1
shr r8d, 1
shl ecx, 7
mov eax, r8d
mov edx, ecx
or edx, 0x40
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 0x20
and al, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
mov eax, r8d
or edx, 0x10
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 8
and al, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
mov eax, r8d
or edx, 4
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 2
and al, 1
cmove ecx, edx
mov eax, ecx
or eax, 1
and r8b, 2
cmove eax, ecx
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, 0x4c11db7
mov r9d, ebx
xor eax, ecx
mov r8d, 0x1e
test al, 1
je 0x1801458e3
lea ecx, [r8 + 1]
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x1801458f6
mov ecx, r8d
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
sub r8d, 2
cmp r8d, 0xfffffffe
jg 0x1801458d1
mov dword [r11], r9d
inc r10d
add r11, 4
cmp r10d, 0xff
jbe 0x1801457d0
cmp qword [0x180388b80], rbx
jne 0x180145941
mov byte [0x180388b79], bl
mov rbx, qword [rsp + 0x30]
mov qword [0x180388b80], rdi
mov byte [0x180388b78], 1
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.18007b164
mov byte [0x180388b79], bl
mov rbx, qword [rsp + 0x30]
mov byte [0x180388b78], 1
add rsp, 0x20
pop rdi
ret
xor ebx, ebx
test al, al
je 0x18014598d
nop word [rax + rax]
mov ecx, 2
call fcn.180104b90
inc ebx
cmp ebx, 0xc8
ja 0x18014598d
cmp byte [0x180388b79], 0
jne 0x180145970
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret