joyce8/EMBER2024-capa huggingface dataset:
Function at 0x514490
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x18
mov dword [rsp], 0x67452301
mov dword [rsp + 4], 0xefcdab89
mov rax, qword [rsp]
mov dword [rsp + 8], 0x98badcfe
mov dword [rsp + 0xc], 0x10325476
mov dword [rcx + 0x14], 0
mov dword [rcx + 0x10], 0
mov dword [rcx + 0x58], 0
mov qword [rcx], rax
mov rax, qword [rsp + 8]
mov qword [rcx + 8], rax
add rsp, 0x18
ret

Function at 0x5145d0
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp edx, 0x10
mov rbx, rcx
mov edi, edx
mov rbp, r8
ja 0x514700
mov esi, dword [rbx + 0x58]
cmp esi, 0x3f
ja 0x5146e2
lea eax, [rsi + 1]
mov byte [rbx + rsi + 0x18], pe_nt_image_headers64
cmp eax, 0x38
ja 0x5146b0
mov edx, eax
mov r8d, 0x38
lea rsi, [rbx + 0x18]
lea rcx, [rbx + rdx + 0x18]
sub r8, rdx
xor edx, edx
call sub.msvcrt.dll_memset
mov edx, dword [rbx + 0x10]
mov r9d, dword [rbx + 0x14]
mov ecx, dword [rbx + 0x58]
mov eax, edx
shl r9d, 9
shl edx, 9
shr eax, 0x17
or eax, r9d
lea r9d, [rcx*8]
mov rcx, rbx
mov byte [rbx + 0x54], al
or r9d, edx
mov edx, r9d
mov byte [rbx + 0x50], r9b
shr edx, 0x18
mov byte [rbx + 0x53], dl
mov edx, r9d
shr edx, 0x10
mov byte [rbx + 0x52], dl
mov edx, r9d
shr edx, 8
mov byte [rbx + 0x51], dl
mov edx, eax
shr edx, 0x18
mov byte [rbx + 0x57], dl
mov edx, eax
shr edx, 0x10
mov byte [rbx + 0x56], dl
mov edx, eax
shr edx, 8
mov byte [rbx + 0x55], dl
mov rdx, rsi
call fcn.00514720
mov ecx, edi
mov r8, rbx
mov rdx, rbp
call fcn.00514fa0
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.00514490
lea rcx, [rbx + rax + 0x18]
lea rsi, [rbx + 0x18]
mov r8d, 0x40
sub r8, rax
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rbx
mov rdx, rsi
call fcn.00514720
mov rcx, rsi
mov r8d, 0x38
jmp 0x51461a
lea rdx, str.md5.c
lea rcx, [0x00780d60]
mov r8d, 0x4b
call fcn.0064b2d0
jmp 0x5145f5
lea rdx, str.md5.c
lea rcx, str.length___MD5_DIGEST_SIZE
mov r8d, 0x49
call fcn.0064b2d0
jmp 0x5145e9
Function at 0x530490
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
test ecx, ecx
jne 0x530500
mov rcx, qword [0x007f0440]
test rcx, rcx
je 0x530590
mov rax, qword [0x007f0470]
sub eax, dword [0x007f0480]
cmp eax, 0x4b0
jbe 0x530590
lea rbx, [rsp + 0x30]
mov esi, 0x10
mov edi, 0x10
mov r8, rbx
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x5305a0
cmp dword [0x007f0400], 1
jg 0x5305e5
mov eax, 0xfffffeaa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
mov r9d, 1
lea rcx, [0x007f0440]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x530545
cmp dword [0x007f0400], 1
jle 0x5304f2
lea rdx, str.error_in_CryptAcquireContext__n
mov ecx, 2
call fcn.0051c740
mov eax, 0xfffffeaa
jmp 0x5304f7
lea rbx, [rsp + 0x30]
xor edx, edx
mov esi, 0x20
mov edi, 0x20
mov rcx, rbx
call fcn.00543f10
mov rax, qword [rsp + 0x30]
mov rcx, qword [0x007f0440]
mov qword [0x007f0480], rax
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
test rcx, rcx
mov dword [0x007f0488], eax
jne 0x5304d2
nop word [rax + rax]
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov rdx, qword [0x007f0478]
mov rax, qword [0x007f0470]
lea r8d, [rdi*4]
lea rcx, [0x007f04c0]
mov qword [rsp + 0x20], rbx
mov r9d, esi
mov qword [0x007f0488], rdx
mov edx, 1
mov qword [0x007f0480], rax
call fcn.005ec690
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rdx, str.Error_in_CryptGenRandom:__s_n
mov r8d, eax
mov ecx, 2
call fcn.0051c740
mov eax, 0xfffffeaa
jmp 0x5304f7
Function at 0x549690
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov r12, rcx
mov r14, rdx
call sub.msvcrt.dll__fileno
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.00580330
test eax, eax
js 0x5496cc
movzx eax, word [rsp + 0x26]
and ax, 0xf000
cmp ax, 0x8000
je 0x549800
mov ebx, 0x200
mov rcx, rbx
call fcn.005498f0
test rax, rax
mov rdi, rax
je 0x549831
xor esi, esi
mov r13, 0xffffffffffffffff
jmp 0x54972a
cmp rbx, 0xffffffffffffffff
je 0x549790
mov rax, rbx
mov rcx, rdi
shr rax, 1
mov rdx, rax
add rax, rbx
not rdx
cmp rbx, rdx
cmovae rax, r13
mov rdx, rax
mov rbx, rax
call fcn.00572ba0
test rax, rax
je 0x5497c0
mov rdi, rax
mov rbp, rbx
lea rcx, [rdi + rsi]
mov r9, r12
sub rbp, rsi
mov edx, 1
mov r8, rbp
call sub.msvcrt.dll_fread
add rsi, rax
cmp rax, rbp
je 0x5496f0
mov rbp, qword [sym.imp.msvcrt.dll__errno]
call rbp
mov rcx, r12
mov r13d, dword [rax]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x54979d
sub rbx, 1
cmp rbx, rsi
ja 0x5497e0
mov byte [rdi + rsi], 0
mov rax, rdi
mov qword [r14], rsi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov r13d, 0xc
mov rcx, rdi
call sub.msvcrt.dll_free
call rbp
mov dword [rax], r13d
xor eax, eax
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rbp, qword [sym.imp.msvcrt.dll__errno]
call rbp
mov r13d, dword [rax]
mov rcx, rdi
call sub.msvcrt.dll_free
call rbp
mov dword [rax], r13d
xor eax, eax
jmp 0x5497ac
lea rdx, [rsi + 1]
mov rcx, rdi
call fcn.00572ba0
test rax, rax
cmovne rdi, rax
jmp 0x54976d
mov rcx, r12
call fcn.0064b450
test rax, rax
js 0x5496cc
mov rbx, qword [rsp + 0x38]
cmp rax, rbx
jge 0x5496cc
sub rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x549838
add rbx, 1
jmp 0x5496d1
xor eax, eax
jmp 0x549777
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0xc
xor eax, eax
jmp 0x549777

Function at 0x568370
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
xor eax, eax
cmp dword [0x007f0960], ecx
mov ebx, ecx
jl 0x568390
add rsp, 0x1c0
pop rbx
ret
lea rdx, [rsp + 0x20]
movzx ecx, cx
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, eax
mov eax, 1
test edx, edx
jne 0x568384
movzx edx, word [rsp + 0x20]
mov al, 2
cmp ebx, edx
jg 0x568384
mov eax, dword [0x007f0960]
test eax, eax
jne 0x5683d8
lea r8, [0x007f0980]
lea rdx, [0x00567f20]
lea rcx, [0x00567af0]
call fcn.00599720
mov dword [0x007f0960], ebx
xor eax, eax
jmp 0x568384
Function at 0x58e770
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
je 0x58e7c0
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x58e7e0
mov r9, qword [rbx + 0x70]
test r9, r9
je 0x58e7b0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp r9
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp dword [0x007f0400], 1
jg 0x58e8c0
mov eax, 0xffffffff
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
test byte [rbx + 0x18], 4
jne 0x58e801
cmp dword [0x007f0400], 1
mov dword [rbx + 0xc], 0x14
jle 0x58e7cd
mov r9d, 0x432
jmp 0x58e8c6
test rdx, rdx
je 0x58e8b0
test r8, r8
je 0x58e8b0
test byte [rbx + 0x28], 1
je 0x58e890
mov rax, qword [rbx + 0x30]
mov r8, qword [rbx + 0x38]
lea rdx, [rsi + rax]
cmp rdx, r8
jbe 0x58e871
mov rbp, qword [rbx + 0x20]
lea rdx, [r8 + rsi + 0x2000]
mov ecx, 1
call qword [sub.msvcrt.dll_calloc]
mov rdx, qword [rbx + 0x38]
mov r8, qword [rbx + 0x30]
mov rcx, rax
mov qword [rbx + 0x20], rax
lea rdx, [rsi + rdx + 0x2000]
mov qword [rbx + 0x38], rdx
mov rdx, rbp
call sub.msvcrt.dll_memcpy
mov rcx, rbp
call qword [sub.msvcrt.dll_free]
mov rax, qword [rbx + 0x30]
add rax, qword [rbx + 0x20]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_memcpy
add qword [rbx + 0x30], rsi
mov eax, esi
jmp 0x58e7b2
mov r9, qword [rbx + 0x48]
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fwrite
test eax, eax
je 0x58e7cd
jmp 0x58e7b2
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.0058dc80
mov r9d, 0x424
lea r8, str.stream.c
lea rdx, [0x0079520b]
mov ecx, 2
call fcn.0051c740
jmp 0x58e7cd
Function at 0x58ea80
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
je 0x58eae3
cmp qword [rcx + 0x80], 0
je 0x58eaa3
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
movzx eax, byte [rcx + 0x18]
test al, 4
je 0x58ea99
test al, 1
jne 0x58ea99
call fcn.0058e4d0
test rax, rax
je 0x58ea99
xor edx, edx
mov rcx, rbx
call fcn.0058e990
test eax, eax
mov edi, eax
je 0x58eafd
or byte [rbx + 0x18], 1
mov eax, dword [0x007f0400]
cmp eax, 1
mov dword [rbx + 0xc], edi
jg 0x58ec9e
mov eax, edi
jmp 0x58ea9b
cmp dword [0x007f0400], 1
jg 0x58ec76
mov eax, 0xb
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
call fcn.0058dc80
test eax, eax
mov edi, eax
jne 0x58eac9
test byte [rbx + 0x18], 1
je 0x58eb2b
mov eax, dword [0x007f0400]
cmp eax, 1
jg 0x58ece7
mov edi, 0xb
or byte [rbx + 0x18], 1
jmp 0x58ead3
mov rsi, qword [rbx]
test rsi, rsi
je 0x58ebee
nop word [rax + rax]
test byte [rsi + 0x4038], 1
je 0x58ebe2
cmp qword [rsi], 0
je 0x58ebf7
call fcn.005a75e0
mov r9, rax
mov qword [rsi + 0x18], rax
test r9, r9
je 0x58ec66
mov rax, qword [rsi]
test rax, rax
je 0x58ec1c
cmp dword [rax + 0x403c], 1
je 0x58ec1c
mov edx, dword [rsi + 0x4040]
mov rcx, qword [rsi + 0x10]
mov r8, qword [rbx + 0x48]
call qword [rsi + 8]
test eax, eax
mov edi, eax
je 0x58ebc0
mov rcx, qword [rsi + 0x18]
call sub.msvcrt.dll_fclose
mov qword [rsi + 0x18], 0
mov eax, dword [0x007f0400]
or byte [rbx + 0x18], 1
jmp 0x58ead3
lea rdx, [rsi + 0x18]
mov rcx, rbx
call fcn.0058dcc0
test eax, eax
mov edi, eax
jne 0x58eb9c
xor edx, edx
mov rcx, rbx
call fcn.0058e990
test eax, eax
mov edi, eax
jne 0x58eb9c
mov rsi, qword [rsi]
test rsi, rsi
jne 0x58eb40
or byte [rbx + 0x18], 1
jmp 0x58ea99
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x58eb57
lea rdx, [0x0079521d]
call sub.msvcrt.dll_fopen
mov r9, rax
mov qword [rsi + 0x18], rax
jmp 0x58eb63
mov r8, qword [rbx + 0x30]
test r8, r8
je 0x58eb85
mov rcx, qword [rbx + 0x20]
mov edx, 1
call sub.msvcrt.dll_fwrite
test eax, eax
jne 0x58ecc3
cmp dword [0x007f0400], 1
jle 0x58ec66
lea r8, str.stream.c
lea rdx, [0x0079520b]
mov r9d, 0x57e
mov ecx, 2
call fcn.0051c740
mov eax, dword [0x007f0400]
mov edi, 2
jmp 0x58eb25
lea r8, str.stream.c
lea rdx, [0x0079520b]
mov r9d, 0x19a
mov ecx, 2
call fcn.0051c740
mov eax, 0xb
jmp 0x58ea9b
lea r8, str.stream.c
lea rdx, [0x0079520b]
mov r9d, 0x1b3
mov ecx, 2
call fcn.0051c740
mov eax, edi
jmp 0x58ea9b
and byte [rbx + 0x28], 0xfe
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov r8, qword [rbx + 0x38]
mov qword [rbx + 0x30], 0
call sub.msvcrt.dll_memset
mov r9, qword [rsi + 0x18]
jmp 0x58eb85
lea r8, str.stream.c
lea rdx, [0x0079520b]
mov r9d, 0x328
mov ecx, 2
mov dil, 0xb
call fcn.0051c740
mov eax, dword [0x007f0400]
jmp 0x58eb25
Function at 0x58efe0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
je 0x58f030
mov rcx, qword [rcx + 0x80]
test rcx, rcx
je 0x58f050
mov rax, qword [rbx + 0x68]
test rax, rax
je 0x58f020
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp dword [0x007f0400], 1
jg 0x58f212
mov eax, 0xffffffff
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx eax, byte [rbx + 0x18]
mov edx, eax
and edx, 0xc
cmp dl, 4
je 0x58f183
test al, 0x20
jne 0x58f130
mov edx, eax
or dl, byte [rbx + 0x28]
and edx, 1
jne 0x58f130
test al, 1
jne 0x58f126
mov rbp, qword [rbx]
test rbp, rbp
jne 0x58f09d
jmp 0x58f126
mov rbp, qword [rbp]
test rbp, rbp
je 0x58f126
movzx eax, byte [rbp + 0x4038]
test al, 1
je 0x58f090
test al, 4
jne 0x58f090
call fcn.005a75e0
test rax, rax
mov r9, rax
mov qword [rbp + 0x18], rax
je 0x58f20b
mov edx, dword [rbp + 0x4040]
mov rcx, qword [rbp + 0x10]
mov r8, qword [rbx + 0x48]
call qword [rbp + 8]
test eax, eax
jne 0x58f1d6
movzx eax, byte [rbp + 0x4038]
mov edx, eax
and edx, 0xfffffffb
test al, 2
mov byte [rbp + 0x4038], dl
jne 0x58f1c0
lea rdx, [rbp + 0x18]
mov rcx, rbx
call fcn.0058dcc0
test eax, eax
jne 0x58f1dd
xor edx, edx
mov rcx, rbx
call fcn.0058e990
test eax, eax
jne 0x58f1dd
and byte [rbp + 0x4038], 0xfe
jmp 0x58f090
or byte [rbx + 0x18], 1
nop word [rax + rax]
test rsi, rsi
jne 0x58f140
xor eax, eax
test rdi, rdi
je 0x58f022
mov r9, qword [rbx + 0x48]
mov edx, 1
mov rcx, rsi
mov r8, rdi
mov esi, 0xffffffff
call sub.msvcrt.dll_fread
mov rcx, qword [rbx + 0x48]
test eax, eax
cmovne esi, eax
call sub.msvcrt.dll_feof
mov edx, eax
mov eax, esi
test edx, edx
je 0x58f022
mov dword [rbx + 0xc], 0
or byte [rbx + 0x18], 2
jmp 0x58f022
cmp dword [0x007f0400], 1
mov dword [rbx + 0xc], 0x14
jle 0x58f03d
mov r9d, 0x3da
lea r8, str.stream.c
lea rdx, [0x0079520b]
mov ecx, 2
call fcn.0051c740
jmp 0x58f03d
mov rcx, qword [rbp + 0x18]
call sub.msvcrt.dll_fclose
mov qword [rbp + 0x18], 0
jmp 0x58f108
or byte [rbp + 0x4038], 4
mov rcx, qword [rbx + 0x48]
mov dword [rbx + 0xc], eax
test rcx, rcx
je 0x58f1f6
call sub.msvcrt.dll_feof
test eax, eax
je 0x58f1f6
or byte [rbx + 0x18], 2
cmp dword [0x007f0400], 1
jle 0x58f03d
mov r9d, 0x3e6
jmp 0x58f19d
mov eax, 2
jmp 0x58f1dd
mov r9d, 0x3cc
jmp 0x58f19d
Function at 0x5990b0
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x10
lea r11, [0x00795cc0]
test r9, r9
lea r10, [r9 - 4]
je 0x59918c
nop dword [rax + rax]
test rdx, rdx
je 0x59918c
movzx eax, byte [rcx]
lea rsi, [0x00795cc0]
mov ebx, eax
shr bl, 2
and ebx, 0x3f
cmp r9, 1
movzx edi, byte [r11 + rbx]
mov byte [r8], dil
je 0x599195
shl eax, 4
cmp rdx, 1
jne 0x599120
and eax, 0x30
cmp r9, 2
movzx eax, byte [rsi + rax]
mov byte [r8 + 1], al
je 0x599195
mov eax, 0x3d
xor edx, edx
jmp 0x59915c
movzx ebx, byte [rcx + 1]
mov edi, ebx
shr dil, 4
add eax, edi
and eax, 0x3f
cmp r9, 2
movzx eax, byte [rsi + rax]
mov byte [r8 + 1], al
je 0x599195
shl ebx, 2
xor eax, eax
sub rdx, 2
je 0x599152
movzx eax, byte [rcx + 2]
shr al, 6
movzx eax, al
add eax, ebx
and eax, 0x3f
movzx eax, byte [r11 + rax]
cmp r9, 3
mov byte [r8 + 2], al
je 0x599195
lea rax, [r8 + 4]
test rdx, rdx
mov r8, rax
jne 0x5991a0
test r10, r10
mov byte [rax - 1], 0x3d
je 0x599195
sub r10, 4
sub r9, 4
test r9, r9
jne 0x5990d0
test r9, r9
je 0x599195
mov byte [r8], 0
add rsp, 0x10
pop rbx
pop rsi
pop rdi
ret
movzx esi, byte [rcx + 2]
mov byte [rsp], sil
mov rbx, qword [rsp]
and ebx, 0x3f
test r10, r10
movzx ebx, byte [r11 + rbx]
mov byte [rax - 1], bl
je 0x599195
sub rdx, 1
je 0x59917b
add rcx, 3
sub r10, 4
sub r9, 4
jmp 0x599183
Function at 0x5a75e0
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x248
xor edx, edx
mov r9d, 0x18
mov rcx, qword [0x007f1e38]
lea rbx, [rsp + 0x20]
mov r8, rbx
call qword [0x0065a048]
lea r11, [rbx + 0x17]
lea r10, str.abcdefghijklmnopqrstuvwxyz
mov rdx, rbx
mov r8d, 0x1a
nop word [rax + rax]
movzx r9d, byte [rdx]
add rdx, 1
movzx ecx, r9b
lea eax, [rcx + rcx*4]
shl eax, 4
sub eax, ecx
shr ax, 0xb
imul eax, r8d
sub r9d, eax
movzx r9d, r9b
movzx eax, byte [r10 + r9]
mov byte [rdx - 1], al
cmp rdx, r11
jne 0x5a7620
lea rsi, [rsp + 0x40]
mov byte [rsp + 0x37], 0
mov ecx, 0x1d0
mov rdx, rsi
call qword [sym.imp.KERNEL32.DLL_GetTempPathA]
test eax, eax
je 0x5a76d0
lea r8, str._cdk_
mov edx, 0x200
mov rcx, rsi
call fcn.00536f80
mov r8, rbx
mov edx, 0x200
mov rcx, rsi
call fcn.00536f80
mov r8d, 0x180
mov edx, 0x8542
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__open]
cmp eax, 0xffffffff
mov ebx, eax
je 0x5a76d0
lea rdx, [0x00797521]
mov ecx, eax
call sub.msvcrt.dll__fdopen
test rax, rax
je 0x5a76c8
add rsp, 0x248
pop rbx
pop rsi
ret
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__close]
xor eax, eax
add rsp, 0x248
pop rbx
pop rsi
ret
Function at 0x5aca10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.005aca80
shl edx, 4
test eax, eax
jne 0x5aca6e
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x5aca3b
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
movups xmmword [rcx], xmm0
add rsp, 8
repz ret

Function at 0x5aca80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
mov rax, 0xffffffffffffffff
test rcx, rcx
je 0x5acc87
test r8, r8
je 0x5acc87
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x5acbd0
cmp edx, 0xc0
je 0x5acb50
cmp edx, 0x80
jne 0x5acc80
mov edx, 9
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.005acc97
aeskeygenassist xmm1, xmm0, 2
call fcn.005acc90
aeskeygenassist xmm1, xmm0, 4
call fcn.005acc90
aeskeygenassist xmm1, xmm0, 8
call fcn.005acc90
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005acc90
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005acc90
aeskeygenassist xmm1, xmm0, 0x40
call fcn.005acc90
aeskeygenassist xmm1, xmm0, 0x80
call fcn.005acc90
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.005acc90
aeskeygenassist xmm1, xmm0, 0x36
call fcn.005acc90
movups xmmword [rax], xmm0
mov dword [rax + 0x50], edx
xor eax, eax
jmp 0x5acc87
movq xmm2, qword [rcx + 0x10]
mov edx, 0xb
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.005accb7
aeskeygenassist xmm1, xmm2, 2
call fcn.005accf0
aeskeygenassist xmm1, xmm2, 4
call fcn.005accb0
aeskeygenassist xmm1, xmm2, 8
call fcn.005accf0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005accb0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005accf0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005accb0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.005accf0
movups xmmword [rax], xmm0
mov dword [rax + 0x30], edx
xor rax, rax
jmp 0x5acc87
movups xmm2, xmmword [rcx + 0x10]
mov edx, 0xd
lea rax, [rax + 0x10]
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.005acd17
aeskeygenassist xmm1, xmm0, 1
call fcn.005acd30
aeskeygenassist xmm1, xmm2, 2
call fcn.005acd10
aeskeygenassist xmm1, xmm0, 2
call fcn.005acd30
aeskeygenassist xmm1, xmm2, 4
call fcn.005acd10
aeskeygenassist xmm1, xmm0, 4
call fcn.005acd30
aeskeygenassist xmm1, xmm2, 8
call fcn.005acd10
aeskeygenassist xmm1, xmm0, 8
call fcn.005acd30
aeskeygenassist xmm1, xmm2, 0x10
call fcn.005acd10
aeskeygenassist xmm1, xmm0, 0x10
call fcn.005acd30
aeskeygenassist xmm1, xmm2, 0x20
call fcn.005acd10
aeskeygenassist xmm1, xmm0, 0x20
call fcn.005acd30
aeskeygenassist xmm1, xmm2, 0x40
call fcn.005acd10
movups xmmword [rax], xmm0
mov dword [rax + 0x10], edx
xor rax, rax
jmp 0x5acc87
mov rax, 0xfffffffffffffffe
add rsp, 8
repz ret
Function at 0x5adca0
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x140
cmp ecx, 3
mov ebx, ecx
mov r12, rdx
mov rbp, r8
mov rdi, r9
je 0x5addc0
cmp ecx, 6
je 0x5add53
lea rsi, [rsp + 0x30]
mov rdx, rsi
call fcn.005ad4e0
test eax, eax
js 0x5add22
mov r8, r12
mov edx, ebp
mov rcx, qword [rsp + 0x108]
mov dword [rsp + 0x110], ebx
call qword [rsp + 0x120]
mov r8, qword [rsp + 0x118]
mov rdx, rdi
mov rcx, rsi
call fcn.005adc20
mov rcx, rsi
call qword [sub.msvcrt.dll_free]
xor eax, eax
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp dword [0x007f0400], 1
jle 0x5add14
lea r8, str.sha_padlock.c
lea rdx, [0x007978ee]
mov r9d, 0x166
mov ecx, 2
mov dword [rsp + 0x2c], eax
call fcn.0051c740
mov eax, dword [rsp + 0x2c]
jmp 0x5add14
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x6a09e667
mov dword [rsp + 0x34], 0xbb67ae85
mov dword [rsp + 0x38], 0x3c6ef372
mov dword [rsp + 0x3c], 0xa54ff53a
mov rcx, rbx
mov dword [rsp + 0x40], 0x510e527f
mov dword [rsp + 0x44], 0x9b05688c
mov dword [rsp + 0x48], 0x1f83d9ab
mov dword [rsp + 0x4c], 0x5be0cd19
call fcn.005aead0
mov r8, rbx
mov rdx, rdi
mov ecx, 0x20
call fcn.005ad450
xor eax, eax
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
mov rcx, rbx
mov dword [rsp + 0x40], 0xc3d2e1f0
call fcn.005aea10
mov r8, rbx
mov rdx, rdi
mov ecx, 0x14
call fcn.005ad450
xor eax, eax
jmp 0x5add14
Function at 0x5af130
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov esi, dword [rsp + 0x130]
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
mov r12, r9
test esi, esi
jne 0x5af180
cmp dword [0x007f0400], 1
jg 0x5af3c9
mov eax, 0xffffffce
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp qword [rsp + 0x140], 0
jne 0x5af1b4
cmp dword [0x007f0400], 1
jle 0x5af167
mov r9d, 0x4f
lea r8, str.pbkdf2_sha1.c
lea rdx, str.ASSERT:__s:_d_n
mov ecx, 2
call fcn.0051c740
jmp 0x5af167
mov eax, 0xffffffff
cmp qword [rsp + 0x140], rax
jbe 0x5af1d4
cmp dword [0x007f0400], 1
jle 0x5af167
mov r9d, 0x5c
jmp 0x5af19a
lea rax, [r9 + 4]
mov qword [rsp + 0x68], rax
mov rcx, rax
call qword [fcn.005498f0]
test rax, rax
mov qword [rsp + 0x60], rax
je 0x5af368
mov rax, qword [rsp + 0x140]
movabs rdx, 0xcccccccccccccccd
mov rcx, qword [rsp + 0x60]
mov r8, r12
mov r14d, 1
lea r13, [rax - 1]
mov rax, r13
mul rdx
mov r13, rdx
mov rdx, rbx
lea rbx, [rsp + 0xa0]
shr r13, 4
lea eax, [r13 + 1]
mov dword [rsp + 0x74], eax
call sub.msvcrt.dll_memcpy
lea eax, [r13 + r13*4]
mov ecx, dword [rsp + 0x140]
lea r13, [rsp + 0x80]
shl eax, 2
sub ecx, eax
mov rax, r13
mov r13, r12
mov qword [rsp + 0x78], rcx
mov r12, rax
mov eax, r14d
mov r15d, r14d
mov qword [rbx], 0
shr eax, 0x18
and r15d, 0xff0000
mov qword [rbx + 8], 0
mov dword [rsp + 0x30], eax
mov eax, r14d
shr r15d, 0x10
shr eax, 8
mov dword [rsp + 0x40], r15d
mov dword [rbx + 0x10], 0
mov dword [rsp + 0x50], eax
mov r15d, 1
nop word [rax + rax]
cmp r15d, 1
je 0x5af37b
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0x14
mov r9, r12
mov r8d, ebp
mov rdx, rdi
mov ecx, 3
call fcn.005393e0
test eax, eax
js 0x5af350
xor eax, eax
movzx edx, byte [r12 + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, 0x14
jne 0x5af2e1
add r15d, 1
cmp esi, r15d
jae 0x5af2b0
mov r15d, dword [rsp + 0x74]
mov rdx, rbx
cmp r14d, r15d
cmove rax, qword [rsp + 0x78]
mov r8, rax
lea eax, [r14 + r14*4]
add r14d, 1
lea ecx, [rax*4 - 0x14]
add rcx, qword [rsp + 0x138]
call sub.msvcrt.dll_memcpy
cmp r15d, r14d
jae 0x5af264
mov rcx, qword [rsp + 0x60]
call qword [sub.msvcrt.dll_free]
xor eax, eax
jmp 0x5af16c
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x60]
call qword [sub.msvcrt.dll_free]
mov eax, dword [rsp + 0x30]
jmp 0x5af16c
cmp dword [0x007f0400], 1
jg 0x5af3d4
mov eax, 0xffffffe7
jmp 0x5af16c
movzx ecx, byte [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov r8d, ebp
mov rdx, rdi
mov byte [rax + r13 + 3], r14b
mov r9, rax
mov byte [rax + r13], cl
movzx ecx, byte [rsp + 0x40]
mov byte [rax + r13 + 1], cl
movzx ecx, byte [rsp + 0x50]
mov byte [rax + r13 + 2], cl
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rcx
mov ecx, 3
call fcn.005393e0
jmp 0x5af2db
mov r9d, 0x49
jmp 0x5af19a
lea r8, str.pbkdf2_sha1.c
lea rdx, str.ASSERT:__s:_d_n
mov r9d, 0x9c
mov ecx, 2
call fcn.0051c740
mov eax, 0xffffffe7
jmp 0x5af16c