joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ffbf1d040e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor ebp, ebp
mov rsi, r8
mov r15, rcx
and dword [rsp + 0x30], ebp
mov r14, rdx
lea rcx, [rsp + 0x34]
lea r8d, [rbp + 0x58]
xor edx, edx
mov ebx, r9d
mov qword [rsp + 0x20], rbp
call fcn.7ffbf1cc1ab4
mov edi, ebx
shr edi, 3
test bl, 7
je 0x7ffbf1d04138
inc edi
mov r13d, edi
shl r13d, 3
sub r13d, ebx
cmp edi, 0x16
jae 0x7ffbf1d04151
mov ebx, 0x80070057
jmp 0x7ffbf1d042d2
lea eax, [rdi - 1]
cmp byte [rax + rsi], 0xbc
jne 0x7ffbf1d04147
mov ecx, 0x1c
call fcn.7ffbf1d1ed78
mov r12, rax
test rax, rax
jne 0x7ffbf1d04176
mov ebx, 0x80000002
jmp 0x7ffbf1d042b8
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [r12], rax
call fcn.7ffbf1cd5304
mov ecx, dword [r14]
mov edx, dword [r14 + 4]
lea r8, [rsp + 0x30]
add rcx, r15
call fcn.7ffbf1cd5340
lea rdx, [r12 + 8]
lea rcx, [rsp + 0x30]
call fcn.7ffbf1cd55e0
lea r14d, [rdi - 0x15]
mov ecx, 8
sub ecx, r13d
mov r15d, 0xff
mov edi, r14d
mov edx, r15d
add rdi, rsi
shl dl, cl
test byte [rsi], dl
je 0x7ffbf1d041d4
mov ebx, 0x80070057
jmp 0x7ffbf1d042b8
lea r9, [rsp + 0x20]
mov r8d, r14d
mov edx, 0x14
mov rcx, rdi
call fcn.7ffbf1cfc2dc
nop
lodsb al, byte [rsi]
add dword [rax], eax
loopne 0x7ffbf1d04234
cmp al, byte [rsi]
nop
mov rbp, qword [rsp + 0x20]
mov ebx, eax
test eax, eax
js 0x7ffbf1d042b8
test r14d, r14d
je 0x7ffbf1d04220
mov rcx, rbp
mov rdx, rsi
mov r8d, r14d
sub rcx, rsi
mov al, byte [rdx + rcx]
xor byte [rdx], al
inc rdx
sub r8, 1
jne 0x7ffbf1d04212
mov ecx, r13d
lea edx, [r14 - 1]
sar r15d, cl
xor ecx, ecx
and byte [rsi], r15b
test edx, edx
je 0x7ffbf1d04244
mov rax, rsi
mov eax, esi
cmp byte [rax], 0
jne 0x7ffbf1d0424a
inc ecx
inc rax
cmp ecx, edx
jb 0x7ffbf1d04236
cmp byte [rdx + rsi], 1
je 0x7ffbf1d04251
mov ebx, 0x80004005
jmp 0x7ffbf1d042b8
lea rcx, [rsp + 0x30]
call fcn.7ffbf1cd5304
lea r8, [rsp + 0x30]
mov edx, 0x1c
mov rcx, r12
call fcn.7ffbf1cd5340
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.7ffbf1cd55e0
mov rcx, qword [rdi]
lea rax, [rsp + 0x90]
cmp rcx, qword [rax]
jne 0x7ffbf1d042a5
mov rcx, qword [rdi + 8]
cmp rcx, qword [rax + 8]
jne 0x7ffbf1d042a5
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
jne 0x7ffbf1d042a5
xor ecx, ecx
jmp 0x7ffbf1d042aa
sbb ecx, ecx
sbb ecx, 0xffffffff
mov eax, ebx
mov ebx, 0x80004005
test ecx, ecx
cmovne eax, ebx
mov ebx, eax
test r12, r12
je 0x7ffbf1d042c5
mov rcx, r12
call fcn.7ffbf1d1ed9c
test rbp, rbp
je 0x7ffbf1d042d2
mov rcx, rbp
call fcn.7ffbf1d1ed9c
mov eax, ebx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.7ffbf1d2cc34
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ffbf1d0f1d8
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
cmp edx, 8
movzx r12d, byte [rcx + 0x100]
movzx r10d, byte [rcx + 0x101]
mov rsi, r8
mov ebp, edx
mov rbx, rcx
jae 0x7ffbf1d0f202
mov edi, edx
jmp 0x7ffbf1d0f33b
mov r9d, r8d
neg r9d
and r9d, 3
sub ebp, r9d
test r9d, r9d
je 0x7ffbf1d0f24e
lea eax, [r12 + 1]
movzx r12d, al
movzx edx, byte [r12 + rbx]
lea eax, [rdx + r10]
movzx r10d, al
mov al, byte [r10 + rbx]
mov byte [r12 + rbx], al
mov byte [r10 + rbx], dl
mov al, byte [r12 + rbx]
add eax, edx
movzx eax, al
mov cl, byte [rax + rbx]
xor byte [rsi], cl
add rsi, 1
add r9d, 0xffffffff
jne 0x7ffbf1d0f214
mov edi, ebp
and edi, 3
sub ebp, edi
je 0x7ffbf1d0f33b
mov r11d, dword [rsi]
lea eax, [r12 + 1]
movzx r9d, al
movzx edx, byte [r9 + rbx]
lea eax, [rdx + r10]
movzx r10d, al
mov al, byte [r10 + rbx]
mov byte [r9 + rbx], al
mov byte [r10 + rbx], dl
mov al, byte [r9 + rbx]
add eax, edx
movzx eax, al
movzx ecx, byte [rax + rbx]
lea eax, [r9 + 1]
movzx r9d, al
xor r11d, ecx
movzx edx, byte [r9 + rbx]
lea eax, [rdx + r10]
movzx r10d, al
mov al, byte [r10 + rbx]
mov byte [r9 + rbx], al
mov byte [r10 + rbx], dl
mov al, byte [r9 + rbx]
add eax, edx
movzx eax, al
movzx ecx, byte [rax + rbx]
lea eax, [r9 + 1]
movzx r9d, al
shl ecx, 8
movzx edx, byte [r9 + rbx]
xor r11d, ecx
lea eax, [rdx + r10]
movzx r10d, al
mov al, byte [r10 + rbx]
mov byte [r9 + rbx], al
mov byte [r10 + rbx], dl
mov al, byte [r9 + rbx]
add eax, edx
movzx eax, al
movzx ecx, byte [rax + rbx]
lea eax, [r9 + 1]
movzx r12d, al
shl ecx, 0x10
movzx edx, byte [r12 + rbx]
xor r11d, ecx
lea eax, [rdx + r10]
movzx r10d, al
mov al, byte [r10 + rbx]
mov byte [r12 + rbx], al
mov byte [r10 + rbx], dl
mov al, byte [r12 + rbx]
add eax, edx
movzx eax, al
movzx ecx, byte [rax + rbx]
shl ecx, 0x18
xor ecx, r11d
mov dword [rsi], ecx
add rsi, 4
add ebp, 0xfffffffc
jne 0x7ffbf1d0f25b
test edi, edi
je 0x7ffbf1d0f378
lea eax, [r12 + 1]
movzx r12d, al
movzx edx, byte [r12 + rbx]
lea eax, [rdx + r10]
movzx r10d, al
mov al, byte [r10 + rbx]
mov byte [r12 + rbx], al
mov byte [r10 + rbx], dl
mov al, byte [r12 + rbx]
add eax, edx
movzx eax, al
mov cl, byte [rax + rbx]
xor byte [rsi], cl
add rsi, 1
add edi, 0xffffffff
jne 0x7ffbf1d0f33f
mov byte [rbx + 0x100], r12b
mov byte [rbx + 0x101], r10b
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ffbf1d0f390
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov rdi, r8
mov r11d, 8
movabs r8, 0xf8f9fafbfcfdfeff
mov r10, rcx
mov esi, edx
lea r9, [rsp + 0x28]
mov qword [rsp + 0x28], r8
mov rcx, r11
mov al, byte [r9]
not al
mov byte [r9], al
add r9, 1
sub rcx, 1
jne 0x7ffbf1d0f3b9
mov rdx, qword [rsp + 0x28]
movabs rax, 0xf0f1f2f3f4f5f6f7
xor ebp, ebp
mov qword [rsp + 0x40], r8
mov r8, r11
mov qword [rsp + 0x28], rax
mov rcx, rbp
mov al, byte [rsp + rcx + 0x40]
add rcx, 1
xor byte [rsp + rcx + 0x27], al
sub r8, 1
jne 0x7ffbf1d0f3ec
mov rax, r10
lea ecx, [r8 + 0x20]
mov qword [rax], rdx
add rdx, qword [rsp + 0x28]
add rax, r11
sub rcx, 1
jne 0x7ffbf1d0f405
mov byte [r10 + 0x100], bpl
mov byte [r10 + 0x101], bpl
mov r8b, bpl
mov r11b, bpl
mov r9, r10
mov ebx, 0x100
mov dl, byte [r9]
movzx eax, r8b
add r8b, 1
mov cl, byte [rax + rdi]
add cl, dl
add r11b, cl
movzx ecx, r11b
mov al, byte [rcx + r10]
mov byte [r9], al
movzx eax, r8b
add r9, 1
cmp eax, esi
movzx r8d, r8b
mov byte [rcx + r10], dl
cmove r8d, ebp
sub rbx, 1
jne 0x7ffbf1d0f432
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x7ffbf1d1e494
Capabilities:
Encode data using xor

Disassembly:
or edx, edx
je 0x7ffbf1d1e4e8
movzx r10, byte [rcx + 0x100]
movzx r11, byte [rcx + 0x101]
add r8, rdx
neg rdx
xor r9d, r9d
nop dword [rax]
inc r10b
mov al, byte [rcx + r10]
add r11b, al
mov r9b, byte [r11 + rcx]
mov byte [r10 + rcx], r9b
add r9b, al
mov byte [r11 + rcx], al
mov al, byte [r9 + rcx]
xor byte [rdx + r8], al
inc rdx
jne 0x7ffbf1d1e4b4
mov byte [rcx + 0x100], r10b
mov byte [rcx + 0x101], r11b
ret
Function at 0x7ffbf1d2cc34
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x7ffbf1d6ab50]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov r11, qword [0x7ffbf1d6ac48]
mov qword [rsp + 0x58], r11
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x7ffbf1cc18ed
xor ecx, ecx
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x7ffbf1d6ab50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x7ffbf1cc190f
mov rax, qword [rsp + 0x88]
mov qword [0x7ffbf1d6ac48], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x7ffbf1d6abe8], rax
mov rax, qword [0x7ffbf1d6ac48]
xor ecx, ecx
mov qword [0x7ffbf1d68e20], rax
mov rax, qword [rsp + 0x90]
mov qword [0x7ffbf1d6abd0], rax
mov dword [0x7ffbf1d68e10], 0xc0000409
mov dword [0x7ffbf1d68e14], 1
mov rax, qword [0x7ffbf1d68270]
mov qword [rsp + 0x68], rax
mov rax, qword [0x7ffbf1d6a548]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x7ffbf1cf9310]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
cmp rcx, qword [0x7ffbf1d68270]
jne 0x7ffbf1d2cc4f
rol rcx, 0x10
test cx, 0xffff
jne 0x7ffbf1d2cc4b
ret 0
ror rcx, 0x10
jmp 0x7ffbf1cc1868

Function at 0x7ffbf1d2e0bc
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rbx, r9
xor r10d, r10d
mov r11, rdx
cmp rbx, r10
mov r9, rcx
je 0x7ffbf1d2e0ff
sub r9, rdx
sub r8, rdx
mov ecx, dword [r9 + r11]
mov edx, dword [r11]
lea eax, [rcx + rdx]
add r10d, eax
mov eax, edx
or edx, ecx
mov dword [r8 + r11], r10d
xor eax, ecx
add r11, 4
and r10d, eax
xor r10d, edx
shr r10d, 0x1f
sub rbx, 1
jne 0x7ffbf1d2e0d4
mov eax, r10d
pop rbx
ret

Function at 0x7ffbf1d2e104
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov r12, qword [rsp + 0x50]
xor eax, eax
mov rdi, r9
cmp r12, rax
mov rsi, r8
mov r11, rdx
mov rbp, rcx
mov ebx, eax
je 0x7ffbf1d2e17b
sub rbp, rdx
sub rsi, rdx
sub rdi, rdx
mov r8d, dword [r11 + rbp]
mov edx, dword [r11]
mov r9d, dword [rsi + r11]
lea r10d, [rdx + r8]
add r10d, eax
mov eax, r10d
mov ecx, r10d
sub eax, r9d
xor ecx, edx
sub eax, ebx
mov ebx, eax
mov dword [rdi + r11], eax
mov eax, r10d
xor eax, r8d
xor ebx, r10d
add r11, 4
or eax, ecx
mov ecx, r10d
xor ecx, r9d
xor eax, r10d
or ebx, ecx
shr eax, 0x1f
xor ebx, r10d
shr ebx, 0x1f
sub r12, 1
jne 0x7ffbf1d2e12d
sub eax, ebx
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ffbf1d2e430
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov rbx, r9
xor r10d, r10d
mov r11, rdx
cmp rbx, r10
mov r9, rcx
je 0x7ffbf1d2e472
sub r9, rdx
sub r8, rdx
mov ecx, dword [r9 + r11]
mov eax, dword [r11]
mov edx, ecx
sub edx, eax
xor eax, ecx
sub edx, r10d
mov dword [r8 + r11], edx
xor edx, ecx
add r11, 4
or edx, eax
xor edx, ecx
shr edx, 0x1f
sub rbx, 1
mov r10d, edx
jne 0x7ffbf1d2e448
mov eax, r10d
pop rbx
ret
Function at 0x7ffbf1d3efd8
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov esi, dword [rcx + 0x58]
mov ebx, 0x40
mov rbp, rdx
mov eax, esi
mov rdi, rcx
and eax, 0x3f
sub ebx, eax
cmp ebx, 8
ja 0x7ffbf1d3f009
add ebx, 0x40
lea r8d, [rbx - 8]
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.7ffbf1cc1ab4
mov ecx, dword [rdi + 0x54]
mov eax, esi
shr eax, 0x1d
shl ecx, 3
lea rdx, [rsp + 0x80]
or ecx, eax
lea eax, [rsi*8]
mov r8d, 2
mov dword [rsp + 0x80], ecx
lea rcx, [rsp + rbx + 0x18]
mov byte [rsp + 0x20], 0x80
mov dword [rsp + 0x84], eax
call fcn.7ffbf1d419f8
lea rdx, [rsp + 0x20]
mov r8d, ebx
mov rcx, rdi
call fcn.7ffbf1d3ef10
lea rdx, [rdi + 0x40]
mov r8d, 5
mov rcx, rbp
call fcn.7ffbf1d419f8
xor r11d, r11d
xor eax, eax
mov qword [rdi], r11
mov qword [rdi + 8], r11
mov qword [rdi + 0x10], r11
mov qword [rdi + 0x18], r11
mov qword [rdi + 0x20], r11
mov qword [rdi + 0x28], r11
mov qword [rdi + 0x30], r11
mov qword [rdi + 0x38], r11
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov dword [rdi + 0x54], eax
mov dword [rdi + 0x58], eax
mov dword [rdi + 0x40], 0x67452301
mov dword [rdi + 0x44], 0xefcdab89
mov dword [rdi + 0x48], 0x98badcfe
mov dword [rdi + 0x4c], 0x10325476
mov dword [rdi + 0x50], 0xc3d2e1f0
mov rsp, r11
pop rdi
ret

Function at 0x7ffbf1d3f0e0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x20], eax
mov dword [rcx + 0x24], eax
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x7ffbf1d40710
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov esi, dword [rcx + 0x24]
mov edi, 0x40
mov rbp, rdx
mov eax, esi
mov rbx, rcx
and eax, 0x3f
sub edi, eax
cmp edi, 8
ja 0x7ffbf1d4074e
add edi, 0x40
lea r8d, [rdi - 8]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.7ffbf1cc1ab4
mov edx, dword [rbx + 0x20]
mov eax, esi
shr eax, 0x1d
shl edx, 3
lea rcx, [rsp + rdi + 0x28]
or edx, eax
lea eax, [rsi*8]
mov r8d, 2
mov dword [rsp + 0x20], edx
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x30], 0x80
mov dword [rsp + 0x24], eax
call fcn.7ffbf1d419f8
lea rdx, [rsp + 0x30]
mov r8d, edi
mov rcx, rbx
call fcn.7ffbf1d405d4
mov r8d, 8
mov rdx, rbx
mov rcx, rbp
call fcn.7ffbf1d419f8
xor eax, eax
lea rdi, [rbx + 0x28]
mov ecx, 0x40
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x20], eax
mov dword [rbx + 0x24], eax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.7ffbf1d2cc34
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret

Function at 0x7ffbf1d40824
Capabilities:
Hash data using sha384

Disassembly:
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
ret

Function at 0x7ffbf1d408a0
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
ret
Function at 0x7ffbf1d416e8
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [rcx + 0x48]
mov ebx, 0x80
mov rsi, rdx
and eax, 0x7f
mov rdi, rcx
sub ebx, eax
cmp ebx, 0x10
ja 0x7ffbf1d41727
sub ebx, 0xffffff80
lea r8d, [rbx - 0x10]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.7ffbf1cc1ab4
mov rdx, qword [rdi + 0x48]
mov rax, qword [rdi + 0x40]
shl rax, 3
mov rcx, rdx
mov byte [rsp + 0x30], 0x80
shr rcx, 0x3d
or rcx, rax
lea rax, [rdx*8]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov eax, ebx
mov qword [rsp + 0x20], rcx
sub rax, rdx
lea rcx, [rsp + 0x20]
mov edx, 2
lea r8, [rsp + rax + 0x20]
nop word [rax + rax]
mov rax, qword [rcx]
add rcx, 8
sub rdx, 1
bswap rax
mov qword [r8 + rcx - 8], rax
jne 0x7ffbf1d41782
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rdi
call fcn.7ffbf1d415dc
mov rdx, rdi
sub rsi, rdi
mov ecx, 8
mov rax, qword [rdx]
add rdx, 8
sub rcx, 1
bswap rax
mov qword [rsi + rdx - 8], rax
jne 0x7ffbf1d417b2
movabs rax, 0x6a09e667f3bcc908
mov ecx, 0x80
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
xor eax, eax
add rdi, 0x50
mov qword [rdi - 0x10], rax
mov qword [rdi - 8], rax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.7ffbf1d2cc34
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x7ffbf1d41870
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [rcx + 0x48]
mov ebx, 0x80
mov rsi, rdx
and eax, 0x7f
mov rdi, rcx
sub ebx, eax
cmp ebx, 0x10
ja 0x7ffbf1d418af
sub ebx, 0xffffff80
lea r8d, [rbx - 0x10]
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.7ffbf1cc1ab4
mov rdx, qword [rdi + 0x48]
mov rax, qword [rdi + 0x40]
shl rax, 3
mov rcx, rdx
mov byte [rsp + 0x30], 0x80
shr rcx, 0x3d
or rcx, rax
lea rax, [rdx*8]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov eax, ebx
mov qword [rsp + 0x20], rcx
sub rax, rdx
lea rcx, [rsp + 0x20]
mov edx, 2
lea r8, [rsp + rax + 0x20]
nop word [rax + rax]
mov rax, qword [rcx]
add rcx, 8
sub rdx, 1
bswap rax
mov qword [r8 + rcx - 8], rax
jne 0x7ffbf1d4190a
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rdi
call fcn.7ffbf1d415dc
mov rdx, rdi
sub rsi, rdi
mov ecx, 6
mov rax, qword [rdx]
add rdx, 8
sub rcx, 1
bswap rax
mov qword [rsi + rdx - 8], rax
jne 0x7ffbf1d4193a
movabs rax, 0x6a09e667f3bcc908
mov ecx, 0x80
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
xor eax, eax
add rdi, 0x50
mov qword [rdi - 0x10], rax
mov qword [rdi - 8], rax
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.7ffbf1d2cc34
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x415a00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415b8b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432fc0
xorps xmm15, xmm15
mov r14, qword [0x006e9050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415a65
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415a74
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415a93
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415aa3
cmp rbx, 0x1000
jae 0x415a6b
jmp 0x415b0d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415ab5
xor edx, edx
jmp 0x415b04
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432fc0
xorps xmm15, xmm15
mov r14, qword [0x006e9050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415a99
jmp 0x415a88
call fcn.00465140
xorps xmm15, xmm15
mov r14, qword [0x006e9050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437560
lea rax, [0x00571338]
mov ebx, 0x18
nop dword [rax]
call fcn.00437de0
mov rax, qword [rsp + 0x38]
call fcn.00437b20
lea rax, [0x005718f5]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437de0
mov rax, qword [rsp + 0x30]
call fcn.00437b20
call fcn.004377a0
call fcn.004375c0
lea rax, [0x00574570]
mov ebx, 0x21
call fcn.00435bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415a00
Function at 0x415bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415de6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433040
xorps xmm15, xmm15
mov r14, qword [0x006e9050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415c33
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415c42
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415c65
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415c75
cmp rbx, 0x1000
jae 0x415c39
nop
jmp 0x415cf8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x415c8d
xor esi, esi
jmp 0x415cea
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00433040
xorps xmm15, xmm15
mov r14, qword [0x006e9050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415c6b
jmp 0x415c56
call fcn.00465140
xorps xmm15, xmm15
mov r14, qword [0x006e9050]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415d80
nop dword [rax + rax]
call fcn.00437560
lea rax, [0x0057190e]
mov ebx, 0x19
call fcn.00437de0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00437b20
lea rax, [0x005718f5]
mov ebx, 0x19
call fcn.00437de0
mov eax, dword [rsp + 0x34]
call fcn.00437b20
nop
call fcn.004377a0
call fcn.004375c0
lea rax, [0x0056da0f]
mov ebx, 0xd
call fcn.00435bc0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415d20
call fcn.00437560
lea rax, [0x0057190e]
mov ebx, 0x19
call fcn.00437de0
mov rax, qword [rsp + 0x38]
call fcn.00437b20
lea rax, [0x005718f5]
mov ebx, 0x19
call fcn.00437de0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00437b20
call fcn.004377a0
call fcn.004375c0
lea rax, [0x00573bf2]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00435bc0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415bc0