joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428480
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x428726
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
test byte [rax], al
lea rsi, [rax + 0x1270]
mov rcx, qword [rax + 0x1260]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42871a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1260], 0
cmp byte [0x00511daf], 0
jne 0x4284e2
xor edx, edx
xor ebx, ebx
nop
jmp 0x42852b
xor edx, edx
jmp 0x42850e
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1270]
mov rax, rcx
call fcn.00418f00
mov rcx, qword [rsp + 0x28]
lea rdx, [rcx + 1]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x4284e6
add rax, 0x1260
call fcn.00428300
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
inc rdx
cmp rdx, rcx
jge 0x4286b2
mov rsi, qword [rax + rdx*8 + 0x1270]
nop dword [rax]
cmp rsi, 0x1000
jb 0x428528
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
nop dword [rax + rax]
call fcn.0040e660
test rax, rax
jne 0x428582
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x428528
nop
mov rsi, rcx
shr rcx, 3
and esi, 7
mov rdx, rcx
mov rcx, rsi
mov r8d, 1
shl r8d, cl
nop
add rdx, qword [rbx + 0x50]
movzx esi, byte [rdx]
test r8b, sil
je 0x4285c5
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop dword [rax]
jmp 0x428528
nop
lock or byte [rdx], r8b
nop
nop
mov rcx, qword [rbx + 0x18]
nop
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
cmp r8, 0x40
jae 0x42870d
lea r10, [0x004e4210]
mov r8, qword [r10 + r8*8]
shr r9, 0x16
and r9d, 0xfffff
mov r9, qword [r8 + r9*8]
test byte [r9], al
test byte [r8], al
mov r8, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx r10d, byte [r9 + rcx + 0x21040]
lea r9, [r9 + rcx]
lea r9, [r9 + 0x21040]
shr r8, 0xd
and r8d, 7
mov rcx, r8
mov r8d, 1
shl r8d, cl
test r8b, r10b
jne 0x42864b
lock or byte [r9], r8b
movzx r8d, byte [rbx + 0x62]
test r8b, 1
je 0x428685
mov r8, qword [rsp + 0x48]
mov r9, qword [r8 + 0x1248]
add r9, qword [rbx + 0x68]
mov qword [r8 + 0x1248], r9
mov rax, r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
nop
jmp 0x428528
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x428705
mov r9, qword [rsp + 0x48]
mov qword [r9 + r8*8 + 0x1270], rax
lea rbx, [r8 + 1]
mov rax, r9
mov rdx, qword [rsp + 0x28]
jmp 0x428528
cmp rbx, 0x200
ja 0x4286f7
lea rdx, [rax + 0x1270]
lea rsi, [rax + 0x1238]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.0041eb20
mov rdx, qword [rsp + 0x48]
lea rax, [rdx + 0x1260]
call fcn.00428300
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov rcx, rbx
mov edx, 0x200
nop
call fcn.00454d60
mov rax, r8
call fcn.00454ce0
mov rax, r8
mov ecx, 0x40
call fcn.00454d00
mov edx, 0x200
nop
call fcn.00454d40
nop
mov qword [rsp + 8], rax
call fcn.00456ce0
mov rax, qword [rsp + 8]
jmp fcn.00428480
Function at 0x4460a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x446218
movzx edx, byte [rax]
nop
test edx, edx
jne 0x4460dc
test r8b, r8b
jne 0x4460dc
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x4460ef
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4461d8
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x4461c6
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x4461bc
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x446143
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x446186
mov eax, 1
cmp rax, rbx
ja 0x446175
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.00454da0
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x4461b4
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44617d
mov r8d, eax
mov eax, r10d
jmp 0x446148
mov rcx, rbx
call fcn.00454ce0
xor eax, eax
mov rcx, rbx
call fcn.00454ce0
mov eax, r8d
mov rcx, rbx
call fcn.00454da0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44620e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x4461d1
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4460f5
mov eax, edx
mov rcx, rbx
call fcn.00454ce0
xor eax, eax
mov rcx, rbx
nop dword [rax]
call fcn.00454ce0
nop
int3
Function at 0x44d840
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44d8fb
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0044d940]
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00452500
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00452640
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044d840
Function at 0x4547a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00512000]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00511dae], 0
je 0x4547d6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005122c0]
aesenc xmm0, xmmword [0x005122d0]
aesenc xmm0, xmmword [0x005122e0]
movq rax, xmm0
ret
jmp 0x408440

Function at 0x4560c0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00512240]
mov qword [rsp + 8], rdx
lea r8d, [0x00511dc4]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.004546a0
add rsp, 0x30
ret

Function at 0x140001000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x30], rax
movzx eax, word [rsp + 0x60]
mov r8d, 0xa
mov edx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1400010a0
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
mov qword [rax], rcx
mov eax, dword [rsp + 0x20]
add rsp, 0x58
ret

Function at 0x140001b88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bd2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bd2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bd2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bd2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bd2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bd4
xor al, al
add rsp, 0x28
ret
Function at 0x6e5a50
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rbx
mov r10d, 0x80000000
mov r11d, ecx
test ecx, ecx
je 0x6e5ac9
mov ebx, 3
lea rsi, [0x023d7600]
jmp 0x6e5a78
add ebx, 1
sar r11d, 1
je 0x6e5ac9
test r11b, 1
je 0x6e5a70
mov eax, ebx
mov edx, 0x80000000
and eax, 0x1f
mov r9d, dword [rsi + rax*4]
mov eax, r10d
xor r10d, r10d
jmp 0x6e5ab1
mov r8d, eax
shr eax, 1
mov ecx, eax
and r8d, 1
shr edx, 1
xor ecx, 0xedb88320
test r8d, r8d
cmovne eax, ecx
test r9d, edx
je 0x6e5a98
lea ecx, [rdx - 1]
xor r10d, eax
test ecx, r9d
jne 0x6e5a98
add ebx, 1
sar r11d, 1
jne 0x6e5a78
mov eax, r10d
pop rbx
pop rsi
ret
Function at 0x70e300
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
sub rsp, 0x30
mov edx, 1
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov r12d, eax
test eax, eax
je 0x70e330
xor r12d, r12d
mov eax, r12d
add rsp, 0x30
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
cmp eax, 5
jne 0x70e35a
lea rdx, [rsp + 0x2c]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x70e35a
cmp dword [rsp + 0x2c], 0x103
jne 0x70e322
mov r12d, 0xffffffff
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.012341f0
mov eax, r12d
add rsp, 0x30
pop r12
pop r13
pop r14
ret

Function at 0x77f120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push r14
push rdi
push rsi
push rbx
mov r10, rdx
not r8d
cmp rdx, 8
jbe 0x77f21e
test cl, 7
je 0x77f16a
mov rdx, qword [0x02471f80]
lea rax, [rcx + r10]
nop dword [rax]
movzx r9d, byte [rcx]
add rcx, 1
mov r10, rax
sub r10, rcx
xor r9d, r8d
shr r8d, 8
movzx r9d, r9b
xor r8d, dword [rdx + r9*4]
test cl, 7
jne 0x77f148
mov rbx, r10
and r10d, 7
and rbx, 0xfffffffffffffff8
lea r14, [rbx + rcx]
cmp r14, rcx
jbe 0x77f21e
mov rdx, qword [0x02471f80]
mov r11, rcx
nop dword [rax]
mov r9d, dword [r11 + 4]
mov eax, dword [r11]
add r11, 8
mov edi, r9d
xor eax, r8d
movzx r8d, r9b
mov ebx, r9d
shr edi, 0x18
mov r8d, dword [rdx + r8*4 + 0xc00]
mov esi, eax
shr r9d, 0x10
xor r8d, dword [rdx + rdi*4]
movzx edi, al
shr esi, 0x10
movzx r9d, r9b
xor r8d, dword [rdx + rdi*4 + 0x1c00]
mov edi, eax
movzx esi, sil
movzx eax, ah
shr edi, 0x18
xor r8d, dword [rdx + rdi*4 + 0x1000]
movzx edi, bh
xor r8d, dword [rdx + rdi*4 + 0x800]
xor r8d, dword [rdx + r9*4 + 0x400]
xor r8d, dword [rdx + rax*4 + 0x1800]
xor r8d, dword [rdx + rsi*4 + 0x1400]
cmp r14, r11
ja 0x77f190
mov rax, rcx
not rax
lea rbx, [r14 + rax]
shr rbx, 3
lea rcx, [rcx + rbx*8 + 8]
test r10, r10
je 0x77f24c
mov rdx, qword [0x02471f80]
add r10, rcx
nop dword [rax]
movzx r9d, byte [rcx]
add rcx, 1
xor r9d, r8d
shr r8d, 8
movzx r9d, r9b
xor r8d, dword [rdx + r9*4]
cmp rcx, r10
jne 0x77f230
mov eax, r8d
not eax
pop rbx
pop rsi
pop rdi
pop r14
ret
Function at 0x77f260
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r10, rcx
mov rbx, rdx
not r8
cmp rdx, 4
jbe 0x77f32d
test cl, 3
je 0x77f364
mov r11, qword [0x02471f90]
add rcx, rdx
nop dword [rax + rax]
movzx edx, byte [r10]
add r10, 1
mov rax, rcx
sub rax, r10
xor edx, r8d
shr r8, 8
movzx edx, dl
xor r8, qword [r11 + rdx*8]
test r10b, 3
jne 0x77f290
mov rsi, rax
and eax, 3
and rsi, 0xfffffffffffffffc
mov rbx, rax
add rsi, r10
cmp rsi, r10
jbe 0x77f32d
mov r11, qword [0x02471f90]
mov r9, r10
nop dword [rax]
mov edx, dword [r9]
add r9, 4
xor edx, r8d
shr r8, 0x20
mov eax, edx
movzx ecx, dl
shr eax, 0x18
mov rcx, qword [r11 + rcx*8 + 0x1800]
xor rcx, qword [r11 + rax*8]
movzx eax, dh
shr edx, 0x10
movzx edx, dl
xor r8, rcx
xor r8, qword [r11 + rax*8 + 0x1000]
xor r8, qword [r11 + rdx*8 + 0x800]
cmp rsi, r9
ja 0x77f2d8
mov rax, r10
not rax
add rsi, rax
shr rsi, 2
lea r10, [r10 + rsi*4 + 4]
test rbx, rbx
je 0x77f35b
mov r11, qword [0x02471f90]
lea rax, [r10 + rbx]
nop dword [rax]
movzx edx, byte [r10]
add r10, 1
xor edx, r8d
shr r8, 8
movzx edx, dl
xor r8, qword [r11 + rdx*8]
cmp r10, rax
jne 0x77f340
mov rax, r8
not rax
pop rbx
pop rsi
ret
mov rax, rdx
jmp 0x77f2b2
Function at 0x78da70
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r11d, 8
mov r10d, dword [rsp + 0x30]
mov rax, rcx
mov ecx, dword [rcx + 0xb94]
and edx, dword [rax + 0xb98]
sub r11d, ecx
shl edx, cl
mov ecx, r11d
shr r8d, cl
add edx, r8d
lea rdx, [rdx + rdx*2]
shl rdx, 9
lea rbx, [rax + rdx + 0xb9c]
mov eax, dword [rsp + 0x38]
add eax, 0x100
test r9b, r9b
je 0x78db20
mov r11, qword [0x02472080]
mov r8d, 0x100
xor r9d, r9d
nop word [rax + rax]
add r10d, r10d
mov edx, eax
mov ecx, r8d
and ecx, r10d
shr edx, 8
add edx, ecx
mov ecx, eax
add eax, eax
add edx, r8d
shl ecx, 0x18
movzx edx, word [rbx + rdx*2]
sar ecx, 0x1f
and ecx, 0x7ff
xor edx, ecx
shr edx, 4
movzx edx, byte [r11 + rdx]
add r9d, edx
mov edx, r10d
xor edx, eax
not edx
and r8d, edx
cmp eax, 0xffff
jbe 0x78dad0
mov eax, r9d
pop rbx
ret
mov r11, qword [0x02472080]
xor r9d, r9d
nop word [rax + rax]
mov ecx, eax
shr eax, 1
and ecx, 1
mov edx, eax
movzx edx, word [rbx + rdx*2]
neg ecx
and ecx, 0x7ff
xor edx, ecx
shr edx, 4
movzx edx, byte [r11 + rdx]
add r9d, edx
cmp eax, 1
jne 0x78db30
mov eax, r9d
pop rbx
ret
Function at 0x8e7510
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, r8d
movzx r8d, r8b
cmp al, 0x18
je 0x8e7530
cmp al, 0x20
je 0x8e7550
cmp al, 0x10
je 0x8e7540
jmp 0x916e80
mov r9d, 0x10c
mov word [rcx], r9w
jmp 0x916e80
mov r10d, 0xa
mov word [rcx], r10w
jmp 0x916e80
mov eax, 0x20e
mov word [rcx], ax
jmp 0x916e80
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rax, rcx
mov r9, rdx
cmp r8b, 0x18
je 0x916ec0
cmp r8b, 0x20
je 0x916ff0
cmp r8b, 0x10
je 0x916fe0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rcx], 0xc
mov r14d, 0xd0
movzx edi, r8b
xor edx, edx
nop
movzx ecx, byte [r9 + rdx]
mov byte [rax + rdx + 8], cl
add rdx, 1
cmp edi, edx
jg 0x916ed0
movzx r9d, r8b
mov r13d, 1
lea r8, [rax + 8]
lea rcx, [rax + r9]
lea rbp, [0x023fc460]
lea r15, [0x023fc320]
cmp r9, r14
jb 0x916f90
jmp 0x916eac
movabs rax, 0xa0a0a0a0a0a0a0a1
movsxd r12, r13d
add r13d, 1
mul r12
shr rdx, 5
lea rax, [rdx + rdx*2]
mov rdx, rax
shl rdx, 4
add rax, rdx
sub r12, rax
movzx eax, sil
movzx esi, byte [rbp + r11]
movzx r11d, byte [rbp + r10]
movzx edx, byte [r15 + r12]
movzx r10d, byte [rbp + rbx]
movzx ebx, byte [rbp + rax]
xor ebx, edx
xor bl, byte [r8]
add r9, 4
add rcx, 4
add r8, 4
mov byte [rcx + 4], bl
movzx eax, byte [r8 - 3]
xor eax, esi
mov byte [rcx + 5], al
xor r11b, byte [r8 - 2]
mov byte [rcx + 6], r11b
xor r10b, byte [r8 - 1]
mov byte [rcx + 7], r10b
cmp r9, r14
jae 0x916eac
mov eax, r9d
movzx ebx, byte [rcx + 4]
movzx esi, byte [rcx + 5]
cdq
movzx r11d, byte [rcx + 6]
movzx r10d, byte [rcx + 7]
idiv edi
test edx, edx
je 0x916f10
cmp edx, 0x10
jne 0x916f5b
cmp edi, 0x20
jne 0x916f5b
movzx eax, sil
movzx ebx, byte [rbp + rbx]
movzx r11d, byte [rbp + r11]
movzx esi, byte [rbp + rax]
movzx r10d, byte [rbp + r10]
jmp 0x916f5b
mov byte [rcx], 0xa
mov r14d, 0xb0
jmp 0x916ec9
mov byte [rcx], 0xe
mov r14d, 0xf0
jmp 0x916ec9

Function at 0x8e7600
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov edi, dword [rsp + 0x80]
mov rax, qword [r8]
mov rbp, rdx
mov rbx, rcx
mov rdx, qword [r8 + 8]
mov rsi, r9
test edi, edi
je 0x8e5fc6
shl rdi, 4
lea r12, [rsp + 0x20]
add rdi, rcx
nop dword [rax]
xor rdx, qword [rsi + 8]
xor rax, qword [rsi]
mov r8, r12
mov rcx, r12
mov qword [rsp + 0x28], rdx
mov rdx, rbp
add rbx, 0x10
add rsi, 0x10
mov qword [rsp + 0x20], rax
call fcn.00916710
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov qword [rbx - 0x10], rax
mov qword [rbx - 8], rdx
cmp rdi, rbx
jne 0x8e5f88
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
jmp 0x8e5f50
Function at 0x8ea730
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor eax, eax
movsxd r8, r8d
mov r10, rcx
mov rcx, rdx
test r8d, r8d
je 0x8ea761
mov rdx, qword [rcx + rax*8]
xor qword [r10 + rax*8], rdx
add rax, 1
cmp r8, rax
jne 0x8ea750
mov qword [rsp], 1
lea rbx, [r10 + 8]
mov rax, qword [r10]
lea r14, [0x023eeb08]
mov qword [rsp + 8], rbx
lea r12, [r10 + 0xc8]
lea rsi, [rsp + 0x10]
mov ebp, 0xcccccccd
lea r13, [r10 + 0x28]
lea rbx, [0x023eeaa0]
lea r11, [0x023eea40]
nop
mov r9, qword [rsp + 8]
mov rdi, rsi
mov rdx, r10
mov r8, rax
mov rcx, qword [r9 + 0x20]
xor rcx, qword [r9 + 0x48]
add rdi, 8
xor rcx, qword [r9 + 0x70]
xor rcx, qword [r9 + 0x98]
xor rcx, r8
mov qword [rdi - 8], rcx
cmp r13, r9
je 0x8ea7e0
mov r8, qword [r9]
add r9, 8
jmp 0x8ea7ae
mov rcx, r12
xor r9d, r9d
lea edi, [r9 + 4]
mov r8, rdi
imul rdi, rbp
shr rdi, 0x22
lea edi, [rdi + rdi*4]
sub r8d, edi
lea edi, [r9 + 1]
mov r9, rdi
imul rdi, rbp
movsxd r8, r8d
shr rdi, 0x22
lea r15d, [rdi + rdi*4]
mov edi, r9d
sub edi, r15d
movsxd rdi, edi
mov rdi, qword [rsp + rdi*8 + 0x10]
rol rdi, 1
xor rdi, qword [rsp + r8*8 + 0x10]
lea r8, [rcx - 0xc8]
xor rax, rdi
mov qword [r8], rax
add r8, 0x28
cmp rcx, r8
je 0x8ea850
mov rax, qword [r8]
add r8, 0x28
xor rax, rdi
mov qword [r8 - 0x28], rax
cmp rcx, r8
jne 0x8ea83d
add rcx, 8
cmp r9d, 5
je 0x8ea868
mov rax, qword [rcx - 0xc8]
jmp 0x8ea7e6
mov r8, qword [r10 + 8]
xor eax, eax
mov r9d, 0xa
mov ecx, 1
jmp 0x8ea88a
mov ecx, dword [rbx + rax]
movsxd r9, dword [r11 + rax]
mov r8, rdi
lea r9, [r10 + r9*8]
rol r8, cl
add rax, 4
mov rdi, qword [r9]
mov qword [r9], r8
cmp rax, 0x60
jne 0x8ea880
movdqu xmm0, xmmword [rdx]
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx + 0x10]
movaps xmmword [rsi], xmm0
mov r8, qword [rsp + 0x18]
mov qword [rsi + 0x18], rcx
mov r9, rax
mov rcx, r8
mov qword [rsi + 0x10], rax
mov rax, qword [rdx + 0x20]
not rcx
and rcx, r9
xor qword [rdx], rcx
mov rcx, qword [rsp + 0x28]
not r9
mov qword [rsi + 0x20], rax
and r9, rcx
not rcx
xor qword [rdx + 8], r9
and rcx, rax
xor qword [rdx + 0x10], rcx
mov rcx, qword [rsp + 0x10]
not rax
and rax, rcx
not rcx
xor qword [rdx + 0x18], rax
and rcx, r8
xor qword [rdx + 0x20], rcx
add rdx, 0x28
cmp r12, rdx
jne 0x8ea8a1
mov rax, qword [rsp]
lea rdx, str.SHA_512__d
xor rax, qword [r10]
mov qword [r10], rax
cmp rdx, r14
je 0x8ea935
mov rdx, qword [r14]
add r14, 8
mov qword [rsp], rdx
jmp 0x8ea7a0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x8eb4f0
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov ebx, edx
mov r13, r8
mov r12, rcx
mov edx, 1
call fcn.008eaa90
shr ebx, 3
mov rdx, r13
mov rcx, r12
mov r8d, ebx
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp fcn.008eab30
Function at 0x8f3260
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rdx
lea rbp, [r8 + 0x40]
mov rbx, rcx
mov r12, r8
mov rdx, rbp
mov r8d, 0x98aa
mov rcx, rsi
mov r13, r9
lea r14, [r12 + 0x80]
lea rdi, [rsp + 0x60]
call fcn.008f9d20
lea r8, [r12 + 0xc0]
mov rdx, rsi
mov rcx, rbx
call fcn.008f9720
mov rdx, r12
mov r8, r14
mov rcx, rsi
call fcn.008f9720
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.008fa700
lea r12, [rsp + 0x20]
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.008fa7f0
mov r8, rbp
mov rdx, r14
mov rcx, r12
call fcn.008fa700
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.008f9720
mov r8d, 0x98a9
mov rdx, rbx
mov rcx, r12
call fcn.008f9d20
mov rdx, r12
mov rcx, rsi
call fcn.008fa240
lea rdx, [0x023f46a0]
mov rcx, r12
mov r15, rax
call fcn.008fabb0
or rax, r15
je 0x8f34a0
mov r8d, 0x98a9
mov rdx, rsi
mov rcx, r12
call fcn.008f9d20
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.008f9720
mov r8, r14
mov rdx, r12
mov rcx, rsi
call fcn.008f9720
mov r8, rsi
mov rdx, rsi
mov rcx, rsi
call fcn.008fa7f0
lea r14, [rsp + 0xa0]
mov rcx, rsi
call fcn.008fa8c0
mov r8, rsi
lea rdx, [0x023f46a0]
mov rcx, r14
mov r15, rax
call fcn.008fa700
xor r15, qword [rsp + 0x160]
xor eax, eax
not r15
movd xmm2, r15d
pshufd xmm6, xmm2, 0
nop dword [rax]
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [r14 + rax]
pand xmm0, xmm6
pxor xmm0, xmmword [rsi + rax]
movaps xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x8f33b8
mov r8, rbx
lea rdx, [0x023f46a0]
mov rcx, r14
call fcn.008fa700
xor eax, eax
nop
movdqa xmm0, xmmword [rbx + rax]
pxor xmm0, xmmword [r14 + rax]
pand xmm0, xmm6
pxor xmm0, xmmword [rbx + rax]
movaps xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x8f33f0
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.008fa7f0
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.008f9720
mov rcx, rbx
call fcn.008fa8c0
mov r8, rbx
lea rdx, [0x023f46a0]
mov rcx, r14
xor r13, rax
call fcn.008fa700
movd xmm3, r13d
xor eax, eax
pshufd xmm1, xmm3, 0
nop word [rax + rax]
movdqa xmm0, xmmword [rbx + rax]
pxor xmm0, xmmword [r14 + rax]
pand xmm0, xmm1
pxor xmm0, xmmword [rbx + rax]
movaps xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x8f3460
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, 0x9a
lea rdx, [0x023eee60]
lea rcx, str.ok__cryptonite_gf_eq_b_ZERO_
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x8f333e