joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017e3f
Capabilities:
Terminate process

Disassembly:
mov byte [rax], al
add byte [rax], al
lea rcx, [0x14001f920]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14001fa18]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140017e1d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001f920]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140017e3f
mov rax, qword [rsp + 0x88]
mov qword [0x14001fa18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001f9b8], rax
mov rax, qword [0x14001fa18]
mov qword [0x14001f890], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001f9a0], rax
mov dword [0x14001f880], 0xc0000409
mov dword [0x14001f884], 1
mov rax, qword [0x14001e400]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14001e408]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14001ba20]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140019d68
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r12
push r13
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x14001e400]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea r12, [rsp + 0x20]
mov eax, dword [r12]
lea rdx, [rbp + 8]
mov r8d, 0x30
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140019e6e
mov r13, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
and dword [rbp], ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x140019df6
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x140019e6e
mov eax, edx
not eax
and ecx, eax
je 0x140019e11
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x140019e6e
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r12
lea rax, [r13 + rdi]
mov esi, ecx
sub rbx, rsi
cmp rbx, rax
jb 0x140019e6e
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140019e6e
lea r9, [rbp + 4]
mov r8d, 0x104
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140019e6e
mov eax, 1
jmp 0x140019e70
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.1400153c0
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r13
pop r12
pop rbp
ret
Function at 0x180002bc8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov ecx, 2
cmp dword [rbx], ecx
je 0x180002c0f
cmp dword [rbx], 1
jne 0x180184ae8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov r9, qword [rbx + 0x10]
mov edx, 1
mov r8, qword [rbx + 8]
mov ecx, eax
mov dword [rsp + 0x20], 1
call fcn.180002c9c
int3
mov ecx, dword [rbx + 0x18]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.Py_ExitStatusException___must_not_be_called_on_success
call sym.python310.dll_Py_FatalError
int3

Function at 0x180002c9c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
cmp dword [0x180423f8c], 0
mov r15, r9
mov rdi, r8
mov esi, ecx
jne 0x180002dd6
mov r12d, 1
mov dword [0x180423f8c], r12d
test edx, edx
je 0x180002d68
xor r9d, r9d
lea r8d, [r12 + 0x13]
lea rdx, [0x18023cd48]
call fcn.180002fb4
or rbx, 0xffffffffffffffff
test rdi, rdi
je 0x180002d31
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x180002d03
movsxd r8, eax
xor r9d, r9d
mov rdx, rdi
mov ecx, esi
call fcn.180002fb4
xor r9d, r9d
lea rdx, [0x18023d61c]
mov ecx, esi
lea r8d, [r9 + 2]
call fcn.180002fb4
test r15, r15
je 0x180184b86
mov rdx, r15
inc rbx
cmp byte [r15 + rbx], 0
jne 0x180002d3d
movsxd r8, ebx
xor r9d, r9d
mov ecx, esi
call fcn.180002fb4
xor r9d, r9d
lea rdx, [0x18023d610]
mov r8, r12
mov ecx, esi
call fcn.180002fb4
mov ecx, esi
call fcn.180002c1c
mov r14, qword [0x18044f1f0]
lea rcx, [0x18044f1e8]
xor edi, edi
call fcn.1800030f8
mov rbx, rax
test r14, r14
je 0x180184b98
mov rdi, qword [r14 + 0x10]
mov rbp, rdi
test rax, rax
je 0x180184ba1
cmp rax, r14
jne 0x180184ba1
mov rcx, rax
call fcn.18000310c
test eax, eax
je 0x180002de5
mov rdx, rbp
mov ecx, esi
call sym.python310.dll__Py_DumpExtensionModules
call fcn.180003870
test r12d, r12d
je 0x180002dce
call fcn.1800d6dc0
mov rcx, r15
call fcn.1800039bc
mov ecx, dword [rsp + 0x70]
test ecx, ecx
js 0x180002df4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r8, rbx
mov rdx, rdi
mov ecx, esi
call fcn.180002508
jmp 0x180002db5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rdx, str._message_not_set_
mov r8d, send
jmp 0x180002d4a
test rbx, rbx
je 0x180184ba1
mov rdi, qword [rax + 0x10]
mov r8, rbx
mov rdx, rdi
mov ecx, esi
mov rbp, rdi
call fcn.180002508
xor r12d, r12d
jmp 0x180002db5

Function at 0x1800030f8
Capabilities:
Get thread local storage value

Disassembly:
cmp qword [rcx + 0x10], 0
je 0x180003108
add rcx, 0x18
jmp sym.python310.dll_PyThread_tss_get
xor eax, eax
ret
Function at 0x1800039bc
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x1803e3008]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, rcx
mov edi, 0x7f
lea rcx, str.Fatal_Python_error:
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or rbx, 0xffffffffffffffff
xor ebp, ebp
inc rbx
cmp byte [rsi + rbx], bpl
jne 0x180003a00
test rbx, rbx
je 0x180003a58
cmp rdi, rbx
mov rax, rbx
mov rcx, rbp
cmovbe rax, rdi
mov rdi, rax
test rax, rax
je 0x180003a34
movsx eax, byte [rcx + rsi]
mov word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, rdi
jb 0x180003a23
add rcx, rcx
cmp rcx, 0x100
jae 0x180003a8e
mov word [rsp + rcx + 0x20], bp
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsi, rdi
sub rbx, rdi
jne 0x180003a0e
lea rcx, [0x18023cda4]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180181080
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1801811a8
int3

Function at 0x180003f10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rsi, rcx
mov ebp, r8d
lea rcx, str..pyc
mov r14, rdx
call sym.python310.dll_PyUnicode_FromString
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x180003ff4
lea r15d, [rbx + 1]
movabs r9, 0x7fffffffffffffff
xor r8d, r8d
mov dword [rsp + 0x20], r15d
mov rdx, rax
mov rcx, r14
call sym.python310.dll_PyUnicode_Tailmatch
sub qword [rdi], r15
mov r14, rax
jne 0x180003f7e
mov rdx, qword [rdi + 8]
mov rcx, rdi
call qword [rdx + 0x30]
test r14, r14
jne 0x180003ff9
test ebp, ebp
jne 0x180003fa2
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
call sym.python310.dll_PyImport_GetMagicNumber
mov rcx, rsi
movzx edi, ax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
test eax, eax
jne 0x180003ff0
mov r9, rsi
lea r8d, [rax + 2]
mov rdx, r15
lea rcx, [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, 2
jne 0x180003fe7
movzx edx, byte [rsp + 0x69]
movzx ecx, byte [rsp + 0x68]
shl edx, 8
or edx, ecx
cmp edx, edi
cmove ebx, r15d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov eax, ebx
jmp 0x180003f89
or eax, 0xffffffff
jmp 0x180003f89
mov eax, r15d
jmp 0x180003f89

Function at 0x180007f14
Capabilities:
Get file size
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rcx, qword [str.KERNEL32.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
mov edx, dword [0x1803e9077]
xor ecx, ecx
mov r8d, 0x1000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
mov edx, dword [0x1803e9077]
mov rcx, rax
call fcn.180007e64
xor ecx, ecx
leave
Function at 0x180016974
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rdi, rcx
or rbp, 0xffffffffffffffff
mov rcx, qword [rdx + 0x18]
mov rbx, rdx
test rcx, rcx
je 0x18018a56a
mov rax, qword [rdx + 0x20]
sub rax, rcx
cmp rax, rdi
jl 0x18018a55e
lea rax, [rcx + rdi]
mov qword [rdx + 0x18], rax
mov rax, rcx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rdx, str.marshal_data_too_short
jmp 0x18018a686
mov rax, qword [rdx + 0x28]
test rax, rax
jne 0x18018a590
mov rcx, rdi
call sym.python310.dll_PyMem_Malloc
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x18018a5aa
call sym.python310.dll_PyErr_NoMemory
xor eax, eax
jmp 0x1800169bd
cmp qword [rdx + 0x30], rdi
jge 0x18018a5ae
mov rdx, rdi
mov rcx, rax
call sym.python310.dll_PyMem_Realloc
test rax, rax
je 0x18018a584
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rdi
cmp qword [rbx + 0x10], 0
jne 0x18018a5ce
mov r9, qword [rbx]
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbp, rax
jmp 0x18018a645
mov dword [rsp + 0x28], 9
lea rcx, [rsp + 0x30]
and dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rax
xor edx, edx
call sym.python310.dll_PyBuffer_FillInfo
cmp eax, 0xffffffff
je 0x18018a589
lea rcx, [rsp + 0x30]
call sym.python310.dll_PyMemoryView_FromBuffer
test rax, rax
je 0x18018a589
mov rcx, qword [rbx + 0x10]
lea r8, [0x18023ed14]
mov r9, rax
lea rdx, str.readinto
call sym.python310.dll__PyObject_CallMethodId_SizeT
mov rsi, rax
test rax, rax
je 0x18018a645
mov rdx, qword [sym.python310.dll_PyExc_ValueError]
mov rcx, rax
call sym.python310.dll_PyNumber_AsSsize_t
sub qword [rsi], 1
mov rbp, rax
jne 0x18018a645
mov rdx, qword [rsi + 8]
mov rcx, rsi
call qword [rdx + 0x30]
cmp rbp, rdi
je 0x18018a697
mov rax, qword [0x18044f1f0]
cmp qword [rax + 0x58], 0
jne 0x18018a589
cmp rbp, rdi
jle 0x18018a67f
mov rcx, qword [sym.python310.dll_PyExc_ValueError]
lea rdx, str.read___returned_too_much_data:__zd_bytes_requested___zd_returned
mov r9, rbp
mov r8, rdi
call sym.python310.dll_PyErr_Format
jmp 0x18018a589
lea rdx, str.EOF_read_where_not_expected
mov rcx, qword [sym.python310.dll_PyExc_EOFError]
call sym.python310.dll_PyErr_SetString
jmp 0x18018a589
mov rax, qword [rbx + 0x28]
jmp 0x1800169bd
Function at 0x18001ae20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r9d, dword [rcx + 0x10]
cmp r9d, 0x270
jge 0x18001ae62
movsxd rax, r9d
mov edx, dword [rcx + rax*4 + 0x14]
lea eax, [r9 + 1]
mov dword [rcx + 0x10], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret
xor r9d, r9d
lea r11, [0x18025ae38]
mov r10d, r9d
mov r8d, 0xe3
nop word [rax + rax]
mov edx, dword [rcx + r10*4 + 0x18]
xor edx, dword [rcx + r10*4 + 0x14]
btr edx, 0x1f
xor edx, dword [rcx + r10*4 + 0x14]
mov eax, edx
shr edx, 1
and eax, 1
xor edx, dword [r11 + rax*4]
xor edx, dword [rcx + r10*4 + 0x648]
mov dword [rcx + r10*4 + 0x14], edx
inc r10
cmp r10, r8
jl 0x18001ae80
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rcx + r8*4 + 0x18]
xor edx, dword [rcx + r8*4 + 0x14]
btr edx, 0x1f
xor edx, dword [rcx + r8*4 + 0x14]
mov eax, edx
shr edx, 1
and eax, 1
xor edx, dword [r11 + rax*4]
xor edx, dword [rcx + r8*4 - 0x378]
mov dword [rcx + r8*4 + 0x14], edx
inc r8
cmp r8, 0x26f
jl 0x18001aec0
mov r8d, dword [rcx + 0x14]
xor r8d, dword [rcx + 0x9d0]
btr r8d, 0x1f
xor r8d, dword [rcx + 0x9d0]
mov eax, r8d
shr r8d, 1
and eax, 1
mov edx, dword [r11 + rax*4]
xor edx, dword [rcx + 0x644]
xor edx, r8d
mov dword [rcx + 0x9d0], edx
mov dword [rcx + 0x10], r9d
jmp 0x18001ae2d
Function at 0x1800335f4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
cmp dword [0x18044f1e8], esi
je 0x180033673
cmp dword [0x18044f200], esi
je 0x180033673
mov rbp, qword [0x18044f1f0]
test rbp, rbp
je 0x18003366f
cmp qword [0x18044f1f8], rsi
je 0x180033658
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x18044f204]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbp, rdi
jne 0x180033658
mov esi, 1
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x18003365a
mov eax, 1
jmp 0x18003365a
Function at 0x1800689ec
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx + 4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x180068a28
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx + 4]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180069acc
Capabilities:
Set thread local storage value

Disassembly:
neg ecx
lea rax, sym.python310.dll__Py_TrueStruct
lea rcx, [0x180420fb8]
sbb rdx, rdx
and rdx, rax
jmp sym.python310.dll_PyThread_tss_set
Function at 0x1800a55fc
Capabilities:
Hash data using sha224

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1800a5659
mov rax, qword [rdx + 8]
test dword [rax + 0xa8], 0x10000000
jne 0x1800a5706
mov rcx, rdx
call sym.python310.dll_PyObject_CheckBuffer
test eax, eax
je 0x1801a9824
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sym.python310.dll_PyObject_GetBuffer
cmp eax, 0xffffffff
je 0x1800a5719
cmp dword [rsp + 0x44], 1
jg 0x1801a9830
mov rcx, rbx
call sym.python310.dll_PyModule_GetState
mov rcx, rax
call fcn.1800a5720
mov rbx, rax
test rax, rax
je 0x1801a9863
and dword [rax + 0x30], 0
and dword [rax + 0x34], 0
and dword [rax + 0x78], 0
mov dword [rax + 0x10], 0xc1059ed8
mov dword [rax + 0x14], 0x367cd507
mov dword [rax + 0x18], 0x3070dd17
mov dword [rax + 0x1c], 0xf70e5939
mov dword [rax + 0x20], 0xffc00b31
mov dword [rax + 0x24], 0x68581511
mov dword [rax + 0x28], 0x64f98fa7
mov dword [rax + 0x2c], 0xbefa4fa4
mov dword [rax + 0x7c], 0x1c
mov rax, qword [0x18044f1f0]
cmp qword [rax + 0x58], 0
jne 0x1801a9853
test rdi, rdi
jne 0x1800a56e8
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov r8, qword [rsp + 0x30]
mov rcx, rbx
mov rdx, qword [rsp + 0x20]
call fcn.1800a5a9c
lea rcx, [rsp + 0x20]
call sym.python310.dll_PyBuffer_Release
jmp 0x1800a56d7
lea rdx, str.Strings_must_be_encoded_before_hashing
mov rcx, qword [sym.python310.dll_PyExc_TypeError]
call sym.python310.dll_PyErr_SetString
xor eax, eax
jmp 0x1800a56da
lea rdx, str.object_supporting_the_buffer_API_required
jmp 0x1800a570d
mov rcx, qword [sym.python310.dll_PyExc_BufferError]
lea rdx, str.Buffer_must_be_single_dimension
call sym.python310.dll_PyErr_SetString
lea rcx, [rsp + 0x20]
call sym.python310.dll_PyBuffer_Release
nop
jmp 0x1800a5719
sub qword [rbx], 1
jne 0x1801a9863
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
test rdi, rdi
je 0x1800a5719
jmp 0x1801a9843
Function at 0x1800a58c8
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1800a5925
mov rax, qword [rdx + 8]
test dword [rax + 0xa8], 0x10000000
jne 0x1800a59d0
mov rcx, rdx
call sym.python310.dll_PyObject_CheckBuffer
test eax, eax
je 0x1801a986e
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sym.python310.dll_PyObject_GetBuffer
cmp eax, 0xffffffff
je 0x1800a59e3
cmp dword [rsp + 0x44], 1
jg 0x1801a987a
mov rcx, rbx
call sym.python310.dll_PyModule_GetState
mov rcx, rax
call fcn.1800a59e8
mov rbx, rax
test rax, rax
je 0x1801a98ad
and dword [rax + 0x30], 0
and dword [rax + 0x34], 0
and dword [rax + 0x78], 0
mov dword [rax + 0x10], 0x6a09e667
mov dword [rax + 0x14], 0xbb67ae85
mov dword [rax + 0x18], 0x3c6ef372
mov dword [rax + 0x1c], 0xa54ff53a
mov dword [rax + 0x20], 0x510e527f
mov dword [rax + 0x24], 0x9b05688c
mov dword [rax + 0x28], 0x1f83d9ab
mov dword [rax + 0x2c], 0x5be0cd19
mov dword [rax + 0x7c], 0x20
mov rax, qword [0x18044f1f0]
cmp qword [rax + 0x58], 0
jne 0x1801a989d
test rdi, rdi
je 0x1800a59bf
mov r8, qword [rsp + 0x30]
mov rcx, rbx
mov rdx, qword [rsp + 0x20]
call fcn.1800a5a9c
lea rcx, [rsp + 0x20]
call sym.python310.dll_PyBuffer_Release
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rdx, str.Strings_must_be_encoded_before_hashing
mov rcx, qword [sym.python310.dll_PyExc_TypeError]
call sym.python310.dll_PyErr_SetString
xor eax, eax
jmp 0x1800a59c2
lea rdx, str.object_supporting_the_buffer_API_required
jmp 0x1800a59d7
mov rcx, qword [sym.python310.dll_PyExc_BufferError]
lea rdx, str.Buffer_must_be_single_dimension
call sym.python310.dll_PyErr_SetString
lea rcx, [rsp + 0x20]
call sym.python310.dll_PyBuffer_Release
nop
jmp 0x1800a59e3
sub qword [rbx], 1
jne 0x1801a98ad
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
test rdi, rdi
je 0x1800a59e3
jmp 0x1801a988d

Function at 0x1800a7a90
Capabilities:
Hash data using sha384

Disassembly:
movabs rax, 0xcbbb9d5dc1059ed8
mov dword [rcx + 0xdc], 0x30
mov qword [rcx + 0x10], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 0x18], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x20], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x28], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x30], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x38], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x40], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x48], rax
xor eax, eax
mov qword [rcx + 0x50], rax
mov dword [rcx + 0xd8], eax
ret
Function at 0x1800a7df0
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov dword [rcx + 0xdc], 0x40
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x48], rax
xor eax, eax
mov qword [rcx + 0x50], rax
mov dword [rcx + 0xd8], eax
ret
Function at 0x1800aae1c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1803e3008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [0x180421278]
test eax, eax
je 0x1800aae8c
cmp eax, 2
jne 0x1800aae82
test edx, edx
jne 0x1800aae82
lea rdx, [rsp + 0x27]
mov r8d, 8
mov al, byte [rcx]
inc rcx
mov byte [rdx], al
dec rdx
sub r8, 1
jne 0x1800aae4f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rax
movsd xmm0, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180181080
add rsp, 0x30
pop rbx
ret
cmp eax, 1
je 0x1800aaeee
mov rax, qword [rcx]
jmp 0x1800aae64
test edx, edx
lea rax, [rcx + 7]
cmove rax, rcx
neg edx
sbb r10, r10
and r10, 0xfffffffffffffffe
movzx ebx, byte [rax]
inc r10
mov r8d, ebx
and r8d, 0x7f
shl r8d, 4
lea r9, [r10 + rax]
movzx r11d, byte [r9]
add r9, r10
mov eax, r11d
shr eax, 4
or r8d, eax
cmp r8d, 0x7ff
jne 0x1801a9a50
mov rcx, qword [sym.python310.dll_PyExc_ValueError]
lea rdx, str.cant_unpack_IEEE_754_special_value_on_non_IEEE_platform
call sym.python310.dll_PyErr_SetString
movsd xmm0, qword [0x180254360]
jmp 0x1800aae6f
test edx, edx
je 0x1800aae87
jmp 0x1800aae44
movzx eax, byte [r9]
and r11d, 0xf
add r9, r10
shl r11d, 8
or r11d, eax
xorps xmm1, xmm1
shl r11d, 0x10
xorps xmm0, xmm0
movzx eax, byte [r9]
add r9, r10
shl eax, 8
or r11d, eax
movzx eax, byte [r9]
add r9, r10
or r11d, eax
movzx edx, byte [r9]
add r9, r10
shl edx, 0x10
movzx eax, byte [r10 + r9]
movzx ecx, byte [r9]
shl ecx, 8
or eax, ecx
or eax, edx
cvtsi2sd xmm1, rax
mov eax, r11d
cvtsi2sd xmm0, rax
mulsd xmm1, qword [0x1803a2da8]
addsd xmm1, xmm0
mulsd xmm1, qword [0x180254428]
test r8d, r8d
jne 0x1801a9acb
mov r8d, 0xfffffc02
jmp 0x1801a9ada
addsd xmm1, qword [0x1802542f8]
sub r8d, 0x3ff
mov edx, r8d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
test bl, bl
jns 0x1800aae6f
xorps xmm0, xmmword [0x1802542c0]
jmp 0x1800aae6f
Function at 0x1800aaf48
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x180421428]
test eax, eax
je 0x1800aaf9c
cmp eax, 2
jne 0x1800aaf93
test edx, edx
jne 0x1800aaf93
lea rdx, [rsp + 0x43]
mov r8d, 4
mov al, byte [rcx]
inc rcx
mov byte [rdx], al
dec rdx
sub r8, 1
jne 0x1800aaf6c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x40], eax
movss xmm0, dword [rsp + 0x40]
cvtps2pd xmm0, xmm0
add rsp, 0x20
pop rbx
ret
cmp eax, 1
je 0x1800aaff7
mov eax, dword [rcx]
jmp 0x1800aaf80
test edx, edx
lea rax, [rcx + 3]
cmove rax, rcx
neg edx
sbb r8, r8
and r8, 0xfffffffffffffffe
movzx ebx, byte [rax]
inc r8
mov edx, ebx
and edx, 0x7f
add edx, edx
lea r9, [r8 + rax]
movzx ecx, byte [r9]
add r9, r8
mov eax, ecx
shr eax, 7
or edx, eax
cmp edx, 0xff
jne 0x1801a9afa
mov rcx, qword [sym.python310.dll_PyExc_ValueError]
lea rdx, str.cant_unpack_IEEE_754_special_value_on_non_IEEE_platform
call sym.python310.dll_PyErr_SetString
movsd xmm0, qword [0x180254360]
jmp 0x1800aaf8d
test edx, edx
je 0x1800aaf98
jmp 0x1800aaf61
movzx eax, byte [r9]
and ecx, 0x7f
shl ecx, 8
xorps xmm0, xmm0
or ecx, eax
movzx eax, byte [r8 + r9]
shl ecx, 8
or eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x1803a2db0]
test edx, edx
jne 0x1801a9b2b
mov edx, 0xffffff82
jmp 0x1801a9b36
addsd xmm0, qword [0x1802542f8]
sub edx, 0x7f
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
test bl, bl
jns 0x1800aaf8d
xorps xmm0, xmmword [0x1802542c0]
jmp 0x1800aaf8d