joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r15
sub rsp, 0x30
mov eax, dword [0x14007bbc8]
mov r12, r9
mov r15, r8
mov rsi, rdx
mov ebp, ecx
test eax, eax
jle 0x140001e80
test ecx, ecx
je 0x140001e80
mov qword [rsp + 0x58], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, edi
mov dword [rsp + 0x20], edi
cmp rdx, r8
jae 0x140001e76
mov qword [rsp + 0x50], rbx
cmp edi, eax
jge 0x140001e54
lea r8, [rsp + 0x20]
mov rdx, r15
mov rcx, rsi
call fcn.140001e90
mov r14d, dword [rsp + 0x20]
mov rbx, rax
test r14d, r14d
jne 0x140001dcc
mov rdx, qword [0x14007bc80]
add rdx, qword [0x14007b0e0]
cmp rax, rdx
je 0x140001e54
test r12, r12
je 0x140001df5
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [0x14007b0dc]
lea rdx, str._s_c
mov rcx, rax
mov r8, r12
call fcn.140002190
cmp dword [0x14007bd20], 0
je 0x140001e1d
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, ebp
lea rdx, str._lu_
mov rcx, rax
call fcn.140002190
inc ebp
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
mov edx, 1
sub r8, rsi
mov r9, rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
inc edi
mov rsi, rbx
cmp rbx, r15
jae 0x140001e54
mov eax, dword [0x14007bbc8]
jmp 0x140001d90
mov rbx, qword [rsp + 0x50]
test edi, edi
jle 0x140001e76
mov dword [0x14007bd0c], 1
test r14d, r14d
jne 0x140001e76
cmp rsi, r15
jb 0x140001e76
call fcn.140006790
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r12
pop rsi
ret

Function at 0x140002120
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rax, r9
mov r10, r8
cmp edx, 1
jne 0x140002141
mov r8d, eax
mov rdx, r10
call sub.zlib.dll_gzread
cdqe
add rsp, 0x28
ret
cmp edx, 2
jne 0x140002158
mov r8d, eax
mov rdx, r10
call sub.LIBBZ2.dll_BZ2_bzread
cdqe
add rsp, 0x28
ret
cmp dword [rsp + 0x50], 0
je 0x140002171
mov r8, rcx
mov rdx, rax
mov rcx, r10
add rsp, 0x28
jmp fcn.1400061e0
mov r9, rcx
mov r8, rax
mov rcx, r10
mov edx, 1
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub dword [rbp + 0x21e6692], esi
invalid
Function at 0x140005de0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [0x14007bd28], 0
mov ebx, ecx
je 0x140005e3f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, 0xffffffd1
mov dword [rsp + 0x28], 0xffffffc1
mov rcx, rax
mov dword [rsp + 0x20], 0xffffffcb
lea rdx, str.pcre2grep:_Error__d___d___d_or__d_means_that_a_resource_limit_was_exceeded._n
lea r8d, [r9 + 1]
call fcn.140002190
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.pcre2grep:_Check_your_regex_for_nested_unlimited_loops._n
call fcn.140002190
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140006090
Capabilities:
Write file on windows

Disassembly:
test edx, edx
je 0x140006170
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x14007bd00], 0
mov rdi, rcx
movsxd rbx, edx
je 0x1400060f7
cmp dword [0x14007bd04], 0
je 0x1400060e3
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, qword [str.1_31]
lea rdx, str._c__sm
mov rcx, rax
mov r8d, 0x1b
call fcn.140002190
jmp 0x1400060f7
movzx edx, word [0x14007bd78]
mov rcx, qword [0x14007bd58]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
mov edx, 1
mov r9, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [0x14007bd00], 0
je 0x140006166
cmp dword [0x14007bd04], 0
je 0x140006152
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x1b
lea rdx, str._c_0m
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140002190
movzx edx, word [0x14007bd68]
mov rcx, qword [0x14007bd58]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140023e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
mov r10d, dword [rcx + 0x1d0]
lea rsi, [0x140000000]
mov r8, rcx
test r10d, r10d
jne 0x140023e89
cmp dword [rcx + 0x1d8], r10d
jne 0x140023e89
movzx r9d, byte [rdx]
mov rcx, qword [rcx + 0x90]
mov eax, r9d
movzx r8d, byte [rcx + r9]
jmp 0x140023fad
movzx r9d, byte [rdx]
mov qword [rsp + 0x10], rbx
mov eax, r9d
mov qword [rsp + 0x18], rdi
test r10d, r10d
je 0x140023f61
cmp eax, 0xc0
jb 0x140023f61
movzx ecx, byte [rdx + 1]
test al, 0x20
jne 0x140023ecb
movzx edx, cl
and eax, 0x1f
and edx, 0x3f
mov ecx, eax
shl ecx, 6
mov eax, edx
jmp 0x140023f5f
movzx ebx, byte [rdx + 2]
test al, 0x10
jne 0x140023eea
movzx edx, cl
and eax, 0xf
mov ecx, eax
and edx, 0x3f
shl ecx, 6
mov eax, edx
or eax, ecx
movzx ecx, bl
jmp 0x140023f59
movzx r11d, cl
movzx ecx, bl
and r11d, 0x3f
movzx ebx, byte [rdx + 3]
and ecx, 0x3f
and ebx, 0x3f
test al, 8
jne 0x140023f18
and eax, 7
shl eax, 6
or eax, r11d
shl eax, 6
or eax, ecx
shl eax, 6
or eax, ebx
jmp 0x140023f61
movzx edi, byte [rdx + 4]
and edi, 0x3f
test al, 4
jne 0x140023f3d
and eax, 3
shl eax, 6
or eax, r11d
shl eax, 6
or eax, ecx
shl eax, 6
or eax, ebx
shl eax, 6
or eax, edi
jmp 0x140023f61
and eax, 1
shl eax, 6
or eax, r11d
shl eax, 6
or eax, ecx
movzx ecx, byte [rdx + 5]
shl eax, 6
or eax, ebx
shl eax, 6
or eax, edi
shl eax, 6
and ecx, 0x3f
or eax, ecx
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
mov edx, eax
cmp eax, 0x7f
ja 0x140023f80
mov rcx, qword [r8 + 0x90]
movzx r8d, byte [rcx + rdx]
jmp 0x140023fad
shr rdx, 7
mov ecx, eax
and ecx, 0x7f
movzx edx, word [rsi + rdx*2 + 0x5e380]
shl edx, 7
add edx, ecx
movzx ecx, word [rsi + rdx*2 + 0x62780]
lea rdx, [rcx + rcx*2]
mov r8d, dword [rsi + rdx*4 + 0x5a174]
add r8d, eax
xor r8d, eax
cmp eax, 0x7f
ja 0x140023fc0
cmp r8d, 0x20
jne 0x140023fc0
mov eax, r8d
pop rsi
ret
lea ecx, [r8 - 1]
test r8d, ecx
je 0x140023fcd
xor eax, eax
pop rsi
ret
test r10d, r10d
je 0x140024004
cmp eax, 0x7f
jbe 0x140024004
movzx eax, r9b
and eax, 0x3f
movzx eax, byte [rax + rsi + 0x75b50]
test r8b, 0x3f
jne 0x140023ffc
nop dword [rax]
dec eax
shr r8d, 6
test r8b, 0x3f
je 0x140023ff0
shl eax, 8
or eax, r8d
pop rsi
ret
mov eax, r8d
pop rsi
ret
Function at 0x140048480
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
xor ecx, ecx
xor eax, eax
lock cmpxchg qword [0x14007bd90], rcx
jne 0x1400484b4
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x14007bd90], rcx
je 0x1400484b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14007bd90]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x14007bda0]
test rcx, rcx
je 0x140048542
mov qword [rsp + 0x20], rbx
nop word [rax + rax]
cmp qword [rcx + 8], 0
mov rbx, qword [rcx + 0x10]
jne 0x140048535
mov rax, qword [rcx + 0x20]
cmp qword [rax + rcx], 1
jne 0x140048535
sub qword [0x14007bdb0], rax
mov rax, rbx
test rbx, rbx
je 0x140048511
mov rax, qword [rcx + 0x18]
mov qword [rbx + 0x18], rax
mov rax, qword [rcx + 0x10]
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x140048520
mov qword [rdx + 0x10], rax
jmp 0x140048527
mov qword [0x14007bda0], rax
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
test rbx, rbx
jne 0x1400484e0
mov rbx, qword [rsp + 0x20]
mov rcx, qword [0x14007bd90]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_ReleaseMutex]

Function at 0x140048730
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
test rcx, rcx
je 0x14004882b
lea rax, [rdx - 1]
cmp rax, 0xffffffffffffdffe
ja 0x14004882b
cmp rcx, rdx
mov rsi, rdx
mov rdx, r8
cmovbe rsi, rcx
mov ecx, 0x20
add rsi, 0x1fff
and rsi, 0xffffffffffffe000
call fcn.140006a40
mov rdi, rax
test rax, rax
je 0x14004882b
mov qword [rsp + 0x60], rbp
lea rbp, [rbx + 0x1fff]
and rbp, 0xffffffffffffe000
cmp rsi, rbp
ja 0x140048811
cmp rsi, 1
jb 0x140048811
mov rdx, qword [rax + 0x10]
mov ecx, 0x20
call qword [rax]
mov rbx, rax
test rax, rax
je 0x140048811
mov rax, qword [0x14007bd98]
test rax, rax
jne 0x1400487e2
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
dec rax
mov qword [0x14007bd98], rax
add rbp, rax
mov r9d, 4
not rax
mov r8d, 0x2000
and rbp, rax
xor ecx, ecx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rbx
test rax, rax
jne 0x14004883d
mov rdx, qword [rdi + 0x10]
call qword [rdi + 8]
xor ebx, ebx
mov rbp, qword [rsp + 0x60]
mov qword [rdi + 0x18], rbx
test rbx, rbx
jne 0x140048870
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
call qword [rdi + 8]
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, [rax + rbp]
mov qword [rbx + 0x18], rax
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], rdx
sub rdx, rsi
call fcn.14004dcb0
test rax, rax
jne 0x140048867
mov rdx, rdi
mov rcx, rbx
call fcn.14004d530
jmp 0x140048811
mov rax, qword [rbx + 8]
mov qword [rbx], rax
jmp 0x140048813
mov rbx, qword [rsp + 0x68]
mov rax, rdi
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14004d3b0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
xor eax, eax
lock cmpxchg qword [0x14007bd90], rdi
jne 0x14004d3ef
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x14007bd90], rcx
je 0x14004d3ef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14007bd90]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx - 0x10]
lea rax, [rbx - 0x10]
sub qword [0x14007bda8], rcx
mov r9, rax
sub r9, qword [rax + 8]
cmp qword [r9], rdi
jne 0x14004d42e
add qword [r9 + 0x20], rcx
lea r8, [r9 + 0x20]
mov rax, qword [r8]
mov qword [rax + r9 + 8], rax
jmp 0x14004d459
lea r8, [rax + 0x20]
mov r9, rax
mov qword [r8], rcx
mov rcx, qword [0x14007bda0]
mov qword [rax], rdi
mov qword [rbx], rcx
mov qword [rax + 0x18], rdi
test rcx, rcx
je 0x14004d452
mov qword [rcx + 0x18], rax
mov qword [0x14007bda0], rax
mov rcx, qword [r8]
cmp qword [rcx + r9], rdi
lea rdx, [rcx + r9]
jne 0x14004d4a4
add rcx, qword [rdx + 0x20]
mov qword [r8], rcx
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x14004d482
mov rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [rdx + 0x10]
mov rax, qword [rdx + 0x18]
test rax, rax
je 0x14004d491
mov qword [rax + 0x10], rcx
jmp 0x14004d498
mov qword [0x14007bda0], rcx
mov rax, qword [r8]
mov qword [rax + r9 + 8], rax
lea rdx, [rax + r9]
cmp qword [r9 + 8], rdi
jne 0x14004d510
cmp qword [rdx], 1
jne 0x14004d510
mov rax, qword [0x14007bda8]
mov rdx, qword [0x14007bdb0]
sub rdx, qword [r8]
lea rcx, [rax + rax*2]
shr rcx, 1
cmp rdx, rcx
jbe 0x14004d510
mov rcx, qword [r9 + 0x10]
mov qword [0x14007bdb0], rdx
test rcx, rcx
je 0x14004d4e9
mov rax, qword [r9 + 0x18]
mov qword [rcx + 0x18], rax
mov rcx, qword [r9 + 0x10]
mov rax, qword [r9 + 0x18]
test rax, rax
je 0x14004d4f8
mov qword [rax + 0x10], rcx
jmp 0x14004d4ff
mov qword [0x14007bda0], rcx
xor edx, edx
mov r8d, 0x8000
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [0x14007bd90]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov bh, 0xc2
ret 0xbb30
cmc
mov ah, 0xff
je 0x1400cede6
jnp 0x1400cee01
cld
std
movsd dword [rdi], dword [rsi]
scasd eax, dword [rdi]
ret
clc
test al, 0x80
jrcxz 0x1400cee5d
jbe 0x1400cee7f
or ch, byte [rcx - 0x24]
invalid
rcl ebp, 1
mov dl, 0xca
invalid
outsb dx, byte [rsi]
adc bh, ch
ret
jg 0x1400cedfc
invalid
wait
movabs al, byte [0x9635613b1f7d5c83]
pop rsp
jge 0x1400cee7f
cmp esp, dword [rcx + 0x35]
xchg esi, eax
invalid
sub dword [rcx - 0xf], 0x21
sub al, 0xa8
or eax, 0x99b0336d
invalid
pushfq
fst qword [r14 - 0x5875c1ab]
rep insb byte [rdi], dx
invalid
invalid
out dx, eax
adc al, 0x21
or bl, byte [rbp - 0x3176228b]
invalid
Function at 0x14004dac0
Capabilities:
Allocate or change rwx memory
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
xor eax, eax
lock cmpxchg qword [0x14007bd90], rbp
jne 0x14004db04
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x14007bd90], rcx
je 0x14004db04
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14007bd90]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 0x30
cmp rbx, rdi
cmovae rdi, rbx
mov rbx, qword [0x14007bda0]
add rdi, 0x17
and rdi, 0xfffffffffffffff8
test rbx, rbx
je 0x14004db48
mov rcx, qword [rbx + 0x20]
cmp rcx, rdi
jae 0x14004db92
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14004db36
lea rbx, [rdi + 0x1000f]
mov qword [rsp + 0x30], rsi
and rbx, 0xffffffffffff0000
mov r9d, 0x40
mov rdx, rbx
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14004dc09
mov rcx, qword [0x14007bd90]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x14004dc8c
lea rax, [rdi + 0x40]
cmp rcx, rax
jbe 0x14004dbb0
sub rcx, rdi
mov qword [rbx + 0x20], rcx
add rbx, rcx
mov qword [rbx + 8], rcx
mov qword [rbx + rdi + 8], rdi
jmp 0x14004dbde
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x14004dbc5
mov rax, qword [rbx + 0x18]
mov qword [rdx + 0x18], rax
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14004dbd4
mov qword [rax + 0x10], rdx
jmp 0x14004dbdb
mov qword [0x14007bda0], rdx
mov rdi, rcx
add qword [0x14007bda8], rdi
mov qword [rbx], rdi
mov rcx, qword [0x14007bd90]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rbx + 0x10]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
sub rbx, 0x10
mov qword [rax + 8], rbp
add qword [0x14007bdb0], rbx
lea rax, [rdi + 0x40]
cmp rbx, rax
jbe 0x14004dc62
mov rcx, qword [0x14007bda0]
lea rax, [rsi + rdi]
add qword [0x14007bda8], rdi
sub rbx, rdi
mov qword [rsi], rdi
mov qword [rax + 8], rdi
mov qword [rax], rbp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rbp
test rcx, rcx
je 0x14004dc55
mov qword [rcx + 0x18], rax
mov qword [0x14007bda0], rax
lea rcx, [rbx + rax]
jmp 0x14004dc70
add qword [0x14007bda8], rbx
lea rcx, [rsi + rbx]
mov qword [rsi], rbx
mov qword [rcx], 1
mov qword [rcx + 8], rbx
mov rcx, qword [0x14007bd90]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rsi + 0x10]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14004dcb0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
cmp rdx, qword [rcx + 0x18]
jb 0x14004dd25
cmp rdx, qword [rcx + 8]
jae 0x14004dd25
mov rax, qword [0x14007bd98]
test rax, rax
jne 0x14004dcf1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
dec rax
mov qword [0x14007bd98], rax
mov r10, qword [rdi + 0x10]
not rax
mov rcx, rax
and r10, rax
and rcx, rbx
cmp rcx, r10
je 0x14004dd4b
jae 0x14004dd32
sub r10, rcx
mov r9d, 4
mov rdx, r10
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14004dd4b
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
sub rcx, r10
mov r8d, 0x4000
mov rdx, rcx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x14004dd25
mov qword [rdi + 0x10], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140002030
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.1400013f0
test eax, eax
js 0x140002294
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x1400020c3
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop dword [rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x140002070
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x140002292
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 4]
lea rdi, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [r10 + 0x10]
lea r10, [r10 + 0x10]
mov edx, dword [r10 - 4]
inc r11d
movzx eax, byte [r10 - 3]
movzx ecx, byte [rdi + rax*4 + 0x16d5c0]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0x16e1c0]
movzx eax, byte [rdi + rax*4 + 0x16d5c0]
xor r8d, dword [rdi + rax*4 + 0x16d9c0]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0x16d5c0]
movzx eax, byte [r10 - 2]
xor r8d, dword [rdi + rcx*4 + 0x16e5c0]
movzx ecx, byte [rdi + rax*4 + 0x16d5c0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x16ddc0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x16d5c0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x16ddc0]
movzx eax, byte [rdi + rcx*4 + 0x16d5c0]
xor r8d, dword [rdi + rax*4 + 0x16e1c0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x16d5c0]
movzx eax, r9b
mov r9d, dword [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x16d9c0]
movzx ecx, byte [rdi + rax*4 + 0x16d5c0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x16e5c0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10], r8d
movzx edx, byte [rdi + rcx*4 + 0x16d5c0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x16ddc0]
movzx eax, byte [rdi + rcx*4 + 0x16d5c0]
xor r8d, dword [rdi + rax*4 + 0x16e1c0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x16d5c0]
movzx eax, r9b
mov r9d, dword [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x16d9c0]
movzx ecx, byte [rdi + rax*4 + 0x16d5c0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x16e5c0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x16d5c0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x16ddc0]
movzx eax, byte [rdi + rcx*4 + 0x16d5c0]
xor r8d, dword [rdi + rax*4 + 0x16e1c0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x16d5c0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x16d9c0]
movzx ecx, byte [rdi + rax*4 + 0x16d5c0]
xor r8d, dword [rdi + rcx*4 + 0x16e5c0]
mov dword [r10 + 8], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400020f0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140002f60
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx + 4], xmm0
movups xmmword [rcx + 0x14], xmm0
movups xmmword [rcx + 0x24], xmm0
movups xmmword [rcx + 0x34], xmm0
movups xmmword [rcx + 0x44], xmm0
mov qword [rcx + 0x54], rax
mov dword [rcx + 0x5c], eax
mov dword [rcx + 4], 0x67452301
mov dword [rcx + 8], 0xefcdab89
mov dword [rcx + 0xc], 0x98badcfe
mov dword [rcx + 0x10], 0x10325476
xor edi, edi
mov qword [rcx + 0xa0], rdi
mov qword [rcx + 0xb0], rdi
mov qword [rcx + 0xb8], 0xf
mov byte [rcx + 0xa0], al
mov qword [rcx + 0xc0], rdi
mov qword [rcx + 0xd0], rdi
mov qword [rcx + 0xd8], 0xf
mov byte [rcx + 0xc0], dil
mov word [rcx], 0x101
mov dword [rsp + 0x78], 0x333231
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], dil
lea rax, [rsp + 0x78]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140003020
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x20]
call fcn.1400040f0
nop
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400030c0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000309a
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003094
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030ab
call fcn.1400ff058
nop
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
call fcn.14011023c
nop
int3
Function at 0x1400076f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x150
xor edx, edx
lea ecx, [rdx + 2]
call fcn.14004f190
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000772d
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call fcn.14004f0b0
test eax, eax
jne 0x140007738
mov rcx, rbx
call fcn.1400529f0
xor al, al
add rsp, 0x150
pop rbx
ret
mov qword [rsp + 0x160], rdi
xor dil, dil
mov dword [rsp + 0x168], 0xf321d342
nop
lea rcx, [rsp + 0x4c]
call fcn.140053b50
movzx edx, byte [rsp + 0x4c]
mov ecx, 0xffffffff
test dl, dl
je 0x14000780d
lea r8, [rsp + 0x4c]
movzx eax, dl
lea r8, [r8 + 1]
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
movzx eax, byte [r8]
movzx edx, al
test al, al
jne 0x140007771
not ecx
xor eax, eax
cmp dword [rsp + rax*4 + 0x168], ecx
je 0x14000783a
inc rax
cmp rax, 1
jl 0x140007811
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14004efd0
test eax, eax
jne 0x140007750
jmp 0x14000783d
mov dil, 1
mov rcx, rbx
call fcn.1400529f0
movzx eax, dil
mov rdi, qword [rsp + 0x160]
add rsp, 0x150
pop rbx
ret
Function at 0x140007880
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x160
xor edx, edx
lea ecx, [rdx + 2]
call fcn.14004f190
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400078bd
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x130
mov rcx, rax
call fcn.14004f0b0
test eax, eax
jne 0x1400078c8
mov rcx, rbx
call fcn.1400529f0
xor al, al
add rsp, 0x160
pop rbx
ret
mov qword [rsp + 0x170], rdi
xor dil, dil
mov dword [rsp + 0x20], 0x5f1c2fc2
mov dword [rsp + 0x24], 0x175dbf9c
mov dword [rsp + 0x28], 0xb4ca0887
mov dword [rsp + 0x2c], 0x60d51755
lea rcx, [rsp + 0x5c]
call fcn.140053b50
movzx edx, byte [rsp + 0x5c]
mov ecx, 0xffffffff
test dl, dl
je 0x1400079bc
lea r8, [rsp + 0x5c]
nop dword [rax]
nop dword [rax + rax]
movzx eax, dl
lea r8, [r8 + 1]
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
movzx eax, byte [r8]
movzx edx, al
test al, al
jne 0x140007920
not ecx
xor eax, eax
cmp dword [rsp + rax*4 + 0x20], ecx
je 0x1400079e6
inc rax
cmp rax, 4
jl 0x1400079c0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14004efd0
test eax, eax
jne 0x1400078f3
jmp 0x1400079e9
mov dil, 1
mov rcx, rbx
call fcn.1400529f0
movzx eax, dil
mov rdi, qword [rsp + 0x170]
add rsp, 0x160
pop rbx
ret