joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ebd0
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, rdx
mov r14, r9
mov edx, dword [rbp + 0x100]
mov rdi, rcx
sub edx, 4
je 0x14002ed18
cmp edx, 1
je 0x14002ec1e
mov eax, 0xffffff18
jmp 0x14002edc0
movdqa xmm0, xmmword [0x1401099c0]
xor ebx, ebx
mov rax, qword [rcx + 0xa8]
xor r8d, r8d
movdqa xmm1, xmmword [0x140109a20]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x1c0], r12
xor edx, edx
movdqa xmmword [rbp - 0x50], xmm0
movabs r12, 0x629a292a367cd507
movdqa xmm0, xmmword [0x1401099f0]
mov qword [rsp + 0x1d0], r15
movabs r15, 0xcbbb9d5dc1059ed8
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp + 0x78], rax
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r12
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
call fcn.14000cd90
test eax, eax
jne 0x14002ecfe
lea rcx, [rbp - 0x60]
call fcn.14000d7e0
test eax, eax
jne 0x14002ecfe
movaps xmm0, xmmword [rbp - 0x60]
mov eax, ebx
movaps xmm1, xmmword [rbp - 0x50]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1401099c0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1401099f0]
movaps xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x140109a20]
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r12
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
mov r15, qword [rsp + 0x1d0]
mov edx, 0x30
mov r12, qword [rsp + 0x1c0]
lea ecx, [rdx - 0x29]
jmp 0x14002ed78
mov rax, qword [rcx + 0xa8]
lea rdx, [rsp + 0x60]
xor ebx, ebx
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x60]
mov qword [rbp], rbx
mov dword [rbp + 8], ebx
mov dword [rbp - 0x60], 0x6a09e667
mov dword [rbp - 0x5c], 0xbb67ae85
mov dword [rbp - 0x58], 0x3c6ef372
mov dword [rbp - 0x54], 0xa54ff53a
mov dword [rbp - 0x50], 0x510e527f
mov dword [rbp - 0x4c], 0x9b05688c
mov dword [rbp - 0x48], 0x1f83d9ab
mov dword [rbp - 0x44], 0x5be0cd19
call fcn.140022030
lea edx, [rbx + 0x20]
lea ecx, [rbx + 6]
test eax, eax
jne 0x14002edc0
cmp byte [rdi + 0x319], 4
je 0x14002ed8c
mov eax, 0xfffffeba
jmp 0x14002edc0
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], edx
mov r9d, edx
mov qword [rsp + 0x40], rax
mov r8, r14
lea rax, str.derived
mov dword [rsp + 0x38], 7
mov rcx, rsi
mov qword [rsp + 0x30], rax
call fcn.14002eac0
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14009a320
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400300c0
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rbp], rax
mov r9, rdx
mov rdi, rcx
mov edx, dword [rbp + 0x50]
mov ecx, 0xffffff53
sub edx, 4
je 0x140030290
sub edx, 1
je 0x1400301d0
cmp edx, 1
jne 0x140030314
movdqa xmm0, xmmword [0x140109a40]
xor ebx, ebx
movdqa xmm1, xmmword [0x140109a30]
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x20], rax
movabs rax, 0xbb67ae8584caa73b
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x140109a00]
mov qword [rsp + 0x28], rax
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rbp - 8], rbx
movdqa xmmword [rsp + 0x40], xmm1
mov dword [rbp - 0x20], ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
test r9, r9
jne 0x14003016a
test r8d, r8d
jne 0x1400301c6
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14000cd90
mov ecx, eax
test eax, eax
jne 0x1400301c6
test rdi, rdi
je 0x1400301c1
lea rcx, [rsp + 0x20]
call fcn.14000d7e0
mov ecx, eax
test eax, eax
jne 0x1400301c6
movaps xmm0, xmmword [rsp + 0x20]
mov ecx, ebx
movaps xmm1, xmmword [rsp + 0x30]
mov eax, 0x40
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm1
jmp 0x140030310
mov ecx, 0xffffff53
mov eax, 0x40
jmp 0x140030310
movdqa xmm0, xmmword [0x1401099c0]
xor ebx, ebx
movdqa xmm1, xmmword [0x140109a20]
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rsp + 0x20], rax
movabs rax, 0x629a292a367cd507
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x1401099f0]
mov qword [rsp + 0x28], rax
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rbp - 8], rbx
movdqa xmmword [rsp + 0x40], xmm1
mov dword [rbp - 0x20], ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
test r9, r9
jne 0x140030233
test r8d, r8d
jne 0x140030286
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14000cd90
mov ecx, eax
test eax, eax
jne 0x140030286
test rdi, rdi
je 0x140030281
lea rcx, [rsp + 0x20]
call fcn.14000d7e0
mov ecx, eax
test eax, eax
jne 0x140030286
movaps xmm0, xmmword [rsp + 0x20]
mov ecx, ebx
movaps xmm1, xmmword [rsp + 0x30]
mov eax, 0x30
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi + 0x20], xmm0
jmp 0x140030310
mov ecx, 0xffffff53
mov eax, 0x30
jmp 0x140030310
xor ebx, ebx
mov dword [rsp + 0x20], 0x6a09e667
mov qword [rbp - 0x70], rbx
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [rbp - 0x80], rbx
mov dword [rbp - 0x78], ebx
test r9, r9
jne 0x1400302e9
test r8d, r8d
je 0x1400302fc
jmp 0x14003030b
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.1400215c0
mov ecx, eax
test eax, eax
jne 0x14003030b
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140022030
mov ecx, eax
mov eax, 0x20
test ecx, ecx
je 0x140030316
mov eax, ecx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14009a320
add rsp, 0x110
pop rdi
pop rbx
pop rbp
ret
Function at 0x140033f60
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xf0
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rbp - 9], rax
mov r15, qword [rbp + 0x67]
mov eax, 0x1b8
mov r12, qword [rbp + 0x77]
mov ecx, eax
ror ecx, 8
mov r14d, 0x37
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
mov byte [rsp + 0x28], r9b
or ecx, eax
mov byte [rsp + 0x20], 1
mov dword [rsp + 0x30], ecx
lea r13d, [r14 - 0x35]
xor esi, esi
mov rdi, rdx
nop dword [rax]
mov r8d, 1
mov qword [rbp - 0x39], rsi
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x40], 0x6a09e667
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0xbb67ae85
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
mov qword [rbp - 0x49], rsi
mov dword [rbp - 0x41], esi
call fcn.1400215c0
mov ebx, eax
test eax, eax
jne 0x140034107
lea r8d, [rax + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400215c0
mov ebx, eax
test eax, eax
jne 0x140034107
cmp byte [rsp + 0x28], 4
je 0x14003407b
lea r8d, [rax + 1]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1400215c0
mov ebx, eax
test eax, eax
jne 0x140034107
test r15, r15
jne 0x14003408c
cmp dword [rbp + 0x6f], esi
jbe 0x1400340a3
mov ebx, 0xffffff53
jmp 0x140034107
mov r8d, dword [rbp + 0x6f]
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.1400215c0
mov ebx, eax
test eax, eax
jne 0x140034107
test r12, r12
je 0x1400340c5
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x1400340c5
mov r8d, eax
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.1400215c0
mov ebx, eax
test eax, eax
jne 0x140034107
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x40]
call fcn.140022030
mov ebx, eax
test eax, eax
jne 0x140034107
cmp r14d, 0x20
jbe 0x1400340f8
movups xmm0, xmmword [rbp - 0x29]
add r14d, 0xffffffe0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
add rdi, 0x20
jmp 0x140034107
mov r8d, r14d
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.14009c440
inc byte [rsp + 0x20]
sub r13, 1
jne 0x140033fd0
mov ecx, 0x20
lea rdx, [rbp - 0x29]
nop
mov byte [rdx], sil
lea rdx, [rdx + 1]
add ecx, 0xffffffff
jne 0x140034120
test ebx, ebx
setne sil
mov eax, esi
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14009a320
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140034280
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rbp + 8], rax
movups xmm0, xmmword [r9]
test r8d, r8d
mov esi, 0
movups xmm1, xmmword [r9 + 0x10]
mov r14, rcx
mov r12d, 1
mov ecx, esi
mov edi, r12d
cmovne edi, r8d
lea ebx, [rsi + 0x37]
test dil, 0x1f
mov eax, edi
movups xmmword [rbp - 0x30], xmm0
setne cl
shr eax, 5
movups xmm0, xmmword [r9 + 0x20]
add ecx, eax
mov r15, rdx
mov eax, dword [r9 + 0x30]
mov r13d, esi
mov dword [rbp], eax
movzx eax, word [r9 + 0x34]
mov word [rbp + 4], ax
movzx eax, byte [r9 + 0x36]
mov byte [rbp + 6], al
mov dword [rsp + 0x20], ecx
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm0
je 0x140034453
mov r8d, ebx
mov qword [rbp - 0x40], rsi
lea rdx, [rbp - 0x30]
mov dword [rsp + 0x50], 0x6a09e667
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x54], 0xbb67ae85
mov dword [rsp + 0x58], 0x3c6ef372
mov dword [rsp + 0x5c], 0xa54ff53a
mov dword [rsp + 0x60], 0x510e527f
mov dword [rsp + 0x64], 0x9b05688c
mov dword [rsp + 0x68], 0x1f83d9ab
mov dword [rsp + 0x6c], 0x5be0cd19
mov qword [rbp - 0x50], rsi
mov dword [rbp - 0x48], esi
call fcn.1400215c0
mov r12d, eax
test eax, eax
jne 0x140034445
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140022030
mov r12d, eax
test eax, eax
jne 0x140034445
cmp dword [r14], 1
mov eax, dword [rsp + 0x28]
jbe 0x1400343c5
cmp eax, dword [r14 + 4]
jne 0x1400343c5
cmp byte [r14 + 0x76], 1
je 0x140034495
mov edx, dword [rsp + 0x20]
mov cl, 1
cmp r13d, edx
lea eax, [rdx + 1]
cmovne eax, edx
mov dword [rsp + 0x20], eax
jmp 0x1400343cb
mov dword [r14 + 4], eax
xor cl, cl
mov byte [r14 + 0x76], cl
test r15, r15
je 0x140034445
test edi, edi
je 0x140034445
cmp edi, 0x20
jb 0x140034433
movups xmm0, xmmword [rsp + 0x28]
add edi, 0xffffffe0
lea rcx, [rbp + 4]
movups xmm1, xmmword [rsp + 0x38]
mov edx, 0x36
lea rax, [rbp + 4]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
add r15, 0x20
sub rdx, rcx
add byte [rax + 2], 1
jne 0x140034445
add byte [rax + 1], 1
jne 0x140034445
add byte [rax], 1
jne 0x140034445
add byte [rax - 1], 1
jne 0x140034445
add byte [rax - 2], 1
jne 0x140034445
sub rax, 5
lea rcx, [rdx + rax]
test rcx, rcx
jns 0x140034407
jmp 0x140034445
mov r8d, edi
lea rdx, [rsp + 0x28]
mov rcx, r15
call fcn.14009c440
mov edi, esi
inc r13d
cmp r13d, dword [rsp + 0x20]
jl 0x140034314
lea rcx, [rbp - 0x30]
nop word [rax + rax]
mov byte [rcx], sil
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x140034460
test r12d, r12d
setne sil
mov eax, esi
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.14009a320
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 3
jmp 0x140034475
Function at 0x140034ba0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
sub rsp, 0xa0
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
test rcx, rcx
jne 0x140034bca
mov eax, 0xffffff53
jmp 0x140034da5
mov qword [rcx + 8], r9
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rbp
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov byte [rcx + 0x18], bpl
xor ecx, ecx
call fcn.140035240
test eax, eax
jne 0x140034d8a
mov rax, qword [0x140121b80]
lea ecx, [rbp + 0x78]
mov qword [rsp + 0xc8], rdi
test rax, rax
je 0x140034c12
call rax
jmp 0x140034c17
call fcn.1400a0b88
mov qword [rsi + 0x10], rax
mov edi, 0x34
test rax, rax
jne 0x140034c2d
lea ebx, [rax - 0x7d]
jmp 0x140034d4f
mov ebx, 1
mov dword [rsp + 0x20], 0xf0000000
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140034d2d
mov rcx, qword [rsi]
lea r8, [rsp + 0x40]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140034d2d
mov rcx, qword [rsi]
xor edx, edx
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], r15
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r12d, 4
mov ebx, ebp
mov r14d, ebp
mov r8d, r12d
mov r15, rbp
lea r13d, [r12 - 1]
nop dword [rax]
mov eax, r8d
lea rdx, [rsp + 0x40]
add rax, r15
lea rcx, [rsp + 0x40]
add rdx, rax
add rcx, r15
call fcn.1400168e0
test eax, eax
mov r8d, edi
cmove ebx, r13d
add r14d, r12d
sub r8d, r14d
add r15, r12
cmp r8d, r12d
cmova r8d, r12d
cmp r14d, 0x30
jb 0x140034cb0
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
test ebx, ebx
jne 0x140034d2d
mov rcx, qword [rsi + 0x10]
lea r8d, [rbx + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x44]
call fcn.140034af0
mov ebx, eax
test eax, eax
je 0x140034d4f
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140034d4b
mov rax, qword [0x140121b70]
test rax, rax
je 0x140034d46
call rax
jmp 0x140034d4b
call fcn.1400a0b74
mov qword [rsi + 0x10], rbp
lea rax, [rsp + 0x40]
mov byte [rax], bpl
lea rax, [rax + 1]
add edi, 0xffffffff
jne 0x140034d54
mov rdi, qword [rsp + 0xc8]
test ebx, ebx
jne 0x140034d72
mov byte [rsi + 0x18], 1
jmp 0x140034d93
cmp ebx, 3
je 0x140034d8a
cmp ebx, 1
mov byte [rsi + 0x18], 2
mov eax, 0xffffff39
cmove ebx, eax
mov ebp, ebx
jmp 0x140034d93
mov byte [rsi + 0x18], 3
mov ebp, 0xffffff2f
mov rbx, qword [rsp + 0xb8]
mov eax, ebp
mov rbp, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14009a320
add rsp, 0xa0
pop rsi
ret
Function at 0x140034dc0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push r12
push r13
sub rsp, 0x90
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x30], r8d
mov rsi, rcx
mov qword [rsp + 0x38], rdx
test rcx, rcx
je 0x140034f87
test rdx, rdx
je 0x140034f87
cmp r8d, 0x10000
ja 0x140034f87
cmp byte [rcx + 0x18], 1
je 0x140034e18
mov eax, 0xffffff39
jmp 0x140034f8c
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
call fcn.1400344a0
xor ebp, ebp
mov edi, eax
cmp eax, 2
jne 0x140034f56
mov edi, 1
mov ecx, edi
call fcn.140035240
test eax, eax
jne 0x140034f5f
mov r9d, edi
mov qword [rsp + 0xc8], rbx
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea ebx, [rbp + 0x24]
test eax, eax
je 0x140034f3d
mov rcx, qword [rsi]
lea r8, [rsp + 0x40]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140034f3d
mov rcx, qword [rsi]
xor edx, edx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r15
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8d, 4
lea r13d, [rbp + 3]
mov r12d, r8d
mov edi, ebp
mov r14d, ebp
mov r15d, ebp
mov eax, r8d
lea rdx, [rsp + 0x40]
add rax, r15
lea rcx, [rsp + 0x40]
add rdx, rax
add rcx, r15
call fcn.1400168e0
test eax, eax
mov r8d, ebx
cmove edi, r13d
add r14d, r12d
sub r8d, r14d
add r15, r12
cmp r8d, r12d
cmova r8d, r12d
cmp r14d, 0x20
jb 0x140034ec0
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x38]
mov r13d, dword [rsp + 0x30]
test edi, edi
jne 0x140034f3d
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x44]
mov r8d, 0x20
call fcn.140034160
mov edi, eax
test eax, eax
jne 0x140034f3d
mov rcx, qword [rsi + 0x10]
mov r8d, r13d
mov rdx, r12
call fcn.1400344a0
mov edi, eax
lea rax, [rsp + 0x40]
mov byte [rax], bpl
lea rax, [rax + 1]
add ebx, 0xffffffff
jne 0x140034f42
mov rbx, qword [rsp + 0xc8]
test edi, edi
je 0x140034f73
cmp edi, 3
jne 0x140034f6a
mov ebp, 0xffffff2f
mov byte [rsi + 0x18], 3
jmp 0x140034f73
mov ebp, 0xffffff39
mov byte [rsi + 0x18], 2
mov rdi, qword [rsp + 0x80]
mov eax, ebp
mov rbp, qword [rsp + 0x88]
jmp 0x140034f8c
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14009a320
add rsp, 0x90
pop r13
pop r12
pop rsi
ret
Function at 0x14003f190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov eax, r8d
xor r9d, r9d
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x14003f287
shr r8d, 3
test r8d, r8d
je 0x14003f350
cmp r8d, 8
jb 0x14003f25c
lea eax, [r8 - 1]
lea r11, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp rcx, rax
ja 0x14003f1db
cmp r11, rdx
jae 0x14003f25c
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + r9*8]
lea eax, [rbx - 2]
movdqu xmm1, xmmword [rdx + r9*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r9*8], xmm1
add r9d, 8
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
lea eax, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r9d, r11d
jb 0x14003f1f0
cmp r9d, r8d
jae 0x14003f350
sub rdx, r10
lea rcx, [rcx + r9*8]
sub r8d, r9d
mov r9d, r8d
nop dword [rax]
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r9, 1
jne 0x14003f270
mov rbx, qword [rsp + 8]
ret
test r8d, r8d
je 0x14003f350
cmp r8d, 0x40
jb 0x14003f32c
lea eax, [r8 - 1]
lea r11, [rax + rcx]
add rax, rdx
cmp r10, rax
ja 0x14003f2b3
cmp r11, rdx
jae 0x14003f32c
mov ebx, r8d
and ebx, 0xffffffc0
mov r11d, 0x20
nop
movdqu xmm0, xmmword [r9 + rcx]
lea eax, [r11 - 0x10]
movdqu xmm1, xmmword [r9 + rdx]
pxor xmm1, xmm0
movdqu xmmword [r9 + rcx], xmm1
add r9d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, r11d
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r9d, ebx
jb 0x14003f2c0
cmp r9d, r8d
jae 0x14003f350
mov eax, r9d
sub rdx, r10
add rax, r10
sub r8d, r9d
mov r9d, r8d
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x14003f340
mov rbx, qword [rsp + 8]
ret
Function at 0x140041970
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa8
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov rsi, qword [rbp + 0x7f]
mov eax, r9d
mov r9, qword [rbp + 0x6f]
mov r14d, eax
mov r13d, eax
shr r14d, 4
and r13d, 0xf
mov dword [rbp - 0x61], eax
mov eax, dword [rbp + 0x77]
mov r12, rcx
mov rcx, qword [rbp + 0x8f]
xorps xmm0, xmm0
mov qword [rbp - 0x51], rdx
xorps xmm1, xmm1
mov qword [rbp - 0x59], rsi
mov rbx, r8
mov qword [rbp - 0x49], rcx
mov r15, rdx
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x41], xmm1
cmp eax, 0xc
jne 0x1400419fc
movsd xmm0, qword [r9]
mov eax, dword [r9 + 8]
movsd qword [rbp - 0x21], xmm0
mov dword [rbp - 0x19], eax
mov byte [rbp - 0x12], 1
jmp 0x140041a1e
lea rcx, [rbp - 0x21]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x20], eax
xor edx, edx
call fcn.1400410d0
movaps xmm0, xmmword [rbp - 0x21]
mov edi, recv
movdqa xmmword [rbp - 0x31], xmm0
test r14d, r14d
je 0x140041af5
lea rsi, [rbp - 0x32]
neg rsi
nop dword [rax]
dec r14d
mov rax, rdi
add byte [rbp + rax - 0x31], 1
jne 0x140041a56
dec rax
cmp rax, 0xc
jge 0x140041a46
lea r8, [rbp - 0x41]
mov rcx, r12
lea rdx, [rbp - 0x31]
call fcn.14003f360
lea rcx, [rbp - 0x41]
mov rax, rbx
or rax, rcx
test al, 7
jne 0x140041a85
mov rax, qword [rbx]
xor qword [rbp - 0x41], rax
mov rax, qword [rbx + 8]
xor qword [rbp - 0x39], rax
jmp 0x140041ad8
lea r9, [rbx + 0xf]
lea rax, [rbp - 0x41]
cmp rax, r9
ja 0x140041ac6
lea rax, [rbp - 0x32]
cmp rax, rbx
jb 0x140041ac6
lea rax, [rbp - 0x41]
mov r8d, reloc.WS2_32.dll_recv
nop word [rax + rax]
lea rcx, [r9 + rsi]
movzx edx, byte [rcx + rax]
xor byte [rax], dl
lea rax, [rax + 1]
sub r8, 1
jne 0x140041ab0
jmp 0x140041ad8
movdqu xmm0, xmmword [rbp - 0x41]
movdqu xmm1, xmmword [rbx]
pxor xmm1, xmm0
movdqu xmmword [rbp - 0x41], xmm1
movups xmm0, xmmword [rbp - 0x41]
add rbx, 0x10
movups xmmword [r15], xmm0
add r15, 0x10
test r14d, r14d
jne 0x140041a40
mov rsi, qword [rbp - 0x59]
test r13d, r13d
je 0x140041b3e
nop word [rax + rax]
add byte [rbp + rdi - 0x31], 1
jne 0x140041b10
dec rdi
cmp rdi, 0xc
jge 0x140041b00
lea r8, [rbp - 0x41]
mov rcx, r12
lea rdx, [rbp - 0x31]
call fcn.14003f360
mov r8d, r13d
lea rcx, [rbp - 0x41]
mov rdx, rbx
call fcn.14003f190
mov r8d, r13d
lea rdx, [rbp - 0x41]
mov rcx, r15
call fcn.14009c440
test rsi, rsi
je 0x140041b8f
mov eax, dword [rbp - 0x61]
mov rcx, r12
mov ebx, dword [rbp + 0x87]
mov r9, qword [rbp - 0x51]
mov r8d, dword [rbp + 0x97]
mov rdx, qword [rbp - 0x49]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call fcn.1400410d0
lea r8, [rbp - 0x41]
mov rcx, r12
lea rdx, [rbp - 0x21]
call fcn.14003f360
mov r8d, ebx
lea rdx, [rbp - 0x41]
mov rcx, rsi
call fcn.14003f190
xor eax, eax
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.14009a320
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140047e50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14011dce8]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x205d], 0
jne 0x140047eb7
cmp byte [rbx + 0x205e], 0
jne 0x140047eb7
mov r9d, dword [rbx + 0x309c]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14004b2b0
test sil, 1
je 0x140047fe6
jmp 0x140047f4f
movss xmm1, dword [rbx + 0x1610]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400cde50]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400cde44]
addss xmm0, dword [rbx + 0x130]
addss xmm1, dword [rbx + 0x134]
or dword [rbx + 0x1be0], 1
mov qword [rbx + 0x1bf8], rax
movss dword [rbx + 0x1bf0], xmm0
mov dword [rbx + 0x1be4], 1
movss dword [rbx + 0x1bf4], xmm1
movss xmm0, dword [rbx + 0x166c]
mov rax, qword [0x14011dce8]
mulss xmm0, dword [0x1400cddf8]
or dword [rax + 0x1be0], 0x40
movss dword [rax + 0x1c40], xmm0
mov r9d, dword [rbx + 0x309c]
call fcn.14004b2b0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140047fa0
lea r11, [0x1400cd7e0]
nop
cmp r9b, 0x23
jne 0x140047f83
cmp byte [r8], r9b
jne 0x140047f83
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140047f70
not ecx
call fcn.14004a370
test rax, rax
je 0x140047fe6
cmp byte [rax + 0x7e], 0
je 0x140047fe6
mov byte [rax + 0x85], 1
lea r8, str.Tooltip__02d
mov dword [rax + 0x9c], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x309c]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x309c]
call fcn.14004b2b0
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140045c60
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14009a320
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14004abf0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0xc8]
mov r9, r8
movsxd r8, dword [rcx + 0xc0]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [rax + r8*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.14004b400