joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401743b0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, rcx
mov r14d, 0x50
xor ecx, ecx
movzx esi, r8b
movzx ebp, dl
mov ebx, ecx
mov r15d, ecx
mov r13d, r14d
mov r10d, dword [r11 + 0x5c0]
mov edi, r10d
mov r12d, ecx
mov r9d, ecx
cmp dl, 0xcc
jne 0x140174430
cmp r8b, 0x15
je 0x14017440e
lea eax, [rsi + 0x56]
cmp al, 1
jbe 0x14017440e
cmp r8b, 0xad
jne 0x140174436
mov eax, 1
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
cmp bpl, 0xc0
jne 0x14017440e
mov rax, qword [r11 + 0x14e8]
test rax, rax
je 0x14017440e
cmp dword [rax], 0xa
je 0x140174452
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x140174442
jmp 0x14017440e
test rax, rax
je 0x14017440e
mov r8, qword [rax + 8]
test r8, r8
je 0x1401745ae
test r9d, r9d
jne 0x1401745ae
movzx eax, word [r8]
cmp ax, 0x1e
ja 0x1401745a1
movzx edx, ax
mov rax, qword [r11]
mov ecx, dword [rax + 0x11c]
bt ecx, edx
jb case.0x140174552.12
sub edx, 0x15
je 0x1401744cb
sub edx, 2
je 0x1401744bf
sub edx, 1
je 0x1401744b3
cmp edx, 1
jne case.0x140174552.12
mov edx, 0xd3
lea eax, [r9 + 0x42]
jmp 0x1401744d5
mov edx, 0xd2
mov eax, 0x30
jmp 0x1401744d5
mov edx, 0x20e
mov eax, 0x20
jmp 0x1401744d5
mov edx, 0xd1
mov eax, SQLFreeHandle
test ebx, ebx
jne 0x1401744f0
cmp word [r11 + 0x5e8], ax
ja 0x1401744f0
movzx ecx, ax
cmp r14d, ecx
jbe 0x1401744f0
mov ebx, edx
mov r14d, ecx
test edi, edi
jne 0x1401744ff
cmp word [r11 + 0x5e8], ax
cmove edi, edx
movzx ecx, ax
test r15d, r15d
je 0x14017450c
cmp r13d, ecx
jbe 0x14017451c
cmp word [r11 + 0x5e8], ax
ja 0x14017451c
mov r15d, edx
mov r13d, ecx
cmp bpl, 0xc0
jne 0x140174578
movzx eax, sil
add eax, 0xfffffffe
cmp eax, 0xad
ja case.0x140174552.6
cdqe
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x17462c]
mov ecx, dword [rcx + rax*4 + 0x17461c]
lea rax, [0x140000000]
add rcx, rax
jmp rcx
xor ecx, ecx
cmp r10d, edx
mov r9d, ecx
sete r9b
lea r12d, [rcx + 1]
jmp 0x1401745a1
xor ecx, ecx
cmp dword [r11 + 0x5ec], edx
mov r9d, ecx
sete r9b
jmp 0x1401745a1
cmp bpl, 0xcc
jne case.0x140174552.12
movzx ecx, sil
sub ecx, 0x13
je case.0x140174552.7
sub ecx, 1
je case.0x140174552.7
sub ecx, 0x94
je case.0x140174552.7
cmp ecx, 1
je case.0x140174552.7
mov r9d, 1
xor ecx, ecx
mov r8, qword [r8 + 8]
test r8, r8
jne 0x140174464
test r10d, r10d
jne 0x140174614
movzx eax, word [r11 + 0x5e8]
mov r10d, ecx
cmp r14d, eax
jne 0x1401745d3
mov r9d, 1
mov dword [r11 + 0x5c0], ebx
mov r10d, ebx
test r10d, r10d
jne 0x140174614
mov dword [r11 + 0x5c0], edi
lea r9d, [r10 + 1]
mov r10d, edi
test edi, edi
jne 0x140174614
mov r10d, ecx
cmp r14d, r13d
jne 0x1401745fc
mov dword [r11 + 0x5c0], ebx
mov r10d, ebx
test r10d, r10d
jne 0x140174614
mov dword [r11 + 0x5c0], r15d
test r15d, r15d
jne 0x140174614
test r12d, r12d
cmovne r9d, ecx
mov eax, r9d
jmp 0x140174413
Function at 0x140178260
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x488
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r13, rcx
lea rdi, [rsp + 0x70]
mov rcx, qword [rsp + 0x4e0]
mov ebx, r9d
mov qword [rsp + 0x60], rcx
mov r12d, r8d
xor ecx, ecx
mov rax, rdx
mov qword [rsp + 0x50], rcx
mov r15d, ecx
mov qword [rsp + 0x58], rcx
test rdx, rdx
je 0x1401784d6
lea rdx, [0x1402d29bc]
mov rcx, rax
call fcn.14028c388
mov rsi, rax
test rax, rax
je 0x1401784d6
xor edx, edx
mov qword [rsp + 0x4d8], rbp
mov rcx, rax
mov qword [rsp + 0x480], r14
lea r8d, [rdx + 2]
call fcn.14028cc40
test eax, eax
jne 0x1401784c4
mov rcx, rsi
call fcn.14028d180
mov rcx, rsi
movsxd rbp, eax
call fcn.1402a0aec
lea eax, [rbp - 1]
cmp eax, 0x3fffff
ja 0x1401784c4
cmp ebp, 0x400
jle 0x14017833d
mov rcx, rbp
call fcn.1401c5b90
mov rdi, rax
test rax, rax
je 0x1401784c4
mov r15d, 1
mov r9, rsi
mov r8, rbp
mov edx, 1
mov rcx, rdi
call fcn.14028c8fc
cmp rax, rbp
je 0x14017835f
mov ebx, 0xfffffffc
jmp 0x14017840f
cmp ebx, 0x16
jne 0x14017847d
mov ebx, 5
lea r8, [rsp + 0x58]
mov ecx, ebx
lea rdx, [rsp + 0x50]
call fcn.140205510
test eax, eax
jne 0x14017839b
mov rdx, qword [rsp + 0x50]
mov r8d, ebp
mov rcx, rdi
call fcn.1401f0850
test rax, rax
jne 0x14017848b
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, [rsp + 0x50]
call fcn.140205510
test eax, eax
jne 0x14017845c
mov rdx, qword [rsp + 0x50]
mov r8d, ebp
mov rcx, rdi
call fcn.1401f0850
test rax, rax
je 0x14017845c
xor ebx, ebx
mov eax, dword [rsp + 0x4f8]
mov r9d, r12d
mov dword [rsp + 0x40], eax
mov r8d, ebp
mov eax, dword [rsp + 0x4e8]
mov rdx, rdi
mov dword [rsp + 0x38], eax
mov rcx, r13
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call fcn.140177570
mov ebx, eax
mov rcx, rsi
call fcn.14028c418
test r15d, r15d
je 0x140178429
test rdi, rdi
je 0x140178429
mov rcx, rdi
call fcn.1401c5b70
mov eax, ebx
mov rbp, qword [rsp + 0x4d8]
mov r14, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140283120
add rsp, 0x488
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test r15d, r15d
je 0x14017846e
test rdi, rdi
je 0x14017846e
mov rcx, rdi
call fcn.1401c5b70
mov rcx, rsi
call fcn.14028c418
mov eax, 0xfffffff8
jmp 0x14017842b
cmp ebx, 5
je 0x14017848b
cmp ebx, 0xf
jne 0x1401783cf
cmp r12d, 1
jne 0x1401783cf
mov eax, dword [rsp + 0x4f8]
mov r9d, r12d
mov dword [rsp + 0x30], eax
mov r8d, ebp
mov rax, qword [rsp + 0x60]
mov rdx, rdi
mov qword [rsp + 0x28], rax
mov rcx, r13
mov dword [rsp + 0x20], ebx
call fcn.140178150
jmp 0x14017840d
mov rcx, rsi
call fcn.14028c418
mov eax, 0xfffffffc
jmp 0x14017842b
mov eax, 0xfffffffc
jmp 0x14017843b
Function at 0x1401b7d10
Capabilities:
Encode data using base64

Disassembly:
push rbx
push rsi
push r13
push r14
push r15
sub rsp, 0x20
xor r14d, r14d
movsxd rsi, edx
mov qword [r8], r14
mov r13, r9
mov dword [r9], r14d
mov rbx, r8
mov r15, rcx
test edx, edx
je 0x1401b7f31
test rcx, rcx
je 0x1401b7f31
lea r10d, [rsi*4]
mov qword [rsp + 0x60], r12
mov eax, 0x55555556
imul r10d
mov eax, edx
inc edx
shr eax, 0x1f
add eax, edx
mov dword [r9], eax
add eax, 0xa
movsxd rcx, eax
call fcn.140283754
mov qword [rbx], rax
test esi, esi
jle 0x1401b7f1e
mov qword [rsp + 0x50], rbp
mov r10d, r14d
mov qword [rsp + 0x58], rdi
mov r11d, r14d
mov edi, 2
nop
movzx r8d, byte [r11 + r15]
lea ebp, [rdi - 1]
xor al, al
xor dl, dl
cmp ebp, esi
jge 0x1401b7da6
movzx eax, byte [r11 + r15 + 1]
cmp edi, esi
jge 0x1401b7db0
movzx edx, byte [r11 + r15 + 2]
movzx r9d, r8b
movzx ecx, al
shr cl, 4
and r8b, 3
and al, 0xf
shl r8b, 4
or r8b, cl
shl al, 2
movzx ecx, dl
shr r9b, 2
shr cl, 6
and dl, 0x3f
or al, cl
cmp r9b, 0x1a
jae 0x1401b7de5
add r9b, 0x41
jmp 0x1401b7e10
cmp r9b, 0x34
jae 0x1401b7df1
add r9b, 0x47
jmp 0x1401b7e10
cmp r9b, 0x3e
jae 0x1401b7dfd
sub r9b, 4
jmp 0x1401b7e10
mov r9d, 0x2b
mov ecx, 0x2f
cmove ecx, r9d
movzx r9d, cl
mov rcx, qword [rbx]
mov byte [r10 + rcx], r9b
mov r9d, 0x2b
cmp r8b, 0x1a
jae 0x1401b7e29
add r8b, 0x41
jmp 0x1401b7e4b
cmp r8b, 0x34
jae 0x1401b7e35
add r8b, 0x47
jmp 0x1401b7e4b
cmp r8b, 0x3e
jae 0x1401b7e41
sub r8b, 4
jmp 0x1401b7e4b
mov r8d, 0x2f
cmove r8d, r9d
mov rcx, qword [rbx]
mov byte [r10 + rcx + 1], r8b
cmp ebp, esi
jge 0x1401b7e9a
cmp al, 0x1a
jae 0x1401b7e67
mov rcx, qword [rbx]
add al, 0x41
mov byte [rcx + r10 + 2], al
jmp 0x1401b7ea3
cmp al, 0x34
jae 0x1401b7e77
mov rcx, qword [rbx]
add al, 0x47
mov byte [rcx + r10 + 2], al
jmp 0x1401b7ea3
cmp al, 0x3e
jae 0x1401b7e87
mov rcx, qword [rbx]
sub al, 4
mov byte [rcx + r10 + 2], al
jmp 0x1401b7ea3
mov rcx, qword [rbx]
mov eax, 0x2f
cmove eax, r9d
mov byte [rcx + r10 + 2], al
jmp 0x1401b7ea3
mov rax, qword [rbx]
mov byte [rax + r10 + 2], reloc.ODBC32.dll_SQLMoreResults
cmp edi, esi
jge 0x1401b7ef0
cmp dl, 0x1a
jae 0x1401b7eb9
mov rax, qword [rbx]
add dl, 0x41
mov byte [r10 + rax + 3], dl
jmp 0x1401b7ef9
cmp dl, 0x34
jae 0x1401b7ecb
mov rax, qword [rbx]
add dl, 0x47
mov byte [r10 + rax + 3], dl
jmp 0x1401b7ef9
cmp dl, 0x3e
jae 0x1401b7edd
mov rax, qword [rbx]
sub dl, 4
mov byte [r10 + rax + 3], dl
jmp 0x1401b7ef9
mov rax, qword [rbx]
mov edx, 0x2f
cmove edx, r9d
mov byte [r10 + rax + 3], dl
jmp 0x1401b7ef9
mov rax, qword [rbx]
mov byte [r10 + rax + 3], reloc.ODBC32.dll_SQLMoreResults
add edi, 3
lea eax, [r14 + 4]
add r11, 3
mov r14d, eax
add r10, 4
cmp r11, rsi
jl 0x1401b7d90
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov dword [r13], r14d
mov rax, qword [rbx]
movsxd rcx, r14d
mov byte [rcx + rax], 0
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
Function at 0x1401be310
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
jle 0x1401be4af
push rsi
sub rsp, 0x40
mov qword [rsp + 0x50], rbx
mov rsi, r9
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
lea r15, [rcx + 4]
cmp edx, 1
jne 0x1401be3f6
mov rdi, qword [rsp + 0x70]
lea rbp, [r8 - 1]
mov r14, r9
shr rbp, 4
sub r14, rdi
inc rbp
lea rax, [rdi + 0xf]
cmp rbx, rax
ja 0x1401be374
lea rax, [rbx + 0xf]
cmp rax, rdi
jae 0x1401be386
lea rax, [rsi + 0xf]
cmp rbx, rax
ja 0x1401be3b7
lea rax, [rbx + 0xf]
cmp rax, rsi
jb 0x1401be3b7
mov r8, rbx
mov rax, rdi
sub r8, rdi
mov edx, reloc.ODBC32.dll_SQLFreeStmt
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r14 + rax]
xor cl, byte [rax]
mov byte [r8 + rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1401be3a0
jmp 0x1401be3c7
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov r8, rbx
mov rdx, rbx
mov rcx, r15
call fcn.1401be4b0
movups xmm0, xmmword [rbx]
add rbx, 0x10
sub r14, 0x10
add rdi, 0x10
movups xmmword [rsi], xmm0
sub rbp, 1
jne 0x1401be362
jmp 0x1401be491
mov rbp, qword [rsp + 0x70]
lea r14, [r8 - 1]
mov qword [rsp + 0x68], r12
mov rdi, rsi
sub rdi, rbx
shr r14, 4
inc r14
movaps xmmword [rsp + 0x20], xmm6
lea r12, [r9 + 0xf]
nop word [rax + rax]
movups xmm6, xmmword [rbp]
mov r8, rbx
mov rdx, rbp
mov rcx, r15
call fcn.1401be4b0
cmp rbx, r12
ja 0x1401be462
lea rax, [rbx + 0xf]
cmp rax, rsi
jb 0x1401be462
mov rcx, rbx
mov edx, reloc.ODBC32.dll_SQLFreeStmt
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1401be450
jmp 0x1401be472
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rsi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
add rbp, 0x10
add rbx, 0x10
sub rdi, 0x10
movups xmmword [rsi], xmm6
sub r14, 1
jne 0x1401be420
movaps xmm6, xmmword [rsp + 0x20]
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop rsi
ret
Function at 0x1401bf400
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [reloc.WS2_32.dll_accept], 0
mov qword [rsp + 0x20], rdi
mov edi, ecx
je 0x1401bf54d
lea rcx, str.ntdll.dll
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtClose
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtConnectPort
mov rcx, rbx
mov qword [0x140452438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtRegisterThreadTerminatePort
mov rcx, rbx
mov qword [0x140452440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtRequestWaitReplyPort
mov rcx, rbx
mov qword [0x140452448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtRequestPort
mov rcx, rbx
mov qword [0x140452450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCreatePort
mov rcx, rbx
mov qword [0x140452458], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtReplyWaitReceivePort
mov rcx, rbx
mov qword [0x140452460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtAcceptConnectPort
mov rcx, rbx
mov qword [0x140452468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtCompleteConnectPort
mov rcx, rbx
mov qword [0x140452470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtImpersonateClientOfPort
mov rcx, rbx
mov qword [0x140452478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenProcess
mov rcx, rbx
mov qword [0x140452480], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtDuplicateObject
mov rcx, rbx
mov qword [0x140452488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rsp + 0x30]
mov qword [0x140452490], rax
mov byte [reloc.WS2_32.dll_accept], 0
call fcn.1401bf380
lea rcx, [rax + 8]
mov rax, qword [rax + 8]
call qword [rax]
cmp edi, eax
mov rdi, qword [rsp + 0x20]
jg 0x1401bf578
call fcn.1401bf380
test rax, rax
je 0x1401bf578
add rax, 8
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1401c5b10
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov r9, r8
mov r8, rdx
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.14029a854
mov qword [rbx], rax
test rax, rax
je 0x1401c5b4a
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
add rsp, 0x30
pop rbx
ret
Function at 0x1401c6b50
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
jne 0x1401c6b5b
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov qword [rcx + 0x70], rax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret

Function at 0x1401c6ba0
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
jne 0x1401c6bab
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x70], rdx
ret

Function at 0x1401c6bf0
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
jne 0x1401c5bdb
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1401c6d15
test rdx, rdx
je 0x1401c6d15
call fcn.1401c5c20
test eax, eax
jne 0x1401c6d1a
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0x18], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x1c], ecx
mov rcx, rbx
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1401c5bd0
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401c7820
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1401c7910
test rdx, rdx
je 0x1401c7910
mov eax, dword [rcx]
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 0xc]
mov byte [rax + rdi], 0x80
mov ecx, dword [rcx]
inc ecx
mov dword [rbx], ecx
cmp ecx, 0x38
jbe 0x1401c788b
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.140285450
mov rdx, rdi
mov dword [rbx], 0x40
mov rcx, rbx
call fcn.1401c6f60
mov ecx, ebp
mov dword [rbx], ebp
mov r8d, SQLMoreResults
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.140285450
mov r8d, dword [rbx + 4]
mov rdx, rdi
mov ecx, dword [rbx + 8]
mov eax, r8d
shr eax, 0x1d
lea eax, [rax + rcx*8]
mov rcx, rbx
mov dword [rbx + 8], eax
lea eax, [r8*8]
mov dword [rbx + 4], eax
mov dword [rdi + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0x3c], eax
call fcn.1401c6f60
movups xmm0, xmmword [rbx + 0x4c]
mov rdi, qword [rsp + 0x38]
xor eax, eax
movups xmmword [rsi], xmm0
mov dword [rbx + 0x4c], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov qword [rbx], rbp
mov dword [rbx + 8], ebp
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffff53
add rsp, 0x20
pop rsi
ret
Function at 0x1401c99d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
shr r8d, 3
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x1401c9a51
mov qword [rsp], rbx
sub r10, rcx
mov r11d, r8d
movabs rbx, 0xffff0000ffff
movabs r8, 0xff00ff00ff00ff
mov rcx, qword [r10 + r9]
lea r9, [r9 + 8]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r8
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, rbx
xor rcx, rdx
rol rcx, 0x20
mov qword [r9 - 8], rcx
sub r11, 1
jne 0x1401c9a01
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x1401c9a60
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x1401c9a6b
mov eax, 0xffffff53
ret
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret

Function at 0x1401cc230
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x1401cc23b
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], 0
jmp fcn.1401c9a60

Function at 0x1401cc250
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x1401cc25b
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
jmp fcn.1401c9a60

Function at 0x1401cc270
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x1401cc27b
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], 0
jmp fcn.1401c9b00

Function at 0x1401cc310
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x1401cc31b
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
jmp fcn.1401c9b00

Function at 0x1401cc330
Capabilities:
Hash data using sha384

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1401cc37b
test rdx, rdx
je 0x1401cc37b
call fcn.1401c9ce0
test eax, eax
jne 0x1401cc380
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401c9a60
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401cc6d0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1401cc723
test rdx, rdx
je 0x1401cc723
call fcn.1401c9ce0
test eax, eax
jne 0x1401cc728
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x30], xmm1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401c9b00
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401d3bc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov eax, r8d
xor r9d, r9d
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x1401d3cb7
shr r8d, 3
test r8d, r8d
je 0x1401d3d80
cmp r8d, 8
jb 0x1401d3c83
lea eax, [r8 - 1]
lea r11, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp rcx, rax
ja 0x1401d3c07
cmp r11, rdx
jae 0x1401d3c83
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + r9*8]
lea eax, [rbx - 2]
movdqu xmm1, xmmword [rdx + r9*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r9*8], xmm1
add r9d, 8
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
lea eax, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r9d, r11d
jb 0x1401d3c20
cmp r9d, r8d
jae 0x1401d3d80
sub rdx, r10
lea rcx, [rcx + r9*8]
sub r8d, r9d
mov r9d, r8d
nop dword [rax]
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r9, 1
jne 0x1401d3ca0
mov rbx, qword [rsp + 8]
ret
test r8d, r8d
je 0x1401d3d80
cmp r8d, 0x40
jb 0x1401d3d57
lea eax, [r8 - 1]
lea r11, [rax + rcx]
add rax, rdx
cmp r10, rax
ja 0x1401d3ce3
cmp r11, rdx
jae 0x1401d3d57
mov ebx, r8d
and ebx, 0xffffffc0
mov r11d, 0x20
nop
movdqu xmm0, xmmword [r9 + rcx]
lea eax, [r11 - 0x10]
movdqu xmm1, xmmword [r9 + rdx]
pxor xmm1, xmm0
movdqu xmmword [r9 + rcx], xmm1
add r9d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, r11d
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r9d, ebx
jb 0x1401d3cf0
cmp r9d, r8d
jae 0x1401d3d80
mov eax, r9d
sub rdx, r10
add rax, r10
sub r8d, r9d
mov r9d, r8d
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1401d3d70
mov rbx, qword [rsp + 8]
ret