joyce8/EMBER2024-capa huggingface dataset:
Function at 0x164c6adc0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8a8]
sub rsp, 0x9a8
mov rax, qword [0x164cb3008]
xor rax, rsp
mov qword [rbp + 0x898], rax
mov rdx, qword [rbp + 0x8f0]
lea rcx, [rsp + 0x20]
mov r8d, dword [rbp + 0x8f8]
xor r13d, r13d
mov rbx, qword [rbp + 0x908]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
call sym.aswCmnIS.dll_md5Update
mov rdx, qword [rsp + 0x30]
mov ecx, 0x78
mov qword [rbp + 0x880], rdx
mov r8d, 0x38
shr edx, 3
and edx, 0x3f
sub ecx, edx
sub r8d, edx
cmp edx, 0x38
lea rdx, [0x164ca4420]
cmovae r8d, ecx
lea rcx, [rsp + 0x20]
call sym.aswCmnIS.dll_md5Update
mov esi, 8
lea rdx, [rbp + 0x880]
mov r8d, esi
lea rcx, [rsp + 0x20]
call sym.aswCmnIS.dll_md5Update
movaps xmm0, xmmword [rsp + 0x20]
lea r9, [rbp - 0x80]
lea rcx, [rbp + 0x888]
movups xmmword [rbp + 0x888], xmm0
call fcn.164c645c0
mov eax, dword [rbp + 0x910]
mov r15, rbx
mov rdi, qword [rbp + 0x900]
mov r12d, r13d
mov qword [rbp + 0x888], rbx
mov r14d, r13d
cmp eax, 0x10
jb 0x164c6af5b
mov ecx, dword [rbp + 0x880]
add eax, 0xfffffff8
mov edx, dword [rbp + 0x880]
mov r15d, eax
shr r15, 3
test rdi, rdi
je 0x164c6af32
mov eax, dword [rdi]
lea r8, [rbp + 0x80]
bswap eax
mov dword [rbp + 0x880], eax
lea rdx, [rbp]
mov eax, dword [rdi + 4]
lea rcx, [rbp + 0x880]
bswap eax
mov dword [rbp + 0x884], eax
call fcn.164c63ff0
mov ecx, dword [rbp + 0x880]
mov edx, dword [rbp + 0x884]
bswap ecx
bswap edx
mov eax, ecx
xor eax, r12d
mov dword [rbx], eax
mov eax, edx
xor eax, r14d
mov dword [rbx + 4], eax
add rbx, rsi
mov r12d, dword [rdi]
mov r14d, dword [rdi + 4]
add rdi, rsi
sub r15, 1
jne 0x164c6aef1
mov r15, qword [rbp + 0x888]
test rdi, rdi
je 0x164c6af9e
mov eax, dword [rdi]
lea r8, [rbp + 0x80]
bswap eax
mov dword [rbp + 0x880], eax
lea rdx, [rbp]
mov eax, dword [rdi + 4]
lea rcx, [rbp + 0x880]
bswap eax
mov dword [rbp + 0x884], eax
call fcn.164c63ff0
mov eax, dword [rbp + 0x880]
mov ecx, dword [rbp + 0x884]
bswap eax
bswap ecx
jmp 0x164c6afaa
mov ecx, dword [rbp + 0x884]
mov eax, dword [rbp + 0x880]
xor r14d, ecx
xor eax, r12d
mov dword [rbp + 0x884], r14d
shr r14d, 0x18
cmp r14b, 8
mov dword [rbp + 0x880], eax
cmovbe r13d, r14d
cmp r13b, 8
jae 0x164c6afeb
sub sil, r13b
lea rdx, [rbp + 0x880]
movzx edi, sil
mov rcx, rbx
mov r8d, edi
call fcn.164c8fe50
add rbx, rdi
sub ebx, r15d
mov eax, ebx
mov rcx, qword [rbp + 0x898]
xor rcx, rsp
call fcn.164c8ef00
add rsp, 0x9a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x164c6b020
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov byte [rax + 0x20], r9b
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
sub rsp, 0x38
cmp byte [rsp + 0x60], 0
mov r8, rcx
mov edx, dword [rax + 0x18]
je 0x164c6b059
mov rcx, qword [rax + 0x10]
mov dword [rax - 0x18], 0
call sym.aswCmnIS.dll_IDEACryptBlock
add rsp, 0x38
ret
mov qword [rsp + 0x30], rdi
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.164c6ea60
cmp byte [rsp + 0x58], 0
jne 0x164c6b09a
cmp dword [rsp + 0x50], 0
mov r8b, 0x37
jbe 0x164c6b09a
mov edx, dword [rsp + 0x50]
movzx ecx, byte [rdi]
lea rdi, [rdi + 1]
movzx eax, cl
xor al, r8b
movzx r8d, cl
mov byte [rdi - 1], al
sub rdx, 1
jne 0x164c6b080
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x164c6b2b0
Capabilities:
Hash data using sha384
Hash data with md5

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov ecx, dword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov dword [rdi], ecx
sub ecx, 1
je 0x164c6b483
sub ecx, 1
je 0x164c6b44e
sub ecx, 1
je 0x164c6b3e9
sub ecx, 1
je 0x164c6b346
xor edx, edx
cmp ecx, 1
je 0x164c6b310
lea rcx, [rdi + 8]
mov r8d, 0x5d8
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rdi + 4], 0x40
mov dword [rdi], eax
add rsp, 0x20
pop rdi
ret
lea rcx, [rdi + 0x10]
mov r8, 0xffffffffffffffff
call sym.aswCmnIS.dll_sha512Init
xor edx, edx
lea rcx, [rdi + 0x2f8]
lea r8, [rdx - 1]
call sym.aswCmnIS.dll_sha512Init
mov dword [rdi + 8], 0x40
mov dword [rdi + 4], 0x80
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x40], rbx
lea rcx, [rdi + 0x10]
lea r8, [rdx - 1]
call sym.aswCmnIS.dll_sha512Init
movaps xmm0, xmmword [0x164ca4c80]
lea rcx, [rdi + 0x2f8]
movups xmmword [rdi + 0x10], xmm0
xor edx, edx
movaps xmm1, xmmword [0x164ca4c90]
movups xmmword [rdi + 0x20], xmm1
movaps xmm0, xmmword [0x164ca4ca0]
lea r8, [rdx - 1]
movups xmmword [rdi + 0x30], xmm0
movaps xmm1, xmmword [0x164ca4cb0]
movups xmmword [rdi + 0x40], xmm1
call sym.aswCmnIS.dll_sha512Init
movaps xmm0, xmmword [0x164ca4c80]
mov rbx, qword [rsp + 0x40]
movups xmmword [rdi + 0x2f8], xmm0
movaps xmm1, xmmword [0x164ca4c90]
movups xmmword [rdi + 0x308], xmm1
movaps xmm0, xmmword [0x164ca4ca0]
movups xmmword [rdi + 0x318], xmm0
movaps xmm1, xmmword [0x164ca4cb0]
movups xmmword [rdi + 0x328], xmm1
mov dword [rdi + 8], 0x30
mov dword [rdi + 4], 0x80
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov dword [rdi + 0x10], 0x67452301
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x308], rax
mov dword [rdi + 0x14], 0xefcdab89
mov dword [rdi + 0x18], 0x98badcfe
mov dword [rdi + 0x1c], 0x10325476
mov dword [rdi + 0x2f8], 0x67452301
mov dword [rdi + 0x2fc], 0xefcdab89
mov dword [rdi + 0x300], 0x98badcfe
mov dword [rdi + 0x304], 0x10325476
mov dword [rdi + 8], 0x10
mov dword [rdi + 4], 0x40
add rsp, 0x20
pop rdi
ret
xor edx, edx
lea rcx, [rdi + 0x10]
lea r8, [rdx - 1]
call sym.aswCmnIS.dll_sha256Init
xor edx, edx
lea rcx, [rdi + 0x2f8]
lea r8, [rdx - 1]
call sym.aswCmnIS.dll_sha256Init
mov dword [rdi + 8], 0x20
mov dword [rdi + 4], 0x40
add rsp, 0x20
pop rdi
ret
xor edx, edx
lea rcx, [rdi + 0x10]
lea r8, [rdx - 1]
call sym.aswCmnIS.dll_sha1Init
xor edx, edx
lea rcx, [rdi + 0x2f8]
lea r8, [rdx - 1]
call sym.aswCmnIS.dll_sha1Init
mov dword [rdi + 8], 0x14
mov dword [rdi + 4], 0x40
add rsp, 0x20
pop rdi
ret
Function at 0x164c6ce20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
movzx r10d, word [rcx]
movzx ebx, word [rcx + 2]
movzx ebp, word [rcx + 4]
movzx r11d, word [rcx + 6]
ror r10w, 8
ror bx, 8
ror bp, 8
ror r11w, 8
xor edi, edi
lea r14d, [rdi + 8]
nop dword [rax]
movzx ecx, word [rax]
lea rax, [rax + 0xc]
dec cx
dec r10w
movzx edx, cx
mov esi, edi
movzx r8d, r10w
mov r10d, edi
lea ecx, [r8 + 1]
imul edx, ecx
lea r9d, [r8 + 1]
add r9d, edx
mov ecx, r9d
shr ecx, 0x10
cmp r9w, cx
setbe r10b
add bx, word [rax - 0xa]
add bp, word [rax - 8]
sub r10w, cx
movzx ecx, word [rax - 6]
add r10w, r9w
dec cx
dec r11w
movzx edx, cx
movzx r8d, r11w
mov r11d, edi
lea ecx, [r8 + 1]
imul edx, ecx
lea r9d, [r8 + 1]
add r9d, edx
movzx edx, word [rax - 4]
mov ecx, r9d
shr ecx, 0x10
cmp r9w, cx
setbe r11b
dec dx
sub r11w, cx
movzx ecx, bp
xor cx, r10w
add r11w, r9w
dec cx
movzx r9d, dx
movzx edx, word [rax - 2]
movzx r8d, cx
lea ecx, [r8 + 1]
inc r8d
imul r9d, ecx
add r9d, r8d
mov ecx, r9d
shr ecx, 0x10
cmp r9w, cx
setbe sil
dec dx
sub si, cx
movzx ecx, r11w
xor cx, bx
add si, r9w
dec cx
movzx r9d, dx
add cx, si
mov edx, edi
movzx r8d, cx
lea ecx, [r8 + 1]
imul r9d, ecx
inc r9d
add r9d, r8d
mov ecx, r9d
shr ecx, 0x10
cmp r9w, cx
setbe dl
dec r14d
sub dx, cx
add dx, r9w
add si, dx
xor r10w, dx
xor r11w, si
xor si, bx
movzx ebx, dx
xor bx, bp
movzx ebp, si
test r14d, r14d
jg 0x164c6ce70
movzx ecx, word [rax]
dec r10w
dec cx
movzx r8d, r10w
movzx edx, cx
lea ecx, [r8 + 1]
imul edx, ecx
lea r9d, [r8 + 1]
add r9d, edx
mov edx, edi
mov ecx, r9d
shr ecx, 0x10
cmp r9w, cx
setbe dl
dec r11w
sub dx, cx
movzx r8d, r11w
mov rcx, qword [rsp + 0x30]
add dx, r9w
lea r9, [rcx + 2]
ror dx, 8
mov word [rcx], dx
add si, word [rax + 2]
ror si, 8
mov word [r9], si
add bx, word [rax + 4]
ror bx, 8
mov word [r9 + 2], bx
movzx ecx, word [rax + 6]
lea eax, [r8 + 1]
mov rbx, qword [rsp + 0x40]
dec cx
movzx edx, cx
lea ecx, [r8 + 1]
imul edx, eax
add ecx, edx
mov eax, ecx
shr eax, 0x10
cmp cx, ax
setbe dil
sub di, ax
add di, cx
ror di, 8
mov word [r9 + 4], di
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x164c6d3a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
mov edx, 0x10
mov r9, qword [rsp + 8]
lea rcx, [r9 + 0x20]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x20]
mov byte [rcx], al
xor al, byte [rcx - 0x10]
mov byte [rcx + 0x10], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x164c6d3c0
xor cl, cl
lea r10, [r9 + 0x11]
xor r8d, r8d
lea r11, [0x164ca4320]
nop word [rax + rax]
mov rax, r10
mov r9d, 2
nop dword [rax]
movzx ecx, cl
movzx ecx, byte [rcx + r11]
xor byte [rax - 1], cl
movzx ecx, byte [rax - 1]
movzx ecx, byte [rcx + r11]
xor cl, byte [rax]
movzx edx, cl
mov byte [rax], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 1]
movzx edx, cl
mov byte [rax + 1], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 2]
movzx edx, cl
mov byte [rax + 2], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 3]
movzx edx, cl
mov byte [rax + 3], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 4]
movzx edx, cl
mov byte [rax + 4], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 5]
movzx edx, cl
mov byte [rax + 5], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 6]
movzx edx, cl
mov byte [rax + 6], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 7]
movzx edx, cl
mov byte [rax + 7], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 8]
movzx edx, cl
mov byte [rax + 8], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 9]
movzx edx, cl
mov byte [rax + 9], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 0xa]
movzx edx, cl
mov byte [rax + 0xa], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 0xb]
movzx edx, cl
mov byte [rax + 0xb], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 0xc]
movzx edx, cl
mov byte [rax + 0xc], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 0xd]
movzx edx, cl
mov byte [rax + 0xd], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 0xe]
movzx edx, cl
mov byte [rax + 0xe], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 0xf]
movzx edx, cl
mov byte [rax + 0xf], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 0x10]
movzx edx, cl
mov byte [rax + 0x10], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 0x11]
movzx edx, cl
mov byte [rax + 0x11], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 0x12]
movzx edx, cl
mov byte [rax + 0x12], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax + 0x13]
lea rax, [rax + 0x18]
movzx edx, cl
mov byte [rax - 5], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax - 4]
movzx edx, cl
mov byte [rax - 4], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax - 3]
movzx edx, cl
mov byte [rax - 3], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax - 2]
mov byte [rax - 2], cl
sub r9, 1
jne 0x164c6d400
add cl, r8b
inc r8d
cmp r8d, 0x12
jl 0x164c6d3f0
ret
Function at 0x164c6de90
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
test rax, rax
je 0x164c6deca
xor ecx, ecx
mov dword [rax + 8], 0x67452301
mov qword [rax], rcx
mov dword [rax + 0xc], 0xefcdab89
mov dword [rax + 0x10], 0x98badcfe
mov qword [rax + 0x14], 0x10325476
ret

Function at 0x164c6dfc0
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x40
mov rbx, rcx
test rcx, rcx
je 0x164c6e124
mov edx, dword [rcx + 0x18]
mov qword [rax - 0x18], rsi
mov esi, r8d
mov qword [rax - 0x20], rdi
mov rdi, qword [rax + 0x10]
mov qword [rax - 0x28], r14
xor r14d, r14d
cmp edx, 0x40
jae 0x164c6e09d
test rdi, rdi
jne 0x164c6e011
test sil, 1
je 0x164c6e0b9
lea ecx, [rdx*8]
mov qword [rsp + 0x38], rbp
add qword [rbx], rcx
mov byte [rdx + rbx + 0x1c], 0x80
mov eax, dword [rbx + 0x18]
inc eax
mov dword [rbx + 0x18], eax
cmp eax, 0x38
jbe 0x164c6e06a
cmp eax, 0x40
jae 0x164c6e052
nop word [rax + rax]
mov byte [rax + rbx + 0x1c], r14b
mov eax, dword [rbx + 0x18]
inc eax
mov dword [rbx + 0x18], eax
cmp eax, 0x40
jb 0x164c6e040
lea rbp, [rbx + 0x1c]
mov rcx, rbx
mov rdx, rbp
call fcn.164c6d8f0
mov eax, r14d
mov dword [rbx + 0x18], r14d
jmp 0x164c6e070
lea rbp, [rbx + 0x1c]
jae 0x164c6e082
mov byte [rax + rbx + 0x1c], r14b
mov eax, dword [rbx + 0x18]
inc eax
mov dword [rbx + 0x18], eax
cmp eax, 0x38
jb 0x164c6e070
mov rax, qword [rbx]
mov rdx, rbp
mov rcx, rbx
mov qword [rbx + 0x54], rax
call fcn.164c6d8f0
mov rbp, qword [rsp + 0x38]
mov dword [rbx + 0x18], r14d
test rdi, rdi
je 0x164c6e0b9
mov eax, dword [rbx + 8]
mov dword [rdi], eax
mov eax, dword [rbx + 0xc]
mov dword [rdi + 4], eax
mov eax, dword [rbx + 0x10]
mov dword [rdi + 8], eax
mov eax, dword [rbx + 0x14]
mov dword [rdi + 0xc], eax
mov rdi, qword [rsp + 0x28]
test sil, 3
je 0x164c6e0fa
test sil, 2
je 0x164c6e11a
mov rsi, qword [rsp + 0x30]
mov qword [rbx], r14
mov r14, qword [rsp + 0x20]
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov qword [rbx + 0x14], 0x10325476
add rsp, 0x40
pop rbx
ret
test sil, 8
je 0x164c6e11a
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret
Function at 0x164c6e130
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x164cb3008]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, qword [rbp + 0x77]
xor esi, esi
mov qword [r11 - 0x20], rdi
xorps xmm0, xmm0
mov rdi, qword [rbp + 0x6f]
mov edx, esi
mov qword [r11 - 0x28], r14
mov r14, qword [rbp + 0x67]
mov dword [rbp - 0x31], 0x67452301
mov dword [rbp - 0x2d], 0xefcdab89
mov dword [rbp - 0x29], 0x98badcfe
mov dword [rbp - 0x25], 0x10325476
mov qword [rbp - 0x39], rsi
mov dword [rbp - 0x21], edx
movups xmmword [r15], xmm0
test r14, r14
je 0x164c6e242
test rdi, rdi
je 0x164c6e242
mov qword [r11 + 0x20], rbx
test edx, edx
jne 0x164c6e1df
cmp rdi, 0x40
jb 0x164c6e1df
mov rdx, r14
lea rcx, [rbp - 0x39]
call fcn.164c6d8f0
add qword [rbp - 0x39], 0x200
add r14, 0x40
mov edx, dword [rbp - 0x21]
sub rdi, 0x40
jmp 0x164c6e231
mov ecx, 0x40
mov eax, edx
sub ecx, edx
mov rbx, rdi
cmp rdi, rcx
mov rdx, r14
cmovae rbx, rcx
lea rcx, [rbp - 0x1d]
add rcx, rax
mov r8, rbx
call fcn.164c8fe50
mov edx, dword [rbp - 0x21]
add r14, rbx
add edx, ebx
sub rdi, rbx
mov dword [rbp - 0x21], edx
cmp edx, 0x40
jne 0x164c6e231
lea rdx, [rbp - 0x1d]
lea rcx, [rbp - 0x39]
call fcn.164c6d8f0
add qword [rbp - 0x39], 0x200
mov edx, esi
mov dword [rbp - 0x21], edx
test rdi, rdi
jne 0x164c6e1b4
mov rbx, qword [rsp + 0xd8]
mov r14, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
test r15, r15
je 0x164c6e30b
cmp edx, 0x40
jae 0x164c6e2f0
mov eax, edx
lea ecx, [rdx*8]
add qword [rbp - 0x39], rcx
mov byte [rbp + rax - 0x1d], 0x80
mov eax, dword [rbp - 0x21]
inc eax
mov dword [rbp - 0x21], eax
cmp eax, 0x38
jbe 0x164c6e2b4
cmp eax, 0x40
jae 0x164c6e2a2
nop dword [rax + rax]
mov byte [rbp + rax - 0x1d], sil
mov eax, dword [rbp - 0x21]
inc eax
mov dword [rbp - 0x21], eax
cmp eax, 0x40
jb 0x164c6e290
lea rdx, [rbp - 0x1d]
lea rcx, [rbp - 0x39]
call fcn.164c6d8f0
mov dword [rbp - 0x21], esi
jmp 0x164c6e2c0
mov esi, eax
jae 0x164c6e2d6
nop dword [rax + rax]
mov eax, esi
mov byte [rbp + rax - 0x1d], 0
mov eax, dword [rbp - 0x21]
inc eax
mov dword [rbp - 0x21], eax
mov esi, eax
cmp eax, 0x38
jb 0x164c6e2c0
mov rax, qword [rbp - 0x39]
lea rdx, [rbp - 0x1d]
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x1b], rax
call fcn.164c6d8f0
nop dword [rax + rax]
mov eax, dword [rbp - 0x31]
mov dword [r15], eax
mov eax, dword [rbp - 0x2d]
mov dword [r15 + 4], eax
mov eax, dword [rbp - 0x29]
mov dword [r15 + 8], eax
mov eax, dword [rbp - 0x25]
mov dword [r15 + 0xc], eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.164c8ef00
add rsp, 0xa0
pop r15
pop rsi
pop rbp
ret
Function at 0x164c6e330
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
sub rsp, 0x90
mov rax, qword [0x164cb3008]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor eax, eax
mov rbx, r8
mov r8, qword [r11 + 0x10]
mov rdx, rcx
mov qword [r11 - 0x68], rax
lea rcx, [r11 - 0x78]
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
call sym.aswCmnIS.dll_md5Update
test rbx, rbx
je 0x164c6e3f2
mov rdx, qword [rsp + 0x30]
mov ecx, 0x78
mov qword [rsp + 0x80], rdx
mov r8d, 0x38
shr edx, 3
and edx, 0x3f
sub ecx, edx
sub r8d, edx
cmp edx, 0x38
lea rdx, [0x164ca4420]
cmovae r8d, ecx
lea rcx, [rsp + 0x20]
call sym.aswCmnIS.dll_md5Update
mov r8d, 8
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call sym.aswCmnIS.dll_md5Update
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx], xmm0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.164c8ef00
add rsp, 0x90
pop rbx
ret

Function at 0x164c6e410
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
xor ecx, ecx
mov rax, qword [rsp + 8]
mov qword [rax + 0x10], rcx
mov dword [rax], 0x67452301
mov dword [rax + 4], 0xefcdab89
mov dword [rax + 8], 0x98badcfe
mov dword [rax + 0xc], 0x10325476
ret

Function at 0x164c6e540
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
sub rsp, 0x38
mov rax, qword [0x164cb3008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x164c6e63c
mov qword [r11 + 0x20], rbp
xor ebp, ebp
mov qword [r11 - 0x18], rdi
mov edi, dword [rsp + 0x60]
test rdx, rdx
jne 0x164c6e58c
test dil, 1
je 0x164c6e5e3
mov rdx, qword [rbx + 0x10]
mov ecx, 0x78
mov qword [rsp + 0x20], rdx
mov r8d, 0x38
shr edx, 3
and edx, 0x3f
sub ecx, edx
sub r8d, edx
cmp edx, 0x38
lea rdx, [0x164ca4420]
cmovae r8d, ecx
mov rcx, rbx
call sym.aswCmnIS.dll_md5Update
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sym.aswCmnIS.dll_md5Update
mov qword [rbx + 0x10], rbp
test rsi, rsi
je 0x164c6e5e3
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
test dil, 3
je 0x164c6e610
test dil, 2
je 0x164c6e632
mov qword [rbx + 0x10], rbp
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
jmp 0x164c6e632
test dil, 8
je 0x164c6e632
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
mov qword [rbx + 0x50], rax
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.164c8ef00
add rsp, 0x38
pop rsi
pop rbx
ret
Function at 0x164c6e6b0
Capabilities:
Hash data with md5

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
add rsp, 0x28
jmp sym.aswCmnIS.dll_md5Final
Function at 0x164c75140
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x164cb3008]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rsi, rcx
mov rbx, r9
lea rcx, [rsp]
mov r9d, 0x100
xor eax, eax
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, r9d
jl 0x164c75181
mov edi, dword [rsp + 0x148]
lea r10, [rsp]
xor r11b, r11b
mov word [rsp + 0x100], 0
xor eax, eax
nop dword [rax + rax]
movzx edx, byte [r10]
lea r8d, [rax + 1]
movzx ecx, dl
lea r10, [r10 + 1]
add cl, byte [rax + rsi]
add r11b, cl
lea rcx, [rsp]
movzx eax, r11b
add rcx, rax
movzx eax, byte [rcx]
mov byte [r10 - 1], al
xor eax, eax
cmp r8d, edi
mov byte [rcx], dl
cmovne eax, r8d
sub r9, 1
jne 0x164c751b0
mov r9, qword [rsp + 0x160]
movzx r11d, byte [rsp + 0x100]
movzx edi, byte [rsp + 0x101]
test r9, r9
je 0x164c75260
mov r10, qword [rsp + 0x150]
sub r10, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + 1]
movzx r11d, al
lea rdx, [rsp]
lea rbx, [rbx + 1]
movzx r8d, byte [rdx + r11]
lea eax, [rdi + r8]
movzx edi, al
movzx ecx, byte [rsp + rdi]
mov byte [rsp + rdi], r8b
mov byte [rdx + r11], cl
add cl, r8b
movzx eax, cl
movzx ecx, byte [rsp + rax]
xor cl, byte [r10 + rbx - 1]
mov byte [rbx - 1], cl
sub r9, 1
jne 0x164c75220
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.164c8ef00
add rsp, 0x120
pop rdi
pop rsi
pop rbx
ret
Function at 0x164c755e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x10
mov rbx, r8
test rbx, rbx
je 0x164c75760
mov qword [rsp], rdi
mov rdi, rdx
test rdx, rdx
je 0x164c7575c
test rcx, rcx
je 0x164c7575c
mov r10d, dword [rcx]
sub r10d, dword [rbx + 0xa8]
mov r11d, dword [rcx + 8]
sub r11d, dword [rbx + 0xac]
mov r9d, dword [rcx + 4]
mov qword [rax + 0x20], rbp
mov ebp, 5
mov qword [rax - 0x10], rsi
lea rsi, [rbx + 0xa0]
mov eax, dword [rcx + 0xc]
nop dword [rax]
sub r9d, dword [rsi + 4]
lea r8d, [r10*2 + 1]
sub eax, dword [rsi]
lea edx, [r11*2 + 1]
imul r8d, r10d
sub r10d, dword [rsi - 4]
lea rsi, [rsi - 0x20]
imul edx, r11d
sub r11d, dword [rsi + 0x18]
rol r8d, 5
movzx ecx, r8b
rol edx, 5
ror r9d, cl
xor r9d, edx
movzx ecx, dl
ror eax, cl
xor eax, r8d
lea edx, [r9*2 + 1]
imul edx, r9d
sub r9d, dword [rsi + 0x10]
lea r8d, [rax*2 + 1]
imul r8d, eax
sub eax, dword [rsi + 0x14]
rol edx, 5
rol r8d, 5
movzx ecx, r8b
ror r10d, cl
xor r10d, edx
movzx ecx, dl
ror r11d, cl
xor r11d, r8d
lea edx, [r10*2 + 1]
imul edx, r10d
sub r10d, dword [rsi + 8]
lea r8d, [r11*2 + 1]
imul r8d, r11d
sub r11d, dword [rsi + 0xc]
rol edx, 5
rol r8d, 5
movzx ecx, r8b
ror eax, cl
movzx ecx, dl
xor eax, edx
ror r9d, cl
xor r9d, r8d
lea edx, [rax*2 + 1]
imul edx, eax
lea r8d, [r9*2 + 1]
imul r8d, r9d
rol edx, 5
rol r8d, 5
movzx ecx, r8b
ror r11d, cl
movzx ecx, dl
xor r11d, edx
ror r10d, cl
xor r10d, r8d
sub rbp, 1
jne 0x164c75650
sub r9d, dword [rbx]
sub eax, dword [rbx + 4]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x38]
mov dword [rdi + 0xc], eax
mov dword [rdi], r10d
mov dword [rdi + 4], r9d
mov dword [rdi + 8], r11d
mov rdi, qword [rsp]
add rsp, 0x10
pop rbx
ret

Function at 0x164c75770
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rcx, qword [0x164cb3630]
mov dword [rbx + 0x60], eax
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x68], rax
mov qword [rbx + 0x70], rax
movabs rax, 0x1000000010000000
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
test rax, rcx
je 0x164c757e9
mov edx, 0x14
lea ecx, [rdx + 0x2c]
call fcn.164c72ef0
mov rcx, qword [0x164cb3630]
mov qword [rbx + 0x68], rax
lea rax, [0x164c4b460]
mov qword [rbx + 0x70], rax
test cl, 0x20
je 0x164c7585c
lea rax, [0x164c4c3a0]
mov qword [rbx + 0x70], rax
bt rcx, 0x12
jae 0x164c7581c
lea rax, [0x164c4b1c0]
mov qword [rbx + 0x70], rax
add rsp, 0x20
pop rbx
ret
bt rcx, 0xa
jae 0x164c7585c
mov rax, rcx
and eax, 0x5000
cmp rax, 0x5000
jne 0x164c75844
lea rax, [0x164c4e020]
mov qword [rbx + 0x70], rax
add rsp, 0x20
pop rbx
ret
mov rax, qword [rbx + 0x70]
bt rcx, 0x29
lea rcx, [0x164c4d240]
cmovb rax, rcx
mov qword [rbx + 0x70], rax
add rsp, 0x20
pop rbx
ret