joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ba580
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x1409b0280]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
mov dword [rsp + 0x44], r9d
mov r12, rdx
mov ebp, r8d
xor edx, edx
mov r10d, r9d
mov r9, qword [rsp + 0x150]
mov r8d, edx
movzx eax, byte [rsi + 0x325]
mov r14d, edx
movzx r15d, byte [rsi + 0x329]
mov ecx, edx
mov qword [rsp + 0x48], r9
cmp al, 1
jne 0x1400ba774
movzx r9d, word [rsi + 0x448]
bt r9w, 0xe
jae 0x1400ba5fd
movzx r8d, word [rsi + 0x320]
mov eax, r8d
mov rcx, rbp
sub rcx, rax
mov dword [rsp + 0x40], 1
bt r9w, 0xd
mov rdi, rbp
movzx r14d, byte [rcx + r12 - 1]
mov ecx, r14d
mov r13d, r14d
jae 0x1400ba701
sub ebp, r8d
mov eax, 0xff
movsxd r8, ebp
dec r8
add r8, r12
lea ecx, [rbp - 1]
movzx r10d, byte [r8]
mov edi, r10d
sub edi, ebp
add edi, r15d
shr edi, 0x1f
dec dil
cmp ecx, eax
cmovg ecx, eax
movsxd r9, ecx
test ecx, ecx
jle 0x1400ba683
nop dword [rax + rax]
mov ecx, r10d
lea r8, [r8 - 1]
sub ecx, edx
movzx eax, r10b
xor al, byte [r8 + 1]
inc edx
shr ecx, 0x1f
dec cl
and cl, al
or dil, cl
sub r9, 1
jne 0x1400ba660
mov eax, dword [rsp + 0x44]
lea rdx, [rsp + 0x90]
mov r9d, ebp
mov dword [rsp + 0x30], 1
sub r9d, r15d
mov dword [rsp + 0x28], eax
sub r9d, r14d
mov dword [rsp + 0x20], r14d
dec r9d
mov r8, r12
mov rcx, rsi
call qword [rsi + 0xf0]
movzx r8d, byte [rsi + 0x329]
lea r9, [rsp + 0x90]
mov edx, ebp
mov rcx, r12
mov ebx, eax
call fcn.1400ba040
or al, dil
not al
movzx ecx, al
shr cl, 4
and al, cl
movzx ecx, al
mov edx, ecx
shr edx, 2
and edx, ecx
mov eax, edx
shr eax, 1
and eax, edx
dec eax
add eax, ebx
je 0x1400ba76e
mov eax, 0xfffffecf
jmp 0x1400ba7f2
sub ebp, r15d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
mov r8, r12
lea eax, [rbp - 1]
cmp r14d, eax
mov dword [rsp + 0x44], eax
cmova r14d, edx
cmp r13d, eax
cmovbe edx, ecx
mov rcx, rsi
sub ebp, edx
mov ebx, edx
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], ebx
lea r9d, [rbp - 1]
call qword [rsi + 0xf0]
sub rdi, rbx
lea rdx, [r12 - 1]
sub rdi, r15
lea rcx, [rsp + 0x50]
add rdx, rdi
mov r8d, r15d
mov ebp, eax
call fcn.1400b5540
test eax, eax
jne 0x1400ba6f7
test ebp, ebp
jne 0x1400ba6f7
cmp r13d, dword [rsp + 0x44]
ja 0x1400ba6f7
mov ecx, dword [rsp + 0x40]
jmp 0x1400ba7cf
test al, al
jne 0x1400ba7d4
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
lea rdx, [rsp + 0x50]
sub r9d, r15d
mov dword [rsp + 0x20], 0xffffffff
mov r8, r12
mov rcx, rsi
call qword [rsi + 0xf0]
mov rdx, rbp
lea rcx, [rsp + 0x50]
sub rdx, r15
mov r8d, r15d
add rdx, r12
mov ebx, eax
call fcn.1400b5540
test eax, eax
jne 0x1400ba6f7
test ebx, ebx
jne 0x1400ba6f7
mov ecx, r14d
mov r9, qword [rsp + 0x48]
cmp byte [rsi + 0x325], 2
jne 0x1400ba7e6
movzx eax, word [rsi + 0x322]
jmp 0x1400ba7ed
lea eax, [r15 + rcx]
add eax, r14d
mov dword [r9], eax
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14015a1f0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400bfb80
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
movsxd r9, ecx
mov rsi, rdx
mov ecx, r9d
mov r10d, 0xffffff18
call fcn.1400bfa60
cmp dword [rsp + 0x50], eax
jae 0x1400bfbc3
lea eax, [r10 + 0x64]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r9d, 0xf
ja case.0x1400bfbdf.0
lea rdx, [0x140000000]
mov ecx, dword [rdx + r9*4 + 0xbfcb8]
add rcx, rdx
jmp rcx
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400c0290
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400c03c0
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400c0460
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400c0620
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400c0520
mov r8, rbx
mov edx, edi
mov rcx, rsi
call fcn.1400c0290
mov r10d, eax
test eax, eax
jne case.0x1400bfbdf.5
lea r8, [rbx + 0x10]
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400c03c0
mov r10d, 0xffffff53
mov rbx, qword [rsp + 0x30]
mov eax, r10d
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c0290
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1409b0280]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov dword [rbp + 0x13], 0x67452301
mov rbx, r8
mov qword [rbp + 0x27], rdi
mov r8d, edx
mov dword [rbp + 0x17], 0xefcdab89
mov rdx, rcx
mov dword [rbp + 0x1b], 0x98badcfe
lea rcx, [rbp - 0x39]
mov dword [rbp + 0x1f], 0x10325476
mov qword [rbp - 0x39], rdi
mov dword [rbp - 0x31], edi
call fcn.1400ed720
test eax, eax
jne 0x1400c039c
test rbx, rbx
je 0x1400c0397
mov eax, dword [rbp - 0x39]
mov byte [rbp + rax - 0x2d], 0x80
mov ecx, dword [rbp - 0x39]
inc ecx
mov dword [rbp - 0x39], ecx
cmp ecx, 0x38
jbe 0x1400c0341
mov eax, ecx
mov r8d, 0x40
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.140195d30
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x39], 0x40
lea rcx, [rbp - 0x39]
call fcn.1400ecf30
mov ecx, edi
mov dword [rbp - 0x39], edi
mov eax, ecx
mov r8d, Ordinal_60
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.140195d30
mov r9d, dword [rbp - 0x35]
mov edx, r9d
mov ecx, dword [rbp - 0x31]
shr edx, 0x1d
shl r9d, 3
mov dword [rbp - 0x35], r9d
mov dword [rbp + 0xb], r9d
lea r8d, [rdx + rcx*8]
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x31], r8d
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], r8d
call fcn.1400ecf30
movups xmm0, xmmword [rbp + 0x13]
mov eax, edi
movups xmmword [rbx], xmm0
jmp 0x1400c039c
mov eax, 0xffffff53
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14015a1f0
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret

Function at 0x1400c03c0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1409b0280]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x6c], 0x67452301
mov rbx, r8
mov qword [rsp + 0x80], rax
mov r8d, edx
mov dword [rsp + 0x70], 0xefcdab89
mov rdx, rcx
mov dword [rsp + 0x74], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x78], 0x10325476
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.1400df1b0
test eax, eax
jne 0x1400c043a
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400df650
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14015a1f0
add rsp, 0xa0
pop rbx
ret

Function at 0x1400c0460
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x1409b0280]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov rbx, r8
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x38], rax
mov dword [r11 - 0x30], eax
test rcx, rcx
jne 0x1400c04de
test edx, edx
je 0x1400c04f2
mov eax, 0xffffff53
jmp 0x1400c04ff
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400dc100
test eax, eax
jne 0x1400c04ff
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400dcaa0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14015a1f0
add rsp, 0xb0
pop rbx
ret
Function at 0x1400d2790
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1409b0280]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, rdx
mov r14, r9
mov edx, dword [rbp + 0x100]
mov rdi, rcx
sub edx, 4
je 0x1400d28d8
cmp edx, 1
je 0x1400d27de
mov eax, 0xffffff18
jmp 0x1400d2980
movdqa xmm0, xmmword [0x1409863e0]
xor ebx, ebx
mov rax, qword [rcx + 0xa8]
xor r8d, r8d
movdqa xmm1, xmmword [0x1409865f0]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x1c0], r12
xor edx, edx
movdqa xmmword [rbp - 0x50], xmm0
movabs r12, 0x629a292a367cd507
movdqa xmm0, xmmword [0x140986550]
mov qword [rsp + 0x1d0], r15
movabs r15, 0xcbbb9d5dc1059ed8
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp + 0x78], rax
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r12
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
call fcn.1400da380
test eax, eax
jne 0x1400d28be
lea rcx, [rbp - 0x60]
call fcn.1400da520
test eax, eax
jne 0x1400d28be
movaps xmm0, xmmword [rbp - 0x60]
mov eax, ebx
movaps xmm1, xmmword [rbp - 0x50]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1409863e0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x140986550]
movaps xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x1409865f0]
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r12
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
mov r15, qword [rsp + 0x1d0]
mov edx, Ordinal_50
mov r12, qword [rsp + 0x1c0]
lea ecx, [rdx - 0x29]
jmp 0x1400d2938
mov rax, qword [rcx + 0xa8]
lea rdx, [rsp + 0x60]
xor ebx, ebx
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x60]
mov qword [rbp], rbx
mov dword [rbp + 8], ebx
mov dword [rbp - 0x60], 0x6a09e667
mov dword [rbp - 0x5c], 0xbb67ae85
mov dword [rbp - 0x58], 0x3c6ef372
mov dword [rbp - 0x54], 0xa54ff53a
mov dword [rbp - 0x50], 0x510e527f
mov dword [rbp - 0x4c], 0x9b05688c
mov dword [rbp - 0x48], 0x1f83d9ab
mov dword [rbp - 0x44], 0x5be0cd19
call fcn.1400dcaa0
lea edx, [rbx + 0x20]
lea ecx, [rbx + 6]
test eax, eax
jne 0x1400d2980
cmp byte [rdi + 0x319], 4
je 0x1400d294c
mov eax, 0xfffffeba
jmp 0x1400d2980
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], edx
mov r9d, edx
mov qword [rsp + 0x40], rax
mov r8, r14
lea rax, str.derived
mov dword [rsp + 0x38], 7
mov rcx, rsi
mov qword [rsp + 0x30], rax
call fcn.1400d2680
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14015a1f0
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400d7a40
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xf0
mov rax, qword [0x1409b0280]
xor rax, rsp
mov qword [rbp - 9], rax
mov r15, qword [rbp + 0x67]
mov ecx, 0x1b8
mov r12, qword [rbp + 0x77]
mov eax, ecx
rol ecx, 8
mov r14d, Ordinal_60
ror eax, 8
mov rdi, rdx
xor ecx, eax
mov byte [rsp + 0x28], r9b
and ecx, 0xff00ff
mov byte [rsp + 0x20], 1
xor ecx, eax
lea r13d, [r14 - 0x35]
mov dword [rsp + 0x30], ecx
xor esi, esi
nop word [rax + rax]
mov r8d, 1
mov qword [rbp - 0x39], rsi
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x40], 0x6a09e667
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0xbb67ae85
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
mov qword [rbp - 0x49], rsi
mov dword [rbp - 0x41], esi
call fcn.1400dc100
mov ebx, eax
test eax, eax
jne 0x1400d7be7
lea r8d, [rax + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400dc100
mov ebx, eax
test eax, eax
jne 0x1400d7be7
cmp byte [rsp + 0x28], 4
je 0x1400d7b5b
lea r8d, [rax + 1]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1400dc100
mov ebx, eax
test eax, eax
jne 0x1400d7be7
test r15, r15
jne 0x1400d7b6c
cmp dword [rbp + 0x6f], esi
jbe 0x1400d7b83
mov ebx, 0xffffff53
jmp 0x1400d7be7
mov r8d, dword [rbp + 0x6f]
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.1400dc100
mov ebx, eax
test eax, eax
jne 0x1400d7be7
test r12, r12
je 0x1400d7ba5
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x1400d7ba5
mov r8d, eax
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.1400dc100
mov ebx, eax
test eax, eax
jne 0x1400d7be7
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x40]
call fcn.1400dcaa0
mov ebx, eax
test eax, eax
jne 0x1400d7be7
cmp r14d, 0x20
jbe 0x1400d7bd8
movups xmm0, xmmword [rbp - 0x29]
add r14d, 0xffffffe0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
add rdi, 0x20
jmp 0x1400d7be7
mov r8d, r14d
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.140195690
inc byte [rsp + 0x20]
sub r13, 1
jne 0x1400d7ab0
mov ecx, reloc.WLDAP32.dll_Ordinal_32
lea rdx, [rbp - 0x29]
nop
mov byte [rdx], sil
lea rdx, [rdx + 1]
add ecx, 0xffffffff
jne 0x1400d7c00
test ebx, ebx
setne sil
mov eax, esi
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14015a1f0
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d7d60
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x1409b0280]
xor rax, rsp
mov qword [rbp + 8], rax
movups xmm0, xmmword [r9]
mov eax, dword [r9 + 0x30]
test r8d, r8d
movups xmm1, xmmword [r9 + 0x10]
mov r14d, 0
mov dword [rbp], eax
movzx eax, word [r9 + 0x34]
mov rsi, rcx
mov ecx, r14d
mov word [rbp + 4], ax
movzx eax, byte [r9 + 0x36]
mov r15, rdx
mov edx, 1
mov byte [rbp + 6], al
mov edi, edx
mov r13d, r14d
cmovne edi, r8d
test dil, 0x1f
mov r12d, edi
movups xmmword [rbp - 0x30], xmm0
setne cl
shr r12d, 5
lea ebx, [rdx + 0x36]
movups xmm0, xmmword [r9 + 0x20]
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm0
add r12d, ecx
je 0x1400d7f2f
mov r8d, ebx
mov qword [rbp - 0x40], r14
lea rdx, [rbp - 0x30]
mov dword [rsp + 0x50], 0x6a09e667
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x54], 0xbb67ae85
mov dword [rsp + 0x58], 0x3c6ef372
mov dword [rsp + 0x5c], 0xa54ff53a
mov dword [rsp + 0x60], 0x510e527f
mov dword [rsp + 0x64], 0x9b05688c
mov dword [rsp + 0x68], 0x1f83d9ab
mov dword [rsp + 0x6c], 0x5be0cd19
mov qword [rbp - 0x50], r14
mov dword [rbp - 0x48], r14d
call fcn.1400dc100
mov edx, eax
test eax, eax
jne 0x1400d7f23
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1400dcaa0
mov dword [rsp + 0x20], eax
mov edx, eax
test eax, eax
jne 0x1400d7f23
cmp dword [rsi], 1
mov eax, dword [rsp + 0x28]
jbe 0x1400d7e9b
cmp eax, dword [rsi + 4]
jne 0x1400d7e9b
cmp byte [rsi + 0x76], 1
je 0x1400d7f68
cmp r13d, r12d
jne 0x1400d7e97
inc r12d
mov al, 1
jmp 0x1400d7ea0
mov dword [rsi + 4], eax
xor al, al
mov byte [rsi + 0x76], al
test r15, r15
je 0x1400d7f23
test edi, edi
je 0x1400d7f23
cmp edi, 0x20
jb 0x1400d7f0c
movups xmm0, xmmword [rsp + 0x28]
add edi, 0xffffffe0
lea rcx, [rbp + 4]
movups xmm1, xmmword [rsp + 0x38]
mov edx, gethostname
lea rax, [rbp + 4]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
add r15, 0x20
sub rdx, rcx
nop dword [rax + rax]
add byte [rax + 2], 1
jne 0x1400d7f1f
add byte [rax + 1], 1
jne 0x1400d7f1f
add byte [rax], 1
jne 0x1400d7f1f
add byte [rax - 1], 1
jne 0x1400d7f1f
add byte [rax - 2], 1
jne 0x1400d7f1f
sub rax, 5
lea rcx, [rdx + rax]
test rcx, rcx
jns 0x1400d7ee0
jmp 0x1400d7f1f
mov r8d, edi
lea rdx, [rsp + 0x28]
mov rcx, r15
call fcn.140195690
mov edi, r14d
mov edx, dword [rsp + 0x20]
inc r13d
cmp r13d, r12d
jl 0x1400d7df3
lea rcx, [rbp - 0x30]
mov byte [rcx], r14b
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x1400d7f33
test edx, edx
setne r14b
mov eax, r14d
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.14015a1f0
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 3
jmp 0x1400d7f48
Function at 0x1400d8670
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
sub rsp, 0xa0
mov rax, qword [0x1409b0280]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
test rcx, rcx
jne 0x1400d869a
mov eax, 0xffffff53
jmp 0x1400d8875
mov qword [rcx + 8], r9
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rbp
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov byte [rcx + 0x18], bpl
xor ecx, ecx
call fcn.1400d8df0
test eax, eax
jne 0x1400d885a
mov rax, qword [0x1409f4538]
lea ecx, [rbp + 0x78]
mov qword [rsp + 0xc8], rdi
test rax, rax
je 0x1400d86e2
call rax
jmp 0x1400d86e7
call fcn.140175580
mov qword [rsi + 0x10], rax
mov edi, 0x34
test rax, rax
jne 0x1400d86fd
lea ebx, [rax - 0x7d]
jmp 0x1400d881f
mov ebx, 1
mov dword [rsp + 0x20], 0xf0000000
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400d87fd
mov rcx, qword [rsi]
lea r8, [rsp + 0x40]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400d87fd
mov rcx, qword [rsi]
xor edx, edx
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], r15
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r12d, 4
mov ebx, ebp
mov r14d, ebp
mov r8d, r12d
mov r15, rbp
lea r13d, [r12 - 1]
nop dword [rax]
mov eax, r8d
lea rdx, [rsp + 0x40]
add rax, r15
lea rcx, [rsp + 0x40]
add rdx, rax
add rcx, r15
call fcn.1400b5540
test eax, eax
mov r8d, edi
cmove ebx, r13d
add r14d, r12d
sub r8d, r14d
add r15, r12
cmp r8d, r12d
cmova r8d, r12d
cmp r14d, 0x30
jb 0x1400d8780
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
test ebx, ebx
jne 0x1400d87fd
mov rcx, qword [rsi + 0x10]
lea r8d, [rbx + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x44]
call fcn.1400d85c0
mov ebx, eax
test eax, eax
je 0x1400d881f
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x1400d881b
mov rax, qword [0x1409f4530]
test rax, rax
je 0x1400d8816
call rax
jmp 0x1400d881b
call fcn.14017007c
mov qword [rsi + 0x10], rbp
lea rax, [rsp + 0x40]
mov byte [rax], bpl
lea rax, [rax + 1]
add edi, 0xffffffff
jne 0x1400d8824
mov rdi, qword [rsp + 0xc8]
test ebx, ebx
jne 0x1400d8842
mov byte [rsi + 0x18], 1
jmp 0x1400d8863
cmp ebx, 3
je 0x1400d885a
cmp ebx, 1
mov byte [rsi + 0x18], 2
mov eax, 0xffffff39
cmove ebx, eax
mov ebp, ebx
jmp 0x1400d8863
mov byte [rsi + 0x18], 3
mov ebp, 0xffffff2f
mov rbx, qword [rsp + 0xb8]
mov eax, ebp
mov rbp, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14015a1f0
add rsp, 0xa0
pop rsi
ret
Function at 0x1400dcaa0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400dcbe6
test rdx, rdx
je 0x1400dcbe6
call fcn.1400dc5a0
test eax, eax
jne 0x1400dcbeb
mov ecx, dword [rbx]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx], ecx
mov ecx, dword [rbx + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 8], ecx
mov ecx, dword [rbx + 0xc]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0xc], ecx
mov ecx, dword [rbx + 0x10]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x10], ecx
mov ecx, dword [rbx + 0x14]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x14], ecx
mov ecx, dword [rbx + 0x18]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x18], ecx
mov ecx, dword [rbx + 0x1c]
mov eax, ecx
ror eax, 8
rol ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400dfaf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, r8d
mov r9, rdx
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x1400dfbd3
shr r8d, 3
xor eax, eax
test r8d, r8d
je 0x1400dfce1
cmp r8d, 8
jb 0x1400dfbae
lea ecx, [r8 - 1]
lea r11, [r10 + rcx*8]
lea rcx, [rdx + rcx*8]
cmp r10, rcx
ja 0x1400dfb36
cmp r11, rdx
jae 0x1400dfbae
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
movdqu xmm0, xmmword [r10 + rax*8]
lea ecx, [rbx - 2]
movdqu xmm1, xmmword [rdx + rax*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rax*8], xmm1
add eax, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
mov ecx, ebx
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
lea ecx, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
cmp eax, r11d
jb 0x1400dfb42
cmp eax, r8d
jae 0x1400dfce1
sub r9, r10
lea rdx, [r10 + rax*8]
sub r8d, eax
mov ecx, r8d
nop dword [rax + rax]
mov rax, qword [r9 + rdx]
xor qword [rdx], rax
lea rdx, [rdx + 8]
sub rcx, 1
jne 0x1400dfbc0
pop rbx
ret
xor eax, eax
test r8d, r8d
je 0x1400dfce1
cmp r8d, 8
jb 0x1400dfcc1
lea ecx, [r8 - 1]
lea r11, [rcx + r10]
add rcx, rdx
cmp r10, rcx
ja 0x1400dfc01
cmp r11, r9
jae 0x1400dfcc1
cmp r8d, 0x40
jb 0x1400dfc91
mov qword [rsp + 0x10], rdi
mov ebx, r8d
and ebx, 0x3f
mov edi, r8d
sub edi, ebx
mov r11d, reloc.WLDAP32.dll_Ordinal_32
movdqu xmm0, xmmword [rax + r10]
lea ecx, [r11 - 0x10]
movdqu xmm1, xmmword [rax + rdx]
xorps xmm1, xmm0
movdqu xmmword [rax + r10], xmm1
add eax, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
mov ecx, r11d
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
lea ecx, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
cmp eax, edi
jb 0x1400dfc21
mov rdi, qword [rsp + 0x10]
cmp ebx, 8
jb 0x1400dfcbc
mov edx, r8d
and edx, 0xfffffff8
nop word [rax + rax]
movq xmm0, qword [rax + r10]
movq xmm1, qword [rax + r9]
xorps xmm1, xmm0
movq qword [rax + r10], xmm1
add eax, 8
cmp eax, edx
jb 0x1400dfca0
cmp eax, r8d
jae 0x1400dfce1
mov edx, eax
sub r9, r10
add rdx, r10
sub r8d, eax
mov ecx, r8d
nop
movzx eax, byte [rdx + r9]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x1400dfcd0
pop rbx
ret