joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ac2d0
Capabilities:
Hash data using crc32b

Disassembly:
push rbx
sub rsp, 0x20
movzx ecx, byte [0x140358150]
movzx eax, byte [0x140358151]
test cl, cl
jne 0x1400ac4aa
test al, al
jne 0x1400ac4b2
cmp qword [0x140358158], 0
jne 0x1400ac4a4
mov ecx, 0x100
mov qword [rsp + 0x30], rdi
mov byte [0x140358151], 1
call fcn.14003bf10
mov rdi, rax
test rax, rax
je 0x1400ac49f
xor ebx, ebx
mov r11, rax
mov r10d, ebx
nop dword [rax]
mov ecx, r10d
mov r8d, r10d
and ecx, 1
shr r8d, 1
shl ecx, 7
mov r9d, ebx
mov edx, ecx
or edx, 0x40
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 0x20
test r8b, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
or edx, 0x10
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 8
test r8b, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
or edx, 4
test r8b, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
or ecx, 2
test r8b, 1
cmove ecx, edx
mov eax, ecx
or eax, 1
test r8b, 2
mov r8d, 0x1e
cmove eax, ecx
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov eax, ecx
add ecx, ecx
sar eax, 0x1f
and eax, 0x4c11db7
xor eax, ecx
nop dword [rax + rax]
test al, 1
je 0x1400ac442
lea ecx, [r8 + 1]
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x1400ac455
mov ecx, r8d
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
sub r8d, 2
cmp r8d, 0xfffffffe
jg 0x1400ac430
mov dword [r11], r9d
inc r10d
add r11, 4
cmp r10d, 0xff
jbe 0x1400ac330
cmp qword [0x140358158], rbx
jne 0x1400ac48a
mov qword [0x140358158], rdi
jmp 0x1400ac492
mov rcx, rdi
call fcn.140247544
mov byte [0x140358150], 1
mov byte [0x140358151], bl
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
test al, al
je 0x1400ac4a4
test cl, cl
jne 0x1400ac4a4
xor ebx, ebx
test al, al
je 0x1400ac4a4
nop dword [rax + rax]
mov ecx, 2
call sub.KERNEL32.dll_Sleep
inc ebx
cmp ebx, 0xc8
ja 0x1400ac4a4
cmp byte [0x140358151], 0
jne 0x1400ac4c0
add rsp, 0x20
pop rbx
ret
Function at 0x1400ac4f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test rdx, rdx
je 0x1400ac73b
test r8d, r8d
je 0x1400ac73b
lea r11, [rcx + 8]
cmp r8d, 0x10
jb 0x1400ac700
mov r9d, r8d
mov qword [rsp], rbx
mov ebx, dword [r11]
shr r9, 4
nop word [rax + rax]
movzx eax, byte [r10]
mov ecx, ebx
shr ecx, 8
movzx edx, bl
xor rdx, rax
mov rax, qword [0x140358158]
xor ecx, dword [rax + rdx*4]
mov edx, ecx
mov dword [r11], edx
movzx ecx, byte [r10 + 1]
movzx eax, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx ecx, byte [r10 + 2]
movzx eax, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx ecx, byte [r10 + 3]
movzx eax, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 5]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 6]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 7]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 8]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 9]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 0xa]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 0xb]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
add r8d, 0xfffffff0
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 0xc]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 0xd]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 0xe]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
movzx eax, byte [r10 + 0xf]
add r10, 0x10
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140358158]
xor edx, dword [rax + rcx*4]
mov dword [r11], edx
mov ebx, edx
sub r9, 1
jne 0x1400ac530
mov rbx, qword [rsp]
test r8d, r8d
je 0x1400ac73b
mov r9d, dword [r11]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx edx, r9b
mov ecx, r9d
xor rdx, rax
shr ecx, 8
mov rax, qword [0x140358158]
xor ecx, dword [rax + rdx*4]
mov dword [r11], ecx
mov r9d, ecx
add r8d, 0xffffffff
jne 0x1400ac710
add rsp, 8
ret
Function at 0x1400add70
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov ebp, edx
mov qword [rcx + 0xd8], r12
mov rsi, r8
mov qword [rcx + 0xe0], r12
mov rbx, rcx
add rcx, 8
mov edi, r9d
xor edx, edx
mov r8d, 0x80
call fcn.14003be60
xor edx, edx
lea r8d, [r12 + 0x40]
lea rcx, [rbx + 0x88]
call fcn.14003be60
xor edx, edx
lea r8d, [r12 + 0x10]
lea rcx, [rbx + 0xc8]
call fcn.14003be60
lea eax, [rbp - 1]
cmp eax, 0x3f
ja 0x1400adeee
cmp edi, 0x40
ja 0x1400adeee
mov qword [rbx + 0xe0], rbp
movabs rax, 0xbb67ae8584caa73b
mov qword [rbx + 0x90], rax
mov ecx, edi
xor ecx, 0x10100
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbx + 0x98], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbx + 0xa0], rax
movabs rax, 0x510e527fade682d1
mov qword [rbx + 0xa8], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0xb0], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0xb8], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbx + 0xc0], rax
movabs rax, 0x6a09e667f3bcc908
shl ecx, 8
xor rcx, rbp
xor rcx, rax
mov eax, edi
mov qword [rbx + 0x88], rcx
mov qword [rbx + 0xc8], r12
mov qword [rbx + 0xd0], r12
mov qword [rbx + 0xd8], r12
cmp rdi, 0x80
jae 0x1400adecd
lea rcx, [rbx + 8]
mov r8d, 0x80
add rcx, rax
sub r8, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
test edi, edi
je 0x1400adeea
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.1400aeee0
mov qword [rbx + 0xd8], 0x80
mov al, 1
jmp 0x1400adef0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400adf10
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 0x10], 0x67452301
mov dword [rcx + 0x24], eax
mov qword [rcx + 8], rax
mov dword [rcx + 0x14], 0xefcdab89
mov dword [rcx + 0x18], 0x98badcfe
mov dword [rcx + 0x1c], 0x10325476
mov dword [rcx + 0x20], 0xc3d2e1f0
ret
Function at 0x1400ae7e0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
mov r14, qword [rsp + 0x120]
lea rax, vtable.s535464zz.0
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x5c], 0x10325476
xorps xmm1, xmm1
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm1
movups xmmword [rsp + 0x88], xmm1
movups xmmword [rsp + 0x98], xmm1
mov dword [rsp + 0x50], 0x67452301
mov dword [rsp + 0x54], 0xefcdab89
mov dword [rsp + 0x58], 0x98badcfe
mov dword [rsp + 0x60], 0xc3d2e1f0
xor r15d, r15d
mov dword [rsp + 0x64], r15d
mov qword [rsp + 0x48], r15
mov ecx, 0x4e28
call fcn.14003be80
mov rbx, rax
test rax, rax
jne 0x1400ae896
jmp 0x1400ae956
mov dword [rsp + 0x30], r15d
mov r15b, 1
mov rcx, rbp
call fcn.14010ff30
test al, al
jne 0x1400ae939
nop
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
mov r8d, 0x4e20
mov rdx, rbx
mov rcx, rbp
call fcn.140110180
test al, al
je 0x1400ae939
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x1400ae918
test r14, r14
je 0x1400ae8f3
mov rdx, rbx
mov rcx, r14
call fcn.14003e880
mov r8d, dword [rsp + 0x30]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400adf40
test rdi, rdi
je 0x1400ae918
mov edx, dword [rsp + 0x30]
mov r8, rsi
mov rcx, rdi
call fcn.14009e710
test al, al
jne 0x1400ae926
mov rcx, rbp
call fcn.14010ff30
test al, al
je 0x1400ae8b0
jmp 0x1400ae939
mov rax, qword [rsi]
lea rdx, str.Digest_SHA1_aborted_by_application
mov rcx, rsi
call qword [rax + 0x28]
xor r15b, r15b
mov rcx, rbx
call fcn.140247544
xor r8d, r8d
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.1400adb60
nop
movzx eax, r15b
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400aeb30
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rbx, r8
mov esi, edx
mov rdi, rcx
cmp byte [0x140357c70], 0
jne 0x1400aec10
xor edx, edx
mov r8d, 0x178
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x30]
call fcn.14004cf80
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x30]
call fcn.14003e200
nop
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, esi
mov rdx, rdi
mov ecx, 1
call fcn.1400a8380
test al, al
je 0x1400aebfc
lea rcx, [rsp + 0x30]
call fcn.1400428d0
mov rdx, rax
mov r8d, shutdown
mov rcx, rbx
call fcn.14003be40
nop
lea rcx, [rsp + 0x30]
call fcn.14003e3b0
nop
lea rcx, [rbp - 0x30]
call fcn.14004d070
jmp 0x1400aec89
lea rcx, [rsp + 0x30]
call fcn.14003e3b0
nop
lea rcx, [rbp - 0x30]
call fcn.14004d070
lea rax, vtable.s535464zz.0
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x7c], 0x10325476
xorps xmm1, xmm1
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x68], xmm1
movups xmmword [rbp - 0x58], xmm1
movups xmmword [rbp - 0x48], xmm1
mov dword [rsp + 0x70], 0x67452301
mov dword [rsp + 0x74], 0xefcdab89
mov dword [rsp + 0x78], 0x98badcfe
mov dword [rbp - 0x80], 0xc3d2e1f0
xor eax, eax
mov dword [rbp - 0x7c], eax
mov qword [rsp + 0x68], rax
mov r8d, esi
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.1400adf40
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400adb60
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1402474e0
mov rbx, qword [rsp + 0x298]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400aecb0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rdx
mov rbp, rcx
mov edx, shutdown
mov rcx, rdi
call fcn.140042850
mov rsi, rax
test rax, rax
je 0x1400aed8f
lea rax, vtable.s535464zz.0
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x3c], 0x10325476
xorps xmm1, xmm1
movups xmmword [rsp + 0x48], xmm1
movups xmmword [rsp + 0x58], xmm1
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm1
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x40], 0xc3d2e1f0
xor eax, eax
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x28], rax
mov rcx, rbp
call fcn.140042d30
mov ebx, eax
mov rcx, rbp
call fcn.1400428d0
mov rdx, rax
mov r8d, ebx
lea rcx, [rsp + 0x20]
call fcn.1400adf40
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1400adb60
mov edx, shutdown
mov rcx, rdi
call fcn.14003e750
nop
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402474e0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400aedc0
Capabilities:
Hash data using sha1

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x140357c70], 0
mov rsi, rdx
mov rdi, rcx
jne 0x1400aee03
mov r9, r8
mov r8, rdx
mov edx, 1
call fcn.1400a8760
test al, al
jne 0x1400aeebb
xorps xmm1, xmm1
mov qword [rsp + 0xa0], rbx
xor ebx, ebx
lea rax, vtable.s535464zz.0
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x40], 0xc3d2e1f0
movups xmmword [rsp + 0x48], xmm1
mov dword [rsp + 0x30], 0x67452301
movups xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x34], 0xefcdab89
movups xmmword [rsp + 0x68], xmm1
mov dword [rsp + 0x38], 0x98badcfe
movups xmmword [rsp + 0x78], xmm1
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x28], rbx
cmp dword [rdi + 0xc08], ebx
jbe 0x1400aeea3
nop dword [rax]
nop word [rax + rax]
mov edx, ebx
lea rcx, [rsp + 0x20]
mov r8d, dword [rdi + rdx*4 + 0x808]
mov rdx, qword [rdi + rdx*8 + 8]
call fcn.1400adf40
inc ebx
cmp ebx, dword [rdi + 0xc08]
jb 0x1400aee80
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1400adb60
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x1400aefd0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
lea rdx, [rcx + 0x28]
mov r8d, reloc.WS2_32.dll_recv
nop dword [rax]
movzx eax, byte [rdx + 0x20]
mov byte [rdx], al
xor al, byte [rdx - 0x10]
mov byte [rdx + 0x10], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x1400aefe0
xor cl, cl
lea r10, [r9 + 0x19]
lea r11, str._.C
mov rax, r10
mov r9d, 2
nop dword [rax]
movzx ecx, cl
movzx ecx, byte [rcx + r11]
xor byte [rax - 1], cl
movzx ecx, byte [rax - 1]
movzx ecx, byte [rcx + r11]
xor cl, byte [rax]
movzx ecx, cl
mov byte [rax], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 1]
movzx ecx, cl
mov byte [rax + 1], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 2]
movzx ecx, cl
mov byte [rax + 2], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 3]
movzx ecx, cl
mov byte [rax + 3], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 4]
movzx ecx, cl
mov byte [rax + 4], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 5]
movzx ecx, cl
mov byte [rax + 5], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 6]
movzx ecx, cl
mov byte [rax + 6], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 7]
movzx ecx, cl
mov byte [rax + 7], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 8]
movzx ecx, cl
mov byte [rax + 8], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 9]
movzx ecx, cl
mov byte [rax + 9], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 0xa]
movzx ecx, cl
mov byte [rax + 0xa], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 0xb]
movzx ecx, cl
mov byte [rax + 0xb], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 0xc]
movzx ecx, cl
mov byte [rax + 0xc], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 0xd]
movzx ecx, cl
mov byte [rax + 0xd], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 0xe]
movzx ecx, cl
mov byte [rax + 0xe], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 0xf]
movzx ecx, cl
mov byte [rax + 0xf], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 0x10]
movzx ecx, cl
mov byte [rax + 0x10], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 0x11]
movzx ecx, cl
mov byte [rax + 0x11], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 0x12]
movzx ecx, cl
mov byte [rax + 0x12], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax + 0x13]
lea rax, [rax + 0x18]
movzx ecx, cl
mov byte [rax - 5], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax - 4]
movzx ecx, cl
mov byte [rax - 4], cl
movzx ecx, byte [rcx + r11]
xor cl, byte [rax - 3]
movzx edx, cl
mov byte [rax - 3], dl
movzx ecx, byte [rdx + r11]
xor cl, byte [rax - 2]
mov byte [rax - 2], cl
sub r9, 1
jne 0x1400af010
add cl, r8b
inc r8d
cmp r8d, 0x12
jl 0x1400af003
ret
Function at 0x1400b09b0
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov r13, r9
mov rbp, qword [rsp + 0xd8]
mov r15, r8
mov qword [rsp + 0x38], rdx
mov rdi, rdx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rbp
test rax, rax
je 0x1400b0bbe
xor esi, esi
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], esi
mov qword [rcx + 8], rsi
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov ecx, 0x4e28
call fcn.14003be80
mov r14, rax
test rax, rax
je 0x1400b0bbe
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov r12b, 1
mov dword [rsp + 0x48], esi
call fcn.14010ff30
test al, al
jne 0x1400b0b9e
nop dword [rax]
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rdi
call fcn.140110180
movzx r12d, al
test al, al
je 0x1400b0b9e
mov esi, dword [rsp + 0x48]
test esi, esi
je 0x1400b0b78
test rbp, rbp
je 0x1400b0aaf
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.14003e880
mov esi, dword [rsp + 0x48]
mov rbp, r14
cmp esi, 1
jb 0x1400b0b5d
nop dword [rax + rax]
mov edx, dword [rbx + 0x50]
test edx, edx
jne 0x1400b0b05
cmp esi, 0x40
jb 0x1400b0b05
movups xmm0, xmmword [rbp]
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x40], xmm1
call fcn.1400af8c0
add qword [rbx + 8], 0x200
add rbp, 0x40
add esi, 0xffffffc0
jmp 0x1400b0b4c
mov ecx, 0x40
mov eax, esi
sub ecx, edx
cmp esi, ecx
cmovae eax, ecx
lea rcx, [rdx + 0x10]
add rcx, rbx
mov r8d, eax
mov rdx, rbp
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x50], edi
add rbp, rdi
sub esi, edi
cmp dword [rbx + 0x50], 0x40
jne 0x1400b0b4c
mov rcx, rbx
call fcn.1400af8c0
add qword [rbx + 8], 0x200
mov dword [rbx + 0x50], 0
test esi, esi
jne 0x1400b0ac0
mov esi, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
test r15, r15
je 0x1400b0b73
mov edx, esi
mov r8, r13
mov rcx, r15
call fcn.14009e710
test al, al
jne 0x1400b0b8a
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call fcn.14010ff30
test al, al
je 0x1400b0a60
jmp 0x1400b0b9e
mov rax, qword [r13]
lea rdx, str.RIPEMD128_aborted_by_application
mov rcx, r13
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, r14
call fcn.140247544
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1400b0be0
movzx eax, r12b
mov r12, qword [rsp + 0x68]
jmp 0x1400b0bc0
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b0e30
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
call fcn.1400b0d40
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400b0be0
Function at 0x1400b2730
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140353c70]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
xor esi, esi
mov rbp, qword [rsp + 0xd8]
mov rbx, rcx
mov dword [rcx + 0x50], esi
mov r13, r9
mov qword [rcx + 8], rsi
mov r15, r8
mov dword [rcx + 0x54], 0x67452301
mov rdi, rdx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
mov ecx, 0x4e28
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rbp
call fcn.14003be80
mov r14, rax
test rax, rax
je 0x1400b293c
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov r12b, 1
mov dword [rsp + 0x48], esi
call fcn.14010ff30
test al, al
jne 0x1400b291e
nop word [rax + rax]
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rdi
call fcn.140110180
movzx r12d, al
test al, al
je 0x1400b291e
mov esi, dword [rsp + 0x48]
test esi, esi
je 0x1400b28f8
test rbp, rbp
je 0x1400b282f
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.14003e880
mov esi, dword [rsp + 0x48]
mov rbp, r14
cmp esi, 1
jb 0x1400b28dd
nop dword [rax + rax]
mov edx, dword [rbx + 0x50]
test edx, edx
jne 0x1400b2885
cmp esi, 0x40
jb 0x1400b2885
movups xmm0, xmmword [rbp]
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x40], xmm1
call fcn.1400b0ee0
add qword [rbx + 8], 0x200
add rbp, 0x40
add esi, 0xffffffc0
jmp 0x1400b28cc
mov ecx, 0x40
mov eax, esi
sub ecx, edx
cmp esi, ecx
cmovae eax, ecx
lea rcx, [rdx + 0x10]
add rcx, rbx
mov r8d, eax
mov rdx, rbp
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x50], edi
add rbp, rdi
sub esi, edi
cmp dword [rbx + 0x50], 0x40
jne 0x1400b28cc
mov rcx, rbx
call fcn.1400b0ee0
add qword [rbx + 8], 0x200
mov dword [rbx + 0x50], 0
test esi, esi
jne 0x1400b2840
mov esi, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
test r15, r15
je 0x1400b28f3
mov edx, esi
mov r8, r13
mov rcx, r15
call fcn.14009e710
test al, al
jne 0x1400b290a
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call fcn.14010ff30
test al, al
je 0x1400b27e0
jmp 0x1400b291e
mov rax, qword [r13]
lea rdx, str.RIPEMD128_aborted_by_application
mov rcx, r13
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, r14
call fcn.140247544
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1400b2960
movzx eax, r12b
mov r12, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402474e0
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b2bc0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
call fcn.1400b2ad0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400b2960