joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800899a0
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
lea rdx, [rcx + 0x28]
mov r8d, reloc.WS2_32.dll_recv
nop dword [rax]
movzx eax, byte [rdx + 0x20]
mov byte [rdx], al
xor al, byte [rdx - 0x10]
mov byte [rdx + 0x10], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x1800899b0
xor cl, cl
lea r10, str._.C
xor edx, edx
lea rax, [r9 + 0x19]
mov r8d, 2
nop dword [rax + rax]
movzx ecx, cl
lea rax, [rax + 0x18]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0x19], cl
movzx ecx, byte [rax - 0x19]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0x18], cl
movzx ecx, byte [rax - 0x18]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0x17], cl
movzx ecx, byte [rax - 0x17]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0x16], cl
movzx ecx, byte [rax - 0x16]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0x15], cl
movzx ecx, byte [rax - 0x15]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0x14], cl
movzx ecx, byte [rax - 0x14]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0x13], cl
movzx ecx, byte [rax - 0x13]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0x12], cl
movzx ecx, byte [rax - 0x12]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0x11], cl
movzx ecx, byte [rax - 0x11]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0x10], cl
movzx ecx, byte [rax - 0x10]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0xf], cl
movzx ecx, byte [rax - 0xf]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0xe], cl
movzx ecx, byte [rax - 0xe]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0xd], cl
movzx ecx, byte [rax - 0xd]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0xc], cl
movzx ecx, byte [rax - 0xc]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0xb], cl
movzx ecx, byte [rax - 0xb]
movzx ecx, byte [rcx + r10]
xor byte [rax - 0xa], cl
movzx ecx, byte [rax - 0xa]
movzx ecx, byte [rcx + r10]
xor byte [rax - 9], cl
movzx ecx, byte [rax - 9]
movzx ecx, byte [rcx + r10]
xor byte [rax - 8], cl
movzx ecx, byte [rax - 8]
movzx ecx, byte [rcx + r10]
xor byte [rax - 7], cl
movzx ecx, byte [rax - 7]
movzx ecx, byte [rcx + r10]
xor byte [rax - 6], cl
movzx ecx, byte [rax - 6]
movzx ecx, byte [rcx + r10]
xor byte [rax - 5], cl
movzx ecx, byte [rax - 5]
movzx ecx, byte [rcx + r10]
xor byte [rax - 4], cl
movzx ecx, byte [rax - 4]
movzx ecx, byte [rcx + r10]
xor byte [rax - 3], cl
movzx ecx, byte [rax - 3]
movzx ecx, byte [rcx + r10]
xor byte [rax - 2], cl
movzx ecx, byte [rax - 2]
sub r8, 1
jne 0x1800899e0
add cl, dl
inc edx
cmp edx, 0x12
jl 0x1800899d1
ret
Function at 0x18008b340
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov r13, r9
mov rbp, qword [rsp + 0xd8]
mov r15, r8
mov qword [rsp + 0x38], rdx
mov rdi, rdx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rbp
test rax, rax
je 0x18008b54e
xor esi, esi
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], esi
mov qword [rcx + 8], rsi
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov ecx, 0x4e28
call fcn.180018e50
mov r14, rax
test rax, rax
je 0x18008b54e
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov r12b, 1
mov dword [rsp + 0x48], esi
call fcn.1800e84c0
test al, al
jne 0x18008b52e
nop dword [rax]
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rdi
call fcn.1800e8710
movzx r12d, al
test al, al
je 0x18008b52e
mov esi, dword [rsp + 0x48]
test esi, esi
je 0x18008b508
test rbp, rbp
je 0x18008b43f
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.18001b830
mov esi, dword [rsp + 0x48]
mov rbp, r14
cmp esi, 1
jb 0x18008b4ed
nop dword [rax + rax]
mov edx, dword [rbx + 0x50]
test edx, edx
jne 0x18008b495
cmp esi, 0x40
jb 0x18008b495
movups xmm0, xmmword [rbp]
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x40], xmm1
call fcn.18008a240
add qword [rbx + 8], 0x200
add rbp, 0x40
add esi, 0xffffffc0
jmp 0x18008b4dc
mov ecx, 0x40
mov eax, esi
sub ecx, edx
cmp esi, ecx
cmovae eax, ecx
lea rcx, [rbx + 0x10]
add rcx, rdx
mov r8d, eax
mov rdx, rbp
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x50], edi
add rbp, rdi
sub esi, edi
cmp dword [rbx + 0x50], 0x40
jne 0x18008b4dc
mov rcx, rbx
call fcn.18008a240
add qword [rbx + 8], 0x200
mov dword [rbx + 0x50], 0
test esi, esi
jne 0x18008b450
mov esi, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
test r15, r15
je 0x18008b503
mov edx, esi
mov r8, r13
mov rcx, r15
call fcn.1800790d0
test al, al
jne 0x18008b51a
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1800e84c0
test al, al
je 0x18008b3f0
jmp 0x18008b52e
mov rax, qword [r13]
lea rdx, str.RIPEMD128_aborted_by_application
mov rcx, r13
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, r14
call fcn.180009630
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.18008b570
movzx eax, r12b
mov r12, qword [rsp + 0x68]
jmp 0x18008b550
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180009610
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18008b7b0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
call fcn.18008b6c0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18008b570
Function at 0x18008d0b0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
xor esi, esi
mov rbp, qword [rsp + 0xd8]
mov rbx, rcx
mov dword [rcx + 0x50], esi
mov r13, r9
mov qword [rcx + 8], rsi
mov r15, r8
mov dword [rcx + 0x54], 0x67452301
mov rdi, rdx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
mov ecx, 0x4e28
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], rbp
call fcn.180018e50
mov r14, rax
test rax, rax
je 0x18008d2bc
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov r12b, 1
mov dword [rsp + 0x48], esi
call fcn.1800e84c0
test al, al
jne 0x18008d29e
nop word [rax + rax]
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rdi
call fcn.1800e8710
movzx r12d, al
test al, al
je 0x18008d29e
mov esi, dword [rsp + 0x48]
test esi, esi
je 0x18008d278
test rbp, rbp
je 0x18008d1af
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.18001b830
mov esi, dword [rsp + 0x48]
mov rbp, r14
cmp esi, 1
jb 0x18008d25d
nop dword [rax + rax]
mov edx, dword [rbx + 0x50]
test edx, edx
jne 0x18008d205
cmp esi, 0x40
jb 0x18008d205
movups xmm0, xmmword [rbp]
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x40], xmm1
call fcn.18008b860
add qword [rbx + 8], 0x200
add rbp, 0x40
add esi, 0xffffffc0
jmp 0x18008d24c
mov ecx, 0x40
mov eax, esi
sub ecx, edx
cmp esi, ecx
cmovae eax, ecx
lea rcx, [rbx + 0x10]
add rcx, rdx
mov r8d, eax
mov rdx, rbp
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x50], edi
add rbp, rdi
sub esi, edi
cmp dword [rbx + 0x50], 0x40
jne 0x18008d24c
mov rcx, rbx
call fcn.18008b860
add qword [rbx + 8], 0x200
mov dword [rbx + 0x50], 0
test esi, esi
jne 0x18008d1c0
mov esi, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
test r15, r15
je 0x18008d273
mov edx, esi
mov r8, r13
mov rcx, r15
call fcn.1800790d0
test al, al
jne 0x18008d28a
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1800e84c0
test al, al
je 0x18008d160
jmp 0x18008d29e
mov rax, qword [r13]
lea rdx, str.RIPEMD128_aborted_by_application
mov rcx, r13
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, r14
call fcn.180009630
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.18008d2e0
movzx eax, r12b
mov r12, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180009610
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18008d540
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
call fcn.18008d450
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18008d2e0
Function at 0x18008e770
Capabilities:
Hash data using ripemd256
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov r13, r9
mov rbp, qword [rsp + 0xd8]
mov r15, r8
mov qword [rsp + 0x38], rdx
mov rdi, rdx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rbp
test rax, rax
je 0x18008e99e
xor esi, esi
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], esi
mov qword [rcx + 8], rsi
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0x76543210
mov dword [rcx + 0x68], 0xfedcba98
mov dword [rcx + 0x6c], 0x89abcdef
mov dword [rcx + 0x70], 0x1234567
mov ecx, 0x4e28
call fcn.180018e50
mov r14, rax
test rax, rax
je 0x18008e99e
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov r12b, 1
mov dword [rsp + 0x48], esi
call fcn.1800e84c0
test al, al
jne 0x18008e97e
nop word [rax + rax]
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rdi
call fcn.1800e8710
movzx r12d, al
test al, al
je 0x18008e97e
mov esi, dword [rsp + 0x48]
test esi, esi
je 0x18008e958
test rbp, rbp
je 0x18008e88f
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.18001b830
mov esi, dword [rsp + 0x48]
mov rbp, r14
cmp esi, 1
jb 0x18008e93d
nop dword [rax + rax]
mov edx, dword [rbx + 0x50]
test edx, edx
jne 0x18008e8e5
cmp esi, 0x40
jb 0x18008e8e5
movups xmm0, xmmword [rbp]
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x40], xmm1
call fcn.18008d600
add qword [rbx + 8], 0x200
add rbp, 0x40
add esi, 0xffffffc0
jmp 0x18008e92c
mov ecx, 0x40
mov eax, esi
sub ecx, edx
cmp esi, ecx
cmovae eax, ecx
lea rcx, [rbx + 0x10]
add rcx, rdx
mov r8d, eax
mov rdx, rbp
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x50], edi
add rbp, rdi
sub esi, edi
cmp dword [rbx + 0x50], 0x40
jne 0x18008e92c
mov rcx, rbx
call fcn.18008d600
add qword [rbx + 8], 0x200
mov dword [rbx + 0x50], 0
test esi, esi
jne 0x18008e8a0
mov esi, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
test r15, r15
je 0x18008e953
mov edx, esi
mov r8, r13
mov rcx, r15
call fcn.1800790d0
test al, al
jne 0x18008e96a
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1800e84c0
test al, al
je 0x18008e840
jmp 0x18008e97e
mov rax, qword [r13]
lea rdx, str.RIPEMD256_aborted_by_application
mov rcx, r13
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, r14
call fcn.180009630
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.18008e9c0
movzx eax, r12b
mov r12, qword [rsp + 0x68]
jmp 0x18008e9a0
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180009610
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18008ec70
Capabilities:
Hash data using ripemd256
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0x76543210
mov dword [rcx + 0x68], 0xfedcba98
mov dword [rcx + 0x6c], 0x89abcdef
mov dword [rcx + 0x70], 0x1234567
call fcn.18008eb80
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18008e9c0
Function at 0x180090650
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov r13, r9
mov rbp, qword [rsp + 0xd8]
mov r15, r8
mov qword [rsp + 0x38], rdx
mov rdi, rdx
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rbp
test rax, rax
je 0x18009088e
xor esi, esi
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], esi
mov qword [rcx + 8], rsi
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
mov dword [rcx + 0x68], 0x76543210
mov dword [rcx + 0x6c], 0xfedcba98
mov dword [rcx + 0x70], 0x89abcdef
mov dword [rcx + 0x74], 0x1234567
mov dword [rcx + 0x78], 0x3c2d1e0f
mov ecx, 0x4e28
call fcn.180018e50
mov r14, rax
test rax, rax
je 0x18009088e
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov r12b, 1
mov dword [rsp + 0x48], esi
call fcn.1800e84c0
test al, al
jne 0x18009086e
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x28], r13
lea r9, [rsp + 0x48]
mov r8d, 0x4e20
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rdi
call fcn.1800e8710
movzx r12d, al
test al, al
je 0x18009086e
mov esi, dword [rsp + 0x48]
test esi, esi
je 0x180090848
test rbp, rbp
je 0x18009077f
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.18001b830
mov esi, dword [rsp + 0x48]
mov rbp, r14
cmp esi, 1
jb 0x18009082d
nop dword [rax + rax]
mov edx, dword [rbx + 0x50]
test edx, edx
jne 0x1800907d5
cmp esi, 0x40
jb 0x1800907d5
movups xmm0, xmmword [rbp]
mov rcx, rbx
movups xmmword [rbx + 0x10], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rbx + 0x20], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x30], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x40], xmm1
call fcn.18008ed40
add qword [rbx + 8], 0x200
add rbp, 0x40
add esi, 0xffffffc0
jmp 0x18009081c
mov ecx, 0x40
mov eax, esi
sub ecx, edx
cmp esi, ecx
cmovae eax, ecx
lea rcx, [rbx + 0x10]
add rcx, rdx
mov r8d, eax
mov rdx, rbp
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add dword [rbx + 0x50], edi
add rbp, rdi
sub esi, edi
cmp dword [rbx + 0x50], 0x40
jne 0x18009081c
mov rcx, rbx
call fcn.18008ed40
add qword [rbx + 8], 0x200
mov dword [rbx + 0x50], 0
test esi, esi
jne 0x180090790
mov esi, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
test r15, r15
je 0x180090843
mov edx, esi
mov r8, r13
mov rcx, r15
call fcn.1800790d0
test al, al
jne 0x18009085a
mov rbp, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1800e84c0
test al, al
je 0x180090730
jmp 0x18009086e
mov rax, qword [r13]
lea rdx, str.RIPEMD320_aborted_by_application
mov rcx, r13
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, r14
call fcn.180009630
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1800908b0
movzx eax, r12b
mov r12, qword [rsp + 0x68]
jmp 0x180090890
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180009610
add rsp, 0x70
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180090ba0
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x54], 0x67452301
mov dword [rcx + 0x50], eax
mov rdi, r9
mov qword [rcx + 8], rax
mov rbx, rcx
mov dword [rcx + 0x58], 0xefcdab89
mov dword [rcx + 0x5c], 0x98badcfe
mov dword [rcx + 0x60], 0x10325476
mov dword [rcx + 0x64], 0xc3d2e1f0
mov dword [rcx + 0x68], 0x76543210
mov dword [rcx + 0x6c], 0xfedcba98
mov dword [rcx + 0x70], 0x89abcdef
mov dword [rcx + 0x74], 0x1234567
mov dword [rcx + 0x78], 0x3c2d1e0f
call fcn.180090ab0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800908b0

Function at 0x180090c20
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable.s738174zz.0
mov dword [rcx + 8], 0x67452301
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 0x18], rax
mov rax, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x180090c90
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r13, qword [rsp + 0xb0]
mov r14, r9
mov rbp, qword [rsp + 0xb8]
mov rsi, r8
mov r15, rdx
mov rdi, rcx
test r13, r13
je 0x180090dd0
mov dword [rcx + 8], 0x67452301
xor r12d, r12d
mov qword [rcx + 0x18], r12
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov ecx, 0x4e28
call fcn.180018e50
mov rbx, rax
test rax, rax
je 0x180090dd0
mov dword [rsp + 0x30], r12d
mov rcx, r15
mov r12b, 1
call fcn.1800e84c0
test al, al
jne 0x180090db7
nop word [rax + rax]
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x30]
mov r8d, 0x4e20
mov qword [rsp + 0x20], rsi
mov rdx, rbx
mov rcx, r15
call fcn.1800e8710
test al, al
je 0x180090db7
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x180090d96
test rbp, rbp
je 0x180090d73
mov rdx, rbx
mov rcx, rbp
call fcn.18001b830
mov r8d, dword [rsp + 0x30]
mov rdx, rbx
mov rcx, rdi
call fcn.1800915d0
test rsi, rsi
je 0x180090d96
mov edx, dword [rsp + 0x30]
mov r8, r14
mov rcx, rsi
call fcn.1800790d0
test al, al
jne 0x180090da4
mov rcx, r15
call fcn.1800e84c0
test al, al
je 0x180090d30
jmp 0x180090db7
mov rax, qword [r14]
lea rdx, str.MD4_aborted_by_application
mov rcx, r14
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, rbx
call fcn.180009630
mov rdx, r13
mov rcx, rdi
call fcn.180090df0
movzx eax, r12b
jmp 0x180090dd2
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180009610
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180090f00
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1802cd010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x20]
call fcn.18001b1b0
nop
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rbx
call fcn.180027700
xor eax, eax
mov qword [rdi + 0x18], rax
mov dword [rdi + 8], 0x67452301
mov dword [rdi + 0xc], 0xefcdab89
mov dword [rdi + 0x10], 0x98badcfe
mov dword [rdi + 0x14], 0x10325476
lea rcx, [rsp + 0x20]
call fcn.18001fd80
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.18001f920
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
call fcn.1800915d0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.180090df0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.18001b830
nop
lea rcx, [rsp + 0x20]
call fcn.18001b360
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180009610
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x180091920
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.1800943e0
jmp fcn.180096520

Function at 0x180091940
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256

Disassembly:
mov r8d, dword [rcx + 0x10]
sub r8d, 0xa0
je 0x180091ad1
xor edx, edx
sub r8d, 0x40
je 0x1800919f0
sub r8d, 0x20
je 0x180091a94
sub r8d, 0x80
je 0x180091a2d
cmp r8d, 0x80
jne 0x180091afa
mov rax, qword [0x1802e2cc0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1802e2cc8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1802e2cd0]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1802e2cd8]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1802e2ce0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1802e2ce8]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1802e2cf0]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1802e2cf8]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], rdx
mov qword [rcx + 0x88], rdx
nop word [rax + rax]
mov dword [rcx + 0x14], 0xc1059ed8
mov dword [rcx + 0x18], 0x367cd507
mov dword [rcx + 0x1c], 0x3070dd17
mov dword [rcx + 0x20], 0xf70e5939
mov dword [rcx + 0x24], 0xffc00b31
mov dword [rcx + 0x28], 0x68581511
mov dword [rcx + 0x2c], 0x64f98fa7
mov dword [rcx + 0x30], 0xbefa4fa4
mov qword [rcx + 0x34], rdx
ret
mov rax, qword [0x1802e2a00]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1802e2a08]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1802e2a10]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1802e2a18]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1802e2a20]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1802e2a28]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1802e2a30]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1802e2a38]
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], rdx
mov qword [rcx + 0x88], rdx
ret
mov dword [rcx + 0x14], 0x6a09e667
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov qword [rcx + 0x30], 0x5be0cd19
mov dword [rcx + 0x38], edx
ret
mov dword [rcx + 0x14], 0x67452301
xor edx, edx
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], rdx
ret