joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140073b90
Capabilities:
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x140073bc1
mov rax, qword [0x140917d20]
test rax, rax
je 0x140073bb8
call rax
jmp 0x140073bbd
call fcn.14012d8fc
mov qword [rbx + 0x78], rdi
mov rax, qword [0x140917d28]
mov ecx, 0x3e8
test rax, rax
je 0x140073bd6
call rax
jmp 0x140073bdb
call fcn.140132e00
mov qword [rbx + 0x78], rax
test rax, rax
jne 0x140073bf4
mov eax, 0xffffff83
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, 0x3e8
mov rcx, rax
call fcn.140153440
mov rcx, qword [rbx + 0x78]
add rcx, 0x1b0
je 0x140073db9
mov rax, qword [rbx + 0xa8]
xorps xmm0, xmm0
mov qword [rcx + 0x70], rax
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x60], rdi
mov dword [rcx + 0x68], edi
mov rcx, qword [rbx + 0x78]
add rcx, 0x228
je 0x140073db9
mov rax, qword [rbx + 0xa8]
mov qword [rcx + 0xd8], rax
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], edi
mov qword [rcx + 0xc8], rdi
mov qword [rcx + 0xd0], rdi
mov rcx, qword [rbx + 0x78]
add rcx, 0x308
je 0x140073db9
mov rax, qword [rbx + 0xa8]
mov qword [rcx + 0xd8], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], edi
mov qword [rcx + 0xc8], rdi
mov qword [rcx + 0xd0], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffff53
add rsp, 0x20
pop rdi
ret
Function at 0x14007ce80
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
movsxd r9, ecx
mov rsi, rdx
mov ecx, r9d
mov r10d, 0xffffff18
call fcn.14007cd60
cmp dword [rsp + 0x50], eax
jae 0x14007cec3
lea eax, [r10 + 0x64]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r9d, 0xf
ja case.0x14007cedf.0
lea rdx, [0x140000000]
mov ecx, dword [rdx + r9*4 + 0x7cfb8]
add rcx, rdx
jmp rcx
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007d590
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007d6c0
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007d760
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007d920
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007d820
mov r8, rbx
mov edx, edi
mov rcx, rsi
call fcn.14007d590
mov r10d, eax
test eax, eax
jne case.0x14007cedf.5
lea r8, [rbx + 0x10]
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14007d6c0
mov r10d, 0xffffff53
mov rbx, qword [rsp + 0x30]
mov eax, r10d
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14007d590
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1408f0280]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov dword [rbp + 0x13], 0x67452301
mov rbx, r8
mov qword [rbp + 0x27], rdi
mov r8d, edx
mov dword [rbp + 0x17], 0xefcdab89
mov rdx, rcx
mov dword [rbp + 0x1b], 0x98badcfe
lea rcx, [rbp - 0x39]
mov dword [rbp + 0x1f], 0x10325476
mov qword [rbp - 0x39], rdi
mov dword [rbp - 0x31], edi
call fcn.1400aafe0
test eax, eax
jne 0x14007d69c
test rbx, rbx
je 0x14007d697
mov eax, dword [rbp - 0x39]
mov byte [rbp + rax - 0x2d], 0x80
mov ecx, dword [rbp - 0x39]
inc ecx
mov dword [rbp - 0x39], ecx
cmp ecx, 0x38
jbe 0x14007d641
mov eax, ecx
mov r8d, 0x40
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.140153440
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x39], 0x40
lea rcx, [rbp - 0x39]
call fcn.1400aa7f0
mov ecx, edi
mov dword [rbp - 0x39], edi
mov eax, ecx
mov r8d, Ordinal_60
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.140153440
mov r9d, dword [rbp - 0x35]
mov edx, r9d
mov ecx, dword [rbp - 0x31]
shr edx, 0x1d
shl r9d, 3
mov dword [rbp - 0x35], r9d
mov dword [rbp + 0xb], r9d
lea r8d, [rdx + rcx*8]
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x31], r8d
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], r8d
call fcn.1400aa7f0
movups xmm0, xmmword [rbp + 0x13]
mov eax, edi
movups xmmword [rbx], xmm0
jmp 0x14007d69c
mov eax, 0xffffff53
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140117aa0
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret

Function at 0x14007d6c0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1408f0280]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x6c], 0x67452301
mov rbx, r8
mov qword [rsp + 0x80], rax
mov r8d, edx
mov dword [rsp + 0x70], 0xefcdab89
mov rdx, rcx
mov dword [rsp + 0x74], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x78], 0x10325476
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.14009c780
test eax, eax
jne 0x14007d73a
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14009cc20
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140117aa0
add rsp, 0xa0
pop rbx
ret

Function at 0x14007d760
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x1408f0280]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov rbx, r8
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x38], rax
mov dword [r11 - 0x30], eax
test rcx, rcx
jne 0x14007d7de
test edx, edx
je 0x14007d7f2
mov eax, 0xffffff53
jmp 0x14007d7ff
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140099810
test eax, eax
jne 0x14007d7ff
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14009a070
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140117aa0
add rsp, 0xb0
pop rbx
ret
Function at 0x14008fc60
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1408f0280]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, rdx
mov r14, r9
mov edx, dword [rbp + 0x100]
mov rdi, rcx
sub edx, 4
je 0x14008fda8
cmp edx, 1
je 0x14008fcae
mov eax, 0xffffff18
jmp 0x14008fe50
movdqa xmm0, xmmword [0x1408d3c50]
xor ebx, ebx
mov rax, qword [rcx + 0xa8]
xor r8d, r8d
movdqa xmm1, xmmword [0x1408d3cf0]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x1c0], r12
xor edx, edx
movdqa xmmword [rbp - 0x50], xmm0
movabs r12, 0x629a292a367cd507
movdqa xmm0, xmmword [0x1408d3c90]
mov qword [rsp + 0x1d0], r15
movabs r15, 0xcbbb9d5dc1059ed8
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp + 0x78], rax
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r12
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
call fcn.140097a90
test eax, eax
jne 0x14008fd8e
lea rcx, [rbp - 0x60]
call fcn.140097c30
test eax, eax
jne 0x14008fd8e
movaps xmm0, xmmword [rbp - 0x60]
mov eax, ebx
movaps xmm1, xmmword [rbp - 0x50]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1408d3c50]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1408d3c90]
movaps xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x1408d3cf0]
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r12
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
mov r15, qword [rsp + 0x1d0]
mov edx, Ordinal_50
mov r12, qword [rsp + 0x1c0]
lea ecx, [rdx - 0x29]
jmp 0x14008fe08
mov rax, qword [rcx + 0xa8]
lea rdx, [rsp + 0x60]
xor ebx, ebx
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x60]
mov qword [rbp], rbx
mov dword [rbp + 8], ebx
mov dword [rbp - 0x60], 0x6a09e667
mov dword [rbp - 0x5c], 0xbb67ae85
mov dword [rbp - 0x58], 0x3c6ef372
mov dword [rbp - 0x54], 0xa54ff53a
mov dword [rbp - 0x50], 0x510e527f
mov dword [rbp - 0x4c], 0x9b05688c
mov dword [rbp - 0x48], 0x1f83d9ab
mov dword [rbp - 0x44], 0x5be0cd19
call fcn.14009a070
lea edx, [rbx + 0x20]
lea ecx, [rbx + 6]
test eax, eax
jne 0x14008fe50
cmp byte [rdi + 0x319], 4
je 0x14008fe1c
mov eax, 0xfffffeba
jmp 0x14008fe50
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], edx
mov r9d, edx
mov qword [rsp + 0x40], rax
mov r8, r14
lea rax, str.derived
mov dword [rsp + 0x38], 7
mov rcx, rsi
mov qword [rsp + 0x30], rax
call fcn.14008fb50
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140117aa0
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140094f10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov r9d, eax
test r8d, r8d
jle 0x140094fe2
cmp r8d, 8
jb 0x140094fe2
mov qword [rsp + 0x10], rbx
lea r11, [rdx + 4]
mov qword [rsp], rdi
sub rcx, rdx
movsxd rbx, r8d
mov rdi, 0xfffffffffffffffc
and rbx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rdi, rdx
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r11 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r11 - 4]
lea r11, [r11 + 8]
punpcklbw xmm2, xmm0
lea rax, [rdi + r11]
punpcklwd xmm2, xmm0
add r9d, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [r11 - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + r11 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rax, rbx
jl 0x140094f60
mov rdi, qword [rsp]
orps xmm3, xmm4
mov rbx, qword [rsp + 0x10]
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
movsxd r11, r9d
movsxd r9, r8d
cmp r11, r9
jge 0x140095018
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
nop word [rax + rax]
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x140095000
add rsp, 8
ret
Function at 0x140095020
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xf0
mov rax, qword [0x1408f0280]
xor rax, rsp
mov qword [rbp - 9], rax
mov r15, qword [rbp + 0x67]
mov ecx, 0x1b8
mov r12, qword [rbp + 0x77]
mov eax, ecx
rol ecx, 8
mov r14d, Ordinal_60
ror eax, 8
mov rdi, rdx
xor ecx, eax
mov byte [rsp + 0x28], r9b
and ecx, 0xff00ff
mov byte [rsp + 0x20], 1
xor ecx, eax
lea r13d, [r14 - 0x35]
mov dword [rsp + 0x30], ecx
xor esi, esi
nop word [rax + rax]
mov r8d, 1
mov qword [rbp - 0x39], rsi
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x40], 0x6a09e667
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0xbb67ae85
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
mov qword [rbp - 0x49], rsi
mov dword [rbp - 0x41], esi
call fcn.140099810
mov ebx, eax
test eax, eax
jne 0x1400951c7
lea r8d, [rax + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140099810
mov ebx, eax
test eax, eax
jne 0x1400951c7
cmp byte [rsp + 0x28], 4
je 0x14009513b
lea r8d, [rax + 1]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.140099810
mov ebx, eax
test eax, eax
jne 0x1400951c7
test r15, r15
jne 0x14009514c
cmp dword [rbp + 0x6f], esi
jbe 0x140095163
mov ebx, 0xffffff53
jmp 0x1400951c7
mov r8d, dword [rbp + 0x6f]
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.140099810
mov ebx, eax
test eax, eax
jne 0x1400951c7
test r12, r12
je 0x140095185
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x140095185
mov r8d, eax
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.140099810
mov ebx, eax
test eax, eax
jne 0x1400951c7
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x40]
call fcn.14009a070
mov ebx, eax
test eax, eax
jne 0x1400951c7
cmp r14d, 0x20
jbe 0x1400951b8
movups xmm0, xmmword [rbp - 0x29]
add r14d, 0xffffffe0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
add rdi, 0x20
jmp 0x1400951c7
mov r8d, r14d
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.140152da0
inc byte [rsp + 0x20]
sub r13, 1
jne 0x140095090
mov ecx, reloc.WLDAP32.dll_Ordinal_32
lea rdx, [rbp - 0x29]
nop
mov byte [rdx], sil
lea rdx, [rdx + 1]
add ecx, 0xffffffff
jne 0x1400951e0
test ebx, ebx
setne sil
mov eax, esi
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140117aa0
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140095d80
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
sub rsp, 0xa0
mov rax, qword [0x1408f0280]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
test rcx, rcx
jne 0x140095daa
mov eax, 0xffffff53
jmp 0x140095f85
mov qword [rcx + 8], r9
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rbp
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov byte [rcx + 0x18], bpl
xor ecx, ecx
call fcn.140096500
test eax, eax
jne 0x140095f6a
mov rax, qword [0x140917d28]
lea ecx, [rbp + 0x78]
mov qword [rsp + 0xc8], rdi
test rax, rax
je 0x140095df2
call rax
jmp 0x140095df7
call fcn.140132e00
mov qword [rsi + 0x10], rax
mov edi, 0x34
test rax, rax
jne 0x140095e0d
lea ebx, [rax - 0x7d]
jmp 0x140095f2f
mov ebx, 1
mov dword [rsp + 0x20], 0xf0000000
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140095f0d
mov rcx, qword [rsi]
lea r8, [rsp + 0x40]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140095f0d
mov rcx, qword [rsi]
xor edx, edx
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], r15
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r12d, 4
mov ebx, ebp
mov r14d, ebp
mov r8d, r12d
mov r15, rbp
lea r13d, [r12 - 1]
nop dword [rax]
mov eax, r8d
lea rdx, [rsp + 0x40]
add rax, r15
lea rcx, [rsp + 0x40]
add rdx, rax
add rcx, r15
call fcn.140094f10
test eax, eax
mov r8d, edi
cmove ebx, r13d
add r14d, r12d
sub r8d, r14d
add r15, r12
cmp r8d, r12d
cmova r8d, r12d
cmp r14d, 0x30
jb 0x140095e90
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
test ebx, ebx
jne 0x140095f0d
mov rcx, qword [rsi + 0x10]
lea r8d, [rbx + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x44]
call fcn.140095cd0
mov ebx, eax
test eax, eax
je 0x140095f2f
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140095f2b
mov rax, qword [0x140917d20]
test rax, rax
je 0x140095f26
call rax
jmp 0x140095f2b
call fcn.14012d8fc
mov qword [rsi + 0x10], rbp
lea rax, [rsp + 0x40]
mov byte [rax], bpl
lea rax, [rax + 1]
add edi, 0xffffffff
jne 0x140095f34
mov rdi, qword [rsp + 0xc8]
test ebx, ebx
jne 0x140095f52
mov byte [rsi + 0x18], 1
jmp 0x140095f73
cmp ebx, 3
je 0x140095f6a
cmp ebx, 1
mov byte [rsi + 0x18], 2
mov eax, 0xffffff39
cmove ebx, eax
mov ebp, ebx
jmp 0x140095f73
mov byte [rsi + 0x18], 3
mov ebp, 0xffffff2f
mov rbx, qword [rsp + 0xb8]
mov eax, ebp
mov rbp, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140117aa0
add rsp, 0xa0
pop rsi
ret
Function at 0x14009a070
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14009a1b6
test rdx, rdx
je 0x14009a1b6
call fcn.140099cb0
test eax, eax
jne 0x14009a1bb
mov ecx, dword [rbx]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx], ecx
mov ecx, dword [rbx + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 8], ecx
mov ecx, dword [rbx + 0xc]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0xc], ecx
mov ecx, dword [rbx + 0x10]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x10], ecx
mov ecx, dword [rbx + 0x14]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x14], ecx
mov ecx, dword [rbx + 0x18]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x18], ecx
mov ecx, dword [rbx + 0x1c]
mov eax, ecx
ror eax, 8
rol ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14009d0c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, r8d
mov r9, rdx
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x14009d1a3
shr r8d, 3
xor eax, eax
test r8d, r8d
je 0x14009d2b1
cmp r8d, 8
jb 0x14009d17e
lea ecx, [r8 - 1]
lea r11, [r10 + rcx*8]
lea rcx, [rdx + rcx*8]
cmp r10, rcx
ja 0x14009d106
cmp r11, rdx
jae 0x14009d17e
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
movdqu xmm0, xmmword [r10 + rax*8]
lea ecx, [rbx - 2]
movdqu xmm1, xmmword [rdx + rax*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rax*8], xmm1
add eax, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
mov ecx, ebx
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
lea ecx, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
cmp eax, r11d
jb 0x14009d112
cmp eax, r8d
jae 0x14009d2b1
sub r9, r10
lea rdx, [r10 + rax*8]
sub r8d, eax
mov ecx, r8d
nop dword [rax + rax]
mov rax, qword [r9 + rdx]
xor qword [rdx], rax
lea rdx, [rdx + 8]
sub rcx, 1
jne 0x14009d190
pop rbx
ret
xor eax, eax
test r8d, r8d
je 0x14009d2b1
cmp r8d, 8
jb 0x14009d291
lea ecx, [r8 - 1]
lea r11, [rcx + r10]
add rcx, rdx
cmp r10, rcx
ja 0x14009d1d1
cmp r11, r9
jae 0x14009d291
cmp r8d, 0x40
jb 0x14009d261
mov qword [rsp + 0x10], rdi
mov ebx, r8d
and ebx, 0x3f
mov edi, r8d
sub edi, ebx
mov r11d, reloc.WLDAP32.dll_Ordinal_32
movdqu xmm0, xmmword [rax + r10]
lea ecx, [r11 - 0x10]
movdqu xmm1, xmmword [rax + rdx]
xorps xmm1, xmm0
movdqu xmmword [rax + r10], xmm1
add eax, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
mov ecx, r11d
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
lea ecx, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
cmp eax, edi
jb 0x14009d1f1
mov rdi, qword [rsp + 0x10]
cmp ebx, 8
jb 0x14009d28c
mov edx, r8d
and edx, 0xfffffff8
nop word [rax + rax]
movq xmm0, qword [rax + r10]
movq xmm1, qword [rax + r9]
xorps xmm1, xmm0
movq qword [rax + r10], xmm1
add eax, 8
cmp eax, edx
jb 0x14009d270
cmp eax, r8d
jae 0x14009d2b1
mov edx, eax
sub r9, r10
add rdx, r10
sub r8d, eax
mov ecx, r8d
nop
movzx eax, byte [rdx + r9]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x14009d2a0
pop rbx
ret
Function at 0x14009f710
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa8
mov rax, qword [0x1408f0280]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov r15, qword [rbp + 0x7f]
mov eax, r9d
mov r9, qword [rbp + 0x6f]
mov esi, eax
mov r13d, eax
shr esi, 4
and r13d, 0xf
mov dword [rbp - 0x61], eax
mov eax, dword [rbp + 0x77]
mov r12, rcx
mov rcx, qword [rbp + 0x8f]
xorps xmm0, xmm0
mov qword [rbp - 0x51], rdx
xorps xmm1, xmm1
mov qword [rbp - 0x59], r15
mov rbx, r8
mov qword [rbp - 0x49], rcx
mov r14, rdx
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x41], xmm1
cmp eax, 0xc
jne 0x14009f79a
movsd xmm0, qword [r9]
mov eax, dword [r9 + 8]
movsd qword [rbp - 0x21], xmm0
mov dword [rbp - 0x19], eax
mov byte [rbp - 0x12], 1
jmp 0x14009f7bc
lea rcx, [rbp - 0x21]
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rcx
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x20], eax
xor edx, edx
call fcn.14009efe0
movaps xmm0, xmmword [rbp - 0x21]
mov edi, reloc.WS2_32.dll_ntohs
movdqa xmmword [rbp - 0x31], xmm0
test esi, esi
je 0x14009f890
lea r15, [rbp - 0x32]
neg r15
nop dword [rax]
dec esi
mov rax, rdi
add byte [rbp + rax - 0x31], 1
jne 0x14009f7f5
dec rax
cmp rax, 0xc
jge 0x14009f7e5
lea r8, [rbp - 0x41]
mov rcx, r12
lea rdx, [rbp - 0x31]
call fcn.14009d2c0
lea rcx, [rbp - 0x41]
mov rax, rbx
or rax, rcx
test al, 7
jne 0x14009f824
mov rax, qword [rbx]
xor qword [rbp - 0x41], rax
mov rax, qword [rbx + 8]
xor qword [rbp - 0x39], rax
jmp 0x14009f874
lea rcx, [rbx + 0xf]
lea rax, [rbp - 0x41]
cmp rax, rcx
ja 0x14009f863
lea rax, [rbp - 0x32]
cmp rax, rbx
jb 0x14009f863
lea rax, [rbp - 0x41]
mov edx, reloc.WS2_32.dll_recv
lea r8, [rcx + r15]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14009f850
jmp 0x14009f874
movdqu xmm0, xmmword [rbp - 0x41]
movdqu xmm1, xmmword [rbx]
xorps xmm1, xmm0
movdqu xmmword [rbp - 0x41], xmm1
movups xmm0, xmmword [rbp - 0x41]
add rbx, 0x10
movups xmmword [r14], xmm0
add r14, 0x10
test esi, esi
jne 0x14009f7e0
mov r15, qword [rbp - 0x59]
test r13d, r13d
je 0x14009f8d3
add byte [rbp + rdi - 0x31], 1
jne 0x14009f8a5
dec rdi
cmp rdi, 0xc
jge 0x14009f895
lea r8, [rbp - 0x41]
mov rcx, r12
lea rdx, [rbp - 0x31]
call fcn.14009d2c0
mov r8d, r13d
lea rcx, [rbp - 0x41]
mov rdx, rbx
call fcn.14009d0c0
mov r8d, r13d
lea rdx, [rbp - 0x41]
mov rcx, r14
call fcn.140152da0
test r15, r15
je 0x14009f924
mov eax, dword [rbp - 0x61]
mov rcx, r12
mov ebx, dword [rbp + 0x87]
mov r9, qword [rbp - 0x51]
mov r8d, dword [rbp + 0x97]
mov rdx, qword [rbp - 0x49]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], eax
call fcn.14009efe0
lea r8, [rbp - 0x41]
mov rcx, r12
lea rdx, [rbp - 0x21]
call fcn.14009d2c0
mov r8d, ebx
lea rdx, [rbp - 0x41]
mov rcx, r15
call fcn.14009d0c0
xor eax, eax
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.140117aa0
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret