joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140078960
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov edi, r8d
movsxd r9, ecx
mov rsi, rdx
mov ecx, r9d
mov r10d, 0xffffff18
call fcn.140078840
cmp dword [rsp + 0x50], eax
jae 0x1400789a3
lea eax, [r10 + 0x64]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp r9d, 0xf
ja case.0x1400789bf.0
lea rdx, [0x140000000]
mov ecx, dword [rdx + r9*4 + 0x78a98]
add rcx, rdx
jmp rcx
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140079070
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400791a0
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140079240
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140079400
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140079300
mov r8, rbx
mov edx, edi
mov rcx, rsi
call fcn.140079070
mov r10d, eax
test eax, eax
jne case.0x1400789bf.5
lea r8, [rbx + 0x10]
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400791a0
mov r10d, 0xffffff53
mov rbx, qword [rsp + 0x30]
mov eax, r10d
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140079070
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14010d0c0]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov dword [rbp + 0x13], 0x67452301
mov rbx, r8
mov qword [rbp + 0x27], rdi
mov r8d, edx
mov dword [rbp + 0x17], 0xefcdab89
mov rdx, rcx
mov dword [rbp + 0x1b], 0x98badcfe
lea rcx, [rbp - 0x39]
mov dword [rbp + 0x1f], 0x10325476
mov qword [rbp - 0x39], rdi
mov dword [rbp - 0x31], edi
call fcn.1400a6b30
test eax, eax
jne 0x14007917c
test rbx, rbx
je 0x140079177
mov eax, dword [rbp - 0x39]
mov byte [rbp + rax - 0x2d], 0x80
mov ecx, dword [rbp - 0x39]
inc ecx
mov dword [rbp - 0x39], ecx
cmp ecx, 0x38
jbe 0x140079121
mov eax, ecx
mov r8d, 0x40
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.1400d5800
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x39], 0x40
lea rcx, [rbp - 0x39]
call fcn.1400a6340
mov ecx, edi
mov dword [rbp - 0x39], edi
mov eax, ecx
mov r8d, 0x38
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.1400d5800
mov r9d, dword [rbp - 0x35]
mov edx, r9d
mov ecx, dword [rbp - 0x31]
shr edx, 0x1d
shl r9d, 3
mov dword [rbp - 0x35], r9d
mov dword [rbp + 0xb], r9d
lea r8d, [rdx + rcx*8]
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x31], r8d
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], r8d
call fcn.1400a6340
movups xmm0, xmmword [rbp + 0x13]
mov eax, edi
movups xmmword [rbx], xmm0
jmp 0x14007917c
mov eax, 0xffffff53
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400a8a40
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret

Function at 0x1400791a0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14010d0c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x6c], 0x67452301
mov rbx, r8
mov qword [rsp + 0x80], rax
mov r8d, edx
mov dword [rsp + 0x70], 0xefcdab89
mov rdx, rcx
mov dword [rsp + 0x74], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x78], 0x10325476
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.1400982f0
test eax, eax
jne 0x14007921a
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140098790
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400a8a40
add rsp, 0xa0
pop rbx
ret

Function at 0x140079240
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x14010d0c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov rbx, r8
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x38], rax
mov dword [r11 - 0x30], eax
test rcx, rcx
jne 0x1400792be
test edx, edx
je 0x1400792d2
mov eax, 0xffffff53
jmp 0x1400792df
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140095380
test eax, eax
jne 0x1400792df
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140095be0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400a8a40
add rsp, 0xb0
pop rbx
ret
Function at 0x14008b740
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14010d0c0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, rdx
mov r14, r9
mov edx, dword [rbp + 0x100]
mov rdi, rcx
sub edx, 4
je 0x14008b888
cmp edx, 1
je 0x14008b78e
mov eax, 0xffffff18
jmp 0x14008b930
movdqa xmm0, xmmword [0x1400f7280]
xor ebx, ebx
mov rax, qword [rcx + 0xa8]
xor r8d, r8d
movdqa xmm1, xmmword [0x1400f7360]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x1c0], r12
xor edx, edx
movdqa xmmword [rbp - 0x50], xmm0
movabs r12, 0x629a292a367cd507
movdqa xmm0, xmmword [0x1400f72d0]
mov qword [rsp + 0x1d0], r15
movabs r15, 0xcbbb9d5dc1059ed8
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp + 0x78], rax
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r12
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
call fcn.140093600
test eax, eax
jne 0x14008b86e
lea rcx, [rbp - 0x60]
call fcn.1400937a0
test eax, eax
jne 0x14008b86e
movaps xmm0, xmmword [rbp - 0x60]
mov eax, ebx
movaps xmm1, xmmword [rbp - 0x50]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1400f7280]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1400f72d0]
movaps xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x1400f7360]
movdqa xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r12
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp + 0x60], ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
mov r15, qword [rsp + 0x1d0]
mov edx, 0x30
mov r12, qword [rsp + 0x1c0]
lea ecx, [rdx - 0x29]
jmp 0x14008b8e8
mov rax, qword [rcx + 0xa8]
lea rdx, [rsp + 0x60]
xor ebx, ebx
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x60]
mov qword [rbp], rbx
mov dword [rbp + 8], ebx
mov dword [rbp - 0x60], 0x6a09e667
mov dword [rbp - 0x5c], 0xbb67ae85
mov dword [rbp - 0x58], 0x3c6ef372
mov dword [rbp - 0x54], 0xa54ff53a
mov dword [rbp - 0x50], 0x510e527f
mov dword [rbp - 0x4c], 0x9b05688c
mov dword [rbp - 0x48], 0x1f83d9ab
mov dword [rbp - 0x44], 0x5be0cd19
call fcn.140095be0
lea edx, [rbx + 0x20]
lea ecx, [rbx + 6]
test eax, eax
jne 0x14008b930
cmp byte [rdi + 0x319], 4
je 0x14008b8fc
mov eax, 0xfffffeba
jmp 0x14008b930
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], edx
mov r9d, edx
mov qword [rsp + 0x40], rax
mov r8, r14
lea rax, str.derived
mov dword [rsp + 0x38], 7
mov rcx, rsi
mov qword [rsp + 0x30], rax
call fcn.14008b630
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400a8a40
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14008cc40
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x14010d0c0]
xor rax, rsp
mov qword [rbp], rax
mov r9, rdx
mov rdi, rcx
mov edx, dword [rbp + 0x50]
mov ecx, 0xffffff53
sub edx, 4
je 0x14008ce10
sub edx, 1
je 0x14008cd50
cmp edx, 1
jne 0x14008ce94
movdqa xmm0, xmmword [0x1400f7380]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400f7370]
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x20], rax
movabs rax, 0xbb67ae8584caa73b
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x1400f72e0]
mov qword [rsp + 0x28], rax
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rbp - 8], rbx
movdqa xmmword [rsp + 0x40], xmm1
mov dword [rbp - 0x20], ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
test r9, r9
jne 0x14008ccea
test r8d, r8d
jne 0x14008cd46
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140093600
mov ecx, eax
test eax, eax
jne 0x14008cd46
test rdi, rdi
je 0x14008cd41
lea rcx, [rsp + 0x20]
call fcn.1400937a0
mov ecx, eax
test eax, eax
jne 0x14008cd46
movaps xmm0, xmmword [rsp + 0x20]
mov ecx, ebx
movaps xmm1, xmmword [rsp + 0x30]
mov eax, 0x40
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm1
jmp 0x14008ce90
mov ecx, 0xffffff53
mov eax, 0x40
jmp 0x14008ce90
movdqa xmm0, xmmword [0x1400f7280]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400f7360]
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rsp + 0x20], rax
movabs rax, 0x629a292a367cd507
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x1400f72d0]
mov qword [rsp + 0x28], rax
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rbp - 8], rbx
movdqa xmmword [rsp + 0x40], xmm1
mov dword [rbp - 0x20], ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
test r9, r9
jne 0x14008cdb3
test r8d, r8d
jne 0x14008ce06
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140093600
mov ecx, eax
test eax, eax
jne 0x14008ce06
test rdi, rdi
je 0x14008ce01
lea rcx, [rsp + 0x20]
call fcn.1400937a0
mov ecx, eax
test eax, eax
jne 0x14008ce06
movaps xmm0, xmmword [rsp + 0x20]
mov ecx, ebx
movaps xmm1, xmmword [rsp + 0x30]
mov eax, 0x30
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi + 0x20], xmm0
jmp 0x14008ce90
mov ecx, 0xffffff53
mov eax, 0x30
jmp 0x14008ce90
xor ebx, ebx
mov dword [rsp + 0x20], 0x6a09e667
mov qword [rbp - 0x70], rbx
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [rbp - 0x80], rbx
mov dword [rbp - 0x78], ebx
test r9, r9
jne 0x14008ce69
test r8d, r8d
je 0x14008ce7c
jmp 0x14008ce8b
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.140095380
mov ecx, eax
test eax, eax
jne 0x14008ce8b
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140095be0
mov ecx, eax
mov eax, 0x20
test ecx, ecx
je 0x14008ce96
mov eax, ecx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1400a8a40
add rsp, 0x110
pop rdi
pop rbx
pop rbp
ret
Function at 0x140090a80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov r9d, eax
test r8d, r8d
jle 0x140090b52
cmp r8d, 8
jb 0x140090b52
mov qword [rsp + 0x10], rbx
lea r11, [rdx + 4]
mov qword [rsp], rdi
sub rcx, rdx
movsxd rbx, r8d
mov rdi, 0xfffffffffffffffc
and rbx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rdi, rdx
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r11 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r11 - 4]
lea r11, [r11 + 8]
punpcklbw xmm2, xmm0
lea rax, [rdi + r11]
punpcklwd xmm2, xmm0
add r9d, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [r11 - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + r11 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rax, rbx
jl 0x140090ad0
mov rdi, qword [rsp]
orps xmm3, xmm4
mov rbx, qword [rsp + 0x10]
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
movsxd r11, r9d
movsxd r9, r8d
cmp r11, r9
jge 0x140090b88
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
nop word [rax + rax]
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x140090b70
add rsp, 8
ret
Function at 0x140090b90
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xf0
mov rax, qword [0x14010d0c0]
xor rax, rsp
mov qword [rbp - 9], rax
mov r15, qword [rbp + 0x67]
mov ecx, 0x1b8
mov r12, qword [rbp + 0x77]
mov eax, ecx
rol ecx, 8
mov r14d, 0x37
ror eax, 8
mov rdi, rdx
xor ecx, eax
mov byte [rsp + 0x28], r9b
and ecx, 0xff00ff
mov byte [rsp + 0x20], 1
xor ecx, eax
lea r13d, [r14 - 0x35]
mov dword [rsp + 0x30], ecx
xor esi, esi
nop word [rax + rax]
mov r8d, 1
mov qword [rbp - 0x39], rsi
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x40], 0x6a09e667
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0xbb67ae85
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
mov qword [rbp - 0x49], rsi
mov dword [rbp - 0x41], esi
call fcn.140095380
mov ebx, eax
test eax, eax
jne 0x140090d37
lea r8d, [rax + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140095380
mov ebx, eax
test eax, eax
jne 0x140090d37
cmp byte [rsp + 0x28], 4
je 0x140090cab
lea r8d, [rax + 1]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.140095380
mov ebx, eax
test eax, eax
jne 0x140090d37
test r15, r15
jne 0x140090cbc
cmp dword [rbp + 0x6f], esi
jbe 0x140090cd3
mov ebx, 0xffffff53
jmp 0x140090d37
mov r8d, dword [rbp + 0x6f]
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.140095380
mov ebx, eax
test eax, eax
jne 0x140090d37
test r12, r12
je 0x140090cf5
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x140090cf5
mov r8d, eax
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.140095380
mov ebx, eax
test eax, eax
jne 0x140090d37
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x40]
call fcn.140095be0
mov ebx, eax
test eax, eax
jne 0x140090d37
cmp r14d, 0x20
jbe 0x140090d28
movups xmm0, xmmword [rbp - 0x29]
add r14d, 0xffffffe0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
add rdi, 0x20
jmp 0x140090d37
mov r8d, r14d
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.1400d5160
inc byte [rsp + 0x20]
sub r13, 1
jne 0x140090c00
mov ecx, 0x20
lea rdx, [rbp - 0x29]
nop
mov byte [rdx], sil
lea rdx, [rdx + 1]
add ecx, 0xffffffff
jne 0x140090d50
test ebx, ebx
setne sil
mov eax, esi
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1400a8a40
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400918f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
sub rsp, 0xa0
mov rax, qword [0x14010d0c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
test rcx, rcx
jne 0x14009191a
mov eax, 0xffffff53
jmp 0x140091af5
mov qword [rcx + 8], r9
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rbp
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov byte [rcx + 0x18], bpl
xor ecx, ecx
call fcn.140092070
test eax, eax
jne 0x140091ada
mov rax, qword [0x1401107f8]
lea ecx, [rbp + 0x78]
mov qword [rsp + 0xc8], rdi
test rax, rax
je 0x140091962
call rax
jmp 0x140091967
call fcn.1400bc3d0
mov qword [rsi + 0x10], rax
mov edi, 0x34
test rax, rax
jne 0x14009197d
lea ebx, [rax - 0x7d]
jmp 0x140091a9f
mov ebx, 1
mov dword [rsp + 0x20], 0xf0000000
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140091a7d
mov rcx, qword [rsi]
lea r8, [rsp + 0x40]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140091a7d
mov rcx, qword [rsi]
xor edx, edx
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], r15
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r12d, 4
mov ebx, ebp
mov r14d, ebp
mov r8d, r12d
mov r15, rbp
lea r13d, [r12 - 1]
nop dword [rax]
mov eax, r8d
lea rdx, [rsp + 0x40]
add rax, r15
lea rcx, [rsp + 0x40]
add rdx, rax
add rcx, r15
call fcn.140090a80
test eax, eax
mov r8d, edi
cmove ebx, r13d
add r14d, r12d
sub r8d, r14d
add r15, r12
cmp r8d, r12d
cmova r8d, r12d
cmp r14d, 0x30
jb 0x140091a00
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
test ebx, ebx
jne 0x140091a7d
mov rcx, qword [rsi + 0x10]
lea r8d, [rbx + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
lea rdx, [rsp + 0x44]
call fcn.140091840
mov ebx, eax
test eax, eax
je 0x140091a9f
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140091a9b
mov rax, qword [0x1401107f0]
test rax, rax
je 0x140091a96
call rax
jmp 0x140091a9b
call fcn.1400b2d30
mov qword [rsi + 0x10], rbp
lea rax, [rsp + 0x40]
mov byte [rax], bpl
lea rax, [rax + 1]
add edi, 0xffffffff
jne 0x140091aa4
mov rdi, qword [rsp + 0xc8]
test ebx, ebx
jne 0x140091ac2
mov byte [rsi + 0x18], 1
jmp 0x140091ae3
cmp ebx, 3
je 0x140091ada
cmp ebx, 1
mov byte [rsi + 0x18], 2
mov eax, 0xffffff39
cmove ebx, eax
mov ebp, ebx
jmp 0x140091ae3
mov byte [rsi + 0x18], 3
mov ebp, 0xffffff2f
mov rbx, qword [rsp + 0xb8]
mov eax, ebp
mov rbp, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400a8a40
add rsp, 0xa0
pop rsi
ret
Function at 0x140095be0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140095d26
test rdx, rdx
je 0x140095d26
call fcn.140095820
test eax, eax
jne 0x140095d2b
mov ecx, dword [rbx]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx], ecx
mov ecx, dword [rbx + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 8], ecx
mov ecx, dword [rbx + 0xc]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0xc], ecx
mov ecx, dword [rbx + 0x10]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x10], ecx
mov ecx, dword [rbx + 0x14]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x14], ecx
mov ecx, dword [rbx + 0x18]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x18], ecx
mov ecx, dword [rbx + 0x1c]
mov eax, ecx
ror eax, 8
rol ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140098c30
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, r8d
mov r9, rdx
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x140098d13
shr r8d, 3
xor eax, eax
test r8d, r8d
je 0x140098e21
cmp r8d, 8
jb 0x140098cee
lea ecx, [r8 - 1]
lea r11, [r10 + rcx*8]
lea rcx, [rdx + rcx*8]
cmp r10, rcx
ja 0x140098c76
cmp r11, rdx
jae 0x140098cee
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
movdqu xmm0, xmmword [r10 + rax*8]
lea ecx, [rbx - 2]
movdqu xmm1, xmmword [rdx + rax*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rax*8], xmm1
add eax, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
mov ecx, ebx
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
lea ecx, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
cmp eax, r11d
jb 0x140098c82
cmp eax, r8d
jae 0x140098e21
sub r9, r10
lea rdx, [r10 + rax*8]
sub r8d, eax
mov ecx, r8d
nop dword [rax + rax]
mov rax, qword [r9 + rdx]
xor qword [rdx], rax
lea rdx, [rdx + 8]
sub rcx, 1
jne 0x140098d00
pop rbx
ret
xor eax, eax
test r8d, r8d
je 0x140098e21
cmp r8d, 8
jb 0x140098e01
lea ecx, [r8 - 1]
lea r11, [rcx + r10]
add rcx, rdx
cmp r10, rcx
ja 0x140098d41
cmp r11, r9
jae 0x140098e01
cmp r8d, 0x40
jb 0x140098dd1
mov qword [rsp + 0x10], rdi
mov ebx, r8d
and ebx, 0x3f
mov edi, r8d
sub edi, ebx
mov r11d, 0x20
movdqu xmm0, xmmword [rax + r10]
lea ecx, [r11 - 0x10]
movdqu xmm1, xmmword [rax + rdx]
xorps xmm1, xmm0
movdqu xmmword [rax + r10], xmm1
add eax, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
mov ecx, r11d
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
lea ecx, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
cmp eax, edi
jb 0x140098d61
mov rdi, qword [rsp + 0x10]
cmp ebx, 8
jb 0x140098dfc
mov edx, r8d
and edx, 0xfffffff8
nop word [rax + rax]
movq xmm0, qword [rax + r10]
movq xmm1, qword [rax + r9]
xorps xmm1, xmm0
movq qword [rax + r10], xmm1
add eax, 8
cmp eax, edx
jb 0x140098de0
cmp eax, r8d
jae 0x140098e21
mov edx, eax
sub r9, r10
add rdx, r10
sub r8d, eax
mov ecx, r8d
nop
movzx eax, byte [rdx + r9]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x140098e10
pop rbx
ret