joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4dd3e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4ddde2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc502108]
test eax, eax
je 0x2fc4dde7a
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc502110]
mov qword [rbp - 8], rax
jmp 0x2fc4dde5e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dde52
cmp qword [rbp - 0x10], 0
je 0x2fc4dde52
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dde18
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dde7b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4ddf80
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4ddfa8
mov eax, 0
jmp 0x2fc4ddff6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4ddfd1
mov eax, 0
jmp 0x2fc4ddff6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4ddff1
mov eax, 0
jmp 0x2fc4ddff6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ddffc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4de07a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4de071
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4de071
mov rax, qword [rbp - 8]
jmp 0x2fc4de08f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4de044
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140028a5c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001bef8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001bef8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028bac
cmp rax, 0xffffffffffffffff
je 0x140028bac
xor edi, edi
test rbp, rbp
jle 0x140028b57
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001eb84
mov rbx, rax
test rax, rax
jne 0x140028ae4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028b4d
mov edx, 0x8000
mov ecx, r14d
call fcn.1400197a0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001cbe0
cmp eax, 0xffffffff
je 0x140028b2d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028af4
mov edx, r15d
mov ecx, r14d
call fcn.1400197a0
jmp 0x140028b4d
cmp byte [rsi + 0x38], dil
je 0x140028b44
cmp dword [rsi + 0x34], 5
jne 0x140028b44
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028b4d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a0e4
jmp 0x140028bc0
jns 0x140028bc0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001bef8
cmp rax, 0xffffffffffffffff
jne 0x140028b78
cmp byte [rsi + 0x30], dil
je 0x140028bc0
mov edi, dword [rsi + 0x2c]
jmp 0x140028bc0
mov ecx, r14d
call fcn.1400182d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028bc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028bc0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028bb9
mov eax, dword [rsi + 0x2c]
jmp 0x140028bbe
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001bef8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029cb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029cd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029cd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140061404
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140159460]
test rax, rax
je 0x14006144e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006144e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006144e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006144e
cmp dword [rcx + 0x84], 0xe
jbe 0x14006144e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140061450
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4d68a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d72a2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fb108]
test eax, eax
je 0x2fc4d733a
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fb110]
mov qword [rbp - 8], rax
jmp 0x2fc4d731e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d7312
cmp qword [rbp - 0x10], 0
je 0x2fc4d7312
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d72d8
lea rax, [0x2fc4fb0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d733b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d7440
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7468
mov eax, 0
jmp 0x2fc4d74b6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d7491
mov eax, 0
jmp 0x2fc4d74b6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d74b1
mov eax, 0
jmp 0x2fc4d74b6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d74bc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d753a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d7531
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d7531
mov rax, qword [rbp - 8]
jmp 0x2fc4d754f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d7504
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140faf3d4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140faf3de
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140faf407
pop rbp
sub rbp, 0x33
sub rbp, 0xfaf3d4
sub rsp, 0x20
jmp 0x140faf426
mov rax, 0xfaf3d4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x2647fbc
xor byte [rax], dl
inc rax
dec rcx
jne 0x140faf445
jmp 0x140faf45c
hlt
Function at 0x1400019a0
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, byte [rcx]
test al, al
jne 0x1400019aa
mov eax, edx
ret
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
jmp fcn.1400019a0

Function at 0x1400019c0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rdx
movsx rdx, byte [rcx]
test dl, dl
je 0x1400019e4
xor rdx, rax
movabs rax, 0x100000001b3
imul rdx, rax
inc rcx
jmp fcn.1400019c0
ret

Function at 0x1400045ba
Capabilities:
Hash data with crc32

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x38]
call fcn.140af50a2
adc cl, byte [rax - 0x73]
or eax, 0x175c47
jmp 0x140c34648

Function at 0x14000f3e0
Capabilities:
Hash data with crc32

Disassembly:
mov r10, rcx
lea r9, [0x1401b3108]
mov rax, r9
mov rcx, r9
shr rax, 8
shr rcx, 8
movzx edx, al
and ecx, 0x700
add rdx, rcx
lea rax, [0x14017c400]
mov r8d, dword [rax + rdx*4]
movabs rax, 0x2a1cf4171e8f5d2a
sub r9, rax
mov ecx, r8d
xor r9, r8
mov rax, r10
bswap r9
bswap rcx
mov qword [r10], r9
mov qword [r10 + 8], rcx
ret

Function at 0x14000f440
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rcx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401bb1c4], eax
jle 0x14000f492
lea rcx, [0x1401bb1c4]
call fcn.1400de190
cmp dword [0x1401bb1c4], 0xffffffff
jne 0x14000f492
lea rcx, [0x1400e74a0]
call fcn.1400de618
lea rcx, [0x1401bb1c4]
call fcn.1400de124
lea r9, [0x1401b3120]
mov rax, r9
mov rcx, r9
shr rax, 8
shr rcx, 8
movzx edx, al
and ecx, 0x700
add rdx, rcx
lea rax, [0x14017c400]
mov r8d, dword [rax + rdx*4]
movabs rax, 0x3244bc627936fd1b
add r9, rax
mov ecx, r8d
xor r9, r8
mov rax, rbx
bswap r9
bswap rcx
mov qword [rbx], r9
mov qword [rbx + 8], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x1400311d0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0xd0
call fcn.1400de208
xor edx, edx
mov qword [rsp + 0x38], rax
mov r8d, 0xd0
mov rcx, rax
mov rbx, rax
call fcn.1400dff29
xor eax, eax
lea rcx, [rbx + 0x10]
mov qword [rbx + 8], rax
movabs rdx, 0x3fffffffffffffff
mov byte [rcx + 0x41], 1
lea rax, [rbx + 0x70]
mov qword [rcx + 0x58], rcx
mov qword [rcx + 0x48], rdx
mov qword [rcx + 0x50], 0x10
mov byte [rax + 0x41], 0
mov byte [rax + 0x41], 1
mov qword [rax + 0x58], rax
mov qword [rax + 0x48], rdx
mov qword [rax + 0x50], 0x10
mov rax, qword [rbx + 0xc8]
mov dword [rax], 0x67452301
mov dword [rax + 4], 0xefcdab89
mov dword [rax + 8], 0x98badcfe
mov dword [rax + 0xc], 0x10325476
mov dword [rax + 0x10], 0xc3d2e1f0
lea rax, vtable.CryptoPP::SHA1.0
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400315a0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1401bb223], 0
mov rbx, rdx
mov rdi, qword [rcx + 0xc8]
jne 0x1400315c2
call fcn.14002d2e0
cmp byte [0x1401bb226], 0
mov rdx, rbx
mov rcx, rdi
je 0x1400315e7
xor r9d, r9d
lea r8d, [r9 + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005c9d0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14005a300
Function at 0x1400447f0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1401b3080]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rsi, r8
mov r14, rdx
mov rbx, rcx
mov eax, dword [rcx + 8]
mov rcx, qword [rcx + 0x28]
bswap eax
test rcx, rcx
je 0x140044831
mov dword [rcx], eax
inc dword [rbx + 8]
mov rdi, qword [rbx + 0x20]
xor edx, edx
mov r8d, 0xd0
lea rcx, [rsp + 0x50]
call fcn.1400dff29
xor eax, eax
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [0x1401935f0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x5f], 1
lea rax, [rsp + 0x60]
mov qword [rbp - 0x48], rax
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp + 1], 1
lea rax, [rbp - 0x40]
mov qword [rbp + 0x18], rax
mov dword [rbp - 0x40], 0x67452301
mov dword [rbp - 0x3c], 0xefcdab89
mov dword [rbp - 0x38], 0x98badcfe
mov dword [rbp - 0x34], 0x10325476
mov dword [rbp - 0x30], 0xc3d2e1f0
lea rax, vtable.CryptoPP::SHA1.0
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 1
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x20], rdi
mov r9, qword [rbx + 0x28]
mov r8, rsi
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.1400525f0
nop
mov rcx, qword [rbp + 0x10]
cmp qword [rbp + 8], rcx
cmovb rcx, qword [rbp + 8]
lea rax, [rbp - 0x40]
mov rdi, qword [rbp + 0x18]
cmp rdi, rax
jne 0x1400448f0
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, qword [rbp - 0x50]
cmp qword [rbp - 0x58], rcx
cmovb rcx, qword [rbp - 0x58]
lea rax, [rsp + 0x60]
mov rdi, qword [rbp - 0x48]
cmp rdi, rax
jne 0x14004490f
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400de0c0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14004b220
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
test r8, r8
je 0x14004b382
cmp r8, 4
jb 0x14004b262
mov r9, r8
shr r9, 2
imul rax, r9, 0xfffffffffffffffc
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rdx]
add rdx, 4
xor dword [rcx], eax
add rcx, 4
sub r9, 1
jne 0x14004b250
xor r10d, r10d
test r8, r8
je 0x14004b382
cmp r8, 8
jb 0x14004b364
lea r9, [rcx - 1]
lea rax, [rdx - 1]
add r9, r8
add rax, r8
cmp rcx, rax
ja 0x14004b294
cmp r9, rdx
jae 0x14004b364
cmp r8, 0x40
jb 0x14004b326
mov r11, r8
mov qword [rsp], rbx
and r11d, 0x3f
mov rbx, r8
sub rbx, r11
mov r9, rdx
lea rax, [rcx + 0x10]
sub r9, rcx
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp r10, rbx
jb 0x14004b2c0
mov rbx, qword [rsp]
cmp r11, 8
jb 0x14004b35f
mov r9, r8
and r9, 0xfffffffffffffff8
mov r11, rdx
lea rax, [r10 + rcx]
sub r11, rcx
nop word [rax + rax]
movq xmm0, qword [rax]
add r10, 8
movq xmm1, qword [rax + r11]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax - 8], xmm1
cmp r10, r9
jb 0x14004b340
cmp r10, r8
jae 0x14004b382
sub rdx, rcx
lea r9, [r10 + rcx]
sub r8, r10
nop
movzx eax, byte [r9 + rdx]
xor byte [r9], al
lea r9, [r9 + 1]
sub r8, 1
jne 0x14004b370
add rsp, 8
ret
Function at 0x14004b390
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x14004b534
cmp r9, 4
jb 0x14004b3da
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14004b3c0
xor r11d, r11d
test r9, r9
je 0x14004b534
cmp r9, 8
jb 0x14004b50d
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14004b40c
cmp rdx, r8
jae 0x14004b50d
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14004b421
cmp rdx, r10
jae 0x14004b50d
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x14004b4c7
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x14004b460
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x14004b4ff
mov rdx, r9
and rdx, 0xfffffffffffffff8
mov rbx, r10
lea rax, [r11 + r8]
sub rbx, r8
mov rdi, rcx
sub rdi, r8
nop
movq xmm1, qword [rax + rbx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rdx
jb 0x14004b4e0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x14004b534
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14004b520
add rsp, 8
ret
Function at 0x14004b540
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x14004b577
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x14004b560
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x14004b668
sub rcx, r10
cmp r9, 8
jb 0x14004b649
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp r11, rax
jb 0x14004b5d0
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x14004b668
add r10, r11
sub r9, r11
nop
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x14004b650
test r8d, r8d
sete al
ret
Function at 0x140053cf0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x1401b3080]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rbx, r8
mov rdi, rdx
mov r15, rcx
xor edx, edx
mov r8d, 0xd8
lea rcx, [rsp + 0x20]
call fcn.1400dff29
xor eax, eax
mov qword [rsp + 0x28], rax
movdqa xmm0, xmmword [0x1401935f0]
movdqu xmmword [rbp - 0x51], xmm0
mov byte [rbp - 0x58], 1
lea rax, [rsp + 0x30]
mov qword [rbp - 0x41], rax
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 0x10], 1
lea rax, [rbp - 0x39]
mov esi, eax
and eax, 0xf
lea rcx, [rbp - 0x39]
add rcx, rax
mov qword [rbp + 0x27], rcx
movups xmm0, xmmword [0x140191a90]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140191aa0]
movups xmmword [rcx + 0x10], xmm1
lea rax, vtable.CryptoPP::SHA256.0
mov qword [rsp + 0x20], rax
mov r14d, 0x20
mov r8d, r14d
mov rdx, qword [r15 + 0x80]
lea rcx, [rsp + 0x20]
call fcn.14004ac00
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14004ac00
mov rbx, qword [r15 + 0x80]
mov rax, qword [rsp + 0x20]
mov rdi, qword [rax + 0x78]
mov rdx, qword [rax + 0x40]
lea rax, [method.CryptoPP::BlockCipherFinal_0__class_CryptoPP::Rijndael::Enc_.virtual_16]
cmp rdx, rax
je 0x140053de4
lea rcx, [rsp + 0x20]
call rdx
mov r14d, eax
mov r8d, r14d
lea rax, [fcn.14004add0]
mov rdx, rbx
lea rcx, [rsp + 0x20]
cmp rdi, rax
jne 0x140053e02
call fcn.14004add0
jmp 0x140053e04
call rdi
mov byte [r15 + 0x90], 0
mov rcx, qword [rbp + 0x1f]
cmp qword [rbp + 0x17], rcx
cmovb rcx, qword [rbp + 0x17]
and esi, 0xf
lea rax, [rbp - 0x39]
add rax, rsi
mov rdi, qword [rbp + 0x27]
cmp rdi, rax
jne 0x140053e30
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, qword [rbp - 0x49]
cmp qword [rbp - 0x51], rcx
cmovb rcx, qword [rbp - 0x51]
lea rax, [rsp + 0x30]
mov rdi, qword [rbp - 0x41]
cmp rdi, rax
jne 0x140053e4f
xor eax, eax
rep stosd dword [rdi], eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400de0c0
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400554d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm0, xmmword [rcx]
lea r11d, [r8 - 1]
xorps xmm0, xmmword [rdx]
mov r9d, 1
movdqu xmmword [rcx], xmm0
mov r10, rcx
cmp r11d, r9d
jbe 0x14005551c
nop dword [rax]
mov eax, r9d
lea ecx, [r9 + 1]
add rax, rax
add rcx, rcx
add r9d, 2
aesenc xmm0, xmmword [rdx + rax*8]
movdqu xmmword [r10], xmm0
aesenc xmm0, xmmword [rdx + rcx*8]
movdqu xmmword [r10], xmm0
cmp r9d, r11d
jb 0x1400554f0
mov eax, r11d
add rax, rax
aesenc xmm0, xmmword [rdx + rax*8]
movdqu xmmword [r10], xmm0
mov eax, r8d
add rax, rax
aesenclast xmm0, xmmword [rdx + rax*8]
movdqu xmmword [r10], xmm0
ret

Function at 0x140055540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rbx, qword [rsp + 0x28]
mov r10, rcx
mov edi, dword [rsp + 0x30]
movdqu xmm2, xmmword [rbx]
movdqa xmm0, xmm2
movdqa xmm1, xmm2
xorps xmm0, xmmword [rcx]
movdqu xmmword [rcx], xmm0
movdqa xmm0, xmm2
xorps xmm1, xmmword [rdx]
movdqu xmmword [rdx], xmm1
xorps xmm0, xmmword [r8]
movdqu xmmword [r8], xmm0
xorps xmm2, xmmword [r9]
movdqu xmmword [r9], xmm2
cmp edi, 1
jbe 0x1400555db
lea rcx, [rbx + 0x10]
lea r11d, [rdi - 1]
movdqu xmm2, xmmword [rcx]
lea rcx, [rcx + 0x10]
movdqu xmm0, xmmword [r10]
aesenc xmm0, xmm2
movdqu xmmword [r10], xmm0
movdqu xmm1, xmmword [rdx]
aesenc xmm1, xmm2
movdqu xmmword [rdx], xmm1
movdqu xmm0, xmmword [r8]
aesenc xmm0, xmm2
movdqu xmmword [r8], xmm0
movdqu xmm1, xmmword [r9]
aesenc xmm1, xmm2
movdqu xmmword [r9], xmm1
sub r11, 1
jne 0x140055593
movdqu xmm0, xmmword [r10]
mov rax, rdi
mov rdi, qword [rsp + 0x10]
add rax, rax
movdqu xmm2, xmmword [rbx + rax*8]
mov rbx, qword [rsp + 8]
aesenclast xmm0, xmm2
movdqu xmmword [r10], xmm0
movdqu xmm1, xmmword [rdx]
aesenclast xmm1, xmm2
movdqu xmmword [rdx], xmm1
movdqu xmm0, xmmword [r8]
aesenclast xmm0, xmm2
movdqu xmmword [r8], xmm0
movdqu xmm1, xmmword [r9]
aesenclast xmm1, xmm2
movdqu xmmword [r9], xmm1
ret