joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401357a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rdi, rcx
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
sub rcx, rdx
sar rcx, 3
mov r9d, 0x3e8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x140135953
sub eax, 1
je 0x140135885
cmp eax, 0x101
je 0x140135976
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x30]
call fcn.1401a8d80
call fcn.140138af0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0x40]
call fcn.14000f010
nop
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rsp + 0x38], eax
setl byte [rbp + 0x38]
jl 0x14013587b
lea rdx, str.WaitForMultipleObjects___failed:
lea rcx, [rsp + 0x30]
call fcn.14004a1f0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400122b0
mov byte [rbp + 0x38], 1
lea rcx, [rsp + 0x30]
call fcn.14000afe0
mov rcx, qword [rdi]
mov edx, 1
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140135953
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x30]
call fcn.1401a8d80
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x13c8
mov eax, dword [rcx + rbx]
mov edi, 0x13c0
test al, 1
jne 0x1401358e2
or eax, 1
mov dword [rcx + rbx], eax
xor eax, eax
mov qword [rbx + rdi], rax
call fcn.140138a70
mov qword [rbx + rdi], rax
mov rax, qword [rbx + rdi]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 2
lea rcx, [rsp + 0x40]
call fcn.14000f010
nop
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400d90b6.0]
cmp dword [rsp + 0x38], eax
setl byte [rbp + 0x38]
jl 0x140135949
lea rdx, str.TerminateProcess:
lea rcx, [rsp + 0x30]
call fcn.140032540
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400122b0
mov byte [rbp + 0x38], 1
lea rcx, [rsp + 0x30]
call fcn.14000afe0
mov al, 1
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.140185380
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
xor al, al
jmp 0x140135955
Function at 0x1401388e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r15, rcx
mov qword [rsp + 0x40], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
lea edi, [rbp + 0x14]
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov esi, 0x13b8
mov eax, dword [rsi + r14]
mov r13d, 0x20
mov r12d, 0xffffffff
test al, 1
jne 0x14013898c
or eax, 1
mov dword [rsi + r14], eax
mov ebx, r13d
add rbx, r14
call fcn.140188c30
mov edx, eax
mov dword [rbx + 0x1384], r12d
mov dword [rbx + 4], eax
lea ecx, [rbp + 1]
lea r8, [rbx + 8]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140138960
mov dword [rbx], 0x270
mov eax, dword [rsi + r14]
mov ebx, 0x13a8
test al, 2
jne 0x1401389a9
or eax, 2
mov dword [rsi + r14], eax
mov qword [r14 + rbx], rbp
mov qword [r14 + rbx + 8], 0x3d
mov qword [r15], rbp
mov qword [r15 + 0x10], rbp
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov dword [rsp + 0x20], 1
mov rdx, rdi
mov rcx, r15
call fcn.14000fdc0
lea rsi, [r14 + rbx]
mov ebp, r13d
add rbp, r14
lea r14, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
dec rdi
mov rdx, qword [rsi + 8]
mov rbx, qword [rsi]
mov qword [rsp + 0x28], rbp
mov ecx, 0x40
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
dec rcx
shr rax, 1
cmp rax, r12
ja 0x140138a00
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
sub rdx, rbx
lea rcx, [rsp + 0x28]
cmp rdx, 0xffffffffffffffff
jne 0x140138a2a
call fcn.140060e40
jmp 0x140138a32
inc rdx
call fcn.140061050
lea rcx, [rax + rbx]
movzx edx, byte [rcx + r14]
mov rcx, r15
call fcn.140010d30
test rdi, rdi
jne 0x1401389e0
mov rax, r15
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14013a290
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x14013a3f2
cmp byte [rdx + 4], 0
je 0x14013a2ce
mov eax, dword [rcx]
cmp dword [rdx], eax
jl 0x14013a3f2
mov r9, r8
mov r8, rdx
lea rdx, str._H:_M:_S
lea rcx, [rbp + 0xf]
call fcn.140139d40
nop
mov dword [rbp + 7], 0
cmp byte [rbx + 0x10], 0
je 0x14013a391
lea rax, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rax, qword [rbp + 0xf]
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x1f]
mov qword [rbp - 1], rax
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbp + 0x2f]
call fcn.140157910
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x3f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x14013a3bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013a38a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013a415
call fcn.1401853a0
jmp 0x14013a3bb
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
mov qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 0x1f]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14013a3f2
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013a3ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013a40f
call fcn.1401853a0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140185380
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rbp
ret
call fcn.1401b3c00
nop
call fcn.1401b3c00
nop
int3
Function at 0x14013ae60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, r9
mov rsi, rdx
mov rbx, rcx
mov rbp, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xe8]
mov r12, qword [rsp + 0xf0]
mov rdi, qword [r8]
test rdi, rdi
je 0x14013af68
cmp qword [rdi + 8], 0xffffffffffffffff
je 0x14013af68
cmp byte [rcx + 4], 0
je 0x14013aec9
mov eax, dword [rdi]
cmp dword [rcx], eax
jl 0x14013af68
mov r9, rsi
mov r8, rbx
lea rdx, str._FT_T
lea rcx, [rsp + 0x38]
call fcn.140139d40
nop
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], 0xffffffffffffffff
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x48]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14013af68
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14013af63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14013afb0
call fcn.1401853a0
mov rcx, qword [r14]
test rcx, rcx
je 0x14013af7b
mov r8, rsi
mov rdx, rbx
call fcn.14013a000
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.14013afc0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140185380
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1401b3c00
int3
Function at 0x140147980
Capabilities:
Hash data using murmur3

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
cmp dword [rcx], 0
jne 0x140147b13
mov r8, qword [rcx + 0x10]
sub r8, qword [rcx + 8]
sar r8, 4
cmp r8, 2
jle 0x140147b13
mov qword [rax - 0x28], rdx
movups xmm0, xmmword [rdx]
movups xmmword [rax - 0x20], xmm0
movsd xmm1, qword [rdx + 0x10]
movsd qword [rax - 0x10], xmm1
mov ebx, 1
mov rcx, r8
shr rcx, 1
add rcx, r8
cmp rbx, rcx
jae 0x1401479ee
add rbx, rbx
cmp rbx, rcx
jb 0x1401479e6
lea rbp, [rbx*8]
mov rdx, rbp
mov rcx, r14
call fcn.1401466d0
mov rdi, rax
test rax, rax
jne 0x140147a37
mov rcx, qword [r14]
mov rdi, qword [rsp + 0x28]
cmp rcx, rdi
je 0x140147a26
mov rbx, qword [rcx]
call fcn.1401b3750
mov rcx, rbx
cmp rbx, rdi
jne 0x140147a16
mov qword [r14], rdi
mov rax, qword [rsp + 0x30]
mov qword [r14 + 8], rax
jmp 0x140147b9d
mov r8, rbp
xor edx, edx
mov rcx, rdi
call fcn.1401a8d80
mov rbp, qword [rsi + 8]
mov r11, rbp
cmp rbp, qword [rsi + 0x10]
je 0x140147ae1
mov rax, qword [r11 + 8]
test rax, rax
je 0x140147a63
xor r8d, r8d
jmp 0x140147a66
mov r8, qword [r11]
test rax, rax
cmovne r8, rax
test r8, r8
je 0x140147ad3
mov eax, r8d
shr eax, 0x10
xor eax, r8d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
lea r10, [rbx - 1]
and rax, r10
xor ecx, ecx
nop
lea r9, [rdi + rax*8]
mov rdx, qword [r9]
test rdx, rdx
je 0x140147ac4
cmp rdx, r8
je 0x140147ad3
inc rax
add rax, rcx
and rax, r10
inc rcx
cmp rcx, r10
jbe 0x140147aa0
jmp 0x140147ad3
mov qword [r9], r8
movups xmm0, xmmword [r11]
movups xmmword [rbp], xmm0
add rbp, 0x10
add r11, 0x10
cmp r11, qword [rsi + 0x10]
jne 0x140147a55
mov qword [rsi + 0x10], rbp
mov rcx, qword [r14]
mov rdi, qword [rsp + 0x28]
cmp rcx, rdi
je 0x140147b02
mov rbx, qword [rcx]
call fcn.1401b3750
mov rcx, rbx
cmp rbx, rdi
jne 0x140147af2
mov qword [r14], rdi
mov rax, qword [rsp + 0x30]
mov qword [r14 + 8], rax
jmp 0x140147b9d
mov r11, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov rdx, r11
sub rdx, rcx
mov rax, rdx
and rax, 0xfffffffffffffff0
cmp rax, 0x10
jle 0x140147b5c
mov r10, qword [rcx]
mov r9, qword [rcx + 0x10]
cmp r10, r9
jne 0x140147b44
mov rax, qword [rcx + 0x18]
cmp qword [rcx + 8], rax
je 0x140147b5c
add rcx, 0x10
sub rdx, 0x10
mov r10, r9
mov rax, rdx
and rax, 0xfffffffffffffff0
cmp rax, 0x10
jg 0x140147b31
cmp rcx, r11
je 0x140147b99
mov rdx, rcx
add rcx, 0x10
cmp rcx, r11
je 0x140147b95
nop dword [rax]
mov rax, qword [rdx]
cmp qword [rcx], rax
jne 0x140147b82
mov rax, qword [rdx + 8]
cmp qword [rcx + 8], rax
je 0x140147b8c
movups xmm0, xmmword [rcx]
add rdx, 0x10
movups xmmword [rdx], xmm0
add rcx, 0x10
cmp rcx, r11
jne 0x140147b70
lea rcx, [rdx + 0x10]
mov qword [rsi + 0x10], rcx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14014de50
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [rdx]
xor r8d, r8d
mov r11, rdx
mov r10, rcx
mov r9, rdx
test al, al
je 0x14014de85
movsx eax, al
lea r9, [r9 + 1]
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
movzx eax, byte [r9]
test al, al
jne 0x14014de63
lea eax, [r8 + r8*8]
mov ecx, eax
shr rax, 0xb
xor rax, rcx
and eax, 0x3f
mov r8, qword [r10 + rax*8]
test r8, r8
je 0x14014def1
nop
mov ecx, dword [r8]
sub ecx, 1
je 0x14014dec7
sub ecx, 1
je 0x14014dec1
sub ecx, 1
je 0x14014dec1
cmp ecx, 1
je 0x14014debb
xor eax, eax
jmp 0x14014decb
lea rax, [r8 + 0x11]
jmp 0x14014decb
lea rax, [r8 + 0x18]
jmp 0x14014decb
lea rax, [r8 + 0x38]
mov r9, r11
sub r9, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x14014dee4
inc rax
test ecx, ecx
jne 0x14014ded1
test edx, edx
je 0x14014def4
mov r8, qword [r8 + 8]
test r8, r8
jne 0x14014dea0
xor eax, eax
ret
mov rax, r8
ret
Function at 0x140156430
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x140293028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov qword [r11 - 0x38], rdi
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x20], 7
mov word [r11 - 0x38], di
lfence
mov word [rsp + 0x20], di
mov r9d, 0x104
movzx r8d, byte [rsp + 0x30]
mov edx, r9d
lea rcx, [r11 - 0x38]
call fcn.140012e90
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rcx, qword [rsp + 0x80]
mov edx, dword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1401565a0
mov ecx, eax
cmp rcx, qword [rsp + 0x90]
ja 0x1401565a0
lea rax, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rax, qword [rsp + 0x80]
mov qword [rsp + 0x90], rcx
mov word [rax + rcx*2], di
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rdx, qword [rsp + 0x80]
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov r8, qword [rsp + 0x90]
mov rcx, rbx
call fcn.14000b550
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 8
jb 0x140156576
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140156571
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14015659a
call fcn.1401853a0
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140185380
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
call fcn.1401b3c00
nop
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.14002dcf0
nop
mov r8, rax
lea rdx, str.GetSystemDirectoryW_failed:_returned_size
lea rcx, [rsp + 0x60]
call fcn.140011b70
nop
mov rcx, rax
call fcn.140030650
int3
Function at 0x14015db80
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov r9d, dword [rcx + 0x10060]
mov rsi, rdx
mov rdi, rcx
test r8d, r8d
je 0x14015dc94
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x50], r14
xor r14d, r14d
mov qword [rsp + 0x70], rbx
mov ebp, r8d
cmp r9d, 0x10
jne 0x14015dc58
mov ecx, r14d
lea rax, [rdi + 0x10080]
add byte [rax], 1
jne 0x14015dbd5
inc ecx
inc rax
cmp ecx, 8
jb 0x14015dbc6
movups xmm0, xmmword [rdi + 0x10080]
mov rbx, qword [rdi + 0x10058]
lea rdx, [rdi + 0x10064]
mov dword [rsp + 0x80], r14d
movups xmmword [rdx], xmm0
test rbx, rbx
je 0x14015dc55
test rdx, rdx
je 0x14015dc55
cmp dword [rbx + 0x18], 2
jne 0x14015dc0b
cmp qword [rbx + 0x60], r14
je 0x14015dc55
mov r9, qword [rbx + 0x60]
lea rax, [rsp + 0x80]
mov rcx, qword [rbx + 8]
mov r8d, 0x10
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x40], rax
mov eax, dword [rbx + 0x28]
mov dword [rsp + 0x38], 0x10
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
test eax, eax
jns 0x14015dc55
mov dword [rbx + 0x1c], eax
mov r9d, r14d
mov eax, r9d
inc r9d
movzx ecx, byte [rax + rdi + 0x10064]
xor byte [rsi], cl
inc rsi
sub rbp, 1
jne 0x14015dbb2
mov r14, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov dword [rdi + 0x10060], r9d
add rsp, 0x58
pop rdi
pop rsi
ret
mov dword [rcx + 0x10060], r9d
xor eax, eax
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x14015edd0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov ebp, edx
mov rsi, rcx
xor ebx, ebx
lea rdx, [0x14024f830]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
js 0x14015ee3d
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov edi, eax
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
test edi, edi
js 0x14015ee3d
lfence
mov eax, ebp
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
test ebp, ebp
jle 0x14015ee63
mov edi, ebx
and edi, 7
jne 0x14015ee53
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movzx ecx, byte [rsp + rdi + 0x58]
inc ebx
mov byte [rsi], cl
inc rsi
cmp ebx, ebp
jl 0x14015ee41
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14015f780
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x60]
movzx r8d, byte [rcx + 0x5c]
test eax, eax
jle 0x14015f7bc
mov edx, dword [rcx + 0x288]
lea r11, [0x140250730]
mov r9d, eax
nop dword [rax]
mov eax, edx
shr rax, 0x18
xor rax, r8
shl edx, 8
xor edx, dword [r11 + rax*4]
sub r9, 1
jne 0x14015f7a0
mov dword [rcx + 0x288], edx
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r9, dword [rcx + 0x60]
mov edx, r9d
sub edx, 1
je 0x14015f894
sub edx, 1
je 0x14015f886
cmp edx, 1
je 0x14015f850
mov byte [r9 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
jmp 0x14015f86f
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
inc dword [rcx + 0x6c]
ret
Function at 0x14016b940
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x160]
mov r9, rdx
mov rbx, rcx
test rax, rax
jne 0x14016b99d
test rdx, rdx
je 0x14016b97c
mov rax, qword [rdx]
test rax, rax
je 0x14016b97c
mov rcx, qword [r9 + 0x10]
mov edx, 1
mov r8d, 0x140
call qword [case.0x1400d90b6.0]
jmp 0x14016b986
mov ecx, 0x140
call fcn.1401b57f8
test rax, rax
jne 0x14016b99d
xor ecx, ecx
mov qword [rbx + 0x160], rcx
lea eax, [rcx + 5]
add rsp, 0x20
pop rbx
ret
xor ecx, ecx
mov dword [rax], ecx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x90], rcx
mov qword [rax + 0x98], rcx
mov qword [rax + 0xa0], rcx
mov qword [rax + 0xa8], rcx
mov qword [rax + 0x120], rcx
mov qword [rax + 0x128], rcx
mov qword [rax + 0x130], rcx
mov dword [rax + 0x138], ecx
movups xmm0, xmmword [0x1402530c0]
movups xmmword [rax + 0x68], xmm0
movups xmm1, xmmword [0x1402530d0]
mov qword [rax + 0x88], rcx
movups xmmword [rax + 0x78], xmm1
movups xmm0, xmmword [0x1402530c0]
movups xmmword [rax + 0xf0], xmm0
movups xmm1, xmmword [0x1402530d0]
mov qword [rax + 0x110], rcx
movups xmmword [rax + 0x100], xmm1
mov qword [rbx + 0x160], rax
xor eax, eax
mov dword [rbx], ecx
mov qword [rbx + 0x180], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x1401715c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
mov esi, dword [rcx + 0x4804]
lea r9, [0x140252f40]
mov ebp, edx
mov r11, rcx
mov dword [rcx + rbp*4 + 0x4808], esi
lea r12, [r11 + 0x404]
movzx edx, word [rcx]
movzx ecx, word [rcx + 2]
mov eax, edx
shr rax, 4
xor rdx, 0x7f0
shr rdx, 4
movzx r14d, byte [rax + r9]
mov eax, ecx
movzx r8d, byte [rdx + r9]
xor rcx, 0x7f0
shr rax, 4
shr rcx, 4
mov dword [rsp + 0x38], r14d
movzx r15d, byte [rax + r9]
movzx r13d, byte [rcx + r9]
add r15d, r8d
imul rax, rbp, 0x440
add r13d, r8d
xor r9d, r9d
add r12, rax
test esi, esi
je 0x1401717a9
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rdi
mov rdi, r12
cmp r9d, 8
jae 0x1401716cf
xor r10d, r10d
lea r8d, [r9 + 8]
lea rbx, [rbp*8]
lea r14, [0x140252f40]
nop dword [rax]
nop dword [rax + rax]
mov ecx, r8d
shr r8d, 1
and ecx, 1
mov eax, r8d
add rax, rbx
movzx edx, word [r11 + rax*2 + 4]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + r14]
add r10d, eax
cmp r8d, 1
jne 0x140171680
mov eax, dword [rsp + 0x38]
inc r9d
add eax, r10d
mov dword [rdi], eax
add rdi, 4
cmp r9d, esi
jb 0x140171658
jmp 0x14017179f
cmp r9d, esi
jae 0x14017179f
lea rdi, [r12 + r9*4]
lea r14, [0x140252f40]
cmp r9d, 0x10
jae 0x14017174c
xor r10d, r10d
lea rbx, [rbp*8]
mov r8d, r9d
nop word [rax + rax]
mov ecx, r8d
shr r8d, 1
and ecx, 1
mov eax, r8d
add rax, rbx
movzx edx, word [r11 + rax*2 + 0x104]
mov eax, ecx
neg eax
shr rdx, 4
shr rax, 4
and eax, 0x7f
xor rdx, rax
movzx eax, byte [rdx + r14]
add r10d, eax
cmp r8d, 1
jne 0x140171700
lea eax, [r10 + r15]
inc r9d
mov dword [rdi], eax
add rdi, 4
cmp r9d, esi
jb 0x1401716e3
jmp 0x14017179f
lea rbx, [r12 + r9*4]
xor r10d, r10d
lea eax, [r9 + 0xf0]
nop word [rax + rax]
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
shr rcx, 4
movzx r8d, word [r11 + rax*2 + 0x204]
and ecx, 0x7f
shr r8, 4
xor r8, rcx
movzx ecx, byte [r8 + r14]
add r10d, ecx
cmp eax, 1
jne 0x140171760
lea eax, [r10 + r13]
inc r9d
mov dword [rbx], eax
add rbx, 4
cmp r9d, esi
jb 0x140171750
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rsi
ret