joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005b86c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov rbx, rdx
test r8, r8
jne 0x14005b89f
mov al, 1
jmp 0x14005b917
cmp qword [rdx + 0x18], 0x10
jb 0x14005b8ab
mov rdi, qword [rdx]
jmp 0x14005b8ae
mov rdi, rdx
lea rcx, [0x1401584f4]
mov edx, 0x81050216
mov r8d, 5
call fcn.140002108
lea rcx, [rsp + 0x20]
mov r9, rsi
mov rdx, rax
mov r8, rdi
call fcn.1400e9240
lea rcx, [rsp + 0x20]
mov esi, 0x2f
add rcx, qword [rbx + 0x10]
jmp 0x14005b8fe
mov bl, byte [rdi + 1]
xor edx, edx
mov byte [rdi + 1], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [rdi + 1], bl
lea rcx, [rdi + 1]
mov edx, esi
call fcn.1400e975c
lea rcx, [rsp + 0x20]
mov rdi, rax
test rax, rax
jne 0x14005b8e8
call fcn.14001fc1c
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400e7da0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14005f110
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r12, qword [rsp + 0x1d0]
lea rbx, [rcx + 0x10]
xor edi, edi
cmp qword [rbx + 0x18], 0x10
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rbp, rcx
jb 0x14005f158
mov rbx, qword [rbx]
lea rcx, [0x1401584d8]
mov edx, 0x4a545c39
mov r8d, 7
call fcn.140002108
lea rcx, [rsp + 0x50]
mov r9, rsi
mov r8, rbx
mov rdx, rax
mov qword [rsp + 0x20], r14
call fcn.1400e9240
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14005f1c3
xor al, al
jmp 0x14005f259
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14005f1ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14005f1ed
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005f1bc
cmp dword [rsp + 0x44], edi
jne 0x14005f24d
cmp esi, dword [rbp + 0x58]
ja 0x14005f1fe
mov rbx, qword [rbp + 0x60]
jmp 0x14005f220
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x60]
mov r9, rsi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [rbp + 0x58], esi
mov rbx, rax
mov qword [rbp + 0x60], rax
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005f24d
cmp dword [rsp + 0x40], esi
jne 0x14005f24d
mov dword [r12], esi
mov dil, 1
mov qword [r15], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, dil
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400e7da0
add rsp, 0x170
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005f984
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x40], rax
cmp qword [rcx + 0x30], 0
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
je 0x14005fa09
lea rcx, [rsp + 0x40]
sub rcx, rdx
mov al, byte [rbx]
mov byte [rcx + rbx], al
inc rbx
test al, al
jne 0x14005f9c0
lea rcx, [rsp + 0x40]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x14005f9d4
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x14005f9de
mov r9d, dword [rbp + 0xa0]
mov rcx, qword [rsi + 0x30]
lea rdx, [rsp + 0x40]
mov r8, rdi
call fcn.14002e578
jmp 0x14005faa7
lea rdx, [rcx + 0x38]
mov r8, rbx
call fcn.14005b86c
lea rdx, [rsp + 0x20]
mov r9, r14
mov r8, rbx
mov rcx, rsi
call fcn.14005bfd4
lea rcx, [0x1401584fc]
mov edx, 0x9781b2d8
mov r8d, 3
call fcn.140002108
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
mov rdx, rax
call fcn.1400ea9ec
mov rbx, rax
test rax, rax
jne 0x14005fa76
cmp qword [rsp + 0x38], 0x10
jb 0x14005fa72
mov rcx, qword [rsp + 0x20]
call fcn.1400e84cc
xor al, al
jmp 0x14005faa9
mov r8d, dword [rbp + 0xa0]
mov r9, rax
mov edx, 1
mov rcx, rdi
call fcn.1400ebc94
mov rcx, rbx
call fcn.1400e9c4c
cmp qword [rsp + 0x38], 0x10
jb 0x14005faa7
mov rcx, qword [rsp + 0x20]
call fcn.1400e84cc
mov al, 1
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400e7da0
add rsp, 0x150
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400610f8
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r12d, r9d
mov r14, r8
mov rsi, rdx
and dword [rbp - 0x1c], 0
mov edx, 0x8b1636a4
mov ecx, 0x3e486afb
mov r8d, 0xdb830b8
call fcn.1400021b0
mov r13, rax
mov qword [rbp - 0x18], rax
mov qword [rsi + 0x18], InitCommonControls
and qword [rsi + 0x10], 0
mov byte [rsi], 0
mov dword [rbp - 0x1c], 1
xor edi, edi
test r12d, r12d
je 0x1400612be
xor ecx, ecx
lea ebx, [rdi + 3]
jmp 0x140061173
mov r14, qword [rbp + 0x50]
dec r12d
mov al, byte [r14]
mov byte [rbp + rcx + 0x58], al
inc edi
inc rcx
inc r14
mov qword [rbp + 0x50], r14
mov r13b, byte [rbp + 0x5a]
mov r14b, byte [rbp + 0x59]
mov r15b, byte [rbp + 0x58]
cmp rcx, rbx
jne 0x1400611fe
mov al, r15b
shr al, 2
mov byte [rbp - 0x20], al
mov cl, r15b
and cl, bl
shl cl, 4
mov al, r14b
shr al, 4
add cl, al
mov byte [rbp - 0x1f], cl
mov cl, r14b
and cl, 0xf
shl cl, 2
mov al, r13b
shr al, 6
add cl, al
mov byte [rbp - 0x1e], cl
mov al, r13b
and al, 0x3f
mov byte [rbp - 0x1d], al
xor edi, edi
mov rbx, qword [rbp - 0x18]
movzx eax, byte [rbp + rdi - 0x20]
mov r8b, byte [rax + rbx]
mov edx, 1
mov rcx, rsi
call fcn.140061ff0
inc rdi
cmp rdi, 4
jl 0x1400611d8
xor edi, edi
xor ecx, ecx
lea ebx, [rdi + 3]
test r12d, r12d
jne 0x14006116f
test edi, edi
je 0x1400612be
movsxd rax, edi
cmp rax, rbx
jge 0x14006123a
jae 0x140061234
mov byte [rbp + rax + 0x58], 0
inc rax
cmp rax, rbx
jl 0x140061217
mov r13b, byte [rbp + 0x5a]
mov r14b, byte [rbp + 0x59]
mov r15b, byte [rbp + 0x58]
jmp 0x14006123a
call fcn.1400e8c4c
int3
mov al, r15b
shr al, 2
mov byte [rbp - 0x20], al
and r15b, bl
shl r15b, 4
mov al, r14b
shr al, 4
add r15b, al
mov byte [rbp - 0x1f], r15b
and r14b, 0xf
shl r14b, 2
mov al, r13b
shr al, 6
add r14b, al
mov byte [rbp - 0x1e], r14b
and r13b, 0x3f
mov byte [rbp - 0x1d], r13b
lea eax, [rdi + 1]
test eax, eax
jle 0x1400612a3
lea r14, [rbp - 0x20]
mov r15d, eax
mov r13, qword [rbp - 0x18]
movzx eax, byte [r14]
mov r8b, byte [rax + r13]
mov edx, 1
mov rcx, rsi
call fcn.140061ff0
inc r14
dec r15
jne 0x140061286
cmp edi, ebx
jge 0x1400612be
sub ebx, edi
mov r8b, 0x3d
mov edx, 1
mov rcx, rsi
call fcn.140061ff0
dec rbx
jne 0x1400612a9
mov rax, rsi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007e99c
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [rcx]
mov r9, rcx
lea r10, [rcx + 0x18]
mov byte [rdx + 4], al
mov al, byte [rcx + 4]
mov r11d, 8
mov byte [rdx + 5], al
mov al, byte [rcx + 8]
mov byte [rdx + 6], al
mov r8b, byte [rcx + 0xc]
mov al, byte [rdx + 7]
and al, 0x3f
shl r8b, 6
or r8b, al
mov byte [rdx + 7], r8b
mov al, byte [rcx + 0x10]
xor al, r8b
and al, 0x3f
xor al, r8b
lea r8, [rdx + 0xc]
mov byte [rdx + 7], al
mov al, byte [rcx + 0x17]
mov byte [rdx + 8], al
mov al, byte [rcx + 0x16]
mov byte [rdx + 9], al
mov eax, dword [rcx + 0x14]
shr eax, 8
mov byte [rdx + 0xa], al
mov al, byte [rcx + 0x14]
mov byte [rdx + 0xb], al
mov cl, byte [r8]
mov al, byte [r10]
lea r10, [r10 + 8]
shl al, 7
and cl, 0x7f
or cl, al
mov byte [r8], cl
mov al, byte [r10 - 4]
xor al, cl
and al, 7
xor al, cl
mov byte [r8], al
lea r8, [r8 + 2]
dec r11
jne 0x14007e9fb
lea r8, [rdx + 0x1e]
lea r10, [r9 + 0x60]
mov r11d, 0x20
mov cl, byte [r10 - 8]
mov al, byte [r8 - 2]
and al, 0x7f
shl cl, 7
or cl, al
mov byte [r8 - 2], cl
mov al, byte [r10 - 4]
xor al, cl
and al, 0x1f
xor al, cl
mov byte [r8 - 2], al
mov al, byte [r10]
lea r10, [r10 + 0x14]
xor al, byte [r8 - 1]
and al, 0x1f
xor byte [r8 - 1], al
mov al, byte [r10 - 0x10]
xor al, byte [r8]
and al, 0x1f
xor byte [r8], al
mov al, byte [r10 - 0xc]
lea r8, [r8 + 4]
xor al, byte [r8 - 3]
and al, 0x1f
xor byte [r8 - 3], al
dec r11
jne 0x14007ea34
mov eax, dword [r9 + 0x2d8]
lea rcx, [r9 + 0x2e8]
add rdx, 0xa4
shr eax, 8
xor al, byte [rdx - 8]
and al, 0x7f
xor byte [rdx - 8], al
mov al, byte [r9 + 0x2d8]
mov byte [rdx - 7], al
mov eax, dword [r9 + 0x2dc]
shr eax, 8
xor al, byte [rdx - 6]
and al, 0x7f
xor byte [rdx - 6], al
mov al, byte [r9 + 0x2dc]
mov byte [rdx - 5], al
mov eax, dword [r9 + 0x2e0]
shr eax, 8
mov byte [rdx - 4], al
mov al, byte [r9 + 0x2e0]
mov byte [rdx - 3], al
mov al, byte [r9 + 0x2e4]
mov byte [rdx - 1], al
jmp 0x14007eb68
add rcx, 8
mov r8d, InitCommonControls
add rdx, 2
mov al, byte [rcx - 8]
mov byte [rdx - 1], al
mov al, byte [rcx - 4]
mov byte [rdx], al
mov al, byte [rcx]
lea rdx, [rdx + 4]
mov byte [rdx - 3], al
lea rcx, [rcx + 0xc]
dec r8
jne 0x14007eb76
ret
Function at 0x140084990
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov edi, dword [rcx]
mov esi, dword [rcx + 4]
mov r14, rdx
mov edx, pe_nt_image_headers64
mov rbx, rcx
jmp 0x1400849b9
xor edx, edx
call fcn.140084ab0
mov eax, dword [rbx]
mov rcx, rbx
and eax, 0x1ff
cmp eax, 0x1c0
jne 0x1400849b7
mov dword [rbx + 0x60], esi
mov dword [rbx + 0x64], edi
call fcn.140084af0
xor r8d, r8d
mov eax, r8d
inc r8d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sar ecx, 2
sub eax, edx
movsxd rdx, ecx
mov ecx, 3
sub ecx, eax
mov eax, dword [rbx + rdx*4 + 8]
shl ecx, 3
shr eax, cl
mov byte [r14], al
inc r14
cmp r8d, 0x14
jl 0x1400849dd
lea rcx, [rbx + 0x28]
xor edx, edx
mov r8d, 0x140
call fcn.1400ea570
and dword [rbx + 4], 0
and dword [rbx], 0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
mov dword [rbx + 0x18], 0xc3d2e1f0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret

Function at 0x140084a64
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov r8d, 0x140
add rcx, 0x28
call fcn.1400ea570
and dword [rbx + 4], 0
and dword [rbx], 0
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
mov dword [rbx + 0x18], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
Function at 0x140084af0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
lea r10, [rcx + 0x28]
mov rdx, rcx
mov r8d, 0x40
mov rcx, r10
mov eax, dword [rcx + 0x34]
xor eax, dword [rcx + 0x20]
xor eax, dword [rcx + 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
rol eax, 1
mov dword [rcx + 0x3c], eax
dec r8
jne 0x140084b1b
mov r15d, dword [rdx + 8]
mov r12d, dword [rdx + 0xc]
mov r13d, dword [rdx + 0x10]
mov r11d, dword [rdx + 0x14]
mov esi, dword [rdx + 0x18]
lea edi, [r8 + 0x14]
mov ebp, r15d
mov ebx, r12d
mov r9d, r13d
mov r14d, edi
mov eax, r11d
mov ecx, ebp
lea r8d, [rsi + 0x5a827999]
xor eax, r9d
rol ecx, 5
mov esi, r11d
and eax, ebx
xor eax, r11d
mov r11d, r9d
mov r9d, ebx
add ecx, eax
ror r9d, 2
mov ebx, ebp
add ecx, dword [r10]
lea r10, [r10 + 4]
add r8d, ecx
mov ebp, r8d
dec r14
jne 0x140084b57
lea rcx, [rdx + 0x78]
mov r10, rdi
rol r8d, 5
add esi, 0x6ed9eba1
mov eax, r11d
xor eax, r9d
xor eax, ebx
add r8d, eax
add r8d, dword [rcx]
lea rcx, [rcx + 4]
add r8d, esi
mov esi, r11d
mov r11d, r9d
mov r9d, ebx
mov ebx, ebp
mov ebp, r8d
ror r9d, 2
dec r10
jne 0x140084b98
lea r10, [rdx + 0xc8]
mov r14, rdi
rol r8d, 5
mov ecx, r9d
mov eax, r9d
or ecx, ebx
and eax, ebx
add r8d, 0x8f1bbcdc
add r8d, dword [r10]
and ecx, r11d
lea r10, [r10 + 4]
or ecx, eax
add ecx, esi
mov esi, r11d
mov r11d, r9d
mov r9d, ebx
add r8d, ecx
mov ebx, ebp
mov ebp, r8d
ror r9d, 2
dec r14
jne 0x140084bd8
lea rcx, [rdx + 0x118]
rol r8d, 5
add esi, 0xca62c1d6
mov eax, r11d
xor eax, r9d
add r8d, esi
mov esi, r11d
xor eax, ebx
mov r11d, r9d
mov r9d, ebx
add eax, dword [rcx]
mov ebx, ebp
ror r9d, 2
add r8d, eax
lea rcx, [rcx + 4]
mov ebp, r8d
dec rdi
jne 0x140084c1c
add dword [rdx + 0x14], r11d
add dword [rdx + 0x18], esi
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
lea eax, [r15 + r8]
mov dword [rdx + 8], eax
lea eax, [r12 + rbx]
mov rbx, qword [rsp + 0x28]
mov dword [rdx + 0xc], eax
lea eax, [r9 + r13]
mov dword [rdx + 0x10], eax
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x14008c9e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14008c9fd
xor eax, eax
jmp 0x14008ca6b
not r9d
lea rdi, [0x140115d40]
cmp r8d, 8
jb 0x14008ca41
mov r11d, r8d
shr r11, 3
mov ebx, 8
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec rbx
jne 0x14008ca19
add r8d, 0xfffffff8
dec r11
jne 0x14008ca14
test r8d, r8d
je 0x14008ca65
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r8d
jne 0x14008ca46
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14008fc2c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov edi, r8d
movaps xmmword [rax - 0x28], xmm6
mov r14, r9
sar edi, 4
mov rbx, rdx
mov rsi, rcx
test r8b, 0xf
je 0x14008fc67
mov eax, 1
jmp 0x14008fd7a
test dl, 3
jne 0x14008fcc4
test r14b, 3
jne 0x14008fcc4
test edi, edi
je 0x14008fd78
mov r15, r9
sub r15, rdx
mov r8, qword [rsp + 0x70]
movups xmm6, xmmword [rsi]
mov rdx, rbx
mov rcx, rsi
dec edi
call fcn.140003100
test eax, eax
jne 0x14008fc5d
lea ecx, [rax + 4]
mov eax, dword [r15 + rbx]
xor dword [rbx], eax
add rbx, 4
dec rcx
jne 0x14008fc9c
movups xmm0, xmm6
add rsi, 0x10
sub r15, 0x10
movdqu xmmword [r14], xmm0
test edi, edi
jne 0x14008fc80
jmp 0x14008fd78
test edi, edi
je 0x14008fd78
lea rbp, [rdx + 2]
sub rsi, rdx
mov r8, qword [rsp + 0x70]
lea rcx, [rsi - 2]
lea rdx, [rbp - 2]
add rcx, rbp
dec edi
movups xmm6, xmmword [rcx]
call fcn.140003100
test eax, eax
jne 0x14008fc5d
mov al, byte [r14]
movups xmm0, xmm6
xor byte [rbp - 2], al
mov al, byte [r14 + 1]
xor byte [rbp - 1], al
mov al, byte [r14 + 2]
xor byte [rbp], al
mov al, byte [r14 + 3]
add rbp, 0x10
xor byte [rbp - 0xf], al
mov al, byte [r14 + 4]
xor byte [rbp - 0xe], al
mov al, byte [r14 + 5]
xor byte [rbp - 0xd], al
mov al, byte [r14 + 6]
xor byte [rbp - 0xc], al
mov al, byte [r14 + 7]
xor byte [rbp - 0xb], al
mov al, byte [r14 + 8]
xor byte [rbp - 0xa], al
mov al, byte [r14 + 9]
xor byte [rbp - 9], al
mov al, byte [r14 + 0xa]
xor byte [rbp - 8], al
mov al, byte [r14 + 0xb]
xor byte [rbp - 7], al
mov al, byte [r14 + 0xc]
xor byte [rbp - 6], al
mov al, byte [r14 + 0xd]
xor byte [rbp - 5], al
mov al, byte [r14 + 0xe]
xor byte [rbp - 4], al
mov al, byte [r14 + 0xf]
xor byte [rbp - 3], al
movdqu xmmword [r14], xmm0
test edi, edi
jne 0x14008fcd3
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14008fed8
Capabilities:
Decrypt data using aes via x86 extensions
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x1a0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rax - 0x88], xmm13
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r10, qword [rsp + 0x1d0]
mov r11, rdx
mov rbx, rcx
test r10b, 0xf
je 0x14008ffa6
lea rax, [rsp]
lea rcx, [rsp]
mov edx, 2
neg rax
and eax, 0xf
add rcx, rax
mov rax, rcx
movups xmm0, xmmword [r10]
movups xmm1, xmmword [r10 + 0x10]
lea r10, [r10 + 0x80]
movups xmmword [rax], xmm0
movups xmm0, xmmword [r10 - 0x60]
movups xmmword [rax + 0x10], xmm1
lea rax, [rax + 0x80]
movups xmm1, xmmword [r10 - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [r10 - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [r10 - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [r10 - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [r10 - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
dec rdx
jne 0x14008ff4b
jmp 0x14008ffa9
mov rcx, r10
movdqa xmm3, xmmword [rcx]
movdqa xmm4, xmmword [rcx + 0x10]
movdqa xmm5, xmmword [rcx + 0x20]
sar r8d, 4
movdqa xmm6, xmmword [rcx + 0x30]
movdqa xmm7, xmmword [rcx + 0x40]
movdqa xmm8, xmmword [rcx + 0x50]
movdqa xmm9, xmmword [rcx + 0x60]
movdqa xmm10, xmmword [rcx + 0x70]
movdqa xmm11, xmmword [rcx + 0x80]
movdqa xmm12, xmmword [rcx + 0x90]
movdqa xmm13, xmmword [rcx + 0xa0]
movdqu xmm2, xmmword [r9]
test r8d, r8d
jle 0x14009005d
sub r11, rbx
mov eax, r8d
movdqu xmm1, xmmword [rbx]
movdqa xmm0, xmm1
pxor xmm0, xmm3
aesdec xmm0, xmm4
aesdec xmm0, xmm5
aesdec xmm0, xmm6
aesdec xmm0, xmm7
aesdec xmm0, xmm8
aesdec xmm0, xmm9
aesdec xmm0, xmm10
aesdec xmm0, xmm11
aesdec xmm0, xmm12
aesdeclast xmm0, xmm13
pxor xmm0, xmm2
movdqa xmm2, xmm1
movdqu xmmword [r11 + rbx], xmm0
lea rbx, [rbx + 0x10]
dec rax
jne 0x140090002
movdqu xmmword [r9], xmm2
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400e7da0
lea r11, [rsp + 0x1a0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop rbx
ret

Function at 0x1400900ec
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x80], rax
and dword [rsp + 0x24], 0
and dword [rsp + 0x20], 0
mov rbx, r8
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
mov dword [rsp + 0x38], 0xc3d2e1f0
call fcn.1400902d4
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140090174
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400e7da0
add rsp, 0x90
pop rbx
ret
Function at 0x1400902a8
Capabilities:
Hash data using sha1

Disassembly:
and dword [rcx + 4], 0
and dword [rcx], 0
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
ret
Function at 0x140092510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea r11, [0x1401717a0]
lea r10, [0x1401721a0]
mov ebx, 0x100
lea rdi, [0x140000000]
movzx r9d, byte [r11 + 0x100]
mov ecx, r9d
mov eax, r9d
mov edx, r9d
shr edx, 1
shr eax, 2
and ecx, 3
movzx r8d, byte [rcx + rdi + 0x160dc0]
xor edx, r9d
xor r8d, eax
movzx eax, byte [rcx + rdi + 0x160dc4]
shr edx, 1
xor edx, eax
xor r8d, r9d
xor edx, r9d
imul eax, edx, 0x10100
add eax, r8d
shl eax, 8
add eax, r9d
shl r9d, 0x10
mov dword [r10 - 0x800], eax
imul eax, edx, 0x1000100
add eax, r8d
add r9d, eax
mov dword [r10], r9d
movzx r9d, byte [r11]
inc r11
mov ecx, r9d
mov eax, r9d
mov edx, r9d
shr edx, 1
and ecx, 3
shr eax, 2
movzx r8d, byte [rcx + rdi + 0x160dc0]
xor edx, r9d
lea r10, [r10 + 4]
shr edx, 1
xor r8d, eax
movzx eax, byte [rcx + rdi + 0x160dc4]
xor edx, eax
xor r8d, r9d
mov ecx, r9d
xor edx, r9d
shl ecx, 8
add ecx, r8d
shl ecx, 0x10
imul eax, edx, 0x101
shl edx, 8
add ecx, eax
add edx, r9d
mov dword [r10 - 0x404], ecx
imul eax, r8d, 0x1000001
shl edx, 8
add edx, eax
mov dword [r10 + 0x3fc], edx
dec rbx
jne 0x140092534
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x14009261c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor ebx, ebx
lea rdi, [0x1401718a0]
lea rsi, [0x140000000]
mov r11b, bl
mov r10b, bl
inc ebx
shr r11b, 4
and r10b, 0xf
movzx edx, r10b
movzx ecx, r11b
mov eax, ecx
movzx ecx, byte [rcx + rsi + 0x160dd8]
xor rax, rdx
movzx r8d, byte [rax + rsi + 0x160de8]
movzx eax, byte [rdx + rsi + 0x160dc8]
xor rcx, rax
mov r9d, r8d
movzx edx, byte [rcx + rsi + 0x160e08]
movzx ecx, byte [r8 + rsi + 0x160dd8]
movzx eax, byte [rdx + rsi + 0x160dc8]
xor r9, rdx
movzx edx, r10b
xor rcx, rax
mov al, byte [rcx + rsi + 0x160e48]
movzx ecx, r11b
shl al, 4
or al, byte [r9 + rsi + 0x160e28]
mov byte [rdi - 0x100], al
mov eax, ecx
movzx ecx, byte [rcx + rsi + 0x160dd8]
xor rax, rdx
movzx r8d, byte [rax + rsi + 0x160df8]
movzx eax, byte [rdx + rsi + 0x160dc8]
xor rcx, rax
mov r9d, r8d
movzx edx, byte [rcx + rsi + 0x160e18]
movzx ecx, byte [r8 + rsi + 0x160dd8]
movzx eax, byte [rdx + rsi + 0x160dc8]
xor r9, rdx
xor rcx, rax
mov al, byte [rcx + rsi + 0x160e58]
shl al, 4
or al, byte [r9 + rsi + 0x160e38]
mov byte [rdi], al
inc rdi
cmp ebx, 0x100
jb 0x14009263b
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret