joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14022ec60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov ecx, reloc.SinoSPE.dll_Ordinal_17
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebp, 0x80
mov ecx, reloc.SinoSPE.dll_Ordinal_16
test bp, ax
seta sil
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edx, word [rbx + 0x1c]
test bp, ax
seta r9b
lea eax, [rdx - 0x1b]
cmp eax, 0x13
ja case.0x14022eccc.28
lea r8, [0x140000000]
cdqe
movzx eax, byte [r8 + rax + 0x22ed24]
mov ecx, dword [r8 + rax*4 + 0x22ed14]
add rcx, r8
jmp rcx
lea rcx, [rdi + 0x6b8]
movzx r8d, sil
call fcn.1401d4f40
jmp case.0x14022eccc.28
lea rcx, [rdi + 0x6b8]
call fcn.1401d37b0
jmp case.0x14022eccc.28
lea rcx, [rdi + 0x6b8]
xor edx, edx
call fcn.1401d3490
mov rbx, qword [rsp + 0x30]
mov al, 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1402313f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x28]
lea rcx, [rbx + 0xc0]
sub rax, qword [rcx]
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbx + 0xc8]
cvtsi2sd xmm1, rax
mulsd xmm1, qword [0x140452e28]
divsd xmm1, xmm0
addsd xmm1, qword [rbx + 0x30]
movsd qword [rbx + 0x30], xmm1
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_58]
mov rcx, qword [rbx + 0x78]
mov edi, eax
test rcx, rcx
je 0x1402314d5
mov eax, dword [rbx + 0x1c]
mov qword [rsp + 0x58], rsi
mov esi, dword [rbx + 0x20]
cmp esi, eax
jle 0x14023147f
cmp edi, esi
jge 0x140231485
cmp esi, eax
jge 0x1402314bc
cmp edi, esi
jg 0x1402314bc
mov dword [rsp + 0x20], esi
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov rcx, rbx
call fcn.1402314e0
mov dword [rbx + 0x24], esi
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1403ca460
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
cmp edi, dword [rbx + 0x24]
je 0x1402314d0
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
mov dword [rbx + 0x24], edi
jmp 0x14023149f
mov dword [rbx + 0x24], edi
jmp 0x1402314a4
Function at 0x140233f70
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
push rbp
push rdi
lea rbp, [r11 - 0x5f]
sub rsp, 0xe8
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, rcx
test rcx, rcx
je 0x140234111
test rdx, rdx
je 0x140234111
mov qword [r11 + 0x18], rbx
xorps xmm0, xmm0
mov qword [r11 - 0x18], rsi
xor eax, eax
mov qword [r11 - 0x20], r12
xorps xmm1, xmm1
mov qword [r11 - 0x28], r13
xor esi, esi
mov qword [r11 - 0x30], r14
mov r8, 0xffffffffffffffff
mov qword [r11 - 0x38], r15
movups xmmword [rbp - 0x61], xmm0
mov word [rbp + 7], ax
movups xmmword [rbp - 0x51], xmm0
mov qword [rbp - 0x69], rsi
movups xmmword [rbp - 0x41], xmm0
mov dword [rbp - 0x79], 0x67452301
movups xmmword [rbp - 0x31], xmm0
mov dword [rbp - 0x75], 0xefcdab89
movups xmmword [rbp + 0xf], xmm0
mov dword [rbp - 0x71], 0x98badcfe
movups xmmword [rbp - 0x19], xmm1
mov dword [rbp - 0x6d], 0x10325476
movups xmmword [rbp - 9], xmm1
nop dword [rax]
inc r8
cmp byte [rdx + r8], al
jne 0x140234010
lea rcx, [rbp - 0x79]
call fcn.140233450
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 0xf]
call fcn.140233560
lea r12, [rbp + 0xf]
mov r15d, 0x21
lea r14, [rbp - 0x19]
mov r13d, reloc.SinoSPE.dll_Ordinal_16
movzx ebx, byte [r12]
lea rdx, [r15 + 1]
mov r9d, ebx
lea r8, str._02X
mov rcx, r14
call fcn.1400da450
shl bl, 4
lea rcx, [r14 + 1]
movzx r9d, bl
lea r8, str._02X
mov rdx, r15
call fcn.1400da450
add r14, 2
lea r12, [r12 + 1]
sub r15, 2
sub r13, 1
jne 0x140234043
mov r15, qword [rsp + 0xc0]
lea rcx, [rbp + 6]
mov r14, qword [rsp + 0xc8]
lea rax, [rdi + 0x1f]
mov r13, qword [rsp + 0xd0]
mov ebx, reloc.SinoSPE.dll_Ordinal_32
mov r12, qword [rsp + 0xd8]
cmp rdi, rcx
ja 0x1402340c6
lea rcx, [rbp - 0x19]
cmp rax, rcx
jae 0x1402340d7
movups xmm0, xmmword [rbp - 0x19]
movups xmm1, xmmword [rbp - 9]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
mov esi, ebx
mov eax, esi
cmp rax, rbx
jae 0x1402340f6
sub rbx, rax
lea rdx, [rbp - 0x19]
add rdx, rax
lea rcx, [rax + rdi]
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add esi, ebx
mov rbx, qword [rsp + 0x110]
movsxd rax, esi
mov rsi, qword [rsp + 0xe0]
mov byte [rax + rdi], 0
mov al, 1
jmp 0x140234113
xor al, al
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0xe8
pop rdi
pop rbp
ret
Function at 0x140236090
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x14023609b
xor eax, eax
ret
lea r11, [0x1404176c0]
not ecx
cmp r8d, 8
jb 0x140236171
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1402360c0
test r8d, r8d
je 0x14023619d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x140236180
not ecx
mov eax, ecx
ret

Function at 0x140236b90
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r10d, edx
mov rdi, r9
imul r10d, r8d
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x140236be8
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140236be2
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x30]
jmp 0x140236c1e
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x28]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x20]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call sub.VCRUNTIME140.dll_memcpy
add dword [rdi + 0x2c], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140236c40
Capabilities:
Read file on windows

Disassembly:
push rbx
push r15
sub rsp, 0x48
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx], 0
mov r15, rdx
mov qword [rsp + 0x70], rsi
mov rbx, rcx
mov qword [rsp + 0x78], rdi
mov edi, 1
je 0x140236c9f
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x34]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140236c99
mov byte [rbx + 0x10], dil
mov esi, dword [rsp + 0x34]
jmp 0x140236cda
mov qword [rsp + 0x40], r14
mov r14d, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [r14 + 1]
cmp eax, ecx
jbe 0x140236cb8
mov edi, ecx
sub edi, r14d
mov rdx, r14
mov r8d, edi
add rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x30]
mov esi, edi
call sub.VCRUNTIME140.dll_memcpy
lea eax, [r14 + rdi]
mov r14, qword [rsp + 0x40]
mov dword [rbx + 0x2c], eax
mov rdi, qword [rsp + 0x78]
cmp esi, 1
mov rsi, qword [rsp + 0x70]
jne 0x140236d08
movzx eax, byte [rsp + 0x30]
mov dword [r15], eax
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0x48
pop r15
pop rbx
ret
cmp byte [rbx], 0
je 0x140236cf1
cmp byte [rbx + 0x10], 0
je 0x140236cf1
mov eax, 0xffffffff
jmp 0x140236cf3
Function at 0x1402379f0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x140237bfb
cmp dword [rcx + 0x1c], 0
je 0x140237bfb
cmp qword [rcx + 0x80], 0
je 0x140237a1f
call fcn.140237f90
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140237740
test eax, eax
je 0x140237a46
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
mov qword [rsp + 0x48], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140237a6f
mov rbx, qword [rsp + 0x48]
mov eax, 0xffffff98
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
test rax, rax
jne 0x140237ab9
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, qword [rsp + 0x20]
mov eax, 0xffffff98
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, dword [rdi + 0x40]
mov ecx, dword [rdi + 0x38]
mov dword [rbx + 0x78], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x64], ebp
mov dword [rbx + 0x74], ebp
mov dword [rbx + 0x90], ecx
mov dword [rbx + 0x24], ebp
test ecx, ecx
je 0x140237b08
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.140236420
test eax, eax
jne 0x140237b08
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
movzx ecx, byte [rdi + 0x34]
mov dword [rbx + 0x7c], eax
and cl, 1
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
mov eax, dword [rdi + 0x34]
shr eax, 3
mov byte [rbx + 0x98], cl
test al, 1
je 0x140237b34
movzx eax, byte [rdi + 0x3d]
jmp 0x140237b38
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
neg cl
mov dword [rbx + 0x9c], 0x12345678
sbb eax, eax
mov dword [rbx + 0xa0], 0x23456789
and eax, 0xc
mov dword [rbx + 0xa4], 0x34567890
mov dword [rbx + 0xa8], eax
test rsi, rsi
je 0x140237bcf
lea r8, [0x1404176c0]
movzx eax, byte [rsi]
test al, al
je 0x140237bcf
mov edx, dword [rbx + 0x9c]
xor rax, rdx
movzx ecx, al
shr edx, 8
xor edx, dword [r8 + rcx*4]
mov ecx, dword [rbx + 0xa4]
movzx eax, dl
add eax, dword [rbx + 0xa0]
mov dword [rbx + 0x9c], edx
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0xa0], edx
shr rdx, 0x18
xor rax, rdx
xor ecx, dword [r8 + rax*4]
mov dword [rbx + 0xa4], ecx
add rsi, 1
jne 0x140237b75
mov eax, dword [rsp + 0x58]
mov ecx, dword [rdi + 0x7c]
add eax, 0x1e
add ecx, eax
mov dword [rbx + 0x10], ebp
mov rbp, qword [rsp + 0x20]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140238040
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push r13
push r14
sub rsp, 0x50
cmp qword [rcx], 0
mov ebp, r9d
mov r13, rdx
mov r14, rcx
jne 0x14023823f
cmp dword [rcx + 8], 0xffffffff
jne 0x14023823f
mov qword [rsp + 0x70], rbx
lea rbx, [rcx + 0x250]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140238090
movzx ecx, word [r14 + rax*2 + 0x24e]
cmp cx, 0x5c
je 0x1402380c8
cmp cx, 0x2f
je 0x1402380c8
sub rbx, 2
cmp word [rbx + 2], 0
lea rbx, [rbx + 2]
jne 0x1402380b5
mov eax, dword [0x14043f8d8]
mov dword [rbx], eax
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r15
cmp ebp, 1
jne 0x140238125
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140238136
mov eax, 0x2000000
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
lea eax, [rbp - 2]
cmp eax, 1
jbe 0x140238136
mov edi, 0x10000
mov eax, edi
jmp 0x1402380ff
xor edi, edi
xor r12b, r12b
xor r15b, r15b
mov esi, edi
cmp ebp, 1
je 0x140238190
cmp ebp, 2
jne 0x1402381ae
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14023818b
mov edi, 0x200
mov eax, edi
jmp 0x1402380ff
mov r15b, 1
jmp 0x140238193
mov rsi, r13
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne r12b
mov ecx, reloc.SinoSPE.dll_Ordinal_48
call fcn.1403ca490
lea ecx, [rbp - 1]
mov rbx, rax
cmp ecx, 1
jbe 0x1402381e2
mov word [rax], 0x100
mov byte [rax + 0x18], dil
mov qword [rax + 0x20], r13
mov eax, dword [rsp + 0x80]
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x2c], edi
mov dword [rbx + 0x14], edi
jmp 0x140238214
mov byte [rax], 1
mov byte [rax + 0x18], r15b
mov byte [rax + 1], r12b
mov qword [rax + 8], rsi
mov byte [rax + 0x10], dil
mov dword [rax + 0x14], edi
test r12b, r12b
je 0x140238214
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x14], eax
test rbx, rbx
jne 0x140238220
mov eax, edi
jmp 0x1402380ff
mov rcx, rbx
call fcn.140236fb0
mov ecx, edi
mov qword [r14], rax
test rax, rax
mov edi, 0x200
cmove ecx, edi
mov eax, ecx
jmp 0x1402380ff
mov eax, 0x1000000
add rsp, 0x50
pop r14
pop r13
pop rbp
ret

Function at 0x14023a0e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rdx, qword [rcx + 0x520]
test rdx, rdx
je 0x14023a0f9
mov rax, qword [rdx]
mov rcx, rdx
jmp qword [rax + 0x188]
cmp byte [rcx + 0x16d], 0
jne 0x14023a116
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x14023a116
mov rdx, rcx
mov rcx, rax
jmp fcn.1401b74b0
ret
Function at 0x14023f460
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov qword [rcx + 0x30], rdx
mov rbx, rcx
mov qword [rcx + 0x38], r8
test r9b, r9b
je 0x14023f4a8
test r8, r8
je 0x14023f481
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_24]
cmp qword [rbx + 0x6b8], 0
je 0x14023f4a8
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14023f4a8
lea rdx, [rbx + 0x6a8]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.1401b4e20
add rsp, 0x20
pop rbx
ret
Function at 0x14024ddf0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
lea rdx, [0x140452478]
movaps xmm6, xmm2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x14024dec4
xor edx, edx
mov r8d, 2
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rax, 0xffffffffffffffff
mov rcx, rsi
add rcx, 1
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14024dead
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rsi
jne 0x14024dead
mov rcx, rbx
mov byte [rsi + rdi], 0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
movaps xmm2, xmm6
mov rcx, rdi
call fcn.14024db00
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rbx
jmp 0x14024dec6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x14024dec4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x140286290
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov ebx, ecx
call fcn.1403a2170
test eax, eax
jne 0x14028642d
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp byte [reloc.SinoSPE.dll_Ordinal_1], bpl
mov qword [rsp + 0x38], rdi
jne 0x1402862c5
mov edi, ebp
jmp 0x1402862e1
mov ecx, 5
call qword [0x1404a5bc0]
mov rdi, rax
test rax, rax
je 0x1402862e1
mov rcx, rax
call qword [0x1404a5bd0]
test ebx, ebx
jle 0x14028640f
test rsi, rsi
je 0x14028640f
cmp dword [0x1404b8680], ebp
jne 0x140286398
xor ecx, ecx
call fcn.14025b030
movups xmm0, xmmword [str.expand_32_byte_k]
movaps xmmword [0x1404b8680], xmm0
test rax, rax
jne 0x140286338
xorps xmm0, xmm0
mov qword [0x1404b86b0], rax
movups xmmword [0x1404b8690], xmm0
mov dword [0x1404b86b8], eax
movups xmmword [0x1404b86a0], xmm0
jmp 0x14028637c
mov ecx, dword [0x1404a5d00]
test ecx, ecx
je 0x14028636a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1404b8690], xmm0
mov dword [0x1404b8690], ecx
movups xmmword [0x1404b86a0], xmm0
mov qword [0x1404b86b0], rax
mov dword [0x1404b86b8], eax
jmp 0x14028637c
lea r8, [0x1404b8690]
mov edx, reloc.SinoSPE.dll_Ordinal_44
mov rcx, rax
call qword [rax + 0x68]
mov eax, dword [0x1404b86b0]
xor cl, cl
mov byte [0x1404b8700], cl
mov dword [0x1404b86bc], eax
mov dword [0x1404b86b0], ebp
jmp 0x14028639f
movzx ecx, byte [0x1404b8700]
movzx eax, cl
lea rbp, [0x1404b86c0]
cmp ebx, eax
jle 0x1402863f1
nop dword [rax]
test cl, cl
je 0x1402863cf
movzx r8d, cl
mov rdx, rbp
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, byte [0x1404b8700]
sub ebx, ecx
add rsi, rcx
inc dword [0x1404b86b0]
lea rdx, [0x1404b8680]
mov rcx, rbp
call fcn.1402aa830
mov cl, 0x40
mov byte [0x1404b8700], cl
cmp ebx, 0x40
jg 0x1402863b0
movzx eax, cl
mov rcx, rsi
sub eax, ebx
movsxd r8, ebx
movsxd rdx, eax
add rdx, rbp
call sub.VCRUNTIME140.dll_memcpy
sub byte [0x1404b8700], bl
jmp 0x140286415
mov dword [0x1404b8680], ebp
test rdi, rdi
je 0x140286423
mov rcx, rdi
call qword [0x1404a5be0]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140291f00
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor esi, esi
mov rdi, r8
mov rbx, rcx
cmp r8, 0x40
jbe 0x140291f6d
mov r8d, edi
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x14], rsi
call fcn.14032dd10
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14032be50
mov edi, Ordinal_23
jmp 0x140291f87
lea rax, [rsp + 0x20]
cmp rax, rdx
je 0x140291f81
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
cmp rdi, 0x40
jae 0x140291f9f
mov r8d, 0x40
lea rcx, [rsp + 0x20]
sub r8, rdi
add rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movdqa xmm3, xmmword [0x1403f5590]
lea rdx, [rsp + 0x60]
movdqa xmm4, xmmword [0x1403f55c0]
movdqa xmm0, xmm3
xorps xmm0, xmmword [rsp + 0x20]
movdqa xmm1, xmm3
xorps xmm1, xmmword [rsp + 0x30]
mov r8d, 0x40
movdqu xmmword [rsp + 0x60], xmm0
mov rcx, rbx
movdqa xmm0, xmm4
movdqu xmmword [rsp + 0x70], xmm1
xorps xmm0, xmmword [rsp + 0x20]
movdqa xmm1, xmm3
xorps xmm1, xmmword [rsp + 0x40]
xorps xmm3, xmmword [rsp + 0x50]
movdqu xmmword [rsp + 0xa0], xmm0
movdqa xmm0, xmm4
xorps xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rsp + 0xb0], xmm0
movdqa xmm0, xmm4
xorps xmm0, xmmword [rsp + 0x40]
xorps xmm4, xmmword [rsp + 0x50]
movdqu xmmword [rsp + 0xc0], xmm0
movdqu xmmword [rsp + 0x80], xmm1
movdqu xmmword [rsp + 0x90], xmm3
movdqu xmmword [rsp + 0xd0], xmm4
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov qword [rbx + 0x14], rsi
call fcn.14032dd10
lea rcx, [rbx + 0x5c]
mov r8d, 0x40
lea rdx, [rsp + 0xa0]
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x14], rsi
call fcn.14032dd10
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0xf0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140294300
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15d, dword [rcx + 0x1c]
xor edi, edi
sub r15d, 6
xor r14d, r14d
movsxd rbx, r15d
mov rsi, rcx
test r15d, r15d
jle 0x1402943b2
mov r8, rbx
lea rcx, [rbp - 0x30]
shl r8, 2
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
xor edx, edx
cmp edi, dword [rsi + 0x1c]
ja 0x140294517
cmp r8, rbx
jge 0x140294387
cmp rdx, 4
jge 0x140294387
mov eax, edi
inc r14d
lea rcx, [rdx + rax*4]
mov eax, dword [rbp + r8*4 - 0x30]
inc r8
mov dword [rsi + rcx*4 + 0x20], eax
inc rdx
cmp r8, rbx
jl 0x140294364
cmp rdx, 4
lea eax, [rdi + 1]
cmovne eax, edi
mov edi, eax
xor eax, eax
cmp rdx, 4
cmovne eax, r14d
mov r14d, eax
xor eax, eax
cmp rdx, 4
cmovne rax, rdx
mov rdx, rax
cmp r8, rbx
jl 0x140294356
cmp edi, dword [rsi + 0x1c]
ja 0x140294517
movsxd rax, r14d
lea r9, [0x1404a9560]
lea r10, [0x1404a6360]
nop dword [rax]
movzx ecx, byte [rbp + rbx*4 - 0x33]
lea r9, [r9 + 4]
movzx edx, byte [rbp - 0x30]
xor dl, byte [rcx + r10]
mov byte [rbp - 0x30], dl
movzx ecx, byte [rbp + rbx*4 - 0x32]
xor dl, byte [r9 - 4]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x2f], cl
movzx ecx, byte [rbp + rbx*4 - 0x31]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x2e], cl
movzx ecx, byte [rbp + rbx*4 - 0x34]
mov byte [rbp - 0x30], dl
mov edx, 1
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x2d], cl
cmp r15d, 8
je 0x140294450
cmp rdx, rbx
jge 0x1402944b5
nop word [rax + rax]
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, rbx
jl 0x140294430
xor r8d, r8d
jmp 0x1402944c0
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, 4
jl 0x140294450
movzx ecx, byte [rbp - 0x24]
mov edx, 5
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x20], cl
movzx ecx, byte [rbp - 0x23]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1f], cl
movzx ecx, byte [rbp - 0x22]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1e], cl
movzx ecx, byte [rbp - 0x21]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1d], cl
cmp rdx, rbx
jge 0x1402944b5
nop dword [rax + rax]
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, rbx
jl 0x1402944a0
xor r8d, r8d
jmp 0x1402944c0
xor r8d, r8d
test r15d, r15d
jle 0x14029450e
nop dword [rax]
cmp edi, dword [rsi + 0x1c]
ja 0x140294517
cmp r8, rbx
jge 0x1402944f0
nop word [rax + rax]
cmp rax, 4
jge 0x1402944f0
mov ecx, edi
lea rdx, [rax + rcx*4]
mov ecx, dword [rbp + r8*4 - 0x30]
inc r8
mov dword [rsi + rdx*4 + 0x20], ecx
inc rax
cmp r8, rbx
jl 0x1402944d0
cmp rax, 4
lea ecx, [rdi + 1]
cmovne ecx, edi
mov edi, ecx
xor ecx, ecx
cmp rax, 4
cmovne rcx, rax
mov rax, rcx
cmp r8, rbx
jl 0x1402944c0
cmp edi, dword [rsi + 0x1c]
jbe 0x1402943d0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret