joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000df90
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4f8
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x550]
mov r15d, dword [rsp + 0x558]
lea r12d, [r9 + 1]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x560]
shr r12d, 1
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x570]
mov dword [rsp + 0x40], r9d
mov qword [rsp + 0x48], r8
mov ebp, edx
mov rdi, rcx
mov qword [rsp + 0x50], rax
cmp r12d, 0x104
ja 0x18000e1d3
mov r14d, dword [rsp + 0x568]
lea r13d, [r15 + r14]
cmp r13d, 0x80
ja 0x18000e1d3
cmp ebp, 0xe0
ja 0x18000e1d3
mov qword [r11 - 0x38], rbx
mov qword [r11 - 0x40], rsi
lea rcx, [r11 - 0x358]
mov r8d, ebp
xor edx, edx
mov esi, ebp
call fcn.180037c60
lea rcx, [rsp + 0xf0]
mov r8d, ebp
xor edx, edx
call fcn.180037c60
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x2b0]
mov r8d, r12d
call fcn.180033ff0
mov r11d, dword [rsp + 0x40]
mov edx, r12d
and r11d, 1
lea rcx, [rsp + 0x3c0]
mov r8d, r12d
sub rdx, r11
add rdx, qword [rsp + 0x48]
call fcn.180033ff0
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x70]
mov r8d, r15d
call fcn.180033ff0
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + r15 + 0x70]
mov r8d, r14d
call fcn.180033ff0
mov r14, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], 1
lea r8, [rsp + 0x2b0]
lea rcx, [rsp + 0x1d0]
mov r9d, r12d
mov edx, ebp
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call fcn.18000dd20
mov ebx, eax
test eax, eax
jne 0x18000e1bf
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 2
lea r8, [rsp + 0x3c0]
lea rcx, [rsp + 0xf0]
mov r9d, r12d
mov edx, ebp
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
call fcn.18000dd20
mov ebx, eax
test eax, eax
jne 0x18000e1bf
lea rdx, [rsp + 0x1d0]
mov r8d, ebp
mov rcx, rdi
call fcn.180033ff0
mov r11d, ebp
lea rax, [rsp + 0xf0]
or r11, rdi
or r11, rax
test r11b, 7
jne 0x18000e193
shr ebp, 3
test ebp, ebp
je 0x18000e1bf
lea rdx, [rsp + 0xf0]
mov ecx, ebp
sub rdx, rdi
nop word [rax + rax]
mov rax, qword [rdx + rdi]
add rdi, 8
xor qword [rdi - 8], rax
dec rcx
jne 0x18000e180
jmp 0x18000e1bf
test ebp, ebp
je 0x18000e1bf
lea rcx, [rsp + 0xf0]
sub rcx, rdi
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rdi
xor byte [rdi - 1], al
dec rsi
jne 0x18000e1b0
mov rsi, qword [rsp + 0x4e8]
mov eax, ebx
mov rbx, qword [rsp + 0x4f0]
jmp 0x18000e1d8
mov eax, 0xffffff7c
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x4f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x18000e350
Capabilities:
Hash data using sha1

Disassembly:
sub rsp, 0x28
xor r8d, r8d
sub edx, 3
je 0x18000e3b8
dec edx
je 0x18000e376
cmp edx, 2
jne 0x18000e3bd
call fcn.18001ec10
mov qword [rcx + 0x118], r8
add rsp, 0x28
ret
test rcx, rcx
je 0x18000e3bd
mov dword [rcx + 0x5c], 0xc3d2e1f0
mov eax, r8d
mov dword [rcx + 8], r8d
mov qword [rcx], r8
mov dword [rcx + 0x58], 0x10325476
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x4c], 0x67452301
mov qword [rcx + 0x60], r8
mov qword [rcx + 0x118], r8
add rsp, 0x28
ret
test rcx, rcx
jne 0x18000e382
mov eax, 0xffffff53
mov qword [rcx + 0x118], r8
add rsp, 0x28
ret

Function at 0x18000e3d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x20
mov esi, r9d
mov r12, rcx
mov r9, r8
test r8, r8
jne 0x18000e3eb
test esi, esi
jne 0x18000e41d
cmp edx, 3
je 0x18000e42b
cmp edx, 4
je 0x18000e42b
cmp edx, 5
je 0x18000e42b
cmp edx, 6
je 0x18000e42b
cmp edx, 7
je 0x18000e42b
cmp edx, 8
je 0x18000e42b
cmp edx, 0xa
je 0x18000e42b
cmp edx, 0xb
je 0x18000e42b
cmp edx, 0xc
je 0x18000e42b
cmp edx, 0xd
je 0x18000e42b
mov eax, 0xffffff53
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
mov byte [rcx + 0x121], 0
mov byte [rcx + 0x120], dl
call fcn.18000e350
mov edi, eax
test eax, eax
jne 0x18000e589
movzx ecx, byte [r12 + 0x120]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
sub ecx, 3
mov qword [rsp + 0x50], r13
lea rbx, [r12 + 0x78]
lea r13, [r12 + 0xb8]
lea ebp, [rax + 0x40]
je 0x18000e506
dec ecx
je 0x18000e4d4
cmp ecx, 2
je 0x18000e48b
mov eax, 0xffffff53
jmp 0x18000e57a
cmp esi, ebp
jbe 0x18000e50a
test r9, r9
jne 0x18000e4a2
test esi, esi
je 0x18000e4ba
mov edi, 0xffffff53
jmp 0x18000e578
mov r8d, esi
mov rdx, r9
mov rcx, r12
call fcn.18001e640
mov edi, eax
test eax, eax
jne 0x18000e578
mov rdx, rbx
mov rcx, r12
call fcn.18001eac0
mov edi, eax
test eax, eax
jne 0x18000e578
lea esi, [rax + 0x20]
jmp 0x18000e54d
cmp esi, ebp
jbe 0x18000e50a
mov r8d, esi
mov rdx, r9
mov rcx, r12
call fcn.18001da30
mov edi, eax
test eax, eax
jne 0x18000e578
mov rdx, rbx
mov rcx, r12
call fcn.18001dd00
mov edi, eax
test eax, eax
jne 0x18000e578
lea esi, [rax + 0x14]
jmp 0x18000e54d
cmp esi, ebp
ja 0x18000e523
test r9, r9
je 0x18000e51d
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call fcn.180033ff0
cmp esi, ebp
jae 0x18000e55f
jmp 0x18000e54d
mov r8d, esi
mov rdx, r9
mov rcx, r12
call fcn.1800182d0
mov edi, eax
test eax, eax
jne 0x18000e578
mov rdx, rbx
mov rcx, r12
call fcn.180018470
mov edi, eax
test eax, eax
jne 0x18000e578
mov esi, reloc.WS2_32.dll_recv
mov r8d, ebp
mov ecx, esi
xor edx, edx
sub r8d, esi
add rcx, rbx
call fcn.180037c60
sub r13, rbx
movzx eax, byte [rbx]
inc rbx
xor al, 0x5c
mov byte [r13 + rbx - 1], al
xor byte [rbx - 1], 0x36
dec rbp
jne 0x18000e562
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r13, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret
Function at 0x180017540
Capabilities:
Encrypt data using des

Disassembly:
push rbp
push rsi
push r12
sub rsp, 0x50
movsxd rbp, edx
mov r12, r8
mov rsi, rcx
cmp ebp, 0x100
jle 0x180017568
mov eax, 0xfffffffd
add rsp, 0x50
pop r12
pop rsi
pop rbp
ret
mov r9d, dword [rcx]
mov qword [rsp + 0x70], rbx
cmp r9d, 1
jne 0x180017594
mov rax, qword [rcx + 0x10]
cmp dword [rax], r9d
jne 0x180017594
xor ebx, ebx
xor eax, eax
mov dword [r8], ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r14
lea r14, [0x18009abe0]
mov rdx, r14
lea r13, [0x18009afe0]
nop
mov ecx, dword [rdx]
test r9d, r9d
jne 0x1800175ca
test ecx, ecx
jne 0x1800175e4
mov dword [r12], 1
xor eax, eax
jmp 0x1800176e8
cmp dword [rsi + 8], 1
je 0x1800175e4
cmp r9d, 1
jg 0x1800175e4
mov rax, qword [rsi + 0x10]
mov r8d, dword [rax]
cmp r8d, ecx
ja 0x1800175e4
jae 0x1800175bb
add rdx, 4
cmp rdx, r13
jl 0x1800175b0
xor ebx, ebx
mov qword [rsp + 0x80], rdi
mov rdi, r14
mov dword [rsp + 0x78], ebx
nop
mov edx, dword [rdi]
lea r8, [rsp + 0x88]
mov rcx, rsi
call fcn.180016b60
test eax, eax
jne 0x1800176e0
cmp dword [rsp + 0x88], ebx
je 0x1800176de
add rdi, 4
cmp rdi, r13
jl 0x180017600
mov qword [rsp + 0x30], rbx
mov eax, ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], ebx
mov edi, ebx
test rbp, rbp
jle 0x180017693
nop word [rax + rax]
mov edx, dword [r14 + rbx*4]
lea rcx, [rsp + 0x20]
call fcn.180011f90
mov edi, eax
test eax, eax
jne 0x1800176ca
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180016c80
mov edi, eax
test eax, eax
jne 0x1800176ca
cmp dword [rsp + 0x78], eax
je 0x1800176ca
inc rbx
cmp rbx, rbp
jl 0x180017650
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x20]
mov dword [r12], 1
test rbx, rbx
je 0x1800176da
test eax, eax
jle 0x1800176b5
mov r8d, eax
xor edx, edx
mov rcx, rbx
shl r8, 2
call fcn.180037c60
mov rax, qword [0x1800b2190]
mov rcx, rbx
test rax, rax
je 0x1800176d5
call rax
mov eax, edi
jmp 0x1800176e0
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0x20]
jmp 0x18001769b
call fcn.1800337e4
mov eax, edi
jmp 0x1800176e0
xor eax, eax
mov rdi, qword [rsp + 0x80]
mov r13, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r12
pop rsi
pop rbp
ret
Function at 0x180018470
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x180018495
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov eax, dword [rcx]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 0xc]
xor ebp, ebp
mov byte [rax + rdi], pe_nt_image_headers64
inc dword [rcx]
mov ecx, dword [rcx]
cmp ecx, 0x38
jbe 0x1800184da
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.180037c60
mov rdx, rdi
mov rcx, rbx
mov dword [rbx], 0x40
call fcn.180017b30
mov dword [rbx], ebp
mov ecx, dword [rbx]
mov r8d, gethostname
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.180037c60
mov r8d, dword [rbx + 4]
mov ecx, dword [rbx + 8]
mov eax, r8d
mov rdx, rdi
shr eax, 0x1d
lea eax, [rax + rcx*8]
mov rcx, rbx
mov dword [rbx + 8], eax
lea eax, [r8*8]
mov dword [rbx + 4], eax
mov dword [rdi + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0x3c], eax
call fcn.180017b30
mov rax, qword [rbx + 0x4c]
mov rdi, qword [rsp + 0x38]
mov qword [rsi], rax
mov rax, qword [rbx + 0x54]
mov qword [rsi + 8], rax
mov qword [rbx], rbp
mov dword [rbx + 8], ebp
mov rbp, qword [rsp + 0x30]
mov dword [rbx + 0x4c], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x18001b120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
movsxd r12, edx
mov r13d, 4
xor edi, edi
lea ebp, [r12 - 4]
xor r11d, r11d
mov rsi, rcx
cmp ebp, r13d
mov eax, ebp
mov rbx, r12
cmova eax, r13d
movsxd r10, eax
test ebp, ebp
je 0x18001b1b3
xor r8d, r8d
test eax, eax
jle 0x18001b18a
mov rdx, rsi
mov r9d, eax
nop
movzx ecx, byte [rdx + r10]
movzx eax, byte [rdx]
inc rdx
xor ecx, eax
or r8d, ecx
dec r9
jne 0x18001b170
test r8d, r8d
jne 0x18001b18f
mov edi, 3
add r11d, r13d
mov eax, r12d
add rsi, r13
sub eax, r11d
sub rbx, r13
cmp eax, r13d
jbe 0x18001b1ab
mov eax, r13d
mov r10, r13
jmp 0x18001b1ae
mov r10, rbx
cmp r11d, ebp
jb 0x18001b161
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov eax, edi
mov rdi, qword [rsp + 0x30]
pop r13
pop r12
ret

Function at 0x18001b1d0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
test rcx, rcx
jne 0x18001b205
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x70
pop rbx
ret
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], 0
mov byte [rcx + 0x18], 0
xor ecx, ecx
mov qword [rsp + 0x90], rdi
call fcn.18001b540
test eax, eax
jne 0x18001b332
mov rax, qword [0x1800b2188]
mov qword [rsp + 0x88], rsi
mov ecx, 0x78
test rax, rax
je 0x18001b249
call rax
jmp 0x18001b24e
call fcn.1800339ec
mov qword [rbx + 0x10], rax
mov esi, 0x34
test rax, rax
jne 0x18001b264
lea edi, [rax - 0x7d]
jmp 0x18001b2fc
mov edi, 1
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov r9d, edi
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18001b2d6
mov rcx, qword [rbx]
lea r8, [rsp + 0x30]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x18001b2d6
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [rsp + 0x30]
mov edx, esi
call fcn.18001b120
mov edi, eax
test eax, eax
jne 0x18001b2d6
mov rcx, qword [rbx + 0x10]
lea r8d, [rax + 0x30]
lea rdx, [rsp + 0x34]
xor r9d, r9d
mov dword [rsp + 0x20], eax
call fcn.18001b000
mov edi, eax
test eax, eax
je 0x18001b2fc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18001b2f4
mov rax, qword [0x1800b2190]
test rax, rax
je 0x18001b2ef
call rax
jmp 0x18001b2f4
call fcn.1800337e4
mov qword [rbx + 0x10], 0
lea rax, [rsp + 0x30]
mov byte [rax], 0
inc rax
dec esi
jne 0x18001b301
mov rsi, qword [rsp + 0x88]
test edi, edi
jne 0x18001b31d
mov byte [rbx + 0x18], 1
jmp 0x18001b33b
cmp edi, 3
je 0x18001b332
mov byte [rbx + 0x18], 2
cmp edi, 1
jne 0x18001b33b
mov edi, 0xffffff39
jmp 0x18001b33b
mov byte [rbx + 0x18], 3
mov edi, 0xffffff2f
mov eax, edi
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x70
pop rbx
ret
Function at 0x18001b360
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x70
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12d, r8d
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
je 0x18001b4a2
test rdx, rdx
je 0x18001b4a2
cmp r8d, 0x10000
ja 0x18001b4a2
cmp byte [rcx + 0x18], 1
je 0x18001b3b0
mov eax, 0xffffff39
jmp 0x18001b4a7
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x60], rsi
call fcn.18001ac00
mov esi, eax
cmp eax, 2
jne 0x18001b470
mov esi, 1
mov ecx, esi
call fcn.18001b540
test eax, eax
jne 0x18001b482
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
lea ebx, [rsi + 0x23]
test eax, eax
je 0x18001b45c
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x18001b45c
mov rcx, qword [rdi]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.18001b120
mov esi, eax
test eax, eax
jne 0x18001b45c
mov rcx, qword [rdi + 0x10]
lea r8d, [rbx - 4]
lea rdx, [rsp + 0x34]
call fcn.18001a7f0
mov esi, eax
test eax, eax
jne 0x18001b45c
mov rcx, qword [rdi + 0x10]
mov r8d, r12d
mov rdx, rbp
call fcn.18001ac00
mov esi, eax
lea rax, [rsp + 0x30]
mov byte [rax], 0
inc rax
dec ebx
jne 0x18001b461
mov rbx, qword [rsp + 0x68]
test esi, esi
jne 0x18001b47d
mov rsi, qword [rsp + 0x60]
xor eax, eax
jmp 0x18001b4a7
cmp esi, 3
jne 0x18001b492
mov rsi, qword [rsp + 0x60]
mov eax, 0xffffff2f
mov byte [rdi + 0x18], 3
jmp 0x18001b4a7
mov rsi, qword [rsp + 0x60]
mov eax, 0xffffff39
mov byte [rdi + 0x18], 2
jmp 0x18001b4a7
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x70
pop r12
pop rdi
pop rbp
ret
Function at 0x18001dd00
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x18001df03
test rdx, rdx
je 0x18001df03
mov eax, dword [rcx]
mov qword [rsp + 0x30], rsi
lea rsi, [rcx + 0xc]
mov byte [rax + rsi], pe_nt_image_headers64
inc dword [rcx]
mov ecx, dword [rcx]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r12
xor r12d, r12d
mov edi, reloc.WS2_32.dll_recv
cmp ecx, 0x38
jbe 0x18001dda9
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rsi
call fcn.180037c60
mov dword [rbx], 0x40
mov rdx, rsi
mov r8d, edi
nop dword [rax + rax]
mov eax, dword [rdx]
add rdx, 4
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
dec r8
mov dword [rdx - 4], ecx
jne 0x18001dd70
mov rdx, rsi
mov rcx, rbx
call fcn.18001c8c0
test eax, eax
jne 0x18001dee9
mov dword [rbx], r12d
mov ecx, dword [rbx]
mov r8d, gethostname
xor edx, edx
sub r8d, ecx
add rcx, rsi
call fcn.180037c60
mov r11, rsi
mov eax, dword [r11]
add r11, 4
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
dec rdi
mov dword [r11 - 4], ecx
jne 0x18001ddc1
mov r9d, dword [rbx + 4]
mov eax, dword [rbx + 8]
mov rdx, rsi
mov ecx, r9d
shr ecx, 0x1d
lea r8d, [rcx + rax*8]
lea eax, [r9*8]
mov rcx, rbx
mov dword [rbx + 4], eax
mov dword [rbx + 8], r8d
mov dword [rsi + 0x38], r8d
mov eax, dword [rbx + 4]
mov dword [rsi + 0x3c], eax
call fcn.18001c8c0
mov ecx, dword [rbx + 0x4c]
mov edx, ecx
mov r11d, eax
mov eax, dword [rbx + 0x50]
ror edx, 8
and edx, 0xff00ff00
rol ecx, 8
and ecx, 0xff00ff
or edx, ecx
mov ecx, eax
ror ecx, 8
mov dword [rbx + 0x4c], edx
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x54]
mov dword [rbx + 0x50], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x58]
mov dword [rbx + 0x54], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x5c]
mov dword [rbx + 0x58], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x5c], ecx
mov rax, qword [rbx + 0x4c]
mov qword [rbp], rax
mov rax, qword [rbx + 0x54]
mov qword [rbp + 8], rax
mov eax, dword [rbx + 0x5c]
mov dword [rbp + 0x10], eax
mov dword [rbx + 0x4c], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov dword [rbx + 0x5c], 0xc3d2e1f0
mov qword [rbx], r12
mov dword [rbx + 8], r12d
mov eax, r11d
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
Function at 0x18001eac0
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
jne 0x18001dfdb
mov eax, 0xffffff53
ret
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x18001ebf5
test rdx, rdx
je 0x18001ebf5
call fcn.18001e840
test eax, eax
jne 0x18001ebfa
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0x18], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x1c], ecx
mov rax, qword [rbx]
mov rcx, rbx
mov qword [rdi], rax
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
mov qword [rdi + 0x18], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x18001dfd0
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18001ec10
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
jne 0x18001ec1b
mov eax, 0xffffff53
ret
xor edx, edx
xor eax, eax
mov qword [rcx + 0x70], rax
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rdx
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
ret
Function at 0x180020530
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
xor edi, edi
test rcx, rcx
je 0x180020561
mov rax, qword [0x1800b2190]
test rax, rax
je 0x180020558
call rax
jmp 0x18002055d
call fcn.1800337e4
mov qword [rbx + 0x18], rdi
mov rax, qword [0x1800b2188]
mov ecx, 0x1d0
test rax, rax
je 0x180020576
call rax
jmp 0x18002057b
call fcn.1800339ec
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x180020594
mov eax, 0xffffff83
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, 0x1d0
mov rcx, rax
call fcn.180037c60
mov r11, qword [rbx + 0x18]
add r11, 0xf0
je 0x180020640
mov rax, qword [rbx + 0x48]
mov dword [r11 + 0x4c], 0x67452301
mov dword [r11 + 0x50], 0xefcdab89
mov dword [r11 + 0x54], 0x98badcfe
mov dword [r11 + 0x58], 0x10325476
mov qword [r11], rdi
mov qword [r11 + 0x60], rax
mov dword [r11 + 8], edi
mov rcx, qword [rbx + 0x18]
add rcx, 0x88
je 0x180020640
mov rax, qword [rbx + 0x48]
mov dword [rcx + 0x4c], 0x67452301
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x58], 0x10325476
mov dword [rcx + 0x5c], 0xc3d2e1f0
mov qword [rcx + 0x60], rax
mov qword [rcx], rdi
mov dword [rcx + 8], edi
mov rcx, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x48]
add rcx, 0x158
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18001e030
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180025190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov esi, r9d
mov rdi, r8
mov rbp, rdx
shr esi, 4
mov r12, rcx
test rcx, rcx
je 0x18000500a
test rdx, rdx
je 0x18000500a
test r8, r8
je 0x18000500a
test esi, esi
je 0x180005006
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0xf8]
movzx eax, bl
dec esi
or al, dil
test al, 7
jne 0x180004f9f
mov rax, qword [rdi]
xor qword [rbx], rax
mov rax, qword [rdi + 8]
xor qword [rbx + 8], rax
jmp 0x180004fd8
mov rdx, rdi
mov rcx, rbx
mov r8d, 4
sub rdx, rbx
nop
movzx eax, byte [rdx + rcx]
add rcx, 4
xor byte [rcx - 4], al
movzx eax, byte [rdx + rcx - 3]
xor byte [rcx - 3], al
movzx eax, byte [rdx + rcx - 2]
xor byte [rcx - 2], al
movzx eax, byte [rdx + rcx - 1]
xor byte [rcx - 1], al
dec r8
jne 0x180004fb0
mov r8, rbx
mov rdx, rbx
mov rcx, r12
call fcn.180003c10
mov rax, qword [rbx]
add rbp, 0x10
mov qword [rbp - 0x10], rax
mov rax, qword [rbx + 8]
add rdi, 0x10
mov qword [rbp - 8], rax
test esi, esi
jne 0x180004f83
mov rbx, qword [rsp + 0x30]
xor eax, eax
jmp 0x18000500f
mov eax, 0xffffff53
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov edi, r9d
mov rbp, rdx
mov r12, rcx
test rcx, rcx
je 0x18000c8da
test rdx, rdx
je 0x18000c8da
test r8, r8
je 0x18000c8da
shr edi, 3
test edi, edi
je 0x18000c8c7
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
lea rsi, [r8 + 2]
lea rbx, [rcx + 0x180]
nop word [rax + rax]
lea rcx, [rsi - 2]
dec edi
movzx eax, cl
or al, bl
test al, 7
jne 0x18000c867
mov rax, qword [rcx]
xor qword [rbx], rax
jmp 0x18000c89c
movzx eax, byte [rcx]
xor byte [rbx], al
movzx eax, byte [rsi - 1]
xor byte [rbx + 1], al
movzx eax, byte [rsi]
xor byte [rbx + 2], al
movzx eax, byte [rsi + 1]
xor byte [rbx + 3], al
movzx eax, byte [rsi + 2]
xor byte [rbx + 4], al
movzx eax, byte [rsi + 3]
xor byte [rbx + 5], al
movzx eax, byte [rsi + 4]
xor byte [rbx + 6], al
movzx eax, byte [rsi + 5]
xor byte [rbx + 7], al
mov r8, rbx
mov rdx, rbx
mov rcx, r12
call fcn.18000c590
mov r11, qword [rbx]
add rbp, 8
mov qword [rbp - 8], r11
add rsi, 8
test edi, edi
jne 0x18000c850
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, 0xffffff53
add rsp, 0x20
pop r12
ret
sub rsp, 0x28
movzx r10d, byte [rcx + 0x2dc]
dec r10d
je 0x1800251f9
sub r10d, 3
je 0x1800251e5
sub r10d, 2
je 0x1800251d1
cmp r10d, 6
je 0x1800251bd
mov eax, 0xfffffec6
add rsp, 0x28
ret
mov rcx, qword [rcx + 0xc0]
movzx r9d, r9w
add rsp, 0x28
jmp fcn.18001a2e0
mov rcx, qword [rcx + 0xb0]
movzx r9d, r9w
add rsp, 0x28
jmp 0x180004f30
mov rcx, qword [rcx + 0xa8]
movzx r9d, r9w
add rsp, 0x28
jmp 0x18000c7f0
mov rcx, qword [rcx + 0xa0]
movzx r9d, r9w
call fcn.1800051d0
xor eax, eax
add rsp, 0x28
ret