joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420630
Capabilities:
Hash data using sha512

Disassembly:
push rdi
push rbx
sub rsp, 0x68
mov rbx, rcx
test rcx, rcx
je 0x420722
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x4206f8
xor eax, eax
vmovdqu xmm3, xmmword [0x005af340]
mov qword [rsp + 0x29], 0
vinsertf128 ymm0, ymm3, xmmword [0x005af350], 1
lea r8, [rcx + 0x40]
mov word [rsp + 0x3e], ax
mov ecx, 0x16
xor eax, eax
mov rdi, r8
mov byte [rsp + 0x20], dl
vmovdqu xmm4, xmmword [0x005af360]
rep stosq qword [rdi], rax
mov byte [rsp + 0x31], 0
mov qword [rsp + 0x21], 0x10100
vmovdqu xmm2, xmmword [rsp + 0x20]
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
vinsertf128 ymm1, ymm2, xmmword [rsp + 0x30], 1
vxorps ymm0, ymm0, ymm1
vextractf128 xmmword [rbx + 0x10], ymm0, 1
vmovups xmmword [rbx], xmm0
vinsertf128 ymm0, ymm4, xmmword [0x005af370], 1
vextractf128 xmmword [rbx + 0x30], ymm0, 1
vmovups xmmword [rbx + 0x20], xmm0
mov dword [rbx + 0xe4], edx
vzeroupper
add rsp, 0x68
pop rbx
pop rdi
ret
mov edx, 0xf0
call fcn.00422b50
cmp byte [rbx + 0xe8], 0
je 0x420713
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x4206ea
mov eax, 0xffffffff
jmp 0x4206ea

Function at 0x420730
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
push rdi
sub rsp, 0xe0
mov r10, r8
mov r12, rcx
mov r8, r9
test rcx, rcx
je 0x4208b9
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x420888
lea rax, [r9 - 1]
cmp rax, 0x3f
ja 0x420888
test r10, r10
je 0x420888
mov byte [rsp + 0x21], r9b
xor eax, eax
vmovdqu xmm3, xmmword [0x005af340]
vinsertf128 ymm0, ymm3, xmmword [0x005af350], 1
lea r9, [rcx + 0x40]
mov word [rsp + 0x3e], ax
xor eax, eax
mov ecx, 0x16
lea r13, [rsp + 0x60]
mov rdi, r9
mov byte [rsp + 0x20], dl
vmovdqu xmm4, xmmword [0x005af360]
rep stosq qword [rdi], rax
mov rdi, r13
mov ecx, 0x10
mov qword [rsp + 0x2a], 0
rep stosq qword [rdi], rax
mov rcx, r13
mov qword [rsp + 0x22], 0x101
vmovdqu xmm2, xmmword [rsp + 0x20]
mov dword [r12 + 0xe4], edx
mov rdx, r10
mov qword [rsp + 0x32], 0
mov dword [rsp + 0x3a], 0
vinsertf128 ymm1, ymm2, xmmword [rsp + 0x30], 1
vxorps ymm0, ymm0, ymm1
vextractf128 xmmword [r12 + 0x10], ymm0, 1
vmovups xmmword [r12], xmm0
vinsertf128 ymm0, ymm4, xmmword [0x005af370], 1
vextractf128 xmmword [r12 + 0x30], ymm0, 1
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
vmovups xmmword [r12 + 0x20], xmm0
vzeroupper
call sub.msvcrt.dll_memcpy
mov r8d, pe_nt_image_headers64
mov rdx, r13
mov rcx, r12
call fcn.00420380
mov edx, pe_nt_image_headers64
mov rcx, r13
call fcn.00422b50
xor eax, eax
add rsp, 0xe0
pop rdi
pop r12
pop r13
ret
mov edx, 0xf0
mov rcx, r12
call fcn.00422b50
cmp byte [r12 + 0xe8], 0
je 0x4208a9
mov qword [r12 + 0x58], 0xffffffffffffffff
mov qword [r12 + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
jmp 0x420874
mov eax, 0xffffffff
jmp 0x420874
Function at 0x426530
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r9, r8
test rcx, rcx
je 0x426580
test rdx, rdx
je 0x426580
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx], rax
sete al
movzx eax, al
neg eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xffffffff
jmp 0x426571
Function at 0x4381e0
Capabilities:
Hash data using sha512

Disassembly:
push r13
push r12
sub rsp, 0x28
vmovdqu xmm1, xmmword [0x005afbc0]
vpxor xmm0, xmm0, xmm0
vmovdqu xmm2, xmmword [0x005afbd0]
vmovdqu xmm3, xmmword [0x005afbe0]
vmovdqu xmm4, xmmword [0x005afbf0]
mov r12, rcx
mov r13, rdx
vmovups xmmword [rcx + 0x80], xmm1
mov rdx, r8
vmovups xmmword [rcx + 0x90], xmm2
mov r8, r9
vmovups xmmword [rcx + 0xa0], xmm3
vmovups xmmword [rcx + 0xb0], xmm4
vmovups xmmword [rcx + 0xc0], xmm0
mov qword [rcx + 0xd0], 0
call fcn.00437e30
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop r12
pop r13
jmp fcn.00437f40
Function at 0x439510
Capabilities:
Hash data using sha256

Disassembly:
push rdi
sub rsp, 0x20
lea eax, [rdx - 1]
mov r8, rcx
cmp al, 0x1f
ja 0x439590
mov byte [rsp], dl
mov eax, 0x101
lea rdx, [rcx + 0x20]
mov word [rsp + 2], ax
mov ecx, 0x14
xor eax, eax
mov rdi, rdx
mov byte [rsp + 1], 0
rep stosq qword [rdi], rax
mov dword [rsp + 4], 0
mov qword [rsp + 8], 0
vmovdqu xmm1, xmmword [rsp]
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
vinsertf128 ymm0, ymm1, xmmword [rsp + 0x10], 1
vxorps ymm0, ymm0, ymmword [0x005afe00]
vmovdqu ymmword [r8], ymm0
vzeroupper
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffffff
jmp 0x439582

Function at 0x43a410
Capabilities:
Hash data using sha256

Disassembly:
push rdi
push rbx
sub rsp, 0x88
mov eax, edx
mov r10, rcx
movzx edx, r9b
lea ecx, [rax - 1]
cmp cl, 0x1f
ja 0x43a5c6
lea ecx, [r9 - 1]
cmp cl, 0x1f
ja 0x43a5bf
test r8, r8
je 0x43a5bf
mov byte [rsp + 0x20], al
mov eax, 0x101
mov ecx, 0x14
mov byte [rsp + 0x21], r9b
lea r9, [r10 + 0x20]
mov word [rsp + 0x22], ax
mov rdi, r9
xor eax, eax
rep stosq qword [rdi], rax
lea rbx, [rsp + 0x40]
mov rax, r8
mov dword [rsp + 0x24], 0
mov qword [rsp + 0x28], 0
mov r9, rbx
vmovdqu xmm1, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
vinsertf128 ymm0, ymm1, xmmword [rsp + 0x30], 1
vxorps ymm0, ymm0, ymmword [0x005afe00]
mov qword [rsp + 0x40], 0
vmovdqu ymmword [r10], ymm0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
cmp edx, 8
jae 0x43a598
xor ecx, ecx
test dl, 4
jne 0x43a580
test dl, 2
jne 0x43a568
and edx, 1
jne 0x43a558
mov r8d, 0x40
mov rdx, rbx
mov rcx, r10
vzeroupper
call fcn.0043a310
mov rax, rbx
nop word [rax + rax]
lea rdi, [rsp + 0x80]
mov rdx, rax
add rax, 1
mov byte [rdx], 0
cmp rax, rdi
jne 0x43a530
xor eax, eax
add rsp, 0x88
pop rbx
pop rdi
ret
movzx eax, byte [rax + rcx]
mov byte [r9 + rcx], al
jmp 0x43a513
movzx r8d, word [rax + rcx]
mov word [r9 + rcx], r8w
add rcx, 2
and edx, 1
je 0x43a513
jmp 0x43a558
mov ecx, dword [rax]
mov dword [r9], ecx
mov ecx, 4
test dl, 2
je 0x43a50e
jmp 0x43a568
mov r11d, edx
xor eax, eax
and r11d, 0xfffffff8
mov ecx, eax
add eax, 8
mov r9, qword [r8 + rcx]
mov qword [rbx + rcx], r9
cmp eax, r11d
jb 0x43a5a1
lea r9, [rbx + rax]
add rax, r8
jmp 0x43a502
mov eax, 0xffffffff
jmp 0x43a549
mov eax, 0xffffffff
jmp 0x43a549
Function at 0x4a6030
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0x48
jmp fcn.004a3150
Function at 0x4d9470
Capabilities:
Hash data using sha256

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x140
xor eax, eax
vmovdqu xmm3, xmmword [0x005e1860]
vinsertf128 ymm0, ymm3, xmmword [0x005e1870], 1
vmovdqu xmm4, xmmword [rdx]
vmovdqu xmm5, xmmword [rdx + 0x10]
mov rsi, r8
mov r13, rcx
mov ecx, 0x12
mov qword [rsp + 0x20], 0x1012020
lea r8, [rsp + 0xa0]
vmovups xmmword [rsp + 0x40], xmm4
mov rdi, r8
vmovups xmmword [rsp + 0x50], xmm5
rep stosq qword [rdi], rax
lea r12, [rsp + 0x80]
mov qword [rsp + 0x28], 0
vmovdqu xmm2, xmmword [rsp + 0x20]
lea r8, [rsp + 0x40]
mov rcx, r12
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rdx, r8
vinsertf128 ymm1, ymm2, xmmword [rsp + 0x30], 1
vxorps ymm0, ymm0, ymm1
mov qword [rsp + 0x60], 0
vextractf128 xmmword [rsp + 0x90], ymm0, 1
vmovups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x68], 0
mov dword [rdi], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
vzeroupper
call fcn.004d8fc0
mov rdx, r13
mov rcx, r12
call fcn.004d8fc0
mov eax, dword [rsp + 0x130]
lea r13, [rsp + 0xb0]
cmp eax, 0x40
ja 0x4d9608
add dword [rsp + 0xa0], eax
mov ebx, pe_nt_image_headers64
mov ecx, eax
mov dword [rsp + 0xa8], 0xffffffff
sub ebx, eax
add rcx, r13
mov eax, ebx
shr eax, 2
je 0x4d95ac
sub eax, 1
xor edx, edx
lea r8, [rax*4 + 4]
call sub.msvcrt.dll_memset
mov rcx, rax
mov edx, ebx
and edx, 3
je 0x4d95cc
mov eax, ebx
sub eax, edx
cmp ebx, eax
jbe 0x4d95cc
sub edx, 1
add rcx, rax
lea r8, [rdx + 1]
xor edx, edx
call sub.msvcrt.dll_memset
mov rdx, r13
mov rcx, r12
call fcn.004d7d50
vmovdqu xmm1, xmmword [rsp + 0x80]
vmovdqu xmm2, xmmword [rsp + 0x90]
vmovups xmmword [rsi], xmm1
vmovups xmmword [rsi + 0x10], xmm2
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
add dword [rsp + 0xa0], 0x40
mov rdx, r13
mov rcx, r12
call fcn.004d7d50
mov edi, dword [rsp + 0x130]
lea ebx, [rdi - 0x40]
mov eax, ebx
mov dword [rsp + 0x130], ebx
shr eax, 2
je 0x4d964e
lea rdx, [rsp + 0xf0]
sub eax, 1
mov rcx, r13
lea r8, [rax*4 + 4]
call sub.msvcrt.dll_memmove
mov edx, ebx
and edx, 3
je 0x4d967a
mov eax, ebx
sub eax, edx
cmp ebx, eax
jbe 0x4d967a
lea rcx, [r13 + rax]
sub edx, ebx
lea r8d, [rdi + rdx - 0x41]
lea rdx, [rsp + rax + 0xf0]
add r8, 1
call sub.msvcrt.dll_memmove
mov eax, dword [rsp + 0x130]
jmp 0x4d9572
Function at 0x4dbf00
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
vmovdqu xmm0, xmmword [0x005e18a0]
vmovdqu xmm1, xmmword [0x005e18b0]
lea r12, [rsp + 0x5f]
mov r14, rcx
mov r13, rdx
and r12, 0xffffffffffffffc0
mov rbx, r8
vmovups xmmword [r12 + 0x40], xmm0
vmovups xmmword [r12 + 0x50], xmm1
mov qword [r12 + 0x60], r8
cmp r8, 0x3f
jbe 0x4dc020
vmovdqu xmm2, xmmword [rdx]
lea rdi, [r12 + 0x40]
vmovdqu xmm3, xmmword [rdx + 0x10]
lea r15, [r13 + 0x40]
mov r8, rdi
mov rcx, rdi
vmovdqu xmm4, xmmword [rdx + 0x20]
vmovups xmmword [r12], xmm2
vmovdqu xmm5, xmmword [rdx + 0x30]
mov rdx, r12
vmovups xmmword [r12 + 0x10], xmm3
vmovups xmmword [r12 + 0x20], xmm4
vmovups xmmword [r12 + 0x30], xmm5
call fcn.004e1030
lea r8, [rbx - 0x40]
cmp r8, 0x3f
jbe 0x4dbfec
add rbx, 0xffffffffffffff80
mov rsi, r15
mov rbp, rbx
shr rbp, 6
lea rdx, [rbp + 2]
shl rdx, 6
add r13, rdx
nop word [rax + rax]
mov rdx, rsi
mov r8, rdi
mov rcx, rdi
call fcn.004e1030
add rsi, 0x40
cmp rsi, r13
jne 0x4dbfc0
lea rax, [rbp + 1]
shl rbp, 6
shl rax, 6
sub rbx, rbp
add r15, rax
mov r8, rbx
mov rdx, r15
mov rcx, r12
call sub.msvcrt.dll_memcpy
mov rdx, r14
mov rcx, r12
call fcn.004dbd40
nop
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
call sub.msvcrt.dll_memcpy
jmp 0x4dbff7
Function at 0x4f4f60
Capabilities:
Hash data using sha256

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
movsxd r8, r8d
call fcn.004dbf00
mov r8d, 0x20
mov rdx, r12
mov rcx, r12
add rsp, 0x20
pop r12
jmp fcn.004dbf00
Function at 0x4f6fa0
Capabilities:
Hash data using sha256

Disassembly:
push r12
push rsi
push rbx
add rsp, 0xffffffffffffff80
vmovups xmmword [rsp + 0x60], xmm6
vmovups xmmword [rsp + 0x70], xmm8
vmovdqu xmm8, xmmword [0x005e2140]
xor r8d, r8d
vmovdqu xmm6, xmmword [0x005e2150]
lea r12, [rsp + 0x20]
mov rbx, rcx
mov rsi, rdx
vmovups xmmword [rsp + 0x20], xmm8
mov rcx, r12
vmovups xmmword [rsp + 0x30], xmm6
call fcn.004f4fb0
lea rdx, [rsi + 0x40]
xor r8d, r8d
call fcn.004f4fb0
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
vmovdqu xmm2, xmmword [0x005e2120]
vmovups xmmword [rbx], xmm8
vmovdqu xmm3, xmmword [0x005e2130]
vmovups xmmword [rbx + 0x10], xmm6
vmovups xmmword [rsp + 0x40], xmm2
vmovups xmmword [rsp + 0x50], xmm3
call fcn.004f4fb0
vmovdqu xmm0, xmmword [0x005e2160]
vmovdqu xmm4, xmmword [rbx]
vmovdqu xmm5, xmmword [rbx + 0x10]
vmovups xmm6, xmmword [rsp + 0x60]
vpshufb xmm1, xmm4, xmm0
vmovups xmmword [rbx], xmm1
vmovups xmm8, xmmword [rsp + 0x70]
vpshufb xmm0, xmm5, xmm0
vmovups xmmword [rbx + 0x10], xmm0
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop r12
ret
Function at 0x51e5a0
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x80]
and eax, 0x3f
mov rbx, rcx
mov rsi, rdx
lea ecx, [rax + 1]
mov byte [rbx + rax], pe_nt_image_headers64
lea rdi, [rbx + 0x40]
mov eax, ecx
add rax, rbx
cmp ecx, 0x20
jbe 0x51e6c0
mov edx, 0x40
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x51e730
mov ecx, edx
sub edx, 1
mov qword [rax + rcx - 8], 0
cmp edx, 8
jb 0x51e608
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov qword [rax + r8], r9
cmp ecx, edx
jb 0x51e5fa
mov rdx, rdi
mov rcx, rbx
call fcn.0051bdf0
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rdx, rax
shr rdx, 0x3d
bswap rdx
mov qword [rbx + 0x30], rdx
shl rax, 3
bswap rax
mov qword [rbx + 0x38], rax
mov rdx, rdi
mov rcx, rbx
call fcn.0051bdf0
lea rax, [rsi + 0x20]
cmp rdi, rax
jae 0x51e683
lea rax, [rbx + 0x60]
cmp rsi, rax
jb 0x51e760
vmovdqu xmm1, xmmword [rbx + 0x40]
vinsertf128 ymm0, ymm1, xmmword [rbx + 0x50], 1
vmovups xmmword [rsi], xmm0
vextractf128 xmmword [rsi + 0x10], ymm0, 1
vmovdqu xmm2, xmmword [rbx + 0x60]
vinsertf128 ymm0, ymm2, xmmword [rbx + 0x70], 1
vmovups xmmword [rsi + 0x20], xmm0
vextractf128 xmmword [rsi + 0x30], ymm0, 1
vzeroupper
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x20
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x51e700
mov ecx, edx
sub edx, 1
mov qword [rax + rcx - 8], 0
cmp edx, 8
jb 0x51e632
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov qword [rax + r8], r9
cmp ecx, edx
jb 0x51e6eb
jmp 0x51e632
test dl, 4
jne 0x51e7a7
test edx, edx
je 0x51e632
mov byte [rax], 0
test dl, 2
je 0x51e632
xor ecx, ecx
mov word [rax + rdx - 2], cx
jmp 0x51e632
test dl, 4
jne 0x51e7ba
test edx, edx
je 0x51e608
mov byte [rax], 0
test dl, 2
je 0x51e608
xor r8d, r8d
mov word [rax + rdx - 2], r8w
jmp 0x51e608
mov rax, qword [rbx + 0x40]
mov qword [rsi], rax
mov rax, qword [rbx + 0x48]
mov qword [rsi + 8], rax
mov rax, qword [rbx + 0x50]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x58]
mov qword [rsi + 0x18], rax
mov rax, qword [rbx + 0x60]
mov qword [rsi + 0x20], rax
mov rax, qword [rbx + 0x68]
mov qword [rsi + 0x28], rax
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x30], rax
mov rax, qword [rbx + 0x78]
mov qword [rsi + 0x38], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x51e632
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x51e608
Function at 0x51ea00
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x80]
and eax, 0x3f
mov rbx, rcx
mov rsi, rdx
lea ecx, [rax + 1]
mov byte [rbx + rax], pe_nt_image_headers64
lea rdi, [rbx + 0x40]
mov eax, ecx
add rax, rbx
cmp ecx, 0x20
jbe 0x51eb20
mov edx, 0x40
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x51eb90
mov ecx, edx
sub edx, 1
mov qword [rax + rcx - 8], 0
cmp edx, 8
jb 0x51ea68
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov qword [rax + r8], r9
cmp ecx, edx
jb 0x51ea5a
mov rdx, rdi
mov rcx, rbx
call fcn.0051d410
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rax, qword [rbx + 0x80]
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rdx, rax
shr rdx, 0x3d
bswap rdx
mov qword [rbx + 0x30], rdx
shl rax, 3
bswap rax
mov qword [rbx + 0x38], rax
mov rdx, rdi
mov rcx, rbx
call fcn.0051d410
lea rax, [rsi + 0x20]
cmp rdi, rax
jae 0x51eae3
lea rax, [rbx + 0x60]
cmp rsi, rax
jb 0x51ebc0
vmovdqu xmm1, xmmword [rbx + 0x40]
vinsertf128 ymm0, ymm1, xmmword [rbx + 0x50], 1
vmovups xmmword [rsi], xmm0
vextractf128 xmmword [rsi + 0x10], ymm0, 1
vmovdqu xmm2, xmmword [rbx + 0x60]
vinsertf128 ymm0, ymm2, xmmword [rbx + 0x70], 1
vmovups xmmword [rsi + 0x20], xmm0
vextractf128 xmmword [rsi + 0x30], ymm0, 1
vzeroupper
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x20
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x51eb60
mov ecx, edx
sub edx, 1
mov qword [rax + rcx - 8], 0
cmp edx, 8
jb 0x51ea92
and edx, 0xfffffff8
xor ecx, ecx
mov r8d, ecx
add ecx, 8
mov qword [rax + r8], r9
cmp ecx, edx
jb 0x51eb4b
jmp 0x51ea92
test dl, 4
jne 0x51ec07
test edx, edx
je 0x51ea92
mov byte [rax], 0
test dl, 2
je 0x51ea92
xor ecx, ecx
mov word [rax + rdx - 2], cx
jmp 0x51ea92
test dl, 4
jne 0x51ec1a
test edx, edx
je 0x51ea68
mov byte [rax], 0
test dl, 2
je 0x51ea68
xor r8d, r8d
mov word [rax + rdx - 2], r8w
jmp 0x51ea68
mov rax, qword [rbx + 0x40]
mov qword [rsi], rax
mov rax, qword [rbx + 0x48]
mov qword [rsi + 8], rax
mov rax, qword [rbx + 0x50]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x58]
mov qword [rsi + 0x18], rax
mov rax, qword [rbx + 0x60]
mov qword [rsi + 0x20], rax
mov rax, qword [rbx + 0x68]
mov qword [rsi + 0x28], rax
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x30], rax
mov rax, qword [rbx + 0x78]
mov qword [rsi + 0x38], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x51ea92
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x51ea68
Function at 0x5395d4
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
xor rcx, rcx
mov ecx, edx
shr ecx, 6
mov rax, 0x40
movdqa xmm0, xmmword [rdi]
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm4, xmmword [rsi]
movdqa xmm5, xmmword [rsi + 0x10]
movdqa xmm8, xmmword [rsi + 0x20]
movdqa xmm9, xmmword [rsi + 0x30]
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm8
pxor xmm3, xmm9
movdqa xmmword [rdi], xmm0
movdqa xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi + 0x20], xmm2
movdqa xmmword [rdi + 0x30], xmm3
add rdi, rax
add rsi, rax
dec ecx
jne 0x5395f2
mov rdi, r10
mov rsi, r11
ret

Function at 0x539650
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
xor rcx, rcx
mov ecx, esi
shr ecx, 1
movdqa xmm0, xmmword [rdi]
movdqa xmm12, xmm0
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm13, xmm1
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm14, xmm2
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm15, xmm3
movdqa xmm4, xmm1
paddd xmm4, xmm0
movdqa xmm5, xmm4
pslld xmm4, 7
psrld xmm5, 0x19
pxor xmm3, xmm4
movdqa xmm4, xmm0
pxor xmm3, xmm5
paddd xmm4, xmm3
movdqa xmm5, xmm4
pslld xmm4, 9
psrld xmm5, 0x17
pxor xmm2, xmm4
movdqa xmm4, xmm3
pxor xmm2, xmm5
pshufd xmm3, xmm3, 0x93
paddd xmm4, xmm2
movdqa xmm5, xmm4
pslld xmm4, 0xd
psrld xmm5, 0x13
pxor xmm1, xmm4
movdqa xmm4, xmm2
pxor xmm1, xmm5
pshufd xmm2, xmm2, 0x4e
paddd xmm4, xmm1
movdqa xmm5, xmm4
pslld xmm4, 0x12
psrld xmm5, 0xe
pxor xmm0, xmm4
movdqa xmm4, xmm3
pxor xmm0, xmm5
pshufd xmm1, xmm1, 0x39
paddd xmm4, xmm0
movdqa xmm5, xmm4
pslld xmm4, 7
psrld xmm5, 0x19
pxor xmm1, xmm4
movdqa xmm4, xmm0
pxor xmm1, xmm5
paddd xmm4, xmm1
movdqa xmm5, xmm4
pslld xmm4, 9
psrld xmm5, 0x17
pxor xmm2, xmm4
movdqa xmm4, xmm1
pxor xmm2, xmm5
pshufd xmm1, xmm1, 0x93
paddd xmm4, xmm2
movdqa xmm5, xmm4
pslld xmm4, 0xd
psrld xmm5, 0x13
pxor xmm3, xmm4
movdqa xmm4, xmm2
pxor xmm3, xmm5
pshufd xmm2, xmm2, 0x4e
paddd xmm4, xmm3
movdqa xmm5, xmm4
pslld xmm4, 0x12
psrld xmm5, 0xe
pxor xmm0, xmm4
pshufd xmm3, xmm3, 0x39
pxor xmm0, xmm5
dec ecx
jne 0x53968a
paddd xmm0, xmm12
movdqa xmmword [rdi], xmm0
paddd xmm1, xmm13
movdqa xmmword [rdi + 0x10], xmm1
paddd xmm2, xmm14
movdqa xmmword [rdi + 0x20], xmm2
paddd xmm3, xmm15
movdqa xmmword [rdi + 0x30], xmm3
mov rdi, r10
mov rsi, r11
ret
Function at 0x53983c
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
xor rcx, rcx
mov ecx, esi
shr ecx, 1
movdqa xmm0, xmmword [rdi]
movdqa xmm12, xmm0
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm13, xmm1
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm14, xmm2
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm15, xmm3
paddd xmm0, xmm1
pxor xmm3, xmm0
pshuflw xmm3, xmm3, 0xb1
pshufhw xmm3, xmm3, 0xb1
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm3
pslld xmm3, 8
psrld xmm4, 0x18
pxor xmm3, xmm4
pshufd xmm0, xmm0, 0x93
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x39
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
pshuflw xmm3, xmm3, 0xb1
pshufhw xmm3, xmm3, 0xb1
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm3
pslld xmm3, 8
psrld xmm4, 0x18
pxor xmm3, xmm4
pshufd xmm0, xmm0, 0x39
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x93
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
dec ecx
jne 0x539876
paddd xmm0, xmm12
movdqa xmmword [rdi], xmm0
paddd xmm1, xmm13
movdqa xmmword [rdi + 0x10], xmm1
paddd xmm2, xmm14
movdqa xmmword [rdi + 0x20], xmm2
paddd xmm3, xmm15
movdqa xmmword [rdi + 0x30], xmm3
mov rdi, r10
mov rsi, r11
ret
Function at 0x56a220
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rdx
movsx rdx, byte [rdx]
test rdx, rdx
je 0x56a2e0
mov r8, rbp
mov esi, 0x1505
mov rax, rsi
add r8, 1
shl rax, 5
add rax, rdx
movsx rdx, byte [r8]
add rsi, rax
test rdx, rdx
jne 0x56a240
mov r8, qword [rcx + 0x10]
lea rdi, [0x005f8e60]
mov rax, rsi
xor edx, edx
add rcx, 0x18
div qword [rdi + r8*8]
mov rdi, qword [rcx - 0x10]
shl rdx, 4
add rdi, rdx
mov rbx, qword [rdi]
cmp rbx, rcx
jne 0x56a29a
jmp 0x56a2d0
cmp rbx, qword [rdi + 8]
je 0x56a2c0
mov rbx, qword [rbx + 8]
cmp qword [rbx - 8], rsi
jne 0x56a290
mov rdx, rbp
lea rcx, [rbx + 0x20]
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x56a290
mov rax, qword [rbx + 0x10]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
cmp rbx, qword [rdi + 8]
jne 0x56a29a
jmp 0x56a2b4
mov esi, 0x1505
jmp 0x56a25a

Function at 0x56d100
Capabilities:
Hash data using djb2

Disassembly:
test rcx, rcx
je 0x56d118
mov eax, dword [rcx]
test eax, eax
jne 0x56d118
add rcx, 0x10
jmp fcn.0056a220
xor eax, eax
ret