joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069650
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
call fcn.1400694a0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140069695
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140069695
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140069440
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, rax
call fcn.140054b30
mov ecx, dword [rbx]
mov rbx, qword [rsp + 0x30]
mov dword [rax], ecx
mov eax, 0xffffffff
add rsp, 0x20
pop rdi
ret

Function at 0x140069970
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rbx, r8
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov qword [rsp + 0x48], rax
test r8, r8
je 0x140069a22
call fcn.1400694a0
mov ecx, 0xffffffff
mov dword [rsp + 0x40], edi
shr rdi, 0x20
lea rdx, [rsp + 0x30]
cmp rbx, rcx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x44], edi
cmovbe ecx, ebx
mov rdx, rsi
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140069a0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x140069a22
cmp eax, 0x6d
je 0x140069a22
mov ecx, eax
call fcn.140069440
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140069a40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor eax, eax
mov rdi, r9
mov qword [rsp + 0x30], rax
mov rbx, r8
mov qword [rsp + 0x38], rax
mov rsi, rdx
mov qword [rsp + 0x48], rax
test r8, r8
je 0x140069ad4
call fcn.1400694a0
mov ecx, 0xffffffff
mov dword [rsp + 0x40], edi
shr rdi, 0x20
lea rdx, [rsp + 0x30]
cmp rbx, rcx
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x70]
mov dword [rsp + 0x44], edi
cmovbe ecx, ebx
mov rdx, rsi
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140069ad0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140069440
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140069af0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
test r8, r8
je 0x140069b6e
call fcn.1400694a0
mov ecx, 0xffffffff
mov qword [rsp + 0x20], 0
cmp rbx, rcx
lea r9, [rsp + 0x50]
mov rdx, rdi
cmovbe ecx, ebx
mov r8d, ecx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140069b5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x140069b6e
cmp eax, 0x6d
je 0x140069b6e
mov ecx, eax
call fcn.140069440
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140069e90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
xor ebx, ebx
mov rsi, rdx
mov r9d, ecx
test r8, r8
jne 0x140069eb4
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov edx, 0xffffffff
mov qword [rsp + 0x60], rdi
cmp r8, rdx
mov edi, edx
cmovbe rdi, r8
call fcn.140069480
test al, 8
je 0x140069eed
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x40], 0xffffffffffffffff
mov ecx, r9d
call fcn.1400694a0
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0x60]
test eax, eax
jne 0x140069f36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140069440
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret

Function at 0x14006a150
Capabilities:
Get mac address on windows

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rdi
mov rax, qword [0x140419c00]
xor rax, rbp
mov qword [rbp + 8], rax
mov rsi, rcx
mov dword [rbp], 0
xor ecx, ecx
lea rdx, [rbp]
mov dil, 1
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x14006a20a
mov eax, dword [rbp]
lea rdx, [rax + 0xf]
cmp rdx, rax
ja 0x14006a1a9
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400f4330
sub rsp, rdx
lea rdx, [rbp]
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x14006a20a
test rbx, rbx
je 0x14006a20a
test dil, dil
je 0x14006a20a
cmp dword [rbx + 0x1a4], 6
jne 0x14006a202
cmp dword [rbx + 0x194], 6
jne 0x14006a202
lea rdx, [rbx + 0x198]
mov r8d, 6
mov rcx, rsi
call fcn.14006a110
movzx edi, al
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14006a1d3
movzx eax, dil
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.1400f4390
mov rbx, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x14006b340
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x138
mov rax, qword [0x140419c00]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebp, r9d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14006b38d
lea rdx, [rsp + 0x20]
mov ecx, 0xf6
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
lea rcx, [rsp + 0x20]
cmove rcx, rbx
mov rbx, rcx
mov r9, rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x14006b3aa
mov eax, 0xffffffff
jmp 0x14006b3f0
mov r8d, dword [rsp + 0x180]
mov rcx, rsi
mov edx, r8d
and edx, 0x40
or edx, ebp
or edx, 0x302
call fcn.140057d90
mov edi, eax
test eax, eax
jns 0x14006b3e8
call fcn.140054b30
xor edx, edx
mov rcx, rsi
mov ebx, dword [rax]
call fcn.1400579e0
call fcn.140054b30
mov dword [rax], ebx
jmp 0x14006b3ee
inc dword [0x140c2332c]
mov eax, edi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400f4390
add rsp, 0x138
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a3400
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r9d, r9d
movsxd rbp, r8d
xor esi, esi
mov rdi, rdx
mov rbx, rcx
mov r14, rcx
test rcx, rcx
je 0x1400a35ab
mov rax, qword [rcx + 0x58]
lea r15, [rcx + 0x58]
test rax, rax
je 0x1400a3461
mov r8, rdx
mov dword [rsp + 0x28], 1
lea edx, [rsi + 2]
mov dword [rsp + 0x20], esi
mov r9d, ebp
call rax
mov r9d, eax
test eax, eax
jle 0x1400a35ae
mov qword [rsp + 0x50], r12
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x1400a347a
cmp byte [rbx + 0x7c], 3
je 0x1400a347a
mov rbx, rax
jmp 0x1400a3466
lea r12, [0x140000000]
test r9d, r9d
js 0x1400a357e
mov rax, qword [rbx + 8]
test rax, rax
je 0x1400a34b3
mov r10, qword [rax + 0x110]
test r10, r10
je 0x1400a34b3
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call r10
mov r9d, eax
jmp case.default.0x1400a34d0
movzx eax, byte [rbx + 0x7c]
add eax, 0xfffffffe
cmp eax, 6
ja case.default.0x1400a34d0
cdqe
mov ecx, dword [r12 + rax*4 + 0xa35c8]
add rcx, r12
jmp rcx
test esi, esi
jle case.default.0x1400a34d0
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.1400a2c80
mov r9d, eax
jmp case.default.0x1400a34d0
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call fcn.1400a2cc0
mov r9d, eax
jmp case.default.0x1400a34d0
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call fcn.1400a2d80
mov r9d, eax
jmp case.default.0x1400a34d0
mov r9, qword [rbx + 0x30]
test r9, r9
je case.0x1400a34d0.2
mov r8, rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r9, rax
jmp case.default.0x1400a34d0
mov r9, r14
mov r8d, ebp
mov rdx, rdi
mov rcx, rbx
call fcn.1400a2e70
mov r9d, eax
jmp case.default.0x1400a34d0
mov r8d, r9d
mov rdx, rdi
mov rcx, rbx
call fcn.1400a2d00
mov r9d, eax
jmp case.default.0x1400a34d0
mov r9d, 0xffffff52
cmp rbx, r14
je 0x1400a357e
mov rbx, qword [rbx + 0x10]
test r9d, r9d
mov eax, r9d
cmovle eax, esi
mov esi, eax
test rbx, rbx
jne 0x1400a3481
mov rax, qword [r15]
mov r12, qword [rsp + 0x50]
test rax, rax
je 0x1400a35ab
mov dword [rsp + 0x28], r9d
mov r8, rdi
mov r9d, ebp
mov dword [rsp + 0x20], 0
mov edx, 0x82
mov rcx, r14
call rax
mov r9d, eax
mov eax, r9d
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1400a8130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx r9d, byte [rcx + 0x228]
sub r9d, 4
je 0x1400a8164
sub r9d, 2
je 0x1400a815f
sub r9d, 1
je 0x1400a815a
cmp r9d, 1
je fcn.1400d68e0
mov eax, 0xffffff53
ret
jmp fcn.1400d68e0
jmp fcn.1400d3bb0
jmp fcn.1400d2190
Function at 0x1400acf60
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x20], rbx
mov byte [rsp + 0x18], r8b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
movzx eax, r8b
xor ecx, ecx
movzx r15d, dl
mov dword [rsp + 0x68], ecx
mov ebp, ecx
mov r13d, ecx
mov ebx, ecx
mov edi, dword [rsi + 0x7d8]
mov r14d, edi
lea r12d, [rcx + 0x50]
cmp dl, 0xcc
jne 0x1400acfd6
mov ecx, eax
sub ecx, 0x15
je 0x1400acfbc
sub ecx, 0x95
je 0x1400acfbc
sub ecx, 1
je 0x1400acfbc
cmp ecx, 2
jne 0x1400acfdc
mov eax, 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r15b, 0xc0
jne 0x1400acfbc
mov rcx, qword [rsi + 0x16c0]
mov edx, 0xa
call fcn.1400a8760
test rax, rax
je 0x1400acfbc
mov r8, qword [rax + 8]
xor r11d, r11d
mov r10d, r12d
test r8, r8
je 0x1400ad135
movzx r9d, byte [rsp + 0x70]
nop dword [rax + rax]
test ebx, ebx
jne 0x1400ad135
movzx eax, word [r8]
cmp eax, 0x1e
ja 0x1400ad128
mov edx, eax
mov rax, qword [rsi]
mov ecx, dword [rax + 0x11c]
bt ecx, edx
jb 0x1400ad128
sub edx, 0x15
je 0x1400ad073
sub edx, 2
je 0x1400ad067
sub edx, 1
je 0x1400ad05b
cmp edx, 1
jne 0x1400ad128
mov edx, 0xd3
lea eax, [rbx + 0x42]
jmp 0x1400ad07d
mov edx, 0xd2
mov eax, 0x30
jmp 0x1400ad07d
mov edx, 0x20e
mov eax, 0x20
jmp 0x1400ad07d
mov edx, 0xd1
mov eax, 0x1c
test ebp, ebp
jne 0x1400ad097
cmp word [rsi + 0x800], ax
ja 0x1400ad097
movzx ecx, ax
cmp r12d, ecx
jbe 0x1400ad097
mov ebp, edx
mov r12d, ecx
test r14d, r14d
jne 0x1400ad0a7
cmp word [rsi + 0x800], ax
cmove r14d, edx
movzx ecx, ax
test r13d, r13d
je 0x1400ad0b4
cmp r10d, ecx
jbe 0x1400ad0c3
cmp word [rsi + 0x800], ax
ja 0x1400ad0c3
mov r13d, edx
mov r10d, ecx
cmp r15b, 0xc0
jne 0x1400ad0f1
lea eax, [r9 - 7]
cmp eax, 0xa8
ja case.0x1400ad0ef.11
lea rbx, [0x140000000]
cdqe
movzx eax, byte [rbx + rax + 0xad1a4]
mov ecx, dword [rbx + rax*4 + 0xad19c]
add rcx, rbx
jmp rcx
cmp r15b, 0xcc
jne 0x1400ad128
mov ecx, r9d
sub ecx, 0x13
je case.0x1400ad0ef.7
sub ecx, 1
je case.0x1400ad0ef.7
sub ecx, 0x94
je case.0x1400ad0ef.7
cmp ecx, 1
je case.0x1400ad0ef.7
mov ebx, 1
jmp 0x1400ad128
cmp edi, edx
mov dword [rsp + 0x68], 1
mov ebx, r11d
sete bl
mov r8, qword [r8 + 8]
test r8, r8
jne 0x1400ad010
test edi, edi
jne 0x1400ad192
movzx eax, word [rsi + 0x800]
cmp r12d, eax
jne 0x1400ad150
lea ebx, [rdi + 1]
mov dword [rsi + 0x7d8], ebp
mov edi, ebp
test edi, edi
jne 0x1400ad192
mov dword [rsi + 0x7d8], r14d
lea ebx, [rdi + 1]
mov edi, r14d
test r14d, r14d
jne 0x1400ad192
mov edi, r11d
cmp r12d, r10d
jne 0x1400ad176
mov dword [rsi + 0x7d8], ebp
mov edi, ebp
test edi, edi
jne 0x1400ad192
mov dword [rsi + 0x7d8], r13d
mov edi, r13d
test r13d, r13d
jne 0x1400ad192
cmp dword [rsp + 0x68], r13d
cmovne ebx, r11d
mov eax, ebx
jmp 0x1400acfc1
Function at 0x1400b5760
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov r9d, eax
test r8d, r8d
jle 0x1400b5839
cmp r8d, 8
jb 0x1400b5839
mov qword [rsp + 0x10], rbx
lea r11, [rdx + 4]
mov qword [rsp], rdi
sub rcx, rdx
movsxd rbx, r8d
mov rdi, 0xfffffffffffffffc
and rbx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rdi, rdx
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r11 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r11 - 4]
lea r11, [r11 + 8]
punpcklbw xmm2, xmm0
lea rax, [rdi + r11]
punpcklwd xmm2, xmm0
add r9d, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r11 - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + r11 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rax, rbx
jl 0x1400b57b0
mov rdi, qword [rsp]
por xmm3, xmm4
mov rbx, qword [rsp + 0x10]
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
movsxd r11, r9d
movsxd r9, r8d
cmp r11, r9
jge 0x1400b5868
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
nop
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x1400b5850
add rsp, 8
ret

Function at 0x1400bcff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsxd rax, edx
lea r10, [rcx - 1]
add r10, rax
lea r9d, [rdx - 1]
mov ecx, 0xff
movzx ebx, byte [r10]
mov eax, ebx
sub eax, edx
add eax, r8d
shr eax, 0x1f
dec al
cmp r9d, ecx
cmovg r9d, ecx
xor r8d, r8d
movsxd r11, r9d
test r9d, r9d
jle 0x1400bd052
nop
mov edx, ebx
lea r10, [r10 - 1]
sub edx, r8d
movzx ecx, bl
xor cl, byte [r10 + 1]
inc r8d
shr edx, 0x1f
dec dl
and dl, cl
or al, dl
sub r11, 1
jne 0x1400bd030
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1400d0680
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400d0747
test rdx, rdx
je 0x1400d0747
mov eax, dword [rcx]
mov qword [rsp + 0x30], rdi
lea rdi, [rcx + 0xc]
mov byte [rax + rdi], 0x80
mov ecx, dword [rcx]
inc ecx
mov dword [rbx], ecx
cmp ecx, 0x38
jbe 0x1400d06e4
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov rdx, rdi
mov dword [rbx], 0x40
mov rcx, rbx
call fcn.1400cfdd0
xor ecx, ecx
mov dword [rbx], ecx
mov r8d, 0x38
xor edx, edx
sub r8d, ecx
add rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rbx + 4]
mov rdx, rdi
mov ecx, dword [rbx + 8]
mov eax, r8d
shr eax, 0x1d
lea eax, [rax + rcx*8]
mov rcx, rbx
mov dword [rbx + 8], eax
lea eax, [r8*8]
mov dword [rbx + 4], eax
mov dword [rdi + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0x3c], eax
call fcn.1400cfdd0
movups xmm0, xmmword [rbx + 0x4c]
mov rcx, rbx
movups xmmword [rsi], xmm0
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp 0x1400d05c0
mov rbx, qword [rsp + 0x38]
mov eax, 0xffffff53
add rsp, 0x20
pop rsi
ret
Function at 0x1400d36a0
Capabilities:
Hash data using sha224

Disassembly:
xor edx, edx
lea r8d, [rdx - 2]
jmp fcn.1400d36b0

Function at 0x1400d36b0
Capabilities:
Hash data using sha224

Disassembly:
test rcx, rcx
jne 0x1400d269b
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [rcx], 0xc1059ed8
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov dword [rcx + 4], 0x367cd507
mov dword [rcx + 8], 0x3070dd17
mov dword [rcx + 0xc], 0xf70e5939
mov dword [rcx + 0x10], 0xffc00b31
mov dword [rcx + 0x14], 0x68581511
mov dword [rcx + 0x18], 0x64f98fa7
mov dword [rcx + 0x1c], 0xbefa4fa4
ret
test rcx, rcx
jne 0x1400d36bb
mov eax, 0xffffff53
ret
mov qword [rcx + 0x70], rdx
jmp 0x1400d2690

Function at 0x1400d36d0
Capabilities:
Hash data using sha256

Disassembly:
xor edx, edx
lea r8d, [rdx - 2]
jmp fcn.1400d36e0

Function at 0x1400d36e0
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
jne 0x1400d26eb
mov eax, 0xffffff53
ret
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
test rcx, rcx
jne 0x1400d36eb
mov eax, 0xffffff53
ret
mov qword [rcx + 0x70], rdx
jmp 0x1400d26e0

Function at 0x1400d3700
Capabilities:
Hash data using sha224

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400d3812
test rdx, rdx
je 0x1400d3812
call fcn.1400d2730
test eax, eax
jne 0x1400d3817
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x18], ecx
mov rcx, rbx
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [rdi + 0x10], xmm1
mov eax, dword [rbx + 0x18]
mov dword [rdi + 0x18], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400d2690
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d38b0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400d39d5
test rdx, rdx
je 0x1400d39d5
call fcn.1400d2730
test eax, eax
jne 0x1400d39da
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0x18], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x1c], ecx
mov rcx, rbx
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400d26e0
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d3bd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
shr r8d, 3
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x1400d3c51
mov qword [rsp], rbx
sub r10, rcx
mov r11d, r8d
movabs rbx, 0xffff0000ffff
movabs r8, 0xff00ff00ff00ff
mov rcx, qword [r10 + r9]
lea r9, [r9 + 8]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r8
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, rbx
xor rcx, rdx
rol rcx, 0x20
mov qword [r9 - 8], rcx
sub r11, 1
jne 0x1400d3c01
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x1400d64d0
Capabilities:
Hash data using sha384

Disassembly:
xor edx, edx
lea r8d, [rdx - 2]
jmp fcn.1400d64e0

Function at 0x1400d64e0
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x1400d3c6b
mov eax, 0xffffff53
ret
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret
test rcx, rcx
jne 0x1400d64eb
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
jmp 0x1400d3c60
Function at 0x1400d65f0
Capabilities:
Hash data using sha384

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400d663b
test rdx, rdx
je 0x1400d663b
call fcn.1400d3f00
test eax, eax
jne 0x1400d6640
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400d3c60
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d9520
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
test byte [0x140c28fe8], 8
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x1400d954c
xor ecx, ecx
call fcn.1400d95d0
test eax, eax
je 0x1400d95b3
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400d9581
mov eax, 0xffffff99
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1400d95a8
mov eax, 0xffffff98
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400d9bf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
xor ebx, ebx
mov esi, edx
xor r11d, r11d
mov edi, edx
mov rbp, rcx
add rsi, 0xfffffffffffffff8
je 0x1400d9c8d
mov qword [rsp + 0x10], r14
lea eax, [rdi - 8]
mov r14d, 8
mov edx, r14d
cmp rsi, rdx
cmovbe edx, eax
nop dword [rax]
xor r8d, r8d
test edx, edx
jle 0x1400d9c6c
mov eax, r11d
add rax, rbp
mov r10d, edx
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + r10]
movzx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r8d, edx
sub r9, 1
jne 0x1400d9c50
test r8d, r8d
jne 0x1400d9c71
mov ebx, 3
add r11d, r14d
mov edx, edi
sub edx, r11d
mov ecx, r11d
cmp edx, r14d
cmova edx, r14d
cmp rcx, rsi
jb 0x1400d9c30
mov r14, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x28]
pop rdi
ret