joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6fd01ac0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
test r9, r9
mov qword [rsp + 0x88], rdx
mov rbp, r8
mov rdi, r9
je 0x6fd01beb
lea rax, [r9 - 1]
xor r14d, r14d
xor r15d, r15d
mov rbx, qword [fcn.6fd28f30]
mov qword [rsp + 0x28], rax
lea r12, str._02X
jmp 0x6fd01b57
call sym.libSFTP.dll_osSuspendAllTasks
movzx r8d, byte [r13]
mov ecx, 2
mov dword [rsp + 0x24], r8d
call rbx
mov r8d, dword [rsp + 0x24]
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_fprintf
call sym.libSFTP.dll_osResumeAllTasks
cmp esi, 0xf
je 0x6fd01bb0
cmp qword [rsp + 0x28], r15
je 0x6fd01bb0
lea r15d, [r14 + 1]
cmp r15, rdi
mov r14, r15
jae 0x6fd01beb
lea r13, [rbp + r15]
mov esi, r14d
and esi, 0xf
jne 0x6fd01b10
call sym.libSFTP.dll_osSuspendAllTasks
mov ecx, 2
call rbx
mov rcx, qword [rsp + 0x88]
mov rdx, rax
call sub.msvcrt.dll_fputs
call sym.libSFTP.dll_osResumeAllTasks
call sym.libSFTP.dll_osSuspendAllTasks
movzx esi, byte [r13]
mov ecx, 2
call rbx
mov rdx, r12
mov rcx, rax
mov r8d, esi
call sub.msvcrt.dll_fprintf
call sym.libSFTP.dll_osResumeAllTasks
cmp qword [rsp + 0x28], r15
jne 0x6fd01b47
call sym.libSFTP.dll_osSuspendAllTasks
lea r15d, [r14 + 1]
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
mov r14, r15
lea rcx, [0x6fd2b186]
mov r9, rax
call sub.msvcrt.dll_fwrite
call sym.libSFTP.dll_osResumeAllTasks
cmp r15, rdi
jb 0x6fd01b57
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x6fd01c20
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor ecx, ecx
mov r9, r8
mov dword [rsp + 0x20], 0
mov r8, rdx
xor edx, edx
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret

Function at 0x6fd01c50
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x6fd01c66
xor edx, edx
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateThread]
call qword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x6fd03100
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x6fd03126
xor eax, eax
nop word [rax + rax]
movzx r10d, byte [rdx + rax]
xor r10b, byte [r8 + rax]
mov byte [rcx + rax], r10b
add rax, 1
cmp r9, rax
jne 0x6fd03110
ret
Function at 0x6fd037d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
test rcx, rcx
je 0x6fd039b3
test rdx, rdx
je 0x6fd039b3
cmp r8, 0x10
je 0x6fd03821
cmp r8, 0x18
je 0x6fd03a03
cmp r8, 0x20
mov eax, 0xe8
jne 0x6fd03912
mov dword [rcx], 0xe
mov r15d, 0x3c
mov r12d, 0x3c
jmp 0x6fd03833
mov dword [rcx], 0xa
mov r15d, 0x2c
mov r12d, 0x2c
shr r8, 2
xor eax, eax
nop dword [rax]
mov r9d, dword [rdx + rax*4]
mov dword [rcx + rax*4 + 4], r9d
add rax, 1
cmp r8, rax
ja 0x6fd03840
cmp r8d, r12d
jae 0x6fd03920
mov edx, r8d
mov r9d, r8d
mov r10, r8
lea edi, [r8 + 1]
not edx
lea r11, [0x6fd2bba0]
add edx, r12d
sub rdi, r9
lea rbp, [r9 + rdx + 1]
lea r13, [0x6fd2b260]
jmp 0x6fd038e1
mov edx, ebx
movzx r14d, bl
movzx esi, bh
shr edx, 0x18
movzx r14d, byte [r11 + r14]
shr ebx, 0x10
movzx edx, byte [r11 + rdx]
movzx ebx, bl
movzx ebx, byte [r11 + rbx]
shl r14d, 0x18
shl edx, 0x10
or edx, r14d
movzx r14d, byte [r11 + rsi]
shl ebx, 8
or edx, r14d
or ebx, edx
xor ebx, dword [r13 + rax*4]
mov dword [rcx + r9*4 + 4], ebx
sub r10, r8
xor ebx, dword [rcx + r10*4 + 4]
lea r10, [rdi + r9]
mov dword [rcx + r9*4 + 4], ebx
add r9, 1
cmp r9, rbp
je 0x6fd03920
lea eax, [r9 - 1]
xor edx, edx
mov ebx, dword [rcx + rax*4 + 4]
mov rax, r10
div r8
test rdx, rdx
je 0x6fd03885
cmp r8, 6
jbe 0x6fd03906
cmp rdx, 4
je 0x6fd039c5
mov dword [rcx + r9*4 + 4], ebx
jmp 0x6fd038c7
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r11d, [r12 - 1]
xor eax, eax
lea rsi, [r15 - 4]
add r11, 1
lea r9, [0x6fd2b2a0]
lea r8, [0x6fd2bba0]
jmp 0x6fd03954
mov edx, dword [rcx + rax*4 + 4]
mov dword [rcx + rax*4 + 0xf4], edx
add rax, 1
cmp r11, rax
je 0x6fd03910
cmp rax, 3
jbe 0x6fd03940
cmp rsi, rax
jbe 0x6fd03940
mov ebx, dword [rcx + rax*4 + 4]
mov edx, ebx
movzx r10d, bl
movzx edi, bh
shr edx, 0x18
movzx r10d, byte [r8 + r10]
shr ebx, 0x10
movzx edx, byte [r8 + rdx]
movzx ebx, bl
mov edx, dword [r9 + rdx*4]
ror edx, 8
xor edx, dword [r9 + r10*4]
movzx r10d, byte [r8 + rdi]
mov r10d, dword [r9 + r10*4]
rol r10d, 8
xor edx, r10d
movzx r10d, byte [r8 + rbx]
mov r10d, dword [r9 + r10*4]
rol r10d, 0x10
xor edx, r10d
mov dword [rcx + rax*4 + 0xf4], edx
jmp 0x6fd0394b
mov eax, 2
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ebx
movzx edx, bl
shr eax, 0x18
movzx edx, byte [r11 + rdx]
movzx eax, byte [r11 + rax]
shl eax, 0x18
or eax, edx
movzx edx, bh
shr ebx, 0x10
movzx edx, byte [r11 + rdx]
movzx ebx, bl
movzx ebx, byte [r11 + rbx]
shl edx, 8
or eax, edx
shl ebx, 0x10
or ebx, eax
mov dword [rcx + r9*4 + 4], ebx
jmp 0x6fd038c7
mov dword [rcx], 0xc
mov r15d, 0x34
mov r12d, 0x34
jmp 0x6fd03833
Function at 0x6fd03e10
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test r9, r9
mov rbp, rcx
mov r12, rdx
mov rbx, r8
mov rdi, r9
je 0x6fd03ea2
mov rax, qword [rcx + 0x88]
lea r13, [rcx + 0x44]
mov esi, 0x40
nop dword [rax]
lea rdx, [rax - 1]
cmp rdx, 0x3e
ja 0x6fd03eb0
mov r11, rsi
sub r11, rax
cmp rdi, r11
cmovbe r11, rdi
test rbx, rbx
je 0x6fd03e93
lea rcx, [r13 + rax]
test r12, r12
je 0x6fd03ee0
lea edx, [r11 - 1]
xor eax, eax
add rdx, 1
movzx r10d, byte [r12 + rax]
xor r10b, byte [rcx + rax]
mov byte [rbx + rax], r10b
add rax, 1
cmp rdx, rax
jne 0x6fd03e70
mov rax, qword [rbp + 0x88]
add r12, r11
add rbx, r11
add rax, r11
sub rdi, r11
mov qword [rbp + 0x88], rax
jne 0x6fd03e40
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rbp
call sym.libSFTP.dll_chachaProcessBlock
add dword [rbp + 0x34], 1
jne 0x6fd03ec2
add dword [rbp + 0x38], 1
mov qword [rbp + 0x88], 0
mov r11d, 0x40
xor eax, eax
jmp 0x6fd03e50
lea r8d, [r11 - 1]
xor eax, eax
add r8, 1
nop word [rax + rax]
movzx edx, byte [rcx + rax]
mov byte [rbx + rax], dl
add rax, 1
cmp r8, rax
jne 0x6fd03ef0
mov rax, qword [rbp + 0x88]
jmp 0x6fd03e90

Function at 0x6fd04050
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, 2
mov rdi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xc0]
mov rsi, rcx
shl r8, 0x20
mov qword [rsp + 0x98], rdx
mov r14, r9
mov rbx, qword [rsi + 0x18]
shr r8, 0x23
mov rcx, r8
mov qword [rsp + 0x28], r8
cmp r8, rbx
ja 0x6fd04012
lea r15, [rsp + 0x30]
not rcx
test r13, r13
mov r12, rcx
je 0x6fd04010
nop dword [rax]
cmp rbx, r13
mov r8, r15
mov rdx, r14
mov rcx, qword [rsp + 0x98]
cmova rbx, r13
call qword [rsi + 0x38]
test rbx, rbx
je 0x6fd03fb5
xor eax, eax
nop
movzx edx, byte [rdi + rax]
xor dl, byte [r15 + rax]
mov byte [rbp + rax], dl
add rax, 1
cmp rbx, rax
jne 0x6fd03fa0
cmp qword [rsp + 0x28], 0
je 0x6fd03ff3
mov rax, qword [rsi + 0x18]
mov rcx, 0xfffffffffffffffe
lea rdx, [r14 + rax - 1]
add byte [rdx], 1
je 0x6fd03fee
jmp 0x6fd03ff3
mov rdx, qword [rsi + 0x18]
add rdx, rcx
sub rcx, 1
add rdx, r14
movzx eax, byte [rdx]
add eax, 1
test al, al
mov byte [rdx], al
jne 0x6fd03ff3
cmp rcx, r12
jne 0x6fd03fd4
add rdi, rbx
add rbp, rbx
sub r13, rbx
je 0x6fd04010
mov rbx, qword [rsi + 0x18]
jmp 0x6fd03f80
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r8b, 7
jne 0x6fd04060
jmp 0x6fd03f10
mov eax, 2
ret
Function at 0x6fd04900
Capabilities:
Encode data using xor

Disassembly:
lea r10, [rcx + 0x20]
neg r8d
nop word [rax + rax]
mov r9d, dword [rcx]
add rcx, 4
mov eax, dword [rdx]
xor eax, r9d
and eax, r8d
xor r9d, eax
mov dword [rcx - 4], r9d
xor dword [rdx], eax
add rdx, 4
cmp rcx, r10
jne 0x6fd04910
ret

Function at 0x6fd04980
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
xor eax, eax
mov r9d, dword [rcx + r8]
xor r9d, dword [rdx + r8]
add r8, 4
or eax, r9d
cmp r8, 0x20
jne 0x6fd04985
mov edx, eax
neg edx
or eax, edx
shr eax, 0x1f
ret

Function at 0x6fd083e0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x4f0
mov rdi, rdx
call sym.libSFTP.dll_osAllocMem
mov rbx, rax
mov eax, 0x64
test rbx, rbx
je 0x6fd083b8
mov rcx, rbx
call sym.libSFTP.dll_sha512Init
mov r8d, 0x20
mov rdx, rsi
mov rcx, rbx
call sym.libSFTP.dll_sha512Update
xor edx, edx
mov rcx, rbx
call sym.libSFTP.dll_sha512Final
movzx eax, byte [rbx + 0x1f]
mov r8, rbx
mov rcx, rbx
and byte [rbx], 0xf8
lea rsi, [rbx + 0x270]
mov rdx, rsi
lea r9, [0x6fd2ca00]
and eax, 0x7f
or eax, 0x40
mov byte [rbx + 0x1f], al
call sym.libSFTP.dll_ed25519Mul
mov rdx, rdi
mov rcx, rsi
call sym.libSFTP.dll_ed25519Encode
mov r8d, 0x4f0
xor edx, edx
mov rcx, rbx
call sub.msvcrt.dll_memset
mov rcx, rbx
call sym.libSFTP.dll_osFreeMem
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
push rbx
sub rsp, 0x30
test rdx, rdx
mov rbx, r8
mov rax, rcx
sete r8b
test rbx, rbx
mov rcx, rdx
sete dl
or r8b, dl
jne 0x6fd08434
test rax, rax
je 0x6fd08434
mov qword [rsp + 0x28], r9
mov r8d, 0x20
mov rdx, rbx
call qword [rax + 0x30]
test eax, eax
jne 0x6fd08439
mov r9, qword [rsp + 0x28]
test r9, r9
je 0x6fd08434
mov rdx, r9
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp 0x6fd08320
mov eax, 2
add rsp, 0x30
pop rbx
ret
Function at 0x6fd091b0
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x6fd091e1
lea r10d, [r8 - 1]
xor eax, eax
xor r8d, r8d
add r10, 1
movzx r9d, byte [rcx + r8]
xor r9b, byte [rdx + r8]
add r8, 1
or eax, r9d
cmp r10, r8
jne 0x6fd091c2
mov edx, eax
neg edx
or eax, edx
shr al, 7
ret
xor eax, eax
ret

Function at 0x6fd09d90
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov r10, rdx
movabs rdx, 0xaaaaaaaaaaaaaaab
mov rax, r10
mul rdx
shr rdx, 1
lea rax, [rdx + rdx*2]
lea r11, [rax + 1]
cmp r11, r10
je 0x6fd09f20
lea r11, [rax + 2]
cmp r11, r10
je 0x6fd09e90
test r8, r8
je 0x6fd09fb0
lea r11, [rdx*4]
test rcx, rcx
mov byte [r8 + rdx*4], 0
setne r10b
test r9, r9
je 0x6fd09ded
mov qword [r9], r11
test r10b, r10b
je 0x6fd09e82
test rdx, rdx
je 0x6fd09e82
lea r9, [rcx + rax - 3]
sub rcx, 3
lea r8, [r8 + rdx*4 - 4]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__u._u
movzx edx, byte [r9]
sub r9, 3
sub r8, 4
movzx eax, byte [r9 + 4]
movzx r10d, byte [r9 + 5]
mov ebx, edx
shl edx, 4
shr bl, 2
and edx, 0x30
and ebx, 0x3f
movzx ebx, byte [r11 + rbx]
mov byte [r8 + 4], bl
mov ebx, eax
shl eax, 2
shr bl, 4
and eax, 0x3c
or edx, ebx
movsx rdx, dl
movzx edx, byte [r11 + rdx]
mov byte [r8 + 5], dl
mov edx, r10d
and r10d, 0x3f
shr dl, 6
or eax, edx
movsx rax, al
movzx eax, byte [r11 + rax]
mov byte [r8 + 6], al
movzx eax, byte [r11 + r10]
mov byte [r8 + 7], al
cmp rcx, r9
jne 0x6fd09e14
pop rbx
pop rsi
pop rdi
pop rbp
ret
test rcx, rcx
setne r11b
test r8, r8
setne r10b
and r10b, r11b
je 0x6fd09f33
movzx ebx, byte [rcx + rax]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__u._u
movzx esi, byte [rcx + rax + 1]
lea rdi, [rdx*4]
mov ebp, ebx
shl ebx, 4
shr bpl, 2
and ebx, 0x30
and ebp, 0x3f
movzx ebp, byte [r11 + rbp]
mov byte [r8 + rdx*4], bpl
mov ebp, esi
shl esi, 2
shr bpl, 4
and esi, 0x3c
mov byte [r8 + rdi + 3], 0x3d
or ebx, ebp
test r9, r9
mov byte [r8 + rdi + 4], 0
movsx rbx, bl
movzx ebx, byte [r11 + rbx]
movzx r11d, byte [r11 + rsi]
mov byte [r8 + rdi + 1], bl
mov byte [r8 + rdi + 2], r11b
lea r11, [rdi + 4]
jne 0x6fd09dea
jmp 0x6fd09df6
test rcx, rcx
setne r11b
test r8, r8
setne r10b
and r10b, r11b
jne 0x6fd09f50
test r9, r9
je 0x6fd09e82
lea r11, [rdx*4 + 4]
jmp 0x6fd09dea
movzx ebx, byte [rcx + rax]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__u._u
lea rsi, [rdx*4]
mov edi, ebx
shl ebx, 4
shr dil, 2
and ebx, 0x30
and edi, 0x3f
test r9, r9
movzx edi, byte [r11 + rdi]
movzx r11d, byte [r11 + rbx]
mov byte [r8 + rdx*4], dil
mov byte [r8 + rsi + 1], r11b
lea r11, [rsi + 4]
mov byte [r8 + rsi + 2], 0x3d
mov byte [r8 + rsi + 3], 0x3d
mov byte [r8 + rsi + 4], 0
jne 0x6fd09dea
jmp 0x6fd09df6
test r9, r9
je 0x6fd09e82
shl rdx, 2
mov qword [r9], rdx
jmp 0x6fd09e82
Function at 0x6fd09fd0
Capabilities:
Decode data using base64 via dword translation table
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
test rcx, rcx
sete r10b
test rdx, rdx
setne al
test r10b, al
jne 0x6fd0a0d3
test r9, r9
je 0x6fd0a0d3
test rdx, rdx
je 0x6fd0a0e0
lea r10, [rcx + rdx]
xor r11d, r11d
xor edx, edx
lea rdi, [0x6fd2ca80]
xor esi, esi
xor ebx, ebx
nop
movsx eax, byte [rcx]
cmp eax, 0xd
je 0x6fd0a080
cmp eax, 0xa
je 0x6fd0a080
cmp eax, 0x3d
je 0x6fd0a0c0
cmp eax, 0x7f
ja 0x6fd0a038
test r11, r11
movzx eax, byte [rdi + rax]
jne 0x6fd0a038
cmp al, 0x3f
jbe 0x6fd0a044
mov eax, 0xeb
mov qword [r9], rdx
pop rbx
pop rsi
pop rdi
ret
shl ebx, 6
add rsi, 1
or ebx, eax
cmp rsi, 4
jne 0x6fd0a080
test r8, r8
je 0x6fd0a06e
mov eax, ebx
mov byte [r8 + rdx + 2], bl
shr eax, 0x10
mov byte [r8 + rdx], al
movzx eax, bh
mov byte [r8 + rdx + 1], al
add rdx, 3
xor r11d, r11d
xor esi, esi
xor ebx, ebx
nop dword [rax]
add rcx, 1
cmp r10, rcx
jne 0x6fd0a010
mov rax, rsi
or rax, r11
je 0x6fd0a0e0
cmp r11, 1
jne 0x6fd0a0f0
cmp rsi, 3
jne 0x6fd0a0f0
test r8, r8
je 0x6fd0a0b3
mov eax, ebx
shr ebx, 2
shr eax, 0xa
mov byte [r8 + rdx + 1], bl
mov byte [r8 + rdx], al
add rdx, 2
xor eax, eax
jmp 0x6fd0a03d
add rcx, 1
add r11, 1
cmp r10, rcx
jne 0x6fd0a010
jmp 0x6fd0a089
mov eax, 2
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x6fd0a03d
cmp r11, 2
jne 0x6fd0a113
cmp rsi, 2
jne 0x6fd0a113
test r8, r8
je 0x6fd0a108
shr ebx, 4
mov byte [r8 + rdx], bl
add rdx, 1
xor eax, eax
jmp 0x6fd0a03d
mov eax, 0xec
jmp 0x6fd0a03d
Function at 0x6fd0ad30
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov esi, dword [rcx]
mov ebx, dword [rcx + 0x10]
mov r8d, dword [rcx + 0xc]
mov r12d, dword [rcx + 4]
mov ebp, dword [rcx + 8]
lea r13, [rcx + 0x20]
mov rax, rcx
mov dword [rsp + 0x24], esi
mov r14d, dword [rcx + 0x14]
add rax, 0x60
mov dword [rsp + 0x2c], ebx
mov rbx, r13
mov edi, dword [rcx + 0x18]
mov qword [rsp + 0x80], rcx
mov rsi, rax
mov r15d, dword [rcx + 0x1c]
mov dword [rsp + 0x28], r8d
mov ecx, dword [rbx]
add rbx, 4
call sym.libSFTP.dll_swapInt32
mov dword [rbx - 4], eax
cmp rsi, rbx
jne 0x6fd0ad81
mov esi, dword [rsp + 0x24]
mov r10d, 1
mov ecx, 0x428a2f98
mov rax, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x28]
mov ebx, dword [rsp + 0x2c]
mov edx, dword [rax + 0x20]
mov r11d, edx
jmp 0x6fd0ae54
mov rcx, r10
and ecx, 0xf
cmp r10, 0xf
lea r9, [r13 + rcx*4]
mov r11d, dword [r9]
jbe 0x6fd0ae2d
lea ecx, [rdx + 0xe]
and ecx, 0xf
mov r8d, dword [r13 + rcx*4]
lea ecx, [rdx + 1]
add edx, 9
and edx, 0xf
and ecx, 0xf
mov ecx, dword [r13 + rcx*4]
add r11d, dword [r13 + rdx*4]
mov r15d, r8d
mov edx, r8d
rol r15d, 0xf
rol edx, 0xd
shr r8d, 0xa
xor edx, r15d
xor edx, r8d
mov r8d, ecx
add edx, r11d
mov r11d, ecx
rol r8d, 0xe
ror r11d, 7
shr ecx, 3
xor r11d, r8d
xor ecx, r11d
lea r11d, [rdx + rcx]
mov dword [r9], r11d
lea rcx, [0x6fd2cce0]
mov r15d, edi
mov edi, r14d
mov r14d, ebx
mov ebx, dword [rsp + 0x24]
mov r8d, ebp
mov ebp, r12d
mov ecx, dword [rcx + r10*4]
mov r12d, esi
add r10, 1
mov esi, eax
mov eax, ebx
mov edx, ebx
ror edx, 0xb
ror eax, 6
xor eax, edx
mov edx, ebx
rol edx, 7
xor edx, eax
mov eax, edi
xor eax, r14d
and eax, ebx
xor eax, edi
add eax, edx
mov edx, esi
add eax, r15d
ror edx, 0xd
add eax, ecx
mov ecx, r12d
add r11d, eax
mov eax, esi
and ecx, ebp
ror eax, 2
xor eax, edx
mov edx, esi
rol edx, 0xa
xor edx, eax
mov eax, r12d
or eax, ebp
and eax, esi
or eax, ecx
lea ecx, [r8 + r11]
add eax, edx
mov edx, r10d
add eax, r11d
cmp r10, 0x40
mov dword [rsp + 0x24], ecx
jne 0x6fd0adc0
mov rcx, qword [rsp + 0x80]
add dword [rcx + 4], esi
add dword [rcx], eax
mov esi, dword [rsp + 0x24]
add dword [rcx + 8], r12d
add dword [rcx + 0xc], ebp
add dword [rcx + 0x10], esi
add dword [rcx + 0x14], ebx
add dword [rcx + 0x18], r14d
add dword [rcx + 0x1c], edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x6fd0b0e0
Capabilities:
Hash data using sha384

Disassembly:
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov qword [rcx + 0xc0], 0
mov qword [rcx + 0xc8], 0
ret
Function at 0x6fd0b1d0
Capabilities:
Hash data using sha384

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov ecx, 0xd0
mov rbp, rdx
mov rsi, r8
call sym.libSFTP.dll_osAllocMem
mov rbx, rax
mov eax, 0x64
test rbx, rbx
je 0x6fd0b2a4
movabs rax, 0xcbbb9d5dc1059ed8
mov r8, rbp
mov rdx, rdi
mov qword [rbx + 0xc0], 0
mov qword [rbx], rax
mov rcx, rbx
movabs rax, 0x629a292a367cd507
mov qword [rbx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rbx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rbx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rbx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rbx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rbx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rbx + 0x38], rax
mov qword [rbx + 0xc8], 0
call sym.libSFTP.dll_sha512Update
mov rdx, rsi
mov rcx, rbx
call sym.libSFTP.dll_sha384Final
mov rcx, rbx
call sym.libSFTP.dll_osFreeMem
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6fd0b340
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
mov qword [rcx + 0xc0], 0
mov qword [rcx + 0xc8], 0
ret

Function at 0x6fd0b750
Capabilities:
Hash data using sha512

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov ecx, 0xd0
mov rbp, rdx
mov rsi, r8
call sym.libSFTP.dll_osAllocMem
mov rbx, rax
mov eax, 0x64
test rbx, rbx
je 0x6fd0b824
movabs rax, 0x6a09e667f3bcc908
mov r8, rbp
mov rdx, rdi
mov qword [rbx + 0xc0], 0
mov qword [rbx], rax
mov rcx, rbx
movabs rax, 0xbb67ae8584caa73b
mov qword [rbx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rbx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbx + 0x38], rax
mov qword [rbx + 0xc8], 0
call sym.libSFTP.dll_sha512Update
mov rdx, rsi
mov rcx, rbx
call sym.libSFTP.dll_sha512Final
mov rcx, rbx
call sym.libSFTP.dll_osFreeMem
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6fd0b830
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
test rcx, rcx
mov rsi, rcx
mov rbx, rdx
mov r12, r8
je 0x6fd0b900
test rdx, rdx
je 0x6fd0b900
test r8, r8
jne 0x6fd0b868
test r9, r9
mov eax, 2
jne 0x6fd0b8f1
cmp r9, qword [rbx + 0x20]
mov qword [rsi], rbx
lea rdi, [rsi + 8]
lea rbp, [rsi + 0xd8]
jbe 0x6fd0b910
mov qword [rsp + 0x28], r9
mov rcx, rdi
call qword [rbx + 0x48]
mov r9, qword [rsp + 0x28]
mov rdx, r12
mov rcx, rdi
mov r8, r9
call qword [rbx + 0x50]
mov rdx, rbp
mov rcx, rdi
call qword [rbx + 0x58]
mov rax, qword [rbx + 0x28]
xor edx, edx
mov r8, qword [rbx + 0x20]
lea rcx, [rbp + rax]
sub r8, rax
call sub.msvcrt.dll_memset
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x6fd0b8dc
lea rdx, [rsi + rdx + 0xd8]
mov rax, rbp
xor byte [rax], 0x36
add rax, 1
cmp rdx, rax
jne 0x6fd0b8d0
mov rcx, rdi
call qword [rbx + 0x48]
mov r8, qword [rbx + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [rbx + 0x50]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, 2
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, r9
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x28], r9
call sub.msvcrt.dll_memcpy
mov r9, qword [rsp + 0x28]
xor edx, edx
mov r8, qword [rbx + 0x20]
lea rcx, [rbp + r9]
sub r8, r9
call sub.msvcrt.dll_memset
jmp 0x6fd0b8bc

Function at 0x6fd0ba90
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, rcx
mov rcx, qword [rbx + 0x20]
mov r12, rdx
lea rbp, [rsi + 0xd8]
test rcx, rcx
je 0x6fd0bacc
mov rax, rbp
add rcx, rbp
nop dword [rax]
xor byte [rax], 0x6a
add rax, 1
cmp rax, rcx
jne 0x6fd0bac0
lea rdi, [rsi + 8]
add rsi, 0x158
mov rcx, rdi
call qword [rbx + 0x48]
mov r8, qword [rbx + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [rbx + 0x50]
mov r8, qword [rbx + 0x28]
mov rdx, rsi
mov rcx, rdi
call qword [rbx + 0x50]
mov rdx, rsi
mov rcx, rdi
call qword [rbx + 0x58]
test r12, r12
je 0x6fd0bb20
mov r8, qword [rbx + 0x28]
mov rdx, rsi
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msvcrt.dll_memcpy
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x6fd0e680
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [r8 + 4]
test eax, eax
mov rsi, rcx
mov rbp, rdx
mov r13, r8
je 0x6fd0e731
lea rdi, str._08X
xor ebx, ebx
lea r12, [0x6fd2d2e6]
jmp 0x6fd0e6f4
mov edx, ebx
not edx
add edx, eax
and edx, 7
cmp edx, 7
je 0x6fd0e6f8
mov rdx, qword [r13 + 8]
sub eax, 1
mov rcx, rsi
sub eax, ebx
mov r8d, dword [rdx + rax*4]
mov rdx, rdi
call sub.msvcrt.dll_fprintf
mov eax, dword [r13 + 4]
lea edx, [rax - 1]
mov ecx, edx
sub ecx, ebx
and ecx, 7
je 0x6fd0e710
cmp edx, ebx
je 0x6fd0e710
add ebx, 1
cmp ebx, eax
jae 0x6fd0e731
test ebx, ebx
jne 0x6fd0e6b3
mov rdx, rsi
mov rcx, rbp
call sub.msvcrt.dll_fputs
mov eax, dword [r13 + 4]
jmp 0x6fd0e6c1
mov r9, rsi
mov r8d, 2
mov edx, 1
mov rcx, r12
add ebx, 1
call sub.msvcrt.dll_fwrite
mov eax, dword [r13 + 4]
cmp ebx, eax
jb 0x6fd0e6f4
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x6fd0fad0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
cmp rdx, 2
jbe 0x6fd0fb91
xor r11d, r11d
mov r10d, 2
movzx r9d, byte [rcx + r10]
mov eax, r9d
neg eax
or eax, r9d
shr al, 7
xor eax, 1
mov r9d, eax
mov eax, r11d
neg eax
or eax, r11d
shr eax, 0x1f
xor eax, 1
and eax, r9d
lea r9d, [rax - 1]
neg eax
and r9d, r11d
and eax, r10d
add r10, 1
or eax, r9d
cmp rdx, r10
mov r11d, eax
jne 0x6fd0fae5
mov r9d, eax
mov r11d, eax
neg r9d
xor r11d, 0xa
or r9d, eax
shr r9d, 0x1f
mov r10d, r9d
lea r9d, [rax - 0xa]
xor r10d, 1
xor r9d, 0xa
or r9d, r11d
xor r9d, eax
shr r9d, 0x1f
movzx r11d, byte [rcx + 1]
or r9d, r10d
sub edx, 1
movzx esi, byte [rcx]
sub edx, eax
mov ebx, r11d
xor ebx, 0xfffffffd
lea ecx, [rbx + 1]
or r11d, ecx
mov ecx, esi
neg ecx
or ecx, esi
or ecx, r11d
shr cl, 7
movzx ecx, cl
or ecx, r9d
lea eax, [rcx - 1]
and edx, eax
mov eax, edx
mov qword [r8], rax
mov eax, ecx
pop rbx
pop rsi
ret
mov r9d, 1
mov r10d, 1
xor eax, eax
jmp 0x6fd0fb54