joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180074ab0
Capabilities:
Log keystrokes

Disassembly:
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x40]
mov ecx, 0x78
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1800d1f40]
xor rax, rsp
mov qword [rsp + 0x210], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov r8d, 0x6d1
xor edx, edx
lea rcx, [0x1801242f2]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x20
jmp 0x180074b15
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x15c
jg 0x180074d19
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x180124038]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0x168], eax
cmp dword [rsp + 0x168], 0xffffffff
jne 0x180074b46
jmp 0x180074b0b
cmp dword [rsp + 0x40], 0x140
jl 0x180074c22
cmp dword [rsp + 0x40], 0x14e
jg 0x180074c22
mov dword [rsp + 0x1b8], 0x60
mov dword [rsp + 0x1bc], 0x61
mov dword [rsp + 0x1c0], 0x62
mov dword [rsp + 0x1c4], 0x63
mov dword [rsp + 0x1c8], 0x64
mov dword [rsp + 0x1cc], 0x65
mov dword [rsp + 0x1d0], 0x66
mov dword [rsp + 0x1d4], 0x67
mov dword [rsp + 0x1d8], 0x68
mov dword [rsp + 0x1dc], 0x69
mov dword [rsp + 0x1e0], 0x6e
mov dword [rsp + 0x1e4], 0x6f
mov dword [rsp + 0x1e8], 0x6a
mov dword [rsp + 0x1ec], 0x6d
mov dword [rsp + 0x1f0], 0x6b
mov eax, dword [rsp + 0x40]
sub eax, 0x140
cdqe
mov eax, dword [rsp + rax*4 + 0x1b8]
mov dword [rsp + 0x164], eax
jmp 0x180074c3b
mov edx, 1
mov ecx, dword [rsp + 0x168]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 0xffffffff
jne 0x180074cb5
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 1
jge 0x180074cc4
jmp 0x180074b0b
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 5
lea rcx, [0x1801242f2]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x178]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x180074b0b
mov rcx, rsp
lea rdx, [0x180096a80]
call fcn.18007a038
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1800793e0
add rsp, 0x220
pop rdi
ret
Function at 0x180077da0
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1800d1f40]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x38], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
cmp qword [0x180124c48], 0
je 0x180077dfb
mov eax, 1
jmp 0x180077f7b
mov dword [rsp + 0x20], 0
jmp 0x180077e0f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + rax*8 + 0x38], 0
je 0x180077e41
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + rax*8 + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x180124c48], rax
cmp qword [0x180124c48], 0
je 0x180077e3f
jmp 0x180077e41
jmp 0x180077e05
cmp qword [0x180124c48], 0
jne 0x180077e63
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.18006d420
xor eax, eax
jmp 0x180077f7b
lea rdx, str.OSMesaCreateContextExt
mov rcx, qword [0x180124c48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180124c50], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x180124c48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180124c58], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x180124c48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180124c60], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x180124c48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180124c68], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x180124c48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180124c70], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x180124c48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180124c78], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x180124c48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180124c80], rax
cmp qword [0x180124c50], 0
je 0x180077f5c
cmp qword [0x180124c60], 0
je 0x180077f5c
cmp qword [0x180124c68], 0
je 0x180077f5c
cmp qword [0x180124c70], 0
je 0x180077f5c
cmp qword [0x180124c78], 0
je 0x180077f5c
cmp qword [0x180124c80], 0
jne 0x180077f76
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.18006d420
call fcn.180077fb0
xor eax, eax
jmp 0x180077f7b
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180096ed0]
call fcn.18007a038
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800793e0
add rsp, 0x70
pop rdi
ret
Function at 0x2fc4fa3b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4fadb2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc51f108]
test eax, eax
je 0x2fc4fae4a
lea rax, [0x2fc51f0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc51f110]
mov qword [rbp - 8], rax
jmp 0x2fc4fae2e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4fae22
cmp qword [rbp - 0x10], 0
je 0x2fc4fae22
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4fade8
lea rax, [0x2fc51f0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4fae4b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4faf50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4faf78
mov eax, 0
jmp 0x2fc4fafc6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4fafa1
mov eax, 0
jmp 0x2fc4fafc6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4fafc1
mov eax, 0
jmp 0x2fc4fafc6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4fafcc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4fb04a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4fb041
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4fb041
mov rax, qword [rbp - 8]
jmp 0x2fc4fb05f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4fb014
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140006640
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x40
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor r11d, r11d
mov r14, r8
mov word [rsp + 0x20], r11w
movzx ebp, dl
mov qword [rsp + 0x28], r11
mov rbx, rcx
movzx r9d, r11w
test rcx, rcx
je 0x140006692
movzx esi, byte [rcx + 0x2f0]
cmp sil, 3
jne 0x1400066af
cmp byte [rcx + 0x2f1], 1
jae 0x1400066b5
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b06c0
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp sil, 0xfe
jne 0x140006692
cmp bpl, 1
jne 0x1400067b1
mov qword [rsp + 0x68], rdi
movzx ecx, r11w
mov rdi, qword [rbx + 8]
movzx r10d, word [rdi]
cmp r11w, r10w
jae 0x140006701
nop word [rax + rax]
movzx eax, cx
movzx edx, byte [rax + rdi + 4]
cmp dl, 0x13
je 0x14000676b
cmp dl, 0xc0
je 0x14000676b
cmp dl, 0xcc
je 0x14000676b
add cx, 2
cmp cx, r10w
jb 0x1400066e0
mov r8b, 4
mov byte [rsp + 0x29], r8b
cmp r11w, r10w
jae 0x140006734
movzx ecx, r11w
movzx eax, cx
movzx edx, byte [rax + rdi + 4]
cmp dl, 0x13
je 0x140006742
cmp dl, 0xc0
je 0x140006742
cmp dl, 0xcc
je 0x140006742
add cx, 2
cmp cx, r10w
jb 0x140006713
movzx r8d, r8b
bts r8d, 3
mov byte [rsp + 0x29], r8b
cmp word [rdi + 2], r9w
mov rdi, qword [rsp + 0x68]
jne 0x14000675a
movzx eax, r8b
bts eax, 5
mov byte [rsp + 0x29], al
cmp sil, 3
jne 0x140006773
cmp byte [rbx + 0x2f1], sil
jb 0x140006782
jmp 0x14000678f
movzx r8d, byte [rsp + 0x29]
jmp 0x14000670f
cmp sil, 0xfe
jne 0x140006782
cmp byte [rbx + 0x2f1], 0xfd
jbe 0x14000678f
movzx eax, byte [rsp + 0x2d]
bts eax, 3
mov byte [rsp + 0x2d], al
movzx eax, word [rbx + 0x2f0]
cmp al, 3
jne 0x1400067a2
shr ax, 8
cmp al, 4
jae 0x1400067cd
movzx eax, byte [rsp + 0x2e]
bts eax, 3
mov byte [rsp + 0x2e], al
jmp 0x1400067cd
cmp bpl, 0xd
jne 0x1400067cd
mov qword [rsp + 0x28], 0xffffffffffffffff
movzx eax, byte [rsp + 0x29]
btr eax, 5
mov byte [rsp + 0x29], al
mov rcx, qword [rbx + 0x568]
test rcx, rcx
je 0x1400067fd
lea r9, [rsp + 0x20]
movzx r8d, bpl
lea rdx, [rsp + 0x28]
call fcn.140005880
mov r11d, eax
test eax, eax
jne 0x140006694
movzx r9d, word [rsp + 0x20]
mov rax, qword [rbx]
test rax, rax
je 0x140006835
mov rcx, qword [rax + 0xd8]
test rcx, rcx
je 0x140006835
lea r9, [rsp + 0x20]
movzx r8d, bpl
lea rdx, [rsp + 0x28]
call fcn.140005880
mov r11d, eax
test eax, eax
jne 0x140006694
movzx r9d, word [rsp + 0x20]
cmp bpl, 1
jne 0x14000686f
mov eax, 0x200
test word [rbx + 0x464], ax
je 0x14000686f
movzx eax, word [rbx + 0x2f0]
cmp al, 3
jne 0x14000686a
shr ax, 8
cmp al, 4
jb 0x14000686a
mov eax, 0x400
test word [rbx + 0x460], ax
je 0x14000686f
add r9w, 4
test r9w, r9w
je 0x14000687a
add r9w, 2
add word [r14], r9w
mov eax, r11d
jmp 0x140006694
Function at 0x140006890
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r11d, r11d
mov r15, r9
mov qword [rsp + 0x38], r11
movzx ebp, r8b
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400068db
movzx esi, byte [rcx + 0x2f0]
cmp sil, 3
jne 0x1400068f6
cmp byte [rcx + 0x2f1], 1
jae 0x1400068fc
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b06c0
add rsp, 0x60
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
cmp sil, 0xfe
jne 0x1400068db
test r14, r14
je 0x1400068db
mov r10d, 2
mov word [rsp + 0x30], r10w
cmp bpl, 1
jne 0x140006a01
mov qword [rsp + 0x58], rdi
movzx ecx, r11w
mov rdi, qword [rbx + 8]
movzx r9d, word [rdi]
cmp r11w, r9w
jae 0x140006951
nop
movzx eax, cx
movzx edx, byte [rax + rdi + 4]
cmp dl, 0x13
je 0x1400069bb
cmp dl, 0xc0
je 0x1400069bb
cmp dl, 0xcc
je 0x1400069bb
add cx, r10w
cmp cx, r9w
jb 0x140006930
mov r8b, 4
mov byte [rsp + 0x39], r8b
cmp r11w, r9w
jae 0x140006984
movzx ecx, r11w
movzx eax, cx
movzx edx, byte [rax + rdi + 4]
cmp dl, 0x13
je 0x140006992
cmp dl, 0xc0
je 0x140006992
cmp dl, 0xcc
je 0x140006992
add cx, r10w
cmp cx, r9w
jb 0x140006963
movzx r8d, r8b
bts r8d, 3
mov byte [rsp + 0x39], r8b
cmp word [rdi + 2], r11w
mov rdi, qword [rsp + 0x58]
jne 0x1400069aa
movzx eax, r8b
bts eax, 5
mov byte [rsp + 0x39], al
cmp sil, 3
jne 0x1400069c3
cmp byte [rbx + 0x2f1], sil
jb 0x1400069d2
jmp 0x1400069df
movzx r8d, byte [rsp + 0x39]
jmp 0x14000695f
cmp sil, 0xfe
jne 0x1400069d2
cmp byte [rbx + 0x2f1], 0xfd
jbe 0x1400069df
movzx eax, byte [rsp + 0x3d]
bts eax, 3
mov byte [rsp + 0x3d], al
movzx eax, word [rbx + 0x2f0]
cmp al, 3
jne 0x1400069f2
shr ax, 8
cmp al, 4
jae 0x140006a1d
movzx eax, byte [rsp + 0x3e]
bts eax, 3
mov byte [rsp + 0x3e], al
jmp 0x140006a1d
cmp bpl, 0xd
jne 0x140006a1d
mov qword [rsp + 0x38], 0xffffffffffffffff
movzx eax, byte [rsp + 0x39]
btr eax, 5
mov byte [rsp + 0x39], al
mov rcx, qword [rbx + 0x568]
test rcx, rcx
je 0x140006a56
lea rax, [rsp + 0x30]
movzx r9d, bpl
lea rdx, [r14 + 2]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
call fcn.140005bd0
mov r11d, eax
test eax, eax
jne 0x1400068dd
movzx r10d, word [rsp + 0x30]
mov rax, qword [rbx]
test rax, rax
je 0x140006a9a
mov rcx, qword [rax + 0xd8]
test rcx, rcx
je 0x140006a9a
movzx edx, r10w
lea rax, [rsp + 0x30]
add rdx, r14
mov qword [rsp + 0x20], rax
movzx r9d, bpl
lea r8, [rsp + 0x38]
call fcn.140005bd0
mov r11d, eax
test eax, eax
jne 0x1400068dd
movzx r10d, word [rsp + 0x30]
cmp bpl, 1
jne 0x140006aee
mov eax, 0x200
test word [rbx + 0x464], ax
je 0x140006aee
movzx eax, word [rbx + 0x2f0]
cmp al, 3
jne 0x140006acf
shr ax, 8
cmp al, 4
jb 0x140006acf
mov eax, 0x400
test word [rbx + 0x460], ax
je 0x140006aee
movzx eax, r10w
add r10w, 2
movzx ecx, r10w
mov word [rax + r14], 0x1700
mov word [rcx + r14], 0
lea r10d, [rcx + 2]
cmp r10w, 2
ja 0x140006afb
cmp bpl, 1
je 0x140006b0d
lea ecx, [r10 - 2]
movzx eax, cx
mov byte [r14 + 1], cl
shr ax, 8
mov byte [r14], al
add word [r15], r10w
mov eax, r11d
jmp 0x1400068dd
Function at 0x140009410
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rsp + 0x450], rax
xor r15d, r15d
lea rdi, [rsp + 0x50]
mov r14d, r9d
mov r12d, r8d
mov rax, rdx
mov r13, rcx
test rdx, rdx
je 0x1400095c8
lea rdx, [0x1400fc754]
mov rcx, rax
call fcn.1400b8904
mov rsi, rax
test rax, rax
je 0x1400095c8
xor edx, edx
mov qword [rsp + 0x4b8], rbp
lea r8d, [r15 + 2]
mov rcx, rax
call fcn.1400b8e70
test eax, eax
jne 0x1400095b9
mov rcx, rsi
call fcn.1400b936c
mov rcx, rsi
movsxd rbx, eax
call fcn.1400b9374
lea ecx, [rbx - 1]
cmp ecx, 0x3fffff
ja 0x1400095b9
mov rbp, rbx
cmp ebx, 0x400
jle 0x1400094e2
mov rax, qword [0x140397868]
mov rcx, rbx
test rax, rax
je 0x1400094cb
call rax
jmp 0x1400094d0
call fcn.1400b85d8
mov rdi, rax
test rax, rax
je 0x1400095b9
mov r15d, 1
mov r9, rsi
mov r8, rbp
mov edx, 1
mov rcx, rdi
call fcn.1400b8ba0
cmp rax, rbp
je 0x140009501
mov ebx, 0xfffffffc
jmp 0x140009562
cmp r14d, 5
je 0x14000950d
cmp r14d, 0xf
jne 0x140009536
cmp r12d, 1
jne 0x140009536
mov eax, dword [rsp + 0x4d8]
mov r9d, r12d
mov dword [rsp + 0x30], eax
mov r8d, ebx
mov rdx, rdi
mov dword [rsp + 0x20], r14d
mov rcx, r13
call fcn.140009130
jmp 0x140009560
mov eax, dword [rsp + 0x4d8]
mov r9d, r12d
mov dword [rsp + 0x40], eax
mov r8d, ebx
mov qword [rsp + 0x30], 0
mov rdx, rdi
mov rcx, r13
mov dword [rsp + 0x20], r14d
call fcn.140008a70
mov ebx, eax
mov rcx, rsi
call fcn.1400b87e4
test r15d, r15d
je 0x14000958c
test rdi, rdi
je 0x14000958c
mov rax, qword [0x140398920]
mov rcx, rdi
test rax, rax
je 0x140009587
call rax
jmp 0x14000958c
call fcn.1400b8268
mov eax, ebx
mov rbp, qword [rsp + 0x4b8]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400b06c0
add rsp, 0x460
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rsi
call fcn.1400b87e4
mov eax, 0xfffffffc
jmp 0x14000958e
mov eax, 0xfffffffc
jmp 0x140009596
Function at 0x14000a7c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov r9d, eax
test r8d, r8d
jle 0x14000a899
cmp r8d, 8
jb 0x14000a899
mov qword [rsp + 0x10], rbx
lea r11, [rdx + 4]
mov qword [rsp], rdi
sub rcx, rdx
movsxd rbx, r8d
mov rdi, 0xfffffffffffffffc
and rbx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rdi, rdx
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r11 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r11 - 4]
lea r11, [r11 + 8]
punpcklbw xmm2, xmm0
lea rax, [rdi + r11]
punpcklwd xmm2, xmm0
add r9d, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r11 - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + r11 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rax, rbx
jl 0x14000a810
mov rdi, qword [rsp]
por xmm3, xmm4
mov rbx, qword [rsp + 0x10]
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
movsxd r11, r9d
movsxd r9, r8d
cmp r11, r9
jge 0x14000a8c8
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
nop
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x14000a8b0
add rsp, 8
ret
Function at 0x14000a8d0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xf0
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rbp - 9], rax
mov r15, qword [rbp + 0x67]
mov eax, 0x1b8
mov r12, qword [rbp + 0x77]
mov ecx, eax
ror ecx, 8
mov r14d, 0x37
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
mov byte [rsp + 0x28], r9b
or ecx, eax
mov byte [rsp + 0x20], 1
mov dword [rsp + 0x30], ecx
lea r13d, [r14 - 0x35]
xor edi, edi
mov rsi, rdx
nop dword [rax]
mov r8d, 1
mov qword [rbp - 0x39], rdi
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x40], 0x6a09e667
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x44], 0xbb67ae85
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
mov qword [rbp - 0x49], rdi
mov dword [rbp - 0x41], edi
call fcn.140033850
mov ebx, eax
test eax, eax
jne 0x14000aa7b
inc byte [rsp + 0x20]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140033850
mov ebx, eax
test eax, eax
jne 0x14000aa7b
cmp byte [rsp + 0x28], 4
je 0x14000a9ef
lea r8d, [rax + 1]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.140033850
mov ebx, eax
test eax, eax
jne 0x14000aa7b
test r15, r15
jne 0x14000aa00
cmp dword [rbp + 0x6f], edi
jbe 0x14000aa17
mov ebx, 0xffffff53
jmp 0x14000aa7b
mov r8d, dword [rbp + 0x6f]
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.140033850
mov ebx, eax
test eax, eax
jne 0x14000aa7b
test r12, r12
je 0x14000aa39
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x14000aa39
mov r8d, eax
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.140033850
mov ebx, eax
test eax, eax
jne 0x14000aa7b
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x40]
call fcn.1400342c0
mov ebx, eax
test eax, eax
jne 0x14000aa7b
cmp r14d, 0x20
jbe 0x14000aa6c
movups xmm0, xmmword [rbp - 0x29]
add r14d, 0xffffffe0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
add rsi, 0x20
jmp 0x14000aa7b
mov r8d, r14d
lea rdx, [rbp - 0x29]
mov rcx, rsi
call fcn.1400b14c0
sub r13, 1
jne 0x14000a940
lea rax, [rbp - 0x29]
mov edx, 0x20
neg eax
lea rcx, [rbp - 0x29]
and eax, 7
sub edx, eax
test eax, eax
je 0x14000aaab
nop dword [rax]
mov byte [rcx], dil
inc rcx
add eax, 0xffffffff
jne 0x14000aaa0
cmp edx, 8
jb 0x14000aad0
mov eax, edx
shr rax, 3
nop word [rax + rax]
mov qword [rcx], rdi
add edx, 0xfffffff8
add rcx, 8
sub rax, 1
jne 0x14000aac0
test edx, edx
je 0x14000aae0
mov byte [rcx], dil
lea rcx, [rcx + 1]
add edx, 0xffffffff
jne 0x14000aad4
test ebx, ebx
setne dil
mov eax, edi
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1400b06c0
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ac70
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rbp + 8], rax
movups xmm0, xmmword [r9]
mov eax, dword [r9 + 0x30]
test r8d, r8d
movups xmm1, xmmword [r9 + 0x10]
mov edi, 0
mov dword [rbp], eax
movzx eax, word [r9 + 0x34]
mov r14, rcx
mov ecx, edi
mov word [rbp + 4], ax
movzx eax, byte [r9 + 0x36]
mov r12d, 1
mov esi, r12d
mov byte [rbp + 6], al
cmovne esi, r8d
mov dword [rsp + 0x20], edi
test sil, 0x1f
lea ebx, [rdi + 0x37]
mov r13d, esi
mov r15, rdx
setne cl
shr r13d, 5
movups xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [r9 + 0x20]
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm0
add r13d, ecx
je 0x14000ae51
mov r8d, ebx
mov qword [rbp - 0x40], rdi
lea rdx, [rbp - 0x30]
mov dword [rsp + 0x50], 0x6a09e667
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x54], 0xbb67ae85
mov dword [rsp + 0x58], 0x3c6ef372
mov dword [rsp + 0x5c], 0xa54ff53a
mov dword [rsp + 0x60], 0x510e527f
mov dword [rsp + 0x64], 0x9b05688c
mov dword [rsp + 0x68], 0x1f83d9ab
mov dword [rsp + 0x6c], 0x5be0cd19
mov qword [rbp - 0x50], rdi
mov dword [rbp - 0x48], edi
call fcn.140033850
mov r12d, eax
test eax, eax
jne 0x14000ae51
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1400342c0
mov r12d, eax
test eax, eax
jne 0x14000ae51
cmp dword [r14], 1
mov eax, dword [rsp + 0x28]
jbe 0x14000adb7
cmp eax, dword [r14 + 4]
jne 0x14000adb7
cmp byte [r14 + 0x76], 1
je 0x14000aec9
lea eax, [r13 - 1]
mov dl, 1
cmp dword [rsp + 0x20], eax
lea ecx, [r13 + 1]
cmovne ecx, r13d
mov r13d, ecx
jmp 0x14000adbd
mov dword [r14 + 4], eax
xor dl, dl
mov byte [r14 + 0x76], dl
test r15, r15
je 0x14000ae3e
test esi, esi
je 0x14000ae3e
cmp esi, 0x20
jb 0x14000ae2c
movups xmm0, xmmword [rsp + 0x28]
add esi, 0xffffffe0
lea rcx, [rbp + 4]
movups xmm1, xmmword [rsp + 0x38]
mov edx, 0x36
lea rax, [rbp + 4]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
add r15, 0x20
sub rdx, rcx
nop dword [rax]
add byte [rax + 2], 1
jne 0x14000ae3e
add byte [rax + 1], 1
jne 0x14000ae3e
add byte [rax], 1
jne 0x14000ae3e
add byte [rax - 1], 1
jne 0x14000ae3e
add byte [rax - 2], 1
jne 0x14000ae3e
sub rax, 5
lea rcx, [rdx + rax]
test rcx, rcx
jns 0x14000ae00
jmp 0x14000ae3e
mov r8d, esi
lea rdx, [rsp + 0x28]
mov rcx, r15
call fcn.1400b14c0
mov esi, edi
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp eax, r13d
jl 0x14000ad04
lea rax, [rbp - 0x30]
neg eax
lea rcx, [rbp - 0x30]
and eax, 7
sub ebx, eax
test eax, eax
je 0x14000ae6f
mov byte [rcx], dil
inc rcx
add eax, 0xffffffff
jne 0x14000ae64
cmp ebx, 8
jb 0x14000ae90
mov eax, ebx
shr rax, 3
nop word [rax + rax]
mov qword [rcx], rdi
add ebx, 0xfffffff8
add rcx, 8
sub rax, 1
jne 0x14000ae80
test ebx, ebx
je 0x14000aea0
mov byte [rcx], dil
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x14000ae94
test r12d, r12d
setne dil
mov eax, edi
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1400b06c0
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 3
jmp 0x14000aea9