joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140140c50
Capabilities:
Encode data using base64

Disassembly:
mov r9d, 0x88
jmp sym.keccak64_core

Function at 0x140140e70
Capabilities:
Encode data using base64

Disassembly:
mov r9d, 0x48
jmp sym.keccak64_core

Function at 0x140141090
Capabilities:
Encode data using base64

Disassembly:
mov r9d, 0x88
jmp sym.keccak64x2_core

Function at 0x1401412b0
Capabilities:
Encode data using base64

Disassembly:
mov r9d, 0x48
jmp sym.keccak64x2_core
Function at 0x14015fc70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.luffa4_close
Function at 0x140161680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor r8d, r8d
mov r9, rdx
xor edx, edx
jmp sym.luffa5_close

Function at 0x1401667c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x1402b21e0]
call sym.__emutls_get_address
vmovdqu xmm0, xmmword [0x1403312c0]
mov r8d, 0x40
mov rdx, rbx
mov rcx, rax
vmovdqu xmmword [rax], xmm0
vmovdqu xmm1, xmmword [0x1403312d0]
vmovdqu xmmword [rax + 0x10], xmm1
vmovdqu xmm2, xmmword [0x1403312e0]
vmovdqu xmmword [rax + 0x20], xmm2
vmovdqu xmm3, xmmword [0x1403312f0]
vmovdqu xmmword [rax + 0x30], xmm3
vmovdqu xmm4, xmmword [0x140331300]
vmovdqu xmmword [rax + 0x40], xmm4
vmovdqu xmm5, xmmword [0x140331310]
vmovdqu xmmword [rax + 0x50], xmm5
vmovdqu xmm0, xmmword [0x140331320]
vmovdqu xmmword [rax + 0x60], xmm0
vmovdqu xmm1, xmmword [0x140331330]
vmovdqu xmmword [rax + 0x70], xmm1
add rsp, 0x20
pop rbx
jmp sym.sph_blake256
Function at 0x14018bf80
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov r9, rdx
mov r12d, r8d
test r8d, r8d
je 0x14018c0ce
mov r8d, r8d
lea rsi, [rcx + 0x80]
mov rax, rdx
shl r8, 8
add r8, rdx
nop word [rax + rax]
vmovdqu ymm0, ymmword [rbx]
mov rdx, rsi
mov rcx, rbx
vmovntdq ymmword [rax], ymm0
vmovdqu ymm1, ymmword [rbx + 0x20]
vmovntdq ymmword [rax + 0x20], ymm1
vmovdqu ymm2, ymmword [rbx + 0x40]
vmovntdq ymmword [rax + 0x40], ymm2
vmovdqu ymm3, ymmword [rbx + 0x60]
vmovntdq ymmword [rax + 0x60], ymm3
vmovdqu ymm4, ymmword [rbx + 0x80]
vmovntdq ymmword [rax + 0x80], ymm4
vmovdqu ymm5, ymmword [rbx + 0xa0]
vmovntdq ymmword [rax + 0xa0], ymm5
vmovdqu ymm0, ymmword [rbx + 0xc0]
vmovntdq ymmword [rax + 0xc0], ymm0
vmovdqu ymm1, ymmword [rbx + 0xe0]
vmovntdq ymmword [rax + 0xe0], ymm1
vzeroupper
call sym.salsa8_simd128_2way
add rax, 0x100
mov rdx, rbx
mov rcx, rsi
call sym.salsa8_simd128_2way
cmp r8, rax
jne 0x14018bfb8
lea ebp, [r12 - 1]
xor edi, edi
lea r8, [rbx + 0x100]
movabs r11, 0xffffffff00000000
nop
mov rax, qword [rbx + 0x80]
mov edx, ebp
and edx, eax
shr rax, 0x20
mov r13, rax
shl edx, 5
mov rax, rbx
and r13d, ebp
shl r13d, 5
sub r13d, edx
nop word [rax + rax]
lea ecx, [r13 + rdx]
mov r10, qword [r9 + rcx*8]
and r10, r11
mov rcx, r10
mov r10d, edx
add edx, 1
mov r10d, dword [r9 + r10*8]
or rcx, r10
xor qword [rax], rcx
add rax, 8
cmp rax, r8
jne 0x14018c088
mov rdx, rsi
mov rcx, rbx
add edi, 1
call sym.salsa8_simd128_2way
mov rdx, rbx
mov rcx, rsi
call sym.salsa8_simd128_2way
cmp edi, r12d
jne 0x14018c060
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x14018c0e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, r8d
mov r12, rcx
lea rsi, [rcx + 0x100]
mov r10, rdx
shl eax, 5
mov dword [rsp + 0xa0], r8d
lea r11, [rdx + rax*8]
test r8d, r8d
je 0x14018c374
mov edi, r8d
lea r15, [rcx + 0x180]
mov rax, rdx
mov rbx, r11
shl rdi, 8
lea rbp, [rcx + 0x80]
add rdi, rdx
nop word cs:[rax + rax]
vmovdqu ymm0, ymmword [r12]
mov r9, r15
mov r8, rbp
mov rdx, rsi
mov rcx, r12
vmovntdq ymmword [rax], ymm0
vmovdqu ymm1, ymmword [r12 + 0x100]
vmovntdq ymmword [rbx], ymm1
vmovdqu ymm2, ymmword [r12 + 0x20]
vmovntdq ymmword [rax + 0x20], ymm2
vmovdqu ymm3, ymmword [r12 + 0x120]
vmovntdq ymmword [rbx + 0x20], ymm3
vmovdqu ymm4, ymmword [r12 + 0x40]
vmovntdq ymmword [rax + 0x40], ymm4
vmovdqu ymm5, ymmword [r12 + 0x140]
vmovntdq ymmword [rbx + 0x40], ymm5
vmovdqu ymm0, ymmword [r12 + 0x60]
vmovntdq ymmword [rax + 0x60], ymm0
vmovdqu ymm1, ymmword [r12 + 0x160]
vmovntdq ymmword [rbx + 0x60], ymm1
vmovdqu ymm2, ymmword [r12 + 0x80]
vmovntdq ymmword [rax + 0x80], ymm2
vmovdqu ymm3, ymmword [r12 + 0x180]
vmovntdq ymmword [rbx + 0x80], ymm3
vmovdqu ymm4, ymmword [r12 + 0xa0]
vmovntdq ymmword [rax + 0xa0], ymm4
vmovdqu ymm5, ymmword [r12 + 0x1a0]
vmovntdq ymmword [rbx + 0xa0], ymm5
vmovdqu ymm0, ymmword [r12 + 0xc0]
vmovntdq ymmword [rax + 0xc0], ymm0
vmovdqu ymm1, ymmword [r12 + 0x1c0]
vmovntdq ymmword [rbx + 0xc0], ymm1
vmovdqu ymm2, ymmword [r12 + 0xe0]
vmovntdq ymmword [rax + 0xe0], ymm2
vmovdqu ymm3, ymmword [r12 + 0x1e0]
vmovntdq ymmword [rbx + 0xe0], ymm3
vzeroupper
call sym.salsa8_simd128_2way_2buf
add rax, 0x100
mov r9, rsi
mov r8, r12
mov rdx, r15
mov rcx, rbp
call sym.salsa8_simd128_2way_2buf
add rbx, 0x100
cmp rdi, rax
jne 0x14018c140
mov eax, dword [rsp + 0xa0]
mov qword [rsp + 0x38], rbp
movabs rbx, 0xffffffff00000000
lea edi, [rax - 1]
xor eax, eax
mov ebp, eax
nop dword [rax]
mov r13d, edi
mov r9d, edi
mov qword [rsp + 0x28], rsi
mov rdx, rsi
mov rax, qword [r12 + 0x80]
mov r8, qword [r12 + 0x180]
mov dword [rsp + 0x34], edi
and r13d, eax
and r9d, r8d
shr rax, 0x20
shr r8, 0x20
and eax, edi
shl r13d, 5
shl eax, 5
and r8d, edi
shl r9d, 5
shl r8d, 5
lea r14d, [rax + 0x20]
sub r13d, eax
sub r9d, eax
sub r8d, eax
nop dword [rax]
mov esi, eax
lea ecx, [r13 + rax]
mov rdi, qword [r10 + rsi*8]
mov ecx, dword [r10 + rcx*8]
lea esi, [r9 + rax]
and rdi, rbx
or rcx, rdi
xor qword [rdx - 0x100], rcx
lea ecx, [r8 + rax]
mov esi, dword [r11 + rsi*8]
mov rdi, qword [r11 + rcx*8]
add eax, 1
and rdi, rbx
mov rcx, rdi
or rcx, rsi
xor qword [rdx], rcx
add rdx, 8
cmp eax, r14d
jne 0x14018c2f0
mov rsi, qword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
mov r9, r15
mov rcx, r12
mov edi, dword [rsp + 0x34]
add ebp, 1
mov r8, rax
mov rdx, rsi
call sym.salsa8_simd128_2way_2buf
mov r9, rsi
mov r8, r12
mov rdx, r15
mov rcx, rax
call sym.salsa8_simd128_2way_2buf
cmp ebp, dword [rsp + 0xa0]
jne 0x14018c298
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14018cf70
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r9, rcx
mov rbx, rdx
test r8d, r8d
je 0x14018d0cd
mov r11d, r8d
lea r10, [rcx + 0x40]
mov rax, rdx
shl r11, 7
add r11, rdx
nop word [rax + rax]
vmovdqu xmm1, xmmword [r9]
mov rdx, r10
mov rcx, r9
sub rax, 0xffffffffffffff80
vmovntdq xmmword [rax - 0x80], xmm1
vmovdqu xmm2, xmmword [r9 + 0x10]
vmovntdq xmmword [rax - 0x70], xmm2
vmovdqu xmm3, xmmword [r9 + 0x20]
vmovntdq xmmword [rax - 0x60], xmm3
vmovdqu xmm4, xmmword [r9 + 0x30]
vmovntdq xmmword [rax - 0x50], xmm4
vmovdqu xmm5, xmmword [r9 + 0x40]
vmovntdq xmmword [rax - 0x40], xmm5
vmovdqu xmm1, xmmword [r9 + 0x50]
vmovntdq xmmword [rax - 0x30], xmm1
vmovdqu xmm2, xmmword [r9 + 0x60]
vmovntdq xmmword [rax - 0x20], xmm2
vmovdqu xmm3, xmmword [r9 + 0x70]
vmovntdq xmmword [rax - 0x10], xmm3
call sym.salsa8_simd128
mov rdx, r9
mov rcx, r10
call sym.salsa8_simd128
cmp r11, rax
jne 0x14018cfa0
lea esi, [r8 - 1]
xor r11d, r11d
jmp 0x14018d085
lea rax, [rbx + rdx - 4]
vmovdqu ymm4, ymmword [r9]
vmovdqu ymm5, ymmword [r9 + 0x20]
vpxor ymm0, ymm4, ymmword [rax]
vmovdqu ymmword [r9], ymm0
vpxor ymm0, ymm5, ymmword [rax + 0x20]
vmovdqu ymmword [r9 + 0x20], ymm0
vmovdqu ymm4, ymmword [rax + 0x40]
vpxor ymm0, ymm4, ymmword [r9 + 0x40]
vmovdqu ymmword [r9 + 0x40], ymm0
vmovdqu ymm5, ymmword [rax + 0x60]
vpxor ymm0, ymm5, ymmword [r9 + 0x60]
vmovdqu ymmword [r9 + 0x60], ymm0
mov rdx, r10
mov rcx, r9
add r11d, 1
call sym.salsa8_simd128
mov rdx, r9
mov rcx, r10
call sym.salsa8_simd128
cmp r11d, r8d
je 0x14018d0cd
mov eax, dword [r9 + 0x40]
mov rcx, r9
and eax, esi
shl eax, 5
cdqe
lea rdx, [rax*4 + 4]
lea rdi, [rbx + rdx]
sub rcx, rdi
cmp rcx, 0x18
ja 0x14018d020
lea rcx, [rbx + rax*4]
xor eax, eax
nop word [rax + rax]
mov edx, dword [rcx + rax]
xor dword [r9 + rax], edx
add rax, 4
cmp rax, 0x80
jne 0x14018d0b8
jmp 0x14018d066
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x14018e120
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rbp, rdx
mov r12d, r8d
test r8d, r8d
je 0x14018e26c
mov r13d, r8d
lea rdi, [rcx + 0x40]
mov rsi, rdx
shl r13, 7
add r13, rdx
nop
vmovdqu xmm1, xmmword [rbx]
mov rdx, rdi
mov rcx, rbx
sub rsi, 0xffffffffffffff80
vmovdqu xmmword [rsi - 0x80], xmm1
vmovdqu xmm2, xmmword [rbx + 0x10]
vmovdqu xmmword [rsi - 0x70], xmm2
vmovdqu xmm3, xmmword [rbx + 0x20]
vmovdqu xmmword [rsi - 0x60], xmm3
vmovdqu xmm4, xmmword [rbx + 0x30]
vmovdqu xmmword [rsi - 0x50], xmm4
vmovdqu xmm5, xmmword [rbx + 0x40]
vmovdqu xmmword [rsi - 0x40], xmm5
vmovdqu xmm1, xmmword [rbx + 0x50]
vmovdqu xmmword [rsi - 0x30], xmm1
vmovdqu xmm2, xmmword [rbx + 0x60]
vmovdqu xmmword [rsi - 0x20], xmm2
vmovdqu xmm3, xmmword [rbx + 0x70]
vmovdqu xmmword [rsi - 0x10], xmm3
call sym.xor_salsa8
mov rdx, rbx
mov rcx, rdi
call sym.xor_salsa8
cmp rsi, r13
jne 0x14018e150
lea esi, [r12 - 1]
xor r13d, r13d
jmp 0x14018e22b
add rax, rbp
vmovdqu ymm4, ymmword [rbx]
vpxor ymm0, ymm4, ymmword [rax]
vmovdqu ymm4, ymmword [rbx + 0x40]
vmovdqu ymmword [rbx], ymm0
vmovdqu ymm5, ymmword [rax + 0x20]
vpxor ymm0, ymm5, ymmword [rbx + 0x20]
vmovdqu ymmword [rbx + 0x20], ymm0
vpxor ymm0, ymm4, ymmword [rax + 0x40]
vmovdqu ymmword [rbx + 0x40], ymm0
vmovdqu ymm5, ymmword [rax + 0x60]
vpxor ymm0, ymm5, ymmword [rbx + 0x60]
vmovdqu ymmword [rbx + 0x60], ymm0
mov rdx, rdi
mov rcx, rbx
add r13d, 1
call sym.xor_salsa8
mov rdx, rbx
mov rcx, rdi
call sym.xor_salsa8
cmp r13d, r12d
je 0x14018e26c
mov edx, dword [rbx + 0x40]
mov rcx, rbx
and edx, esi
mov eax, edx
shl rax, 7
lea r8, [rbp + rax + 4]
sub rcx, r8
cmp rcx, 0x18
ja 0x14018e1d0
shl edx, 5
mov eax, edx
lea rcx, [rbp + rax*4]
xor eax, eax
nop dword [rax + rax]
mov edx, dword [rcx + rax]
xor dword [rbx + rax], edx
add rax, 4
cmp rax, 0x80
jne 0x14018e258
jmp 0x14018e20c
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x140194d20
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
vpshufd xmm0, xmmword [r9], 0xb1
vpshufd xmm1, xmmword [r9 + 0x10], 0x1b
vpalignr xmm2, xmm0, xmm1, 8
vpblendw xmm1, xmm1, xmm0, 0xf0
vmovdqu xmm0, xmmword [0x1402f5660]
vmovdqu xmmword [r8], xmm2
vmovdqu xmmword [r8 + 0x10], xmm1
vpaddd xmm0, xmm0, xmmword [rdx]
sha256rnds2 xmm1, xmm2, xmm0
vpshufd xmm0, xmm0, 0xe
sha256rnds2 xmm2, xmm1, xmm0
vmovdqu xmmword [rcx + 0x10], xmm1
vmovdqu xmmword [rcx], xmm2
ret
Function at 0x1401957d0
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rbx
sub rsp, 0xc8
vmovdqu xmm0, xmmword [0x1402f5640]
vmovdqu xmm1, xmmword [0x1402f5650]
lea rbx, [rsp + 0x5f]
mov rsi, rcx
mov r9, rdx
mov r10, r8
and rbx, 0xffffffffffffffc0
mov qword [rbx + 0x60], r8
vmovdqu xmmword [rbx + 0x40], xmm0
vmovdqu xmmword [rbx + 0x50], xmm1
cmp r8, 0x3f
jbe 0x1401958c0
vmovdqu xmm2, xmmword [rdx]
vmovdqu xmm3, xmmword [rdx + 0x10]
lea r8, [rbx + 0x40]
lea rax, [r10 - 0x40]
vmovdqu xmm4, xmmword [rdx + 0x20]
vmovdqu xmm5, xmmword [rdx + 0x30]
mov rcx, r8
mov rdx, rbx
vmovdqu xmmword [rbx], xmm2
lea r11, [r9 + 0x40]
vmovdqu xmmword [rbx + 0x10], xmm3
vmovdqu xmmword [rbx + 0x20], xmm4
vmovdqu xmmword [rbx + 0x30], xmm5
call sym.sha256_x86_sha_transform_be
cmp rax, 0x3f
jbe 0x140195898
mov rax, r11
add r9, r10
nop dword [rax]
mov rdx, rax
mov rcx, r8
add rax, 0x40
call sym.sha256_x86_sha_transform_be
mov rdx, r9
sub rdx, rax
cmp rdx, 0x3f
ja 0x140195860
lea rax, [r10 - 0x80]
mov rdx, rax
shr rdx, 6
lea rcx, [rdx + 1]
shl rdx, 6
shl rcx, 6
sub rax, rdx
add r11, rcx
mov r8, rax
mov rdx, r11
mov rcx, rbx
call sym.memcpy
mov rdx, rsi
mov rcx, rbx
call sym.sha256_final
nop
add rsp, 0xc8
pop rbx
pop rsi
ret
mov rcx, rbx
call sym.memcpy
jmp 0x1401958a6
Function at 0x1401b9720
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1e8
xor r10d, r10d
xor r14d, r14d
mov ebp, pe_nt_image_headers64
movabs rax, 0x6a09e667f3bcc908
vmovq xmm0, rax
movabs rax, 0xbb67ae8584caa73b
vpunpcklqdq xmm0, xmm0, xmm0
lea r15, [rsp + 0x5f]
mov qword [rsp + 0x230], rcx
mov r12, rdx
mov rdi, r8
and r15, 0xffffffffffffffc0
vmovdqu xmmword [r15 + 0x100], xmm0
vmovq xmm0, rax
movabs rax, 0x3c6ef372fe94f82b
lea r13, [r15 + 0x100]
vpunpcklqdq xmm0, xmm0, xmm0
mov byte [r15 + 0x188], 1
vmovdqu xmmword [r15 + 0x110], xmm0
vmovq xmm0, rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [r15 + 0x180], 0
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [r15 + 0x120], xmm0
vmovq xmm0, rax
movabs rax, 0x510e527fade682d1
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [r15 + 0x130], xmm0
vmovq xmm0, rax
movabs rax, 0x9b05688c2b3e6c1f
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [r15 + 0x140], xmm0
vmovq xmm0, rax
movabs rax, 0x1f83d9abfb41bd6b
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [r15 + 0x150], xmm0
vmovq xmm0, rax
movabs rax, 0x5be0cd19137e2179
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [r15 + 0x160], xmm0
vmovq xmm0, rax
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [r15 + 0x170], xmm0
test r8, r8
je 0x1401b98be
nop dword [rax]
mov rbx, rbp
mov rcx, r14
sub rbx, r14
cmp rbx, rdi
cmova rbx, rdi
shr rcx, 3
shl rcx, 4
mov rsi, rbx
shr rsi, 3
test esi, esi
jle 0x1401b9899
lea r8d, [rsi - 1]
add rcx, r15
mov rdx, r12
add r8, 1
shl r8, 4
call sym.memcpy
mov r10, qword [r15 + 0x180]
shl rsi, 4
add r14, rbx
sub rdi, rbx
add r12, rsi
cmp r14, 0x80
je 0x1401b98e8
add r10, rbx
mov qword [r15 + 0x180], r10
test rdi, rdi
jne 0x1401b9858
mov rdx, qword [rsp + 0x230]
mov rcx, r15
call sym.sha512_2x64_close
nop
add rsp, 0x1e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, r13
mov rcx, r15
add r10, rbx
call sym.sha512_2x64_round.constprop.0
mov qword [r15 + 0x180], r10
test rdi, rdi
je 0x1401b98be
xor r14d, r14d
jmp 0x1401b9858
Function at 0x1401b9910
Capabilities:
Hash data using sha512

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor r12d, r12d
mov ebp, pe_nt_image_headers64
movabs rax, 0x6a09e667f3bcc908
vmovq xmm0, rax
movabs rax, 0xbb67ae8584caa73b
vpunpcklqdq xmm0, xmm0, xmm0
mov byte [rcx + 0x188], 1
mov rsi, rcx
mov rbx, rdx
mov r10, r8
vmovdqu xmmword [rcx + 0x100], xmm0
vmovq xmm0, rax
movabs rax, 0x3c6ef372fe94f82b
lea rdi, [rcx + 0x100]
mov qword [rcx + 0x180], 0
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x110], xmm0
vmovq xmm0, rax
movabs rax, 0xa54ff53a5f1d36f1
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x120], xmm0
vmovq xmm0, rax
movabs rax, 0x510e527fade682d1
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x130], xmm0
vmovq xmm0, rax
movabs rax, 0x9b05688c2b3e6c1f
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x140], xmm0
vmovq xmm0, rax
movabs rax, 0x1f83d9abfb41bd6b
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x150], xmm0
vmovq xmm0, rax
movabs rax, 0x5be0cd19137e2179
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x160], xmm0
vmovq xmm0, rax
vpunpcklqdq xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x170], xmm0
test r9, r9
je 0x1401b9a96
nop dword [rax]
mov r11, rbp
mov rax, r12
sub r11, r12
cmp r11, r9
cmova r11, r9
shr rax, 3
shl rax, 4
mov r8, r11
mov rcx, rax
shr r8, 3
test r8d, r8d
jle 0x1401b9a74
lea edx, [r8 - 1]
xor eax, eax
add rcx, rsi
add rdx, 1
shl rdx, 4
vmovdqu xmm1, xmmword [r10 + rax]
vmovdqu xmmword [rcx + rax], xmm1
add rax, 0x10
cmp rdx, rax
jne 0x1401b9a60
shl r8, 4
add r12, r11
sub r9, r11
add r10, r8
cmp r12, 0x80
je 0x1401b9ab0
add qword [rsi + 0x180], r11
test r9, r9
jne 0x1401b9a28
mov rdx, rbx
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.sha512_2x64_close
mov rdx, rdi
mov rcx, rsi
call sym.sha512_2x64_round.constprop.0
add qword [rsi + 0x180], r11
test r9, r9
je 0x1401b9a96
xor r12d, r12d
jmp 0x1401b9a28
Function at 0x1401bba20
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movsxd r8, r8d
call sym.sha256_full
mov r8d, 0x20
mov rdx, rbx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.sha256_full
Function at 0x1401d0c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
vmovups xmmword [rsp + 0x20], xmm6
mov rax, qword [rcx + 0xc0]
vmovd xmm1, dword [rcx + 0xd0]
vpinsrd xmm0, xmm1, dword [rcx + 0xd4], 1
mov rsi, rdx
mov edx, dword [rcx + 0xc8]
mov rbx, rcx
lea edx, [rdx + rax*8]
vmovd xmm2, edx
mov dword [rcx + 0xc8], edx
vpinsrd xmm6, xmm2, dword [rcx + 0xcc], 1
vpunpcklqdq xmm6, xmm6, xmm0
test rax, rax
je 0x1401d0d98
lea r8, [rcx + rax]
lea rdx, [rax + 1]
mov byte [r8], pe_nt_image_headers64
lea rcx, [rcx + rdx]
cmp rax, 0x6d
jbe 0x1401d0d60
mov r8d, pe_nt_image_headers64
lea rdi, [rbx + 8]
sub r8, rdx
xor edx, edx
and rdi, 0xfffffffffffffff8
call sym.memset
mov rcx, rbx
mov rdx, rbx
call sym.c512
sub rcx, rdi
xor eax, eax
vpxor xmm0, xmm0, xmm0
add ecx, 0x6e
mov qword [rbx], 0
shr ecx, 3
mov qword [rbx + 0x66], 0
rep stosq qword [rdi], rax
vmovdqu xmmword [rbx + 0xc8], xmm0
movzx eax, word [0x1402f5f80]
mov rdx, rbx
vmovdqu xmmword [rbx + 0x6e], xmm6
mov rcx, rbx
mov word [rbx + 0x7e], ax
call sym.c512
lea rdx, [rbx + 0x84]
mov rax, rsi
sub rax, rdx
cmp rax, 0x18
jbe 0x1401d0e10
vmovdqu ymm3, ymmword [rbx + 0x80]
vmovdqu ymmword [rsi], ymm3
vmovdqu ymm0, ymmword [rbx + 0xa0]
vmovdqu ymmword [rsi + 0x20], ymm0
vzeroupper
vmovups xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov eax, 0x6e
sub rax, rdx
cmp eax, 8
jae 0x1401d0dd8
test al, 4
jne 0x1401d0ead
test eax, eax
je 0x1401d0cfc
mov byte [rcx], 0
test al, 2
je 0x1401d0cfc
mov eax, eax
xor edx, edx
mov word [rcx + rax - 2], dx
jmp 0x1401d0cfc
lea rdi, [rcx + 9]
mov edx, ecx
mov byte [rcx], pe_nt_image_headers64
vpxor xmm0, xmm0, xmm0
and rdi, 0xfffffffffffffff8
mov qword [rcx + 1], 0
sub edx, edi
mov qword [rcx + 0x66], 0
lea ecx, [rdx + 0x6e]
shr ecx, 3
rep stosq qword [rdi], rax
vmovdqu xmmword [rbx + 0xc8], xmm0
jmp 0x1401d0cfc
lea rdi, [rcx + 8]
mov edx, eax
mov qword [rcx], 0
mov qword [rcx + rdx - 8], 0
and rdi, 0xfffffffffffffff8
sub rcx, rdi
add ecx, eax
mov eax, ecx
shr eax, 3
mov ecx, eax
xor eax, eax
rep stosq qword [rdi], rax
jmp 0x1401d0cfc
mov eax, dword [rbx + 0x80]
mov dword [rsi], eax
mov eax, dword [rbx + 0x84]
mov dword [rsi + 4], eax
mov eax, dword [rbx + 0x88]
mov dword [rsi + 8], eax
mov eax, dword [rbx + 0x8c]
mov dword [rsi + 0xc], eax
mov eax, dword [rbx + 0x90]
mov dword [rsi + 0x10], eax
mov eax, dword [rbx + 0x94]
mov dword [rsi + 0x14], eax
mov eax, dword [rbx + 0x98]
mov dword [rsi + 0x18], eax
mov eax, dword [rbx + 0x9c]
mov dword [rsi + 0x1c], eax
mov eax, dword [rbx + 0xa0]
mov dword [rsi + 0x20], eax
mov eax, dword [rbx + 0xa4]
mov dword [rsi + 0x24], eax
mov eax, dword [rbx + 0xa8]
mov dword [rsi + 0x28], eax
mov eax, dword [rbx + 0xac]
mov dword [rsi + 0x2c], eax
mov eax, dword [rbx + 0xb0]
mov dword [rsi + 0x30], eax
mov eax, dword [rbx + 0xb4]
mov dword [rsi + 0x34], eax
mov eax, dword [rbx + 0xb8]
mov dword [rsi + 0x38], eax
mov eax, dword [rbx + 0xbc]
mov dword [rsi + 0x3c], eax
vmovups xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov eax, eax
mov dword [rcx], 0
mov dword [rcx + rax - 4], 0
jmp 0x1401d0cfc
Function at 0x14021b610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x278
lea rdi, [rsp + 0x5f]
mov r12, r8
lea rbx, [rdx - 0x20]
mov rsi, rcx
and rdi, 0xffffffffffffffc0
mov edx, 0x50
mov rcx, r12
mov rbp, r9
lea r13, [rdi + 0x200]
mov r9d, 0x20
shr rbx, 4
mov r8, r13
add ebx, 1
call sym.sha3
mov rdx, qword [r12 + 0x48]
mov rcx, rdi
call sym.verthash_sha3_512_final_8
mov eax, 0x1000193
mov rcx, rdi
vmovdqu ymm0, ymmword [rdi + 0x200]
vmovd xmm1, eax
mov r9d, 0x811c9dc5
vpbroadcastd ymm1, xmm1
nop dword [rax]
mov eax, dword [rcx]
xor edx, edx
add rcx, 4
xor eax, r9d
imul eax, eax, 0x1000193
div ebx
shl rdx, 4
lea rax, [rsi + rdx]
xor r9d, dword [rax]
vpxor ymm0, ymm0, ymmword [rax]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 4]
imul r9d, r9d, 0x1000193
vpmulld ymm0, ymm1, ymm0
xor r9d, dword [rax + 8]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 0xc]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 0x10]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 0x14]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 0x18]
imul r9d, r9d, 0x1000193
xor r9d, dword [rax + 0x1c]
imul r9d, r9d, 0x1000193
cmp rcx, r13
jne 0x14021b688
mov eax, 0x1000193
mov r11d, 1
vmovd xmm2, eax
vpbroadcastd ymm2, xmm2
nop dword [rax]
mov ecx, r11d
mov r10, rdi
nop word cs:[rax + rax]
mov eax, dword [r10]
xor edx, edx
add r10, 4
rol eax, cl
xor eax, r9d
imul eax, eax, 0x1000193
div ebx
shl rdx, 4
add rdx, rsi
xor r9d, dword [rdx]
vpxor ymm0, ymm0, ymmword [rdx]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 4]
imul r9d, r9d, 0x1000193
vpmulld ymm1, ymm0, ymm2
xor r9d, dword [rdx + 8]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 0xc]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 0x10]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 0x14]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 0x18]
imul r9d, r9d, 0x1000193
xor r9d, dword [rdx + 0x1c]
vmovdqu ymm0, ymm1
imul r9d, r9d, 0x1000193
cmp r10, r13
jne 0x14021b730
add r11, 1
cmp r11, 0x20
jne 0x14021b720
vmovdqu ymmword [rdi + 0x200], ymm1
mov rax, qword [r10 + 0x10]
mov rdx, qword [r10 + 0x18]
vmovdqu xmmword [rbp], xmm1
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
vzeroupper
add rsp, 0x278
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x14021b850
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov rcx, qword [rcx]
mov edx, r8d
shl edx, 5
xor r8d, r8d
call sym.fseek
mov r9, qword [rbx]
mov edx, 1
mov rcx, rsi
mov r8d, 0x20
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fwrite

Function at 0x14021b890
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdx, qword [rcx + 0x10]
mov rbx, rcx
mov rcx, qword [rcx]
not rdx
and rdx, r8
xor r8d, r8d
shl edx, 5
call sym.fseek
mov r9, qword [rbx]
mov edx, 1
mov rcx, rsi
mov r8d, 0x20
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fwrite
Function at 0x14021b8d0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rdx, qword [rcx + 0x10]
mov rbx, rcx
mov rcx, qword [rcx]
mov rsi, r8
xor r8d, r8d
not rdx
and rdx, rax
shl edx, 5
call sym.fseek
mov r9, qword [rbx]
mov edx, 1
mov rcx, rsi
mov r8d, 0x20
add rsp, 0x28
pop rbx
pop rsi
jmp sym.fwrite

Function at 0x14021b920
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rcx, qword [rcx]
shl edx, 5
call sym.fseek
mov ecx, 0x20
call sym.malloc
mov r9, qword [rsi]
mov r8d, 0x20
mov edx, 1
mov rcx, rax
mov rbx, rax
call sym.fread
cmp rax, 0x20
mov eax, 0
cmovne rbx, rax
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x14021b980
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rax, rdx
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
mov rcx, qword [rcx]
not rdx
and rdx, rax
shl edx, 5
call sym.fseek
mov ecx, 0x20
call sym.malloc
mov r9, qword [rsi]
mov r8d, 0x20
mov edx, 1
mov rcx, rax
mov rbx, rax
call sym.fread
cmp rax, 0x20
mov eax, 0
cmovne rbx, rax
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret