joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a4f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140014040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000a51d
xor eax, eax
jmp 0x14000a689
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000a557
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000a557
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000a689
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000a67c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000a59a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000a5c5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000a681
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000a634
sub eax, 1
je 0x14000a634
cmp eax, 2
jne 0x14000a67c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000a681
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000a662
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000a67c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000a681
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000c4a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000ad40
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140014040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000ae13
cmp byte [rcx + 0x71], 0
je 0x14000ae13
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000ae0f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000add4
sub eax, 1
je 0x14000add8
cmp eax, 2
jne 0x14000ae0f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000c4a0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000ae06
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000ae0f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000adbc
xor al, al
jmp 0x14000adbc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000c4a0
add rsp, 0x60
pop rbx
ret

Function at 0x14000cf90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000cfda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000cfda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000cfda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000cfda
cmp dword [rcx + 0x84], 0xe
jbe 0x14000cfda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000cfdc
xor al, al
add rsp, 0x28
ret
Function at 0x1400146e0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1400148be
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.14000ff40
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov rax, qword [rax]
cmp rax, rdi
je 0x1400148b2
movabs rcx, 0x100000001b3
movabs rdx, 0xcbf29ce484222325
jmp 0x140014781
mov qword [r9 + r10*8], r8
mov qword [r9 + rbx*8], r8
cmp rax, rdi
je 0x1400148b2
mov r8, rax
mov rax, qword [rax]
movzx r9d, byte [r8 + 0x10]
xor r9, rdx
imul r9, rcx
movzx r10d, byte [r8 + 0x11]
xor r10, r9
imul r10, rcx
movzx r9d, byte [r8 + 0x12]
xor r9, r10
imul r9, rcx
movzx r10d, byte [r8 + 0x13]
xor r10, r9
imul r10, rcx
movzx r9d, byte [r8 + 0x14]
xor r9, r10
imul r9, rcx
movzx r10d, byte [r8 + 0x15]
xor r10, r9
imul r10, rcx
movzx r9d, byte [r8 + 0x16]
xor r9, r10
imul r9, rcx
movzx r11d, byte [r8 + 0x17]
xor r11, r9
imul r11, rcx
and r11, qword [rsi + 0x30]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11*2 + 1]
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x140014770
mov r14, qword [r9 + rbx*8]
mov r15, qword [r8 + 0x10]
cmp r15, qword [r14 + 0x10]
jne 0x140014850
mov r10, qword [r14]
cmp r10, r8
je 0x140014774
mov r11, qword [r8 + 8]
mov qword [r11], rax
mov r14, qword [rax + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], r8
mov qword [r10 + 8], r14
mov qword [rax + 8], r11
mov qword [r8 + 8], r15
jmp 0x140014774
cmp r11, r14
je 0x140014888
mov r14, qword [r14 + 8]
cmp r15, qword [r14 + 0x10]
jne 0x140014850
mov r9, qword [r14]
mov r10, qword [r8 + 8]
mov qword [r10], rax
mov r11, qword [rax + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], r8
mov qword [r9 + 8], r11
mov qword [rax + 8], r10
mov qword [r8 + 8], rbx
jmp 0x140014778
mov rbx, qword [r8 + 8]
mov qword [rbx], rax
mov r14, qword [rax + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], r8
mov qword [r11 + 8], r14
mov qword [rax + 8], rbx
mov qword [r8 + 8], r15
mov qword [r9 + r10*8], r8
jmp 0x140014778
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1400a2b4c
int3
Function at 0x140019da0
Capabilities:
Send icmp echo request

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rcx, rdx
mov rax, qword [0x1400ffa80]
xor rax, rsp
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [0x1400d4db0]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [str.PING1000]
movaps xmmword [rsp + 0x40], xmm0
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, 0xffffffff
cmp eax, 0xffffffff
je 0x140019ebd
mov ebp, eax
call qword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
cmp rax, 0xffffffffffffffff
je 0x140019ebd
mov rsi, rax
mov ecx, 0x48
call fcn.1400b3f60
test rax, rax
je 0x140019ebd
mov rdi, rax
call fcn.1400a6c50
mov r14, rax
call fcn.1400a6c34
mov rcx, rax
cmp r14, 0x989680
jne 0x140019ed7
imul r14, rcx, 0x64
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x38], 0x3e8
mov dword [rsp + 0x30], 0x48
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x40]
mov rcx, rsi
mov edx, ebp
mov r9w, 0x20
call qword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
test eax, eax
je 0x140019eac
call fcn.1400a6c50
mov rbx, rax
call fcn.1400a6c34
mov rcx, rax
cmp rbx, 0x989680
jne 0x140019f42
imul rax, rcx, 0x64
sub rax, r14
movabs rcx, 0x431bde82d7b634db
imul rcx
mov rbx, rdx
mov rax, rdx
shr rax, 0x3f
shr rbx, 0x12
add ebx, eax
mov rcx, rdi
call fcn.1400b2a00
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400a2150
mov eax, ebx
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
cmp r14, 0x16e3600
jne 0x140019fa9
movabs r9, 0xb2f4fc0794908cf3
mov rax, rcx
imul r9
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r9
mov r14, rdx
imul rax, r8, 0x3b9aca00
add r14, rcx
mov rcx, r14
shr rcx, 0x3f
sar r14, 0x18
add r14, rcx
add r14, rax
jmp 0x140019e34
cmp rbx, 0x16e3600
jne 0x140019fbf
movabs r9, 0xb2f4fc0794908cf3
mov rax, rcx
imul r9
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r9
mov rax, rdx
imul rdx, r8, 0x3b9aca00
add rax, rcx
mov rcx, rax
shr rcx, 0x3f
sar rax, 0x18
add rax, rcx
add rax, rdx
jmp 0x140019e8c
mov rax, rcx
or rax, r14
shr rax, 0x20
je 0x140019fd5
mov rax, rcx
cqo
idiv r14
jmp 0x140019fdc
mov rax, rcx
or rax, rbx
shr rax, 0x20
je 0x14001a010
mov rax, rcx
cqo
idiv rbx
jmp 0x14001a016
mov eax, ecx
xor edx, edx
div r14d
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, r14
or rdx, rax
shr rdx, 0x20
je 0x14001a000
cqo
idiv r14
mov r14, rax
jmp 0x14001a008
xor edx, edx
div r14d
mov r14d, eax
add r14, rcx
jmp 0x140019e34
mov eax, ecx
xor edx, edx
div ebx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rbx
or rdx, rax
shr rdx, 0x20
je 0x14001a037
cqo
idiv rbx
jmp 0x14001a03b
xor edx, edx
div ebx
add rax, rcx
jmp 0x140019e8c

Function at 0x14001d680
Capabilities:
Packed with generic packer

Disassembly:
mov rdi, qword [rsp + 0x30]
jne 0x14008820a
Function at 0x140037ca0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov rax, qword [0x1400ffa80]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov ebp, 0xfffffffc
test rdx, rdx
je 0x140037d48
mov r13d, r9d
mov r12d, r8d
mov rdi, rcx
lea rax, [0x1400f3808]
mov rcx, rdx
mov rdx, rax
call fcn.1400b213c
test rax, rax
je 0x140037d48
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8d, 2
call fcn.1400af3c8
test eax, eax
jne 0x140037d40
mov rcx, rsi
call fcn.1400b2d10
mov ebx, eax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.1400af3c8
test eax, eax
jne 0x140037d40
lea eax, [rbx - 0x400001]
cmp eax, 0xffbfffff
ja 0x140037d6e
mov rcx, rsi
call fcn.1400b17c4
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400a2150
mov eax, ebp
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15d, ebx
cmp ebx, 0x401
jae 0x140037d80
lea r14, [rsp + 0x60]
jmp 0x140037d90
mov rcx, r15
call fcn.140046490
mov r14, rax
test rax, rax
je 0x140037d40
mov edx, 1
mov rcx, r14
mov r8, r15
mov r9, rsi
call fcn.1400b2770
mov ebp, 0xfffffffc
cmp rax, r15
jne 0x140037eb9
mov r9d, r13d
cmp r13d, 0x16
jne 0x140037e42
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x50]
mov ecx, 5
call fcn.14006c4d0
test eax, eax
je 0x140037e0d
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x50]
xor ecx, ecx
call fcn.14006c4d0
test eax, eax
je 0x140037e2a
cmp ebx, 0x401
jb 0x140037dfb
mov rcx, r14
call fcn.1400464b0
mov rcx, rsi
call fcn.1400b17c4
mov ebp, 0xfffffff8
jmp 0x140037d48
mov rdx, qword [rsp + 0x58]
mov rcx, r14
mov r8d, ebx
call fcn.140047380
mov r9d, 5
test rax, rax
jne 0x140037e42
jmp 0x140037dd6
mov rdx, qword [rsp + 0x58]
mov rcx, r14
mov r8d, ebx
call fcn.140047380
xor r9d, r9d
test rax, rax
je 0x140037deb
mov ecx, dword [rsp + 0x4e8]
mov rax, qword [rsp + 0x4d0]
cmp r9d, 5
sete dl
cmp r9d, 0xf
sete r8b
cmp r12d, 1
jne 0x140037e84
or dl, r8b
je 0x140037e84
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r14
mov r8d, ebx
call fcn.140037ee0
jmp 0x140037eb7
mov edx, dword [rsp + 0x4d8]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x30], 0
mov rcx, rdi
mov rdx, r14
mov r9d, r12d
mov r8d, ebx
call fcn.140036460
mov ebp, eax
mov rcx, rsi
call fcn.1400b17c4
cmp ebx, 0x401
jb 0x140037d48
mov rcx, r14
call fcn.1400464b0
jmp 0x140037d48
Function at 0x140042980
Capabilities:
Encrypt data using aes
Resolve function by parsing pe exports

Disassembly:
mov rax, rdx
mov rdx, r8
mov r8, rax
jmp fcn.140042990
Function at 0x140046530
Capabilities:
Encrypt data using des

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov dword [rsp + 0x2c], edx
mov rax, qword [0x1400ffa80]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor eax, eax
lea rdx, str.91__
lea r10, [0x1400dd220]
nop dword [rax]
movzx r11d, byte [rax + rdx]
dec r11d
mov esi, r11d
and esi, 7
sar r11d, 3
movsxd r11, r11d
movzx r11d, byte [rcx + r11]
test dword [r10 + rsi*4], r11d
setne byte [rsp + rax + 0x30]
inc rax
cmp rax, 0x38
jne 0x140046570
xor r11d, r11d
lea rsi, [0x1400dd240]
mov edi, 0xffffffe5
mov ebx, 0x1c
movabs r14, 0xaaaaaaaaaaaaaaab
lea r15, [0x1400dd250]
jmp 0x140046643
mov eax, dword [rsp + 0xa0]
shl eax, 0x18
movzx ecx, byte [rsp + 0xa2]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [rsp + 0xa4]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0xa6]
or ecx, eax
mov dword [r8 + r11*8], ecx
movzx eax, byte [rsp + 0xa1]
shl eax, 0x18
movzx ecx, byte [rsp + 0xa3]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [rsp + 0xa5]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0xa7]
or ecx, eax
mov dword [r8 + r11*8 + 4], ecx
inc r11
cmp r11, 0x10
je 0x14004671d
mov qword [rsp + 0xa0], 0
movzx eax, byte [r11 + rsi]
lea rcx, [rax + 1]
lea rdx, [rax + rdi]
xor r12d, r12d
nop
lea r13, [rax + r12]
cmp r12, 0x1c
mov ebp, 0x38
cmovb rbp, rbx
lea r9d, [rdx - 1]
cmp r13, rbp
cmovb r9, r13
movsxd r9, r9d
movzx r9d, byte [rsp + r9 + 0x30]
lea r13, [r12 + 1]
cmp r13, 0x1c
mov r13d, 0x38
cmovb r13, rbx
cmp rcx, r13
mov r13, rdx
cmovb r13, rcx
mov byte [rsp + r12 + 0x68], r9b
movsxd r9, r13d
movzx r9d, byte [rsp + r9 + 0x30]
mov byte [rsp + r12 + 0x69], r9b
add rcx, 2
add rdx, 2
add r12, 2
cmp r12, 0x38
jne 0x140046660
mov r12, r10
xor ecx, ecx
jmp 0x1400466e1
inc rcx
add r12, 4
cmp rcx, 0x30
je 0x1400465d0
mov rax, rcx
mul r14
movzx eax, byte [rcx + r15]
cmp byte [rsp + rax + 0x67], 0
je 0x1400466d0
add rdx, rdx
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
mov eax, dword [r12 + rax]
shr eax, 2
movzx edx, cl
imul edx, edx, 0xab
shr edx, 0xa
or byte [rsp + rdx + 0xa0], al
jmp 0x1400466d0
cmp dword [rsp + 0x2c], 1
jne 0x1400467ae
movdqu xmm0, xmmword [r8 + 0x70]
pshufd xmm0, xmm0, 0x4e
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
movdqu xmm3, xmmword [r8 + 0x20]
movdqu xmm4, xmmword [r8 + 0x30]
movdqu xmmword [r8], xmm0
pshufd xmm0, xmm1, 0x4e
movdqu xmmword [r8 + 0x70], xmm0
movdqu xmm0, xmmword [r8 + 0x60]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [r8 + 0x10], xmm0
pshufd xmm0, xmm2, 0x4e
movdqu xmmword [r8 + 0x60], xmm0
movdqu xmm0, xmmword [r8 + 0x50]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [r8 + 0x20], xmm0
pshufd xmm0, xmm3, 0x4e
movdqu xmmword [r8 + 0x50], xmm0
movdqu xmm0, xmmword [r8 + 0x40]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [r8 + 0x30], xmm0
pshufd xmm0, xmm4, 0x4e
movdqu xmmword [r8 + 0x40], xmm0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400a2150
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400470e0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, dword [rcx]
mov esi, dword [rdx]
xor r9d, r9d
lea r10, [0x1400dd280]
nop word [rax + rax]
mov r11d, esi
rol esi, 0x1c
xor esi, dword [r8 + r9]
mov edi, esi
and edi, 0x3f
mov ebx, esi
shr ebx, 6
and ebx, 0xfc
mov r14d, esi
shr r14d, 0xe
and r14d, 0xfc
shr esi, 0x16
and esi, 0xfc
mov r15d, dword [r8 + r9 + 4]
xor r15d, r11d
mov r12d, r15d
and r12d, 0x3f
mov r13d, r15d
shr r13d, 6
and r13d, 0xfc
mov ebp, r15d
shr ebp, 0xe
and ebp, 0xfc
shr r15d, 0x16
and r15d, 0xfc
xor eax, dword [r10 + rdi*4 + 0x600]
xor eax, dword [rbx + r10 + 0x400]
xor eax, dword [r14 + r10 + 0x200]
xor eax, dword [rsi + r10]
xor eax, dword [r10 + r12*4 + 0x700]
xor eax, dword [r13 + r10 + 0x500]
xor eax, dword [rbp + r10 + 0x300]
xor eax, dword [r15 + r10 + 0x100]
mov edi, eax
rol edi, 0x1c
xor edi, dword [r8 + r9 + 8]
mov esi, edi
and esi, 0x3f
mov esi, dword [r10 + rsi*4 + 0x600]
mov ebx, edi
shr ebx, 6
and ebx, 0xfc
mov r14d, edi
shr r14d, 0xe
and r14d, 0xfc
shr edi, 0x16
and edi, 0xfc
mov r15d, dword [r8 + r9 + 0xc]
xor r15d, eax
mov r12d, r15d
and r12d, 0x3f
mov r13d, r15d
shr r13d, 6
and r13d, 0xfc
mov ebp, r15d
shr ebp, 0xe
and ebp, 0xfc
shr r15d, 0x16
and r15d, 0xfc
xor esi, dword [rbx + r10 + 0x400]
xor esi, dword [r14 + r10 + 0x200]
xor esi, dword [rdi + r10]
xor esi, dword [r10 + r12*4 + 0x700]
xor esi, dword [r13 + r10 + 0x500]
xor esi, dword [rbp + r10 + 0x300]
xor esi, dword [r15 + r10 + 0x100]
xor esi, r11d
add r9, 0x10
cmp r9, 0x80
jne 0x140047100
mov dword [rcx], eax
mov dword [rdx], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140047c00
Capabilities:
Generate random numbers via winapi

Disassembly:
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp fcn.1400476a0

Function at 0x140047c10
Capabilities:
Generate random numbers via winapi

Disassembly:
mov r9, rdx
xor edx, edx
xor r8d, r8d
jmp fcn.1400476a0
Function at 0x140048930
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14004897e
mov rcx, qword [rsi]
mov edx, ebx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140048985
mov rcx, qword [rsi]
xor esi, esi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x14004898a
mov esi, 0xffffff99
jmp 0x14004898a
mov esi, 0xffffff98
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140071dc0
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, 0xffffff53
test rcx, rcx
je 0x140071e93
mov rdi, rdx
test rdx, rdx
je 0x140071e93
mov rsi, rcx
call fcn.1400740e0
test eax, eax
jne 0x140071e93
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmm3, xmmword [rsi + 0x30]
movups xmmword [rdi + 0x30], xmm3
movups xmmword [rdi + 0x20], xmm2
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rsi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rsi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rsi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsi + 0x38], rax
mov dword [rsi + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0xc8], xmm0
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140071ea0
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x140071f3a
mov qword [rcx + 0xd8], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0xc8], xmm0
xor eax, eax
ret
mov eax, 0xffffff53
ret
Function at 0x140074000
Capabilities:
Hash data using sha384

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, 0xffffff53
test rcx, rcx
je 0x1400740cb
mov rdi, rdx
test rdx, rdx
je 0x1400740cb
mov rsi, rcx
call fcn.1400740e0
test eax, eax
jne 0x1400740cb
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmmword [rdi + 0x20], xmm2
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rsi], rax
movabs rax, 0x629a292a367cd507
mov qword [rsi + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rsi + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rsi + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rsi + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rsi + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rsi + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rsi + 0x38], rax
mov dword [rsi + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0xc8], xmm0
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400743b0
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
je 0x140074446
mov qword [rcx + 0xd8], rdx
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0xc8], xmm0
xor eax, eax
ret
mov eax, 0xffffff53
ret

Function at 0x140074450
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
je 0x1400744ea
mov qword [rcx + 0xd8], 0
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0xc8], xmm0
xor eax, eax
ret
mov eax, 0xffffff53
ret
Function at 0x14007a440
Capabilities:
Hash data using sha512

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp qword [rcx + 0x78], 0
je 0x14007a457
mov rcx, rsi
call fcn.14007a530
mov ecx, 0x470
call fcn.140046490
mov qword [rsi + 0x78], rax
test rax, rax
je 0x14007a523
mov r8d, 0x470
mov rcx, rax
xor edx, edx
call fcn.1400d0da0
mov r8d, dword [rsi + 0x164c]
mov rdx, qword [rsi + 0xa8]
mov ecx, 0x1d0
add rcx, qword [rsi + 0x78]
call fcn.140074fa0
test eax, eax
jne 0x14007a528
mov r8d, dword [rsi + 0x164c]
mov rdx, qword [rsi + 0xa8]
mov ecx, 0x168
add rcx, qword [rsi + 0x78]
call fcn.14006f390
test eax, eax
jne 0x14007a528
mov r8d, dword [rsi + 0x164c]
mov rdx, qword [rsi + 0xa8]
mov ecx, 0x238
add rcx, qword [rsi + 0x78]
call fcn.140070c80
test eax, eax
jne 0x14007a528
mov r8d, dword [rsi + 0x164c]
mov rdx, qword [rsi + 0xa8]
mov ecx, 0x2b0
add rcx, qword [rsi + 0x78]
call fcn.1400743b0
test eax, eax
jne 0x14007a528
mov r8d, dword [rsi + 0x164c]
mov ecx, 0x390
add rcx, qword [rsi + 0x78]
mov rdx, qword [rsi + 0xa8]
add rsp, 0x20
pop rsi
jmp fcn.140071850
mov eax, 0xffffff83
add rsp, 0x20
pop rsi
ret