joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008e2c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov esi, edx
mov rdi, rcx
or ebx, 0xffffffff
cmp edx, ebx
jne 0x140008e5c
xor eax, eax
jmp 0x140009047
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140008e96
mov rdx, qword [rdi + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140008e96
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rdi + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov byte [rdx], sil
mov eax, esi
jmp 0x140009047
cmp qword [rdi + 0x90], 0
je 0x140009045
mov rdx, qword [rdi + 0x18]
lea rax, [rdi + 0x80]
cmp qword [rdx], rax
jne 0x140008ece
mov rcx, qword [rdi + 0x70]
mov rax, qword [rdi + 0x68]
mov qword [rdx], rax
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
sub ecx, ecx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
cmp qword [rdi + 0x78], 0
jne 0x140008eef
movsx ecx, sil
mov rdx, qword [rdi + 0x90]
call fcn.140043828
cmp eax, ebx
cmovne ebx, esi
jmp 0x140009045
mov byte [rbp - 0x30], sil
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov qword [rbp - 8], 0xf
and qword [rbp - 0x10], 0
mov byte [rbp - 0x20], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x20]
call fcn.14000a514
nop
mov r10, qword [rbp - 0x20]
mov r9, qword [rbp - 8]
lea rdx, [rbp - 0x20]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x20]
cmovae r8, r10
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp - 0x10]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x2f]
lea r8, [rbp - 0x30]
lea rdx, [rdi + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x140009024
cmp eax, 1
jg 0x14000900a
lea rax, [rbp - 0x20]
mov r10, qword [rbp - 0x20]
mov r9, qword [rbp - 8]
cmp r9, 0x10
cmovae rax, r10
mov r14, qword [rbp + 0x40]
sub r14, rax
je 0x140008fd0
lea rcx, [rbp - 0x20]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, r14
mov edx, 1
call fcn.14004511c
cmp r14, rax
jne 0x140009024
mov r9, qword [rbp - 8]
mov r10, qword [rbp - 0x20]
mov byte [rdi + 0x81], 1
lea rax, [rbp - 0x30]
cmp qword [rbp + 0x48], rax
jne 0x140009006
test r14, r14
jne 0x140008f27
cmp qword [rbp - 0x10], 0x20
jae 0x140009024
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x20]
call fcn.140004508
jmp 0x140008f1f
mov ebx, esi
jmp 0x140009024
cmp eax, 3
jne 0x140009024
movsx ecx, byte [rbp - 0x30]
mov rdx, qword [rdi + 0x90]
call fcn.140043828
cmp eax, ebx
cmovne ebx, esi
cmp qword [rbp - 8], 0x10
jb 0x140009034
mov rcx, qword [rbp - 0x20]
call fcn.1400431dc
mov qword [rbp - 8], 0xf
and qword [rbp - 0x10], 0
mov byte [rbp - 0x20], 0
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009f84
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x14000a0f0
cmp byte [rcx + 0x82], 0
je 0x14000a0f0
mov rax, qword [rcx]
mov ebx, 0xffff
mov edx, ebx
call qword [rax + 0x18]
cmp bx, ax
jne 0x140009fd6
xor al, al
jmp 0x14000a0f5
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov qword [rbp - 0x10], 0xf
and qword [rbp - 0x18], 0
mov byte [rbp - 0x28], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x28]
call fcn.14000a514
nop
mov ebx, 1
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x28]
cmovae r8, r10
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x18]
add r9, rdx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x14000a04f
dec eax
jne 0x14000a0c4
jmp 0x14000a056
mov byte [rdi + 0x82], 0
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rsi, qword [rbp + 0x20]
sub rsi, rax
je 0x14000a09e
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rsi
mov rdx, rbx
call fcn.14004511c
cmp rsi, rax
jne 0x14000a0c9
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
cmp byte [rdi + 0x82], 0
je 0x14000a0cb
test rsi, rsi
jne 0x14000a00f
xor r8d, r8d
lea edx, [rsi + 8]
lea rcx, [rbp - 0x28]
call fcn.140004508
jmp 0x14000a007
sub eax, 2
je 0x14000a0cb
xor bl, bl
cmp qword [rbp - 0x10], 0x10
jb 0x14000a0db
mov rcx, qword [rbp - 0x28]
call fcn.1400431dc
mov qword [rbp - 0x10], 0xf
and qword [rbp - 0x18], 0
mov byte [rbp - 0x28], 0
mov al, bl
jmp 0x14000a0f5
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000a240
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x78], 0
je 0x14000a3a8
cmp byte [rcx + 0x81], 0
je 0x14000a3a8
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x14000a28e
xor al, al
jmp 0x14000a3ad
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov qword [rbp - 0x10], 0xf
and qword [rbp - 0x18], 0
mov byte [rbp - 0x28], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x28]
call fcn.14000a514
nop
mov ebx, 1
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x28]
cmovae r8, r10
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x18]
add r9, rdx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
test eax, eax
je 0x14000a307
dec eax
jne 0x14000a37c
jmp 0x14000a30e
mov byte [rdi + 0x81], 0
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rsi, qword [rbp + 0x20]
sub rsi, rax
je 0x14000a356
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x90]
mov r8, rsi
mov rdx, rbx
call fcn.14004511c
cmp rsi, rax
jne 0x14000a381
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
cmp byte [rdi + 0x81], 0
je 0x14000a383
test rsi, rsi
jne 0x14000a2c7
xor r8d, r8d
lea edx, [rsi + 8]
lea rcx, [rbp - 0x28]
call fcn.140004508
jmp 0x14000a2bf
sub eax, 2
je 0x14000a383
xor bl, bl
cmp qword [rbp - 0x10], 0x10
jb 0x14000a393
mov rcx, qword [rbp - 0x28]
call fcn.1400431dc
mov qword [rbp - 0x10], 0xf
and qword [rbp - 0x18], 0
mov byte [rbp - 0x28], 0
mov al, bl
jmp 0x14000a3ad
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001d390
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov r10d, dword [rcx]
mov ebx, r8d
mov r8, rcx
mov eax, ebx
mov r9d, r10d
mov r11, rdx
xor r9, rax
shr r10d, 8
movzx eax, r9b
mov r9d, dword [rdx + rax*4]
mov edx, dword [rcx + 8]
xor r9d, r10d
mov dword [rcx], r9d
movzx eax, r9b
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
mov ecx, eax
shr ecx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
mov eax, dword [r11 + rax*4]
xor eax, edx
mov dword [r8 + 8], eax
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x14001d460
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push r15
sub rsp, 0x48
mov rbp, r9
mov r15, rcx
cmp r8d, 0xc
jge 0x14001d482
xor eax, eax
add rsp, 0x48
pop r15
pop rbp
ret
mov eax, dword [0x1400c1a00]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
inc eax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov dword [0x1400c1a00], eax
cmp eax, 1
jne 0x14001d4c6
xor ecx, ecx
call fcn.1400462ac
xor eax, 0xbb40e64e
mov ecx, eax
call fcn.140046338
mov r12, qword [rsp + 0x80]
mov rdx, rbp
mov rcx, r15
mov r8, r12
call fcn.14001d3f0
mov r13d, 0xa
lea rsi, [rsp + 0x20]
mov r14d, r13d
nop word [rax + rax]
call fcn.14004630c
mov rcx, rbp
sar eax, 7
movzx edi, al
call fcn.14001d370
mov r8d, edi
mov rdx, r12
mov ebx, eax
call fcn.14001d390
xor dil, bl
inc rsi
dec r14
mov byte [rsi - 1], dil
jne 0x14001d4f0
mov r8, r12
mov rdx, rbp
mov rcx, r15
call fcn.14001d3f0
mov r15, qword [rsp + 0x68]
lea rax, [rsp + 0x20]
mov r14, r15
lea rsi, [rsp + 0x20]
sub r14, rax
mov rcx, rbp
call fcn.14001d370
movzx edi, byte [rsi]
mov rdx, r12
mov r8d, edi
mov ebx, eax
call fcn.14001d390
xor dil, bl
inc rsi
dec r13
mov byte [r14 + rsi - 1], dil
jne 0x14001d542
mov rcx, rbp
call fcn.14001d370
mov esi, dword [rsp + 0x88]
mov rdx, r12
mov ebx, esi
mov edi, eax
shr ebx, 0x10
movzx r8d, bl
call fcn.14001d390
xor bl, dil
mov rcx, rbp
mov byte [r15 + 0xa], bl
call fcn.14001d370
shr esi, 0x18
mov r8d, esi
mov rdx, r12
mov ebx, eax
call fcn.14001d390
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
xor sil, bl
mov rbx, qword [rsp + 0x60]
mov byte [r15 + 0xb], sil
mov rsi, qword [rsp + 0x70]
lea eax, [r13 + 0xc]
mov r13, qword [rsp + 0x38]
add rsp, 0x48
pop r15
pop rbp
ret
Function at 0x14001e6f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
cmp dword [rcx + 0x10108], 0
mov rsi, rcx
je 0x14001e773
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp dword [rcx + 0xd4], ebp
jbe 0x14001e76e
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r12
lea rdi, [rcx + 0x100]
nop word [rax + rax]
lea rcx, [rsi + 0x10128]
call fcn.14001d370
movzx r8d, byte [rdi]
mov rdx, qword [rsi + 0x10138]
lea rcx, [rsi + 0x10128]
mov ebx, eax
call fcn.14001d390
xor byte [rdi], bl
inc ebp
inc rdi
cmp ebp, dword [rsi + 0xd4]
jb 0x14001e730
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r9d, dword [rsi + 0xd4]
mov rdx, qword [rsi + 0x58]
mov rcx, qword [rsi + 0x38]
mov ebx, dword [rsi + 0xd4]
lea r8, [rsi + 0x100]
call qword [rsi + 0x10]
or ecx, 0xffffffff
xor edx, edx
cmp eax, ebx
mov dword [rsi + 0xd4], 0
cmovne edx, ecx
mov ecx, dword [rsi + 0x84]
add qword [rsi + 0x10118], rbx
mov rbx, qword [rsp + 0x48]
add qword [rsi + 0x10120], rcx
mov dword [rsi + 0x84], 0
mov eax, edx
add rsp, 0x20
pop rsi
ret
Function at 0x140035340
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx + 0xd0]
jmp 0x14003f1d0
jmp fcn.14003e4e0
Function at 0x140036d50
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1400bd320]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140036e4f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140036e4f
mov dword [rsp + 0x20], 0x28
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140036e4f
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x50], 0xf
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x38], 0
mov r8d, 0x13
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x38]
call fcn.14000472c
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140036f00
lea rdx, [0x1400b98b8]
lea rcx, [rsp + 0x60]
call fcn.14004682c
nop
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140047700
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret

Function at 0x140037180
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x1400bd320]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
mov rdi, rdx
lea rcx, [rsp + 0x20]
call fcn.140037340
mov ecx, ebx
cmp rbx, rcx
jne 0x14003723c
xor r9d, r9d
test rbx, rbx
setne r9b
xor ecx, ecx
test ebx, ebx
setne cl
cmp r9d, ecx
jne 0x14003723c
mov r8, rdi
mov edx, ebx
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x140037297
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], al
lea r8d, [rax + 0xe]
lea rdx, [0x140089650]
lea rcx, [rsp + 0x30]
call fcn.14000472c
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140036f00
lea rdx, [0x1400b98b8]
lea rcx, [rsp + 0x50]
call fcn.14004682c
nop
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
mov r8d, 0x12
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x30]
call fcn.14000472c
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140036f00
lea rdx, [0x1400b98b8]
lea rcx, [rsp + 0x50]
call fcn.14004682c
nop
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140047700
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
Function at 0x140037a00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
xor r14d, r14d
lea r15, [0x140000000]
nop word [rax + rax]
movzx ebx, byte [r14 + r15 + 0x8afc0]
mov edx, ebx
mov r10d, ebx
mov esi, ebx
shr edx, 6
shr esi, 5
shr r10d, 7
mov r8d, edx
and edx, 1
mov eax, r10d
mov ebp, esi
mov r11d, esi
and esi, 1
imul r10d, r10d, 0x11b
imul eax, eax, 0x1b000000
and r11d, 2
and ebp, 4
and r8d, 2
lea ecx, [rbx + rbx]
xor ecx, ebx
lea r9d, [rcx + rcx]
lea ecx, [rcx*4]
xor ecx, ebx
xor r9d, ebx
shl ecx, 8
add r9d, r9d
shl r9d, 0x18
xor r9d, eax
mov eax, esi
imul eax, eax, 0x1b000000
xor r9d, eax
mov eax, r11d
imul eax, eax, 0x1b000000
xor r9d, eax
mov eax, edx
imul edx, edx, 0x11b00
imul eax, eax, 0x1b000000
xor r9d, eax
mov eax, r8d
imul r8d, r8d, 0x11b00
imul eax, eax, 0x1b000000
xor r9d, eax
mov eax, ebp
imul eax, eax, 0x1b000000
xor r9d, eax
mov eax, esi
imul eax, eax, 0x11b00
xor ecx, eax
mov eax, r11d
imul eax, eax, 0x11b00
xor ecx, eax
mov eax, ebp
xor ecx, edx
imul eax, eax, 0x11b00
xor ecx, r8d
xor ecx, eax
mov eax, esi
or r9d, ecx
lea ecx, [rbx*8]
imul esi, esi, 0x11b
imul eax, eax, 0x11b0000
xor ecx, ebx
shl ecx, 0x10
xor ecx, eax
mov eax, r11d
imul r11d, r11d, 0x11b
imul eax, eax, 0x11b0000
xor ecx, eax
mov eax, ebp
imul eax, eax, 0x11b0000
xor ecx, eax
lea eax, [rbx*4]
xor eax, ebx
or ecx, r9d
lea edx, [rax + rax]
mov eax, r10d
xor rdx, rax
mov eax, esi
xor rdx, rax
mov eax, r11d
xor rdx, rax
imul ebp, ebp, 0x11b
inc r14
mov eax, ebp
xor rdx, rax
xor rdx, rbx
or rdx, rcx
shl rdx, 0x20
or rdx, rcx
or rdx, rbx
mov qword [r15 + r14*8 + 0xc2648], rdx
cmp r14, 0x100
jl 0x140037a30
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov byte [0x1400c2641], 1
pop r15
pop r14
ret

Function at 0x140037bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
xor r11d, r11d
lea rdi, [0x140000000]
nop
movzx r10d, byte [r11 + rdi + 0x8aec0]
inc r11
mov ecx, r10d
lea r9d, [r10 + r10]
mov r8d, r10d
shr r8d, 7
mov eax, r9d
shl eax, 0x18
mov edx, r8d
imul r8d, r8d, 0x11b
imul edx, edx, 0x1b000000
xor edx, eax
mov eax, r10d
shl eax, 8
or ecx, eax
mov eax, r9d
shl ecx, 8
or ecx, edx
mov edx, r8d
xor rdx, rax
xor rdx, r10
or rdx, rcx
shl rdx, 0x20
or rdx, rcx
mov qword [rdi + r11*8 + 0xc1e28], rdx
cmp r11, 0x100
jl 0x140037bc0
mov rdi, qword [rsp + 8]
mov qword [0x1400c2638], 0
mov qword [0x1400c2630], 0
mov byte [0x1400c2640], 1
ret
Function at 0x140039130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r10, r8
mov r9, rcx
mov r11d, ebx
cmp r8, 8
jb 0x140039177
mov rcx, r8
shr rcx, 3
mov rax, rcx
imul rax, rax, 0xfffffffffffffff8
add r10, rax
nop word [rax + rax]
mov rax, qword [r9]
add r9, 8
add rdx, 8
xor rax, qword [rdx - 8]
or r11, rax
dec rcx
jne 0x140039160
mov r8, r11
shr r8, 0x20
or r8d, r11d
mov eax, r8d
mov r11d, r8d
shr eax, 0x10
shr r11d, 0x18
movzx ecx, al
mov eax, r8d
or r11d, ecx
shr eax, 8
movzx ecx, al
movzx eax, r8b
or r11d, ecx
or r11d, eax
test r10, r10
je 0x1400391c7
sub r9, rdx
nop
movzx r8d, byte [r9 + rdx]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
xor r8d, ecx
or r11d, r8d
dec r10
jne 0x1400391b0
mov rbx, qword [rsp + 8]
test r11d, r11d
sete al
ret

Function at 0x1400391e0
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x140039247
cmp r9, 4
jb 0x140039219
mov r10, r9
shr r10, 2
mov rax, r10
imul rax, rax, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
mov eax, dword [rdx]
add rcx, 4
add rdx, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx - 4], eax
dec r10
jne 0x140039200
test r9, r9
je 0x140039247
sub rdx, r8
sub rcx, r8
nop word [rax + rax]
movzx eax, byte [rdx + r8]
lea r8, [r8 + 1]
xor al, byte [r8 - 1]
mov byte [rcx + r8 - 1], al
dec r9
jne 0x140039230
repz ret

Function at 0x14003e450
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x14008a920]
mov dword [rcx], eax
mov eax, dword [0x14008a924]
mov dword [rcx + 4], eax
mov eax, dword [0x14008a928]
mov dword [rcx + 8], eax
mov eax, dword [0x14008a92c]
mov dword [rcx + 0xc], eax
mov eax, dword [0x14008a930]
mov dword [rcx + 0x10], eax
mov eax, dword [0x14008a934]
mov dword [rcx + 0x14], eax
mov eax, dword [0x14008a938]
mov dword [rcx + 0x18], eax
mov eax, dword [0x14008a93c]
mov dword [rcx + 0x1c], eax
ret
Function at 0x14003f8d8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rsi, r8
mov r11, r9
movdqa xmm0, xmmword [rsi]
movdqu xmm4, xmmword [rcx]
pxor xmm0, xmm4
movd ebx, xmm0
mov eax, 0xf0f0f0f0
and eax, ebx
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
movdqa xmm5, xmmword [rdi + rsi + 0x420]
movzx edi, al
movdqa xmm4, xmmword [rdi + rsi + 0x420]
shr eax, 0x10
movzx edi, ah
movdqa xmm3, xmmword [rdi + rsi + 0x420]
movzx edi, al
movdqa xmm2, xmmword [rdi + rsi + 0x420]
psrldq xmm0, 4
movd eax, xmm0
and eax, 0xf0f0f0f0
movzx edi, bh
pxor xmm5, xmmword [rdi + rsi + 0x20]
movzx edi, bl
pxor xmm4, xmmword [rdi + rsi + 0x20]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rdi + rsi + 0x20]
movzx edi, bl
pxor xmm2, xmmword [rdi + rsi + 0x20]
movd ebx, xmm0
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
pxor xmm5, xmmword [rdi + rsi + 0x520]
movzx edi, al
pxor xmm4, xmmword [rdi + rsi + 0x520]
shr eax, 0x10
movzx edi, ah
pxor xmm3, xmmword [rdi + rsi + 0x520]
movzx edi, al
pxor xmm2, xmmword [rdi + rsi + 0x520]
psrldq xmm0, 4
movd eax, xmm0
and eax, 0xf0f0f0f0
movzx edi, bh
pxor xmm5, xmmword [rdi + rsi + 0x120]
movzx edi, bl
pxor xmm4, xmmword [rdi + rsi + 0x120]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rdi + rsi + 0x120]
movzx edi, bl
pxor xmm2, xmmword [rdi + rsi + 0x120]
movd ebx, xmm0
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
pxor xmm5, xmmword [rdi + rsi + 0x620]
movzx edi, al
pxor xmm4, xmmword [rdi + rsi + 0x620]
shr eax, 0x10
movzx edi, ah
pxor xmm3, xmmword [rdi + rsi + 0x620]
movzx edi, al
pxor xmm2, xmmword [rdi + rsi + 0x620]
psrldq xmm0, 4
movd eax, xmm0
and eax, 0xf0f0f0f0
movzx edi, bh
pxor xmm5, xmmword [rdi + rsi + 0x220]
movzx edi, bl
pxor xmm4, xmmword [rdi + rsi + 0x220]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rdi + rsi + 0x220]
movzx edi, bl
pxor xmm2, xmmword [rdi + rsi + 0x220]
movd ebx, xmm0
shl ebx, 4
and ebx, 0xf0f0f0f0
movzx edi, ah
pxor xmm5, xmmword [rdi + rsi + 0x720]
movzx edi, al
pxor xmm4, xmmword [rdi + rsi + 0x720]
shr eax, 0x10
movzx edi, ah
pxor xmm3, xmmword [rdi + rsi + 0x720]
movzx edi, al
pxor xmm2, xmmword [rdi + rsi + 0x720]
movzx edi, bh
pxor xmm5, xmmword [rdi + rsi + 0x320]
movzx edi, bl
pxor xmm4, xmmword [rdi + rsi + 0x320]
shr ebx, 0x10
movzx edi, bh
pxor xmm3, xmmword [rdi + rsi + 0x320]
movzx edi, bl
pxor xmm2, xmmword [rdi + rsi + 0x320]
movdqa xmm0, xmm3
pslldq xmm3, 1
pxor xmm2, xmm3
movdqa xmm1, xmm2
pslldq xmm2, 1
pxor xmm5, xmm2
psrldq xmm0, 0xf
movq rdi, xmm0
movzx eax, word [r11 + rdi*2]
shl eax, 8
movdqa xmm0, xmm5
pslldq xmm5, 1
pxor xmm4, xmm5
psrldq xmm1, 0xf
movq rdi, xmm1
xor ax, word [r11 + rdi*2]
shl eax, 8
psrldq xmm0, 0xf
movq rdi, xmm0
xor ax, word [r11 + rdi*2]
movd xmm0, eax
pxor xmm0, xmm4
add rcx, 0x10
sub rdx, 1
jne 0x14003f8e6
movdqa xmmword [rsi], xmm0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003fb58
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov rsi, r8
movdqa xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rcx]
pxor xmm1, xmm0
pxor xmm0, xmm0
movd eax, xmm1
psrldq xmm1, 4
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x20]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x1020]
shr eax, 0x10
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x2020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x3020]
movd eax, xmm1
psrldq xmm1, 4
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x4020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x5020]
shr eax, 0x10
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x6020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x7020]
movd eax, xmm1
psrldq xmm1, 4
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x8020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0x9020]
shr eax, 0x10
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xa020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xb020]
movd eax, xmm1
psrldq xmm1, 4
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xc020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xd020]
shr eax, 0x10
movzx edi, al
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xe020]
movzx edi, ah
add rdi, rdi
pxor xmm0, xmmword [rsi + rdi*8 + 0xf020]
add rcx, 0x10
sub rdx, 1
jne 0x14003fb62
movdqa xmmword [rsi], xmm0
pop rdi
pop rsi
ret
Function at 0x140041290
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmm5, xmmword [rcx]
xor eax, eax
movaps xmmword [rsp], xmm6
pshufb xmm5, xmmword [0x14008ae30]
movdqa xmm6, xmmword [0x14008ae50]
movdqa xmm4, xmm5
add r8d, 0xffffffe0
je 0x1400413e9
lea eax, [r8 - 1]
lea rcx, [rdx + 8]
shr eax, 5
inc eax
mov r8d, eax
shl eax, 5
movq qword [rcx - 8], xmm4
movdqa xmm3, xmm4
movdqa xmm2, xmm4
lea rcx, [rcx + 0x20]
pclmulqdq xmm2, xmm5, 0x10
movdqa xmm0, xmm4
pclmulqdq xmm3, xmm5, 0
movdqa xmm1, xmm3
pclmulqdq xmm0, xmm5, 1
pslldq xmm1, 8
pxor xmm2, xmm0
pxor xmm2, xmm1
movdqa xmm0, xmm3
pclmulqdq xmm0, xmm6, 0x10
psrldq xmm3, 8
pxor xmm2, xmm0
pxor xmm3, xmm2
movdqa xmm0, xmm4
movdqa xmm1, xmm2
pclmulqdq xmm0, xmm5, 0x11
psllq xmm3, 1
psrldq xmm1, 8
pclmulqdq xmm3, xmm6, 0
pxor xmm3, xmm0
pxor xmm3, xmm1
punpcklqdq xmm2, xmm3
psllq xmm3, 1
psrlq xmm2, 0x3f
pxor xmm3, xmm2
movdqu xmmword [rcx - 0x18], xmm3
movdqu xmmword [rcx - 0x20], xmm4
movdqa xmm4, xmm3
movq qword [rcx - 0x20], xmm3
pclmulqdq xmm4, xmm5, 0
movdqa xmm1, xmm4
movdqa xmm2, xmm3
movdqa xmm0, xmm3
pclmulqdq xmm3, xmm5, 0x11
pclmulqdq xmm2, xmm5, 0x10
pclmulqdq xmm0, xmm5, 1
pslldq xmm1, 8
pxor xmm2, xmm0
pxor xmm2, xmm1
movdqa xmm0, xmm4
psrldq xmm4, 8
pclmulqdq xmm0, xmm6, 0x10
pxor xmm2, xmm0
pxor xmm4, xmm2
psllq xmm4, 1
movdqa xmm0, xmm2
pclmulqdq xmm4, xmm6, 0
psrldq xmm0, 8
pxor xmm4, xmm3
pxor xmm4, xmm0
punpcklqdq xmm2, xmm4
psllq xmm4, 1
psrlq xmm2, 0x3f
pxor xmm4, xmm2
dec r8
jne 0x1400412d0
movq qword [rax + rdx], xmm4
movdqa xmm3, xmm4
movdqa xmm2, xmm4
pclmulqdq xmm3, xmm5, 0
pclmulqdq xmm2, xmm5, 0x10
movdqa xmm0, xmm4
movdqa xmm1, xmm3
pclmulqdq xmm0, xmm5, 1
pslldq xmm1, 8
pxor xmm2, xmm0
pxor xmm2, xmm1
movdqa xmm0, xmm3
psrldq xmm3, 8
pclmulqdq xmm0, xmm6, 0x10
pxor xmm2, xmm0
pxor xmm3, xmm2
movdqa xmm0, xmm4
movdqa xmm1, xmm2
psllq xmm3, 1
pclmulqdq xmm0, xmm5, 0x11
psrldq xmm1, 8
pclmulqdq xmm3, xmm6, 0
pxor xmm3, xmm0
movaps xmm6, xmmword [rsp]
pxor xmm3, xmm1
punpcklqdq xmm2, xmm3
psllq xmm3, 1
psrlq xmm2, 0x3f
pxor xmm3, xmm2
movdqu xmmword [rax + rdx + 0x10], xmm3
movdqu xmmword [rax + rdx + 8], xmm4
movq qword [rax + rdx + 8], xmm3
add rsp, 0x18
ret