joyce8/EMBER2024-capa huggingface dataset:
Function at 0x164c75a00
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rdi
sub rsp, 0x38
mov edi, r8d
mov rbx, rcx
test rcx, rcx
je 0x164c75bd3
mov qword [rax - 0x20], rsi
mov rsi, qword [rsp + 0x58]
mov qword [rax - 0x28], r14
xor r14d, r14d
mov qword [rax - 0x18], rbp
mov eax, dword [rcx + 0x60]
cmp eax, 0x40
jae 0x164c75ac8
test rsi, rsi
jne 0x164c75a53
test dil, 1
je 0x164c75af3
mov byte [rax + rbx + 0x14], 0x80
mov eax, dword [rbx + 0x60]
inc eax
mov dword [rbx + 0x60], eax
cmp eax, 0x38
jbe 0x164c75a9a
cmp eax, 0x40
jae 0x164c75a82
nop word [rax + rax]
mov byte [rax + rbx + 0x14], r14b
mov eax, dword [rbx + 0x60]
inc eax
mov dword [rbx + 0x60], eax
cmp eax, 0x40
jb 0x164c75a70
lea rbp, [rbx + 0x14]
mov rcx, rbx
mov rdx, rbp
call fcn.164c75870
mov eax, r14d
mov dword [rbx + 0x60], r14d
jmp 0x164c75aa0
lea rbp, [rbx + 0x14]
jae 0x164c75ab2
mov byte [rax + rbx + 0x14], r14b
mov eax, dword [rbx + 0x60]
inc eax
mov dword [rbx + 0x60], eax
cmp eax, 0x38
jb 0x164c75aa0
mov rax, qword [rbx + 0x58]
mov rdx, rbp
bswap rax
mov rcx, rbx
mov qword [rbx + 0x4c], rax
call fcn.164c75870
test rsi, rsi
je 0x164c75af3
mov eax, dword [rbx]
bswap eax
mov dword [rsi], eax
mov eax, dword [rbx + 4]
bswap eax
mov dword [rsi + 4], eax
mov eax, dword [rbx + 8]
bswap eax
mov dword [rsi + 8], eax
mov eax, dword [rbx + 0xc]
bswap eax
mov dword [rsi + 0xc], eax
mov eax, dword [rbx + 0x10]
bswap eax
mov dword [rsi + 0x10], eax
test dil, 3
je 0x164c75b32
test dil, 2
je 0x164c75bc4
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov dword [rbx + 0x60], r14d
mov qword [rbx + 0x58], r14
jmp 0x164c75bc4
mov rsi, qword [rbx + 0x68]
and edi, 8
test rsi, rsi
je 0x164c75b98
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x164c75b70
test edi, edi
je 0x164c75b56
mov r8d, dword [rsi + 0x24]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rsi + 0x24]
mov r8d, 0x8000
mov rcx, qword [rsi + 0x10]
mov rax, qword [0x164cb3640]
call qword [0x164c92120]
test edi, edi
je 0x164c75b84
xor edx, edx
mov r8d, 0xc0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov rax, qword [0x164cb3650]
mov rcx, rsi
call qword [0x164c92120]
mov qword [rbx + 0x68], r14
mov qword [rbx + 0x70], r14
test edi, edi
je 0x164c75bc4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
movups xmmword [rbx + 0x60], xmm0
mov qword [rbx + 0x70], rax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x164c76000
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov rbx, qword [rsp + 0x30]
xor edx, edx
movups xmm0, xmmword [0x164ca4930]
mov r8d, 0x100
movups xmmword [rbx], xmm0
lea rcx, [rbx + 0x20]
movups xmm1, xmmword [0x164ca4940]
movups xmmword [rbx + 0x10], xmm1
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x164cb3630]
xor eax, eax
mov qword [rbx + 0x120], rax
mov dword [rbx + 0x128], eax
mov qword [rbx + 0x130], rax
mov qword [rbx + 0x138], rax
movabs rax, 0x1000000010000000
test rax, rcx
je 0x164c7608c
mov edx, 0x20
lea ecx, [rdx + 0x20]
call fcn.164c72ef0
mov rcx, qword [0x164cb3630]
mov qword [rbx + 0x130], rax
lea rax, [0x164c4fd40]
mov qword [rbx + 0x138], rax
test cl, 0x20
je 0x164c76111
lea rax, [0x164c50e40]
mov qword [rbx + 0x138], rax
bt rcx, 0x12
jae 0x164c760c8
lea rax, [0x164c4f9c0]
mov qword [rbx + 0x138], rax
add rsp, 0x20
pop rbx
ret
bt rcx, 0xa
jae 0x164c76111
mov rax, rcx
and eax, 0x5000
cmp rax, 0x5000
jne 0x164c760f3
lea rax, [0x164c53900]
mov qword [rbx + 0x138], rax
add rsp, 0x20
pop rbx
ret
mov rax, qword [rbx + 0x138]
bt rcx, 0x29
lea rcx, [0x164c52360]
cmovb rax, rcx
mov qword [rbx + 0x138], rax
add rsp, 0x20
pop rbx
ret
Function at 0x164c76360
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rdi
sub rsp, 0x28
mov edi, r8d
mov rbx, rcx
test rcx, rcx
je 0x164c764d6
mov qword [rax + 0x20], rsi
mov rsi, rdx
test rdx, rdx
jne 0x164c76396
test dil, 1
je 0x164c763e1
mov rcx, rbx
call fcn.164c762a0
test rsi, rsi
je 0x164c763e1
mov eax, dword [rbx]
bswap eax
mov dword [rsi], eax
mov eax, dword [rbx + 4]
bswap eax
mov dword [rsi + 4], eax
mov eax, dword [rbx + 8]
bswap eax
mov dword [rsi + 8], eax
mov eax, dword [rbx + 0xc]
bswap eax
mov dword [rsi + 0xc], eax
mov eax, dword [rbx + 0x10]
bswap eax
mov dword [rsi + 0x10], eax
mov eax, dword [rbx + 0x14]
bswap eax
mov dword [rsi + 0x14], eax
mov eax, dword [rbx + 0x18]
bswap eax
mov dword [rsi + 0x18], eax
mov eax, dword [rbx + 0x1c]
bswap eax
mov dword [rsi + 0x1c], eax
test dil, 3
je 0x164c76438
test dil, 2
je 0x164c764d1
movups xmm0, xmmword [0x164ca4930]
lea rcx, [rbx + 0x20]
xor edx, edx
mov r8d, 0x100
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x164ca4940]
movups xmmword [rbx + 0x10], xmm1
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x58]
mov qword [rbx + 0x120], 0
mov dword [rbx + 0x128], 0
add rsp, 0x28
pop rdi
pop rbx
ret
mov rsi, qword [rbx + 0x130]
and edi, 8
test rsi, rsi
je 0x164c764b2
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x164c76483
mov qword [rsp + 0x20], r14
test edi, edi
je 0x164c76464
mov r8d, dword [rsi + 0x24]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rsi + 0x24]
mov r8d, 0x8000
mov rcx, qword [rsi + 0x10]
mov rax, qword [0x164cb3640]
call qword [0x164c92120]
mov r14, qword [rsp + 0x20]
test edi, edi
je 0x164c76497
xor edx, edx
mov r8d, 0xc0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov rax, qword [0x164cb3650]
mov rcx, rsi
call qword [0x164c92120]
mov qword [rbx + 0x130], 0
mov qword [rbx + 0x138], 0
test edi, edi
je 0x164c764d1
xor edx, edx
mov r8d, 0x140
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x58]
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x164c76600
Capabilities:
Hash data using sha384

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov rbx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rbx
mov edx, dword [rsp + 0x38]
call sym.aswCmnIS.dll_sha512Init
movaps xmm0, xmmword [0x164ca4c80]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x164ca4c90]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x164ca4ca0]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x164ca4cb0]
movups xmmword [rbx + 0x30], xmm1
add rsp, 0x20
pop rbx
ret
Function at 0x164c76690
Capabilities:
Hash data using sha384

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x164c76798
mov qword [rax - 0x10], rsi
mov esi, r8d
mov qword [rax - 0x18], rdi
mov rdi, rdx
test rdx, rdx
jne 0x164c766c9
test sil, 1
je 0x164c76716
mov rcx, rbx
call fcn.164c76b90
test rdi, rdi
je 0x164c76716
mov rax, qword [rbx]
bswap rax
mov qword [rdi], rax
mov rax, qword [rbx + 8]
bswap rax
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
bswap rax
mov qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
bswap rax
mov qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
bswap rax
mov qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
bswap rax
mov qword [rdi + 0x28], rax
mov rdi, qword [rsp + 0x20]
test sil, 3
je 0x164c76774
test sil, 2
je 0x164c76793
movaps xmm0, xmmword [0x164ca4c80]
xor eax, eax
mov rsi, qword [rsp + 0x28]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x164ca4c90]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x164ca4ca0]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x164ca4cb0]
movups xmmword [rbx + 0x30], xmm1
mov qword [rbx + 0x2c8], rax
mov qword [rbx + 0x2c0], rax
mov qword [rbx + 0x2d0], rax
add rsp, 0x30
pop rbx
ret
xor eax, eax
mov qword [rbx + 0x2e0], rax
test sil, 8
je 0x164c76793
xor edx, edx
mov r8d, 0x2e8
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rsi, qword [rsp + 0x28]
add rsp, 0x30
pop rbx
ret

Function at 0x164c767a0
Capabilities:
Hash data using sha384

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x320
mov rax, qword [0x164cb3008]
xor rax, rsp
mov qword [rsp + 0x310], rax
xorps xmm0, xmm0
mov rsi, r8
movups xmmword [r8], xmm0
mov rdi, rcx
mov rbx, rdx
movups xmmword [r8 + 0x10], xmm0
lea rcx, [rsp + 0x20]
movups xmmword [r8 + 0x20], xmm0
mov r8, rdx
mov edx, 1
call sym.aswCmnIS.dll_sha512Init
movaps xmm0, xmmword [0x164ca4c80]
lea rcx, [rsp + 0x20]
movaps xmm1, xmmword [0x164ca4c90]
mov r8, rbx
movaps xmmword [rsp + 0x20], xmm0
mov rdx, rdi
movaps xmm0, xmmword [0x164ca4ca0]
movaps xmmword [rsp + 0x30], xmm1
movaps xmm1, xmmword [0x164ca4cb0]
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
call sym.aswCmnIS.dll_sha512Update
test rsi, rsi
je 0x164c7688d
lea rcx, [rsp + 0x20]
call fcn.164c76b90
mov rax, qword [rsp + 0x20]
bswap rax
mov qword [rsi], rax
mov rax, qword [rsp + 0x28]
bswap rax
mov qword [rsi + 8], rax
mov rax, qword [rsp + 0x30]
bswap rax
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x38]
bswap rax
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x40]
bswap rax
mov qword [rsi + 0x20], rax
mov rax, qword [rsp + 0x48]
bswap rax
mov qword [rsi + 0x28], rax
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.164c8ef00
add rsp, 0x320
pop rdi
pop rsi
pop rbx
ret
Function at 0x164c768b0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
movaps xmm0, xmmword [0x164ca4cc0]
xor edi, edi
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov r8d, 0x280
movups xmmword [rbx], xmm0
lea rcx, [rbx + 0x40]
movaps xmm1, xmmword [0x164ca4cd0]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x164ca4ce0]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x164ca4cf0]
movups xmmword [rbx + 0x30], xmm1
mov qword [rbx + 0x2c8], rdi
mov qword [rbx + 0x2c0], rdi
mov qword [rbx + 0x2d0], rdi
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [0x164cb3630]
bt rcx, 0x3f
mov qword [rbx + 0x2d8], rdi
mov qword [rbx + 0x2e0], rdi
jae 0x164c76955
lea edx, [rdi + 0x40]
lea ecx, [rdx + 0x40]
call fcn.164c72ef0
mov rcx, qword [0x164cb3630]
mov qword [rbx + 0x2d8], rax
lea rax, [0x164c55940]
movabs rdx, 0x200000020
mov qword [rbx + 0x2e0], rax
mov rax, rcx
and rax, rdx
cmp rax, 0x20
jne 0x164c769d5
lea rax, [0x164c56ac0]
mov qword [rbx + 0x2e0], rax
bt rcx, 0xa
jae 0x164c769d5
mov rax, rcx
and eax, 0x5000
cmp rax, 0x5000
jne 0x164c769b7
lea rax, [0x164c59ca0]
mov qword [rbx + 0x2e0], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x2e0]
bt rcx, 0x29
lea rcx, [0x164c58420]
cmovb rax, rcx
mov qword [rbx + 0x2e0], rax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x164c76c70
Capabilities:
Hash data using sha512

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rdi
sub rsp, 0x38
mov edi, r8d
mov rbx, rcx
test rcx, rcx
je 0x164c76e0e
mov qword [rax - 0x20], rsi
mov rsi, rdx
test rdx, rdx
jne 0x164c76ca6
test dil, 1
je 0x164c76d09
mov rcx, rbx
call fcn.164c76b90
test rsi, rsi
je 0x164c76d09
mov rax, qword [rbx]
bswap rax
mov qword [rsi], rax
mov rax, qword [rbx + 8]
bswap rax
mov qword [rsi + 8], rax
mov rax, qword [rbx + 0x10]
bswap rax
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x18]
bswap rax
mov qword [rsi + 0x18], rax
mov rax, qword [rbx + 0x20]
bswap rax
mov qword [rsi + 0x20], rax
mov rax, qword [rbx + 0x28]
bswap rax
mov qword [rsi + 0x28], rax
mov rax, qword [rbx + 0x30]
bswap rax
mov qword [rsi + 0x30], rax
mov rax, qword [rbx + 0x38]
bswap rax
mov qword [rsi + 0x38], rax
mov qword [rsp + 0x30], rbp
test dil, 3
je 0x164c76d71
test dil, 2
je 0x164c76e04
movaps xmm0, xmmword [0x164ca4cc0]
xor ebp, ebp
mov rsi, qword [rsp + 0x28]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x164ca4cd0]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x164ca4ce0]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x164ca4cf0]
mov qword [rbx + 0x2c8], rbp
mov qword [rbx + 0x2c0], rbp
mov qword [rbx + 0x2d0], rbp
mov rbp, qword [rsp + 0x30]
movups xmmword [rbx + 0x30], xmm1
add rsp, 0x38
pop rdi
pop rbx
ret
mov rsi, qword [rbx + 0x2d8]
and edi, 8
xor ebp, ebp
test rsi, rsi
je 0x164c76de9
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x164c76dbe
mov qword [rsp + 0x20], r14
test edi, edi
je 0x164c76d9f
mov r8d, dword [rsi + 0x24]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rsi + 0x24]
mov r8d, 0x8000
mov rcx, qword [rsi + 0x10]
mov rax, qword [0x164cb3640]
call qword [0x164c92120]
mov r14, qword [rsp + 0x20]
test edi, edi
je 0x164c76dd2
xor edx, edx
mov r8d, 0xc0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov rax, qword [0x164cb3650]
mov rcx, rsi
call qword [0x164c92120]
mov qword [rbx + 0x2d8], rbp
mov qword [rbx + 0x2e0], rbp
test edi, edi
je 0x164c76e04
xor edx, edx
mov r8d, 0x2e8
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x164c77120
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x164cb3008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebp, dword [r11 + 0x20]
lea rdi, [r11 - 0x68]
mov qword [r11 - 0x68], 0xffffffffffffffff
lea r12, [r11 - 0x60]
mov r8d, dword [r11 - 0x64]
mov r9, rdx
mov r11, qword [r11 + 0x18]
mov r15, rcx
mov edx, dword [rsp + 0x20]
xor r10d, r10d
mov ebx, dword [r11]
mov esi, dword [r11 + 4]
mov r14d, dword [r11 + 8]
mov r13d, dword [r11 + 0xc]
nop word [rax + rax]
inc r10d
mov ecx, r8d
shl ecx, 4
mov eax, r8d
add ecx, ebx
shr eax, 5
add eax, esi
xor ecx, eax
lea eax, [r10 + r8]
xor ecx, eax
add edx, ecx
mov ecx, edx
mov eax, edx
shr ecx, 5
shl eax, 4
add ecx, r13d
add eax, r14d
xor ecx, eax
lea eax, [r10 + rdx]
xor ecx, eax
add r8d, ecx
cmp r10d, 0x10
jl 0x164c77190
mov dword [rsp + 0x20], edx
mov ebx, 0x10
mov dword [rsp + 0x24], r8d
cmp ebp, 8
jb 0x164c77290
mov r14, rbp
shr r14, 3
nop dword [rax]
mov r8, qword [r15]
mov r10d, ebx
mov r13d, dword [r11 + 8]
mov rax, r8
xor rax, qword [rdi]
mov rsi, rbx
mov qword [r12], rax
mov rax, r8
shr rax, 0x20
nop
mov edx, r8d
mov ecx, r8d
shr edx, 5
add edx, dword [r11 + 0xc]
shl ecx, 4
add ecx, r13d
xor edx, ecx
lea ecx, [r10 + r8]
xor edx, ecx
sub eax, edx
mov edx, eax
mov ecx, eax
shl edx, 4
add edx, dword [r11]
shr ecx, 5
add ecx, dword [r11 + 4]
xor edx, ecx
lea ecx, [r10 + rax]
xor edx, ecx
lea r10d, [r10 - 1]
sub r8d, edx
sub rsi, 1
jne 0x164c77210
mov dword [r9 + 4], eax
add r15, 8
mov rax, qword [rdi]
add ebp, 0xfffffff8
mov dword [r9], r8d
xor qword [r9], rax
mov rax, rdi
add r9, 8
mov rdi, r12
mov r12, rax
sub r14, 1
jne 0x164c771f0
lea rax, [rsp + 0x20]
cmp rdi, rax
je 0x164c77290
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
test ebp, ebp
je 0x164c7731b
mov r8, qword [rsp + 0x20]
mov rdx, rbx
mov edi, dword [r11 + 8]
mov esi, dword [r11 + 0xc]
mov r14d, dword [r11]
mov r11d, dword [r11 + 4]
mov r10d, dword [rsp + 0x20]
shr r8, 0x20
nop dword [rax + rax]
mov ecx, r10d
mov eax, r10d
shr ecx, 5
add ecx, esi
shl eax, 4
add eax, edi
xor ecx, eax
lea eax, [rbx + r10]
xor ecx, eax
sub r8d, ecx
mov ecx, r8d
mov eax, r8d
shl ecx, 4
shr eax, 5
add ecx, r14d
add eax, r11d
xor ecx, eax
lea eax, [rbx + r8]
xor ecx, eax
lea ebx, [rbx - 1]
sub r10d, ecx
sub rdx, 1
jne 0x164c772c0
mov dword [rsp + 0x2c], r8d
lea rcx, [rsp + 0x28]
mov r8d, ebp
mov rdx, r15
mov dword [rsp + 0x28], r10d
call fcn.164c61c60
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.164c8ef00
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x164c77ac0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov edx, 1
mov qword [rsp + 8], rcx
mov r10, qword [rsp + 8]
mov eax, dword [rsp + 0x10]
lea r8, [r10 + 0xc]
mov dword [r8], eax
lea r9, [r8 + 4]
mov ecx, dword [r8]
lea r8, [r8 + 4]
shr ecx, 0x1e
lea r9, [r9 + 4]
xor ecx, dword [r8 - 4]
imul eax, ecx, 0x6c078965
add eax, edx
inc edx
mov dword [r9 - 4], eax
cmp edx, 0x270
jb 0x164c77ae2
mov dword [r10 + 8], 1
mov qword [r10], 0
ret

Function at 0x164c77b20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov r10, qword [rsp + 0x20]
sub dword [r10 + 8], 1
jne 0x164c77ca6
movdqa xmm3, xmmword [0x164cadec0]
mov eax, 1
movdqa xmm5, xmmword [0x164cade80]
mov ecx, 0x38
mov qword [rsp + 0x10], rbx
lea rbx, [r10 + 0xc]
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [0x164caded0]
movd xmm4, eax
mov rax, rbx
mov dword [r10 + 8], 0x270
mov qword [r10], rbx
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + 4]
lea rax, [rax + 0x10]
movdqa xmm2, xmm1
pand xmm1, xmm5
pxor xmm2, xmm0
pand xmm2, xmm3
pxor xmm2, xmm0
xorps xmm0, xmm0
psubd xmm0, xmm1
pand xmm0, xmm6
psrld xmm2, xmm4
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax + 0x624]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x10], xmm2
sub rcx, 1
jne 0x164c77b80
movaps xmm6, xmmword [rsp]
lea r8, [r10 + 0x38c]
lea r9, [r10 + 0x9c0]
lea r11d, [rcx + 3]
mov edx, dword [r8]
lea r8, [r8 + 4]
mov ecx, dword [r9 - 0x630]
lea r9, [r9 + 4]
xor edx, ecx
and ecx, 1
and edx, 0x7ffffffe
neg ecx
xor edx, dword [r8 - 4]
and ecx, 0x9908b0df
shr edx, 1
xor edx, ecx
xor edx, dword [r9 - 4]
mov dword [r8 - 4], edx
sub r11, 1
jne 0x164c77be1
lea r9, [r10 + 0x398]
mov rax, rbx
mov r11d, 0x18c
nop dword [rax]
mov edx, dword [rax + 0x390]
lea r9, [r9 + 4]
mov r8d, edx
lea rax, [rax + 4]
xor r8d, dword [r9 - 4]
and edx, 1
and r8d, 0x7ffffffe
neg edx
xor r8d, dword [r9 - 4]
and edx, 0x9908b0df
shr r8d, 1
xor r8d, edx
xor r8d, dword [rax - 4]
mov dword [r9 - 4], r8d
sub r11, 1
jne 0x164c77c30
mov ecx, dword [rbx]
mov edx, ecx
mov eax, dword [r10 + 0x9c8]
and ecx, 1
mov rbx, qword [rsp + 0x10]
xor edx, eax
and edx, 0x7ffffffe
neg ecx
xor edx, eax
and ecx, 0x9908b0df
shr edx, 1
xor edx, ecx
xor edx, dword [r10 + 0x63c]
mov dword [r10 + 0x9c8], edx
mov rax, qword [r10]
mov ecx, dword [rax]
add rax, 4
mov qword [r10], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
add rsp, 0x18
ret
Function at 0x164c79c50
Capabilities:
Compute adler32 checksum

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov r8d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
add rsp, 0x28
jmp sym.aswCmnIS.dll_z_adler32_z
Function at 0x164c8b8c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
mov r8, qword [rsp + 8]
mov ecx, dword [r8 + 0x60]
movzx edx, byte [r8 + 0x5c]
test ecx, ecx
jle 0x164c8b90d
mov eax, dword [r8 + 0x288]
lea r11, [0x164cad680]
mov r9d, ecx
nop dword [rax + rax]
mov ecx, eax
shr rcx, 0x18
xor rcx, rdx
shl eax, 8
xor eax, dword [r11 + rcx*4]
sub r9, 1
jne 0x164c8b8f0
mov dword [r8 + 0x288], eax
mov eax, dword [r8 + 0x5c]
mov byte [rax + r8 + 0x80], 1
movsxd r9, dword [r8 + 0x60]
mov ecx, r9d
sub ecx, 1
je 0x164c8b9ed
sub ecx, 1
je 0x164c8b9e0
cmp ecx, 1
je 0x164c8b9a2
mov byte [r9 + r8 + 0x7c], 1
mov rax, qword [r8 + 0x40]
movsxd rcx, dword [r8 + 0x6c]
mov byte [rcx + rax], dl
movsxd rcx, dword [r8 + 0x6c]
lea eax, [rcx + 1]
mov dword [r8 + 0x6c], eax
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax + 1], dl
movsxd rcx, dword [r8 + 0x6c]
lea eax, [rcx + 1]
mov dword [r8 + 0x6c], eax
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax + 1], dl
movsxd rcx, dword [r8 + 0x6c]
lea eax, [rcx + 1]
mov dword [r8 + 0x6c], eax
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax + 1], dl
movsxd rcx, dword [r8 + 0x6c]
lea eax, [rcx + 1]
mov dword [r8 + 0x6c], eax
movzx edx, byte [r8 + 0x60]
mov rax, qword [r8 + 0x40]
sub dl, 4
mov byte [rcx + rax + 1], dl
inc dword [r8 + 0x6c]
ret
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], dl
movsxd rcx, dword [r8 + 0x6c]
lea eax, [rcx + 1]
mov dword [r8 + 0x6c], eax
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax + 1], dl
movsxd rcx, dword [r8 + 0x6c]
lea eax, [rcx + 1]
mov dword [r8 + 0x6c], eax
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax + 1], dl
inc dword [r8 + 0x6c]
ret
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], dl
jmp 0x164c8b9c0
movsxd rcx, dword [r8 + 0x6c]
mov rax, qword [r8 + 0x40]
mov byte [rcx + rax], dl
inc dword [r8 + 0x6c]
ret
Function at 0x140c33058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c331df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c33089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c3306f
add dl, dl
jne 0x140c33096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c330f6
xor eax, eax
add dl, dl
jne 0x140c330a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c331ad
add dl, dl
jne 0x140c330b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c330c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c330d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c330dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c330ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c3307e
mov eax, 1
add dl, dl
jne 0x140c33106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c33113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c330fb
sub eax, ebx
mov ebx, 1
jne 0x140c3314c
mov ecx, 1
add dl, dl
jne 0x140c3312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c3313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c33123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c33168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c33175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c3315d
cmp eax, 0x7d00
jae 0x140c3319b
cmp eax, 0x500
jb 0x140c33196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3307e
cmp eax, 0x7f
ja 0x140c3319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c331d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c3307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x425030
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
je 0x425040
jne 0x425040
sub rsp, 0x28
mov rax, qword [rdx]
cmp dword [rax + 0x8c], 0
je 0x4250eb
mov rsi, qword [rdx + 8]
mov edi, dword [rax + 0x88]
cmp dword [rdi + rsi + 0x18], 0
je 0x425088
jne 0x425088
je 0x493651b6
add r12, rsi
add rbx, rsi
je 0x4250eb
cmp dword [rsi + rdi + 0x14], 0
je 0x4250eb
mov r15, r8
mov r13, rcx
mov ebx, dword [rsi + rdi + 0x20]
mov r12d, dword [rsi + rdi + 0x24]
je 0x425069
jne 0x425069
je 0x7505afeb
and eax, 0x44e92375
mov esi, dword [rcx + rax]