joyce8/EMBER2024-capa huggingface dataset:
Function at 0x238b76ad884
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rax - 0x47]
sub rsp, 0x90
lea rax, [rbp - 0x31]
mov r10d, r9d
mov r9, qword [rbp + 0x6f]
mov r11, r8
mov qword [rsp + 0x28], rax
mov edi, edx
mov eax, dword [rbp + 0x77]
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x20], eax
mov r8d, r10d
mov dword [rbp - 0x31], ebx
mov rdx, r11
xor ecx, ecx
mov r14d, ebx
call fcn.238b76b0ca8
mov qword [rbp - 0x29], rax
mov r12, rax
test rax, rax
jne 0x238b76ad8f3
lea rax, [0x238b76caacc]
jmp 0x238b76ada41
mov esi, dword [rbp + 0x7f]
mov r8d, esi
cmp esi, edi
jae 0x238b76ad925
lea r9, [rsi + r13]
xor edx, edx
mov eax, r8d
div dword [rbp - 0x31]
mov al, byte [r9]
cmp byte [rdx + r12], al
je 0x238b76ad91f
inc r8d
inc r9
cmp r8d, edi
jb 0x238b76ad901
jmp 0x238b76ad925
mov r14d, r8d
sub r14d, esi
lea rax, [rbp - 0x21]
mov edi, 0x22
mov dword [rsp + 0x28], edi
lea r8, str.electricmadness
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, 0xb4
mov ecx, 0x7d3
call qword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
jne 0x238b76ad969
mov eax, ebx
lea rcx, [rbp - 0x21]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x14
jb 0x238b76ad95b
jmp 0x238b76ad97d
mov ecx, ebx
lea rdx, [rbp - 0x21]
lea eax, [rcx + 0xa]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, edi
jb 0x238b76ad96f
test r14d, r14d
je 0x238b76ad9e3
mov rcx, qword [0x238b76cab68]
test rcx, rcx
je 0x238b76ad9d2
lea r8d, [r14 + 1]
mov edx, 8
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x238b76ad9d2
mov r8, rax
mov r9d, r14d
xor edx, edx
mov eax, esi
div dword [rbp - 0x31]
mov al, byte [rdx + r12]
xor al, byte [rsi + r13]
inc esi
movzx eax, al
mov word [r8], ax
lea r8, [r8 + 2]
sub r9, 1
jne 0x238b76ad9ae
jmp 0x238b76ada32
mov edx, dword [rbp - 0x31]
lea rcx, [rbp - 0x29]
call fcn.238b76ac7c4
jmp 0x238b76ad8e7
lea rax, [rbp - 0x21]
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, str.chickenfried
mov edx, 0x172
mov ecx, 0xdc
call qword [sym.imp.KERNEL32.dll_GetNumberFormatA]
test eax, eax
jne 0x238b76ada1e
lea rax, [rbp - 0x21]
inc ebx
inc rax
cmp ebx, 0x14
jb 0x238b76ada12
jmp 0x238b76ada2b
lea rcx, [rbp - 0x21]
inc ebx
inc rcx
cmp ebx, edi
jb 0x238b76ada22
lea rdi, [0x238b76caacc]
mov edx, dword [rbp - 0x31]
lea rcx, [rbp - 0x29]
call fcn.238b76ac7c4
mov rax, rdi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
Function at 0x238b76adb28
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov rdi, rdx
xor r8d, r8d
lea rdx, [0x238b76c4390]
mov r14d, r9d
mov r13, rcx
call fcn.238b76ad2e0
xor ebx, ebx
mov qword [rsp + 0x58], rax
test rax, rax
je 0x238b76add23
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x210], rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x238b76add12
mov r12d, dword [rbp + 0x220]
mov r15d, dword [rbp + 0x218]
cmp word [rbp - 0x74], 0x2e
jne 0x238b76adbce
movzx eax, word [rbp - 0x72]
test ax, ax
je 0x238b76adcec
cmp ax, 0x2e
jne 0x238b76adbce
cmp word [rbp - 0x70], bx
je 0x238b76adcec
mov eax, dword [rsp + 0x60]
test al, 0x10
je 0x238b76adbde
test r14b, 2
jne 0x238b76adbe4
jmp 0x238b76adc53
test r14b, 4
je 0x238b76adc53
mov r15, qword [rbp + 0x208]
mov rsi, qword [rbp + 0x200]
mov rax, qword [0x238b76ca060]
lea rcx, [rbp - 0x74]
mov rdx, qword [rdi]
call qword [rax + 0x30]
test eax, eax
je 0x238b76adc2d
mov r8, r15
lea rdx, [rsp + 0x60]
mov rcx, r13
call rsi
test eax, eax
je 0x238b76adc38
test r12d, r12d
je 0x238b76adc2d
mov rax, qword [str.p_t1c]
mov ecx, r12d
call qword [rax + 0x188]
inc ebx
add rdi, 8
cmp ebx, 1
jb 0x238b76adbf2
mov eax, dword [rsp + 0x60]
xor ebx, ebx
mov rsi, qword [rbp + 0x210]
mov r15d, dword [rbp + 0x218]
mov rdi, qword [rbp + 0x1e8]
test al, 0x10
je 0x238b76adcec
test r14b, 1
je 0x238b76adcec
xor r9d, r9d
lea r8, [rbp - 0x74]
lea rdx, [0x238b76c4184]
mov rcx, r13
call fcn.238b76ad2e0
mov qword [rsp + 0x50], rax
mov rbx, rax
test rax, rax
je 0x238b76adcea
test r15d, r15d
je 0x238b76adc9d
mov rax, qword [str.p_t1c]
mov ecx, r15d
call qword [rax + 0x188]
mov rax, qword [rbp + 0x208]
mov r9d, r14d
mov dword [rsp + 0x40], r12d
mov r8d, 1
mov dword [rsp + 0x38], r15d
mov rdx, rdi
and qword [rsp + 0x30], 0
mov rcx, rbx
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x200]
mov qword [rsp + 0x20], rax
call fcn.238b76adb28
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x50]
call fcn.238b76ac7c4
xor ebx, ebx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x238b76adbaa
mov rax, qword [str.p_t1c]
mov rcx, rsi
call qword [rax + 0x108]
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x58]
call fcn.238b76ac7c4
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x238b76ade88
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [str.p_t1c]
xor r8d, r8d
mov rbp, rdx
mov rsi, rcx
xor edi, edi
call qword [rax + 0x240]
test eax, eax
jne 0x238b76adf70
xor edx, edx
mov word [rsp + 0x30], di
mov r8d, 0x206
lea rcx, [rsp + 0x32]
call sub.msvcrt.dll_memset
mov ecx, 0x116c
call fcn.238b76adae8
mov rcx, qword [0x238b76ca050]
lea edx, [rdi + 1]
add rcx, 0x668
mov qword [rsp + 0x260], rax
mov r8d, 0xf4240
mov rbx, rax
call fcn.238b76bb9c0
mov r9, rbp
mov dword [rsp + 0x20], eax
mov r8, rbx
lea rcx, [rsp + 0x30]
mov edx, 0x103
call fcn.238b76b095c
lea rcx, [rsp + 0x260]
call fcn.238b76ada84
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x238b76adf59
mov rax, qword [str.p_t1c]
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [rax + 0x240]
test eax, eax
jne 0x238b76adf5e
or edi, 0xffffffff
jmp 0x238b76adf80
mov rax, qword [str.p_t1c]
mov rcx, rsi
call qword [rax + 0x238]
jmp 0x238b76adf80
mov rdx, qword [str.p_t1c]
mov rcx, rsi
call qword [rdx + 0x238]
lea r11, [rsp + 0x240]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x238b76adf9c
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x260
mov edx, 0x80
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x200
call sub.msvcrt.dll_memset
mov r8d, 0x200
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.238b76b4238
mov rax, qword [str.p_t1c]
mov rcx, rbx
call qword [rax + 0x238]
test eax, eax
je 0x238b76adff6
mov eax, 1
jmp 0x238b76ae07a
mov rcx, qword [0x238b76ca050]
or r8d, 0xffffffff
add rcx, 0x668
mov edx, 0xf0000000
call fcn.238b76bb9c0
mov r9d, eax
lea r8, [0x238b76c4398]
mov edx, 0x20
lea rcx, [rsp + 0x20]
call fcn.238b76b095c
xor r9d, r9d
lea r8, [rsp + 0x20]
lea rdx, [0x238b76c436c]
mov rcx, rbx
call fcn.238b76ad2e0
mov qword [rsp + 0x278], rax
test rax, rax
je 0x238b76ae078
mov rdx, rax
mov rcx, rbx
call fcn.238b76ade88
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x278]
mov ebx, eax
call fcn.238b76ac7c4
test ebx, ebx
jns 0x238b76adfec
xor eax, eax
add rsp, 0x260
pop rbx
ret

Function at 0x238b76aebf4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [0x238b76cab68]
test rcx, rcx
jne 0x238b76aec13
mov eax, ebx
jmp 0x238b76aec48
mov r8d, dword [rdi]
mov edx, 8
inc r8d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x238b76aec48
cmp dword [rdi], ebx
jbe 0x238b76aec48
mov ecx, ebx
and ecx, 3
mov edx, ebx
inc ebx
mov cl, byte [rcx + rdi + 0x108]
xor cl, byte [rdx + rdi + 4]
mov byte [rdx + rax], cl
cmp ebx, dword [rdi]
jb 0x238b76aec2d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x238b76af078
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r10, qword [0x238b76ca050]
xor r8d, r8d
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x40]
lea edx, [r8 + 8]
mov r9d, edx
mov rax, r8
inc r8
and eax, 7
mov al, byte [rax + r10 + 0x1880]
xor byte [rcx], al
inc rcx
sub r9, 1
jne 0x238b76af09a
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.238b76b3f94
add rsp, 0x28
ret

Function at 0x238b76aff24
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x230
xor r13d, r13d
mov r12, rcx
mov dword [rax + 0x10], r13d
mov ebx, r13d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x278]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [rsp + 0x278]
mov ebp, r13d
mov r14, rax
test edx, edx
jle 0x238b76b0068
lea r15, [rsp + 0x20]
mov rsi, qword [r14]
cmp word [rsi], 0x2f
ja 0x238b76aff97
movzx eax, word [rsi]
movabs rcx, 0xa00000002401
bt rcx, rax
jb 0x238b76affd3
cmp ebx, 0x20
jae 0x238b76affd3
mov rcx, rsi
mov qword [r15], rsi
mov rdi, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
test eax, eax
jle 0x238b76affc6
cmp word [rsi + rdi*2], 0x2c
jne 0x238b76affbe
mov word [rsi + rdi*2], r13w
inc rdi
cmp rdi, rcx
jl 0x238b76affb2
mov edx, dword [rsp + 0x278]
inc ebx
add r15, 8
inc ebp
add r14, 8
cmp ebp, edx
jl 0x238b76aff7b
cmp ebx, 1
jne 0x238b76affe9
mov rbx, qword [rsp + 0x20]
jmp 0x238b76afff0
jle 0x238b76b0068
mov rbx, qword [rsp + 0x28]
cmp word [rbx], 0x5c
je 0x238b76b0053
cmp word [rbx + 2], 0x3a
je 0x238b76b0053
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor r9d, r9d
lea rdx, [0x238b76c4184]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.238b76ad2e0
mov r8d, 0x104
mov qword [rsp + 0x280], rax
mov rdx, rax
mov rcx, r12
call fcn.238b76b0a10
mov rdx, 0xfffffffffffffffe
lea rcx, [rsp + 0x280]
call fcn.238b76ac7c4
jmp 0x238b76b0064
mov r8d, 0x104
mov rdx, rbx
mov rcx, r12
call fcn.238b76b0a10
xor eax, eax
jmp 0x238b76b006b
or eax, 0xffffffff
mov rbx, qword [rsp + 0x270]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x238b76b2374
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
xor edi, edi
xor ecx, ecx
mov qword [rsp + 0x70], rdi
xor edx, edx
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
or edx, 0xffffffff
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [rsp + 0x70]
xor edx, edx
lea r9, [0x238b76c3db0]
mov qword [rsp + 0x20], rax
lea r8d, [rdi + 1]
lea rcx, [0x238b76c3dc0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x238b76b248f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rdx, rax
mov r10, qword [rcx]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call qword [r10 + 0x18]
test eax, eax
js 0x238b76b248f
mov rcx, qword [rsp + 0x68]
lea edx, [rdi + 0xa]
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x238b76b248f
mov rcx, qword [0x238b76cab68]
test rcx, rcx
je 0x238b76b248f
lea edx, [rdi + 8]
lea r8d, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x238b76b248f
mov rcx, qword [rsp + 0x70]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
jmp 0x238b76b24b1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x238b76b249f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x238b76b24af
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x238b76b3f94
Capabilities:
Encode data using xor

Disassembly:
not r8d
test edx, edx
jne 0x238b76b3f9e
xor eax, eax
ret
mov r9d, edx
lea rdx, [0x238b76c4280]
movzx eax, byte [rcx]
inc rcx
xor r8d, eax
mov eax, r8d
shr r8d, 4
and eax, 0xf
xor r8d, dword [rdx + rax*4]
mov eax, r8d
shr r8d, 4
and eax, 0xf
xor r8d, dword [rdx + rax*4]
sub r9, 1
jne 0x238b76b3fa8
not r8d
mov eax, r8d
ret
Function at 0x238b76b6200
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, edx
mov eax, 0xaaaaaaab
mul edx
mov rbp, rcx
mov rcx, qword [0x238b76cab68]
shr edx, 1
lea edi, [rdx*4 + 5]
test rcx, rcx
je 0x238b76b634b
lea r8d, [rdi + 1]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9, rax
test rax, rax
je 0x238b76b634b
xor r11d, r11d
xor edx, edx
test ebx, ebx
je 0x238b76b633d
lea esi, [rdi - 4]
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp edx, esi
jae 0x238b76b633d
xor r10d, r10d
xor r8d, r8d
mov cl, byte [r11 + rbp]
mov byte [rsp + r8 + 0x48], cl
cmp r11d, ebx
jae 0x238b76b628a
inc r10d
jmp 0x238b76b6290
mov byte [rsp + r8 + 0x48], 0
inc r11d
inc r8
cmp r8, 3
jl 0x238b76b6277
test r10d, r10d
je 0x238b76b6334
movzx ecx, byte [rsp + 0x48]
movzx eax, byte [rsp + 0x48]
and ecx, 3
movzx r8d, byte [rsp + 0x49]
shr rax, 2
shl ecx, 4
mov al, byte [rax + r14]
mov byte [rsp + 0x50], al
mov eax, r8d
shr rax, 4
or rcx, rax
mov al, byte [rcx + r14]
mov byte [rsp + 0x51], al
cmp r10d, 1
jle 0x238b76b6312
movzx eax, byte [rsp + 0x4a]
and r8d, 0xf
shr rax, 6
shl r8d, 2
mov ecx, r8d
or rcx, rax
mov al, byte [rcx + r14]
mov byte [rsp + 0x52], al
cmp r10d, 2
jle 0x238b76b6317
movzx eax, byte [rsp + 0x4a]
and eax, 0x3f
mov cl, byte [rax + r14]
jmp 0x238b76b6319
mov byte [rsp + 0x52], 0x3d
mov cl, 0x3d
mov byte [rsp + 0x53], cl
xor r8d, r8d
mov al, byte [rsp + r8 + 0x50]
inc r8
mov byte [rdx + r9], al
inc edx
cmp r8, 4
jl 0x238b76b6320
cmp r11d, ebx
jb 0x238b76b6269
cmp edx, edi
jae 0x238b76b6346
mov byte [rdx + r9], 0
mov rax, r9
jmp 0x238b76b634d
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x238b76b6bc4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
movsxd rsi, edx
mov rdi, rcx
lea rax, str.business.doc
xor r9d, r9d
inc rax
inc r9d
cmp byte [rax], 0
jne 0x238b76b6be6
mov eax, 0xf
mov byte [rsp + 0x2f], 0
cmp r9d, eax
cmova r9d, eax
xor ecx, ecx
test r9d, r9d
je 0x238b76b6c1d
lea rdx, [rsp + 0x20]
lea eax, [rcx + 0x41]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, r9d
jb 0x238b76b6c0e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9b, byte [rbx + 0x100]
mov r11, rsi
mov r10b, byte [rbx + 0x101]
test esi, esi
jle 0x238b76b6c6e
inc r9b
movzx r8d, r9b
mov dl, byte [r8 + rbx]
add r10b, dl
movzx ecx, r10b
mov al, byte [rcx + rbx]
mov byte [r8 + rbx], al
mov byte [rcx + rbx], dl
add dl, byte [r8 + rbx]
movzx eax, dl
mov cl, byte [rax + rbx]
xor byte [rdi], cl
inc rdi
sub r11, 1
jne 0x238b76b6c3d
mov rsi, qword [rsp + 0x48]
mov byte [rbx + 0x100], r9b
mov byte [rbx + 0x101], r10b
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x238b76b6da0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r8, rcx
lea r9, [rsp]
add rcx, 0x1d
mov r10d, 0x10
sub r9, r8
movzx eax, byte [rcx]
movzx edx, byte [rcx - 1]
lea rcx, [rcx + 4]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 2]
shl edx, 8
or edx, eax
mov dword [r9 + rcx - 0x21], edx
sub r10, 1
jne 0x238b76b6dd3
lea rcx, [rsp + 8]
lea edx, [r10 + 0x40]
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
ror eax, 0x1f
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x238b76b6e09
mov r15d, dword [r8]
lea esi, [rdx + 0x14]
mov r12d, dword [r8 + 4]
mov r14d, r15d
mov r13d, dword [r8 + 8]
mov r10d, r12d
mov ebx, dword [r8 + 0xc]
mov r9d, r13d
mov edi, dword [r8 + 0x10]
xor ebp, ebp
mov eax, r9d
lea r11d, [rdi + 0x5a827999]
and eax, r10d
mov ecx, r10d
not ecx
mov edx, r14d
and ecx, ebx
ror edx, 0x1b
or ecx, eax
mov edi, ebx
mov ebx, r9d
add edx, ecx
add edx, dword [rsp + rbp*4]
mov r9d, r10d
shr r10d, 2
add r11d, edx
shl r9d, 0x1e
inc rbp
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rbp, rsi
jl 0x238b76b6e45
mov ebp, 0x28
ror r11d, 0x1b
add edi, 0x6ed9eba1
add r11d, dword [rsp + rsi*4]
mov ecx, ebx
xor ecx, r9d
add r11d, edi
xor ecx, r10d
mov edi, ebx
mov ebx, r9d
add r11d, ecx
mov r9d, r10d
inc rsi
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rsi, rbp
jl 0x238b76b6e8f
mov edx, 0x3c
mov ecx, r9d
ror r11d, 0x1b
or ecx, r10d
mov eax, r9d
and ecx, ebx
and eax, r10d
add edi, 0x8f1bbcdc
or ecx, eax
add ecx, dword [rsp + rbp*4]
add r11d, edi
add r11d, ecx
mov edi, ebx
mov ebx, r9d
inc rbp
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rbp, rdx
jl 0x238b76b6ed1
mov eax, dword [rsp + rdx*4]
add edi, 0xca62c1d6
ror r11d, 0x1b
mov ecx, ebx
xor ecx, r9d
add r11d, edi
xor ecx, r10d
mov edi, ebx
mov ebx, r9d
add eax, ecx
mov r9d, r10d
add r11d, eax
shr r10d, 2
inc rdx
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rdx, 0x50
jl 0x238b76b6f15
add dword [r8 + 0xc], ebx
lea eax, [r15 + r11]
add dword [r8 + 0x10], edi
lea r11, [rsp + 0x140]
and dword [r8 + 0x5c], 0
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r8], eax
lea eax, [r12 + r10]
mov dword [r8 + 4], eax
lea eax, [r9 + r13]
mov dword [r8 + 8], eax
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x238b76b6f9c
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor ebx, ebx
mov dword [rbp - 0x29], 0x67452301
mov r14, r8
mov qword [rbp - 0x15], rbx
mov rsi, rcx
mov qword [rbp + 0x33], rbx
mov edx, ebx
mov dword [rbp - 0x25], 0xefcdab89
lea edi, [rbx + 0xe]
mov dword [rbp - 0x21], 0x98badcfe
lea r15d, [rbx + 1]
mov dword [rbp - 0x1d], 0x10325476
mov dword [rbp - 0x19], 0xc3d2e1f0
mov eax, ebx
mov dword [rbp + 0x3b], ebx
dec edi
test eax, eax
jne 0x238b76b7104
mov al, byte [rsi]
movsxd rcx, edx
mov byte [rbp + rcx - 0xd], al
mov edx, dword [rbp + 0x33]
mov eax, dword [rbp + 0x3b]
inc edx
add dword [rbp - 0x15], 8
mov dword [rbp + 0x33], edx
jne 0x238b76b702b
add dword [rbp - 0x11], r15d
cmove eax, r15d
mov dword [rbp + 0x3b], eax
cmp edx, 0x40
jne 0x238b76b703f
lea rcx, [rbp - 0x29]
call fcn.238b76b6da0
mov eax, dword [rbp + 0x3b]
mov edx, dword [rbp + 0x33]
add rsi, r15
test edi, edi
jne 0x238b76b6ffc
test eax, eax
jne 0x238b76b7104
cmp dword [rbp + 0x37], ebx
jne 0x238b76b7104
movsxd rax, edx
mov byte [rbp + rax - 0xd], 0x80
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp edx, 0x37
jle 0x238b76b70b6
jmp 0x238b76b707e
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x40
jl 0x238b76b706f
lea rcx, [rbp - 0x29]
call fcn.238b76b6da0
mov eax, dword [rbp + 0x33]
jmp 0x238b76b70a0
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x38
jl 0x238b76b7091
jmp 0x238b76b70bb
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x38
jl 0x238b76b70a7
mov ecx, dword [rbp - 0x11]
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x2b], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x2c], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x2d], al
mov byte [rbp + 0x2e], cl
mov ecx, dword [rbp - 0x15]
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x2f], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x30], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x32], cl
lea rcx, [rbp - 0x29]
mov byte [rbp + 0x31], al
call fcn.238b76b6da0
mov dword [rbp + 0x37], r15d
lea r8, [rbp - 0x27]
mov al, byte [r8 + 1]
lea edx, [rbx*4]
lea ecx, [rdx + 1]
mov byte [rdx + r14], al
mov al, byte [r8]
add ebx, r15d
mov byte [rcx + r14], al
lea ecx, [rdx + 2]
mov al, byte [r8 - 1]
lea r8, [r8 + 4]
mov byte [rcx + r14], al
lea ecx, [rdx + 3]
mov al, byte [r8 - 6]
mov byte [rcx + r14], al
cmp ebx, 5
jb 0x238b76b7108
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x238b76b9628
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea r9d, [r8 - 0x21524111]
mov r10, rdx
add r9d, edx
mov rbx, rcx
mov r11d, r9d
mov edi, r9d
cmp rdx, 0xc
jbe 0x238b76b9742
lea r8, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r8
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add r10, rax
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
movzx r8d, byte [rbx + 4]
movzx edx, byte [rbx + 8]
add r8d, r11d
shl ecx, 8
add edx, r9d
add ecx, eax
movzx eax, byte [rbx + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
add r8d, ecx
movzx ecx, byte [rbx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [rbx + 3]
shl ecx, 8
mov r9d, edx
add ecx, eax
ror r9d, 0x1c
movzx eax, byte [rbx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx]
shl ecx, 8
add rbx, 0xc
add ecx, eax
sub ecx, edx
add edx, r8d
add ecx, edi
xor r9d, ecx
sub r8d, r9d
mov eax, r9d
add r9d, edx
ror eax, 0x1a
xor eax, r8d
sub edx, eax
mov ecx, eax
add eax, r9d
ror ecx, 0x18
xor ecx, edx
sub r9d, ecx
mov edi, ecx
add ecx, eax
ror edi, 0x10
xor edi, r9d
sub eax, edi
mov r11d, edi
ror r11d, 0xd
add edi, ecx
xor r11d, eax
sub ecx, r11d
mov r9d, r11d
ror r9d, 0x1c
add r11d, edi
xor r9d, ecx
sub rsi, 1
jne 0x238b76b9679
cmp r10, 6
ja 0x238b76b9786
je 0x238b76b97e3
test r10, r10
je 0x238b76b9868
sub r10, 1
je 0x238b76b980f
sub r10, 1
je 0x238b76b9806
sub r10, 1
je 0x238b76b97fd
sub r10, 1
je 0x238b76b97f4
cmp r10, 1
je 0x238b76b97ed
jmp 0x238b76b9814
sub r10, 7
je 0x238b76b97d9
sub r10, 1
je 0x238b76b97cf
sub r10, 1
je 0x238b76b97c8
sub r10, 1
je 0x238b76b97be
sub r10, 1
je 0x238b76b97b4
cmp r10, 1
jne 0x238b76b9814
movzx eax, byte [rbx + 0xb]
shl eax, 0x18
add r9d, eax
movzx eax, byte [rbx + 0xa]
shl eax, 0x10
add r9d, eax
movzx eax, byte [rbx + 9]
shl eax, 8
add r9d, eax
movzx eax, byte [rbx + 8]
add r9d, eax
movzx eax, byte [rbx + 7]
shl eax, 0x18
add r11d, eax
movzx eax, byte [rbx + 6]
shl eax, 0x10
add r11d, eax
movzx eax, byte [rbx + 5]
shl eax, 8
add r11d, eax
movzx eax, byte [rbx + 4]
add r11d, eax
movzx eax, byte [rbx + 3]
shl eax, 0x18
add edi, eax
movzx eax, byte [rbx + 2]
shl eax, 0x10
add edi, eax
movzx eax, byte [rbx + 1]
shl eax, 8
add edi, eax
movzx eax, byte [rbx]
add edi, eax
xor r9d, r11d
mov eax, r11d
ror eax, 0x12
sub r9d, eax
mov eax, r9d
mov edx, r9d
ror eax, 0x15
xor edx, edi
sub edx, eax
xor r11d, edx
mov eax, edx
ror eax, 7
sub r11d, eax
xor r9d, r11d
mov eax, r11d
ror eax, 0x10
sub r9d, eax
mov eax, r9d
mov ecx, r9d
ror eax, 0x1c
xor ecx, edx
sub ecx, eax
xor r11d, ecx
mov eax, ecx
ror eax, 0x12
sub r11d, eax
mov eax, r11d
xor r9d, r11d
ror eax, 8
sub r9d, eax
mov rbx, qword [rsp + 8]
mov eax, r9d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret