joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001aa0
Capabilities:
Clear windows event logs
Delete volume shadow copies
Disable automatic windows recovery features

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r9
mov rdi, r8
mov rsi, rcx
cmp r9, 3
jae 0x140001acb
xor eax, eax
test rbx, rbx
jne 0x140001ae9
jmp 0x140001cd9
movzx eax, word [rdi]
xor eax, 0x2d2d
movzx ecx, byte [rdi + 2]
xor ecx, 0x2d
or cx, ax
sete al
test rbx, rbx
je 0x140001cd9
test al, al
jne 0x140001cd9
lea rcx, [0x140440803]
mov edx, 4
mov r8, rdi
mov r9, rbx
call fcn.1400047e0
test al, al
je 0x140001cd9
lea rax, [rdi + rbx]
xor r10d, r10d
mov rcx, qword [str._yP_]
movabs rdx, 0x100003e00
mov r9, rdi
xor r11d, r11d
xor r8d, r8d
jmp 0x140001b4f
xor r8d, r8d
mov r11, r10
cmp r14, r12
jne 0x140001cfa
test r8b, r8b
jne 0x140001cd9
mov r12, r11
mov r8b, 1
cmp r9, rax
je 0x140001cc0
mov r15, r9
mov r14, r10
movzx r11d, byte [r9]
test r11b, r11b
js 0x140001b80
lea r9, [r15 + 1]
jmp 0x140001c00
mov r10d, r11d
and r10d, 0x1f
movzx r13d, byte [r15 + 1]
and r13d, 0x3f
cmp r11b, 0xdf
jbe 0x140001bd7
movzx ebp, byte [r15 + 2]
shl r13d, 6
and ebp, 0x3f
or ebp, r13d
cmp r11b, 0xf0
jb 0x140001be7
lea r9, [r15 + 4]
movzx r11d, byte [r15 + 3]
and r10d, 7
shl r10d, 0x12
shl ebp, 6
and r11d, 0x3f
or r11d, ebp
or r11d, r10d
cmp r11d, 0x110000
jne 0x140001c00
jmp 0x140001cd4
lea r9, [r15 + 2]
shl r10d, 6
or r10d, r13d
mov r11d, r10d
jmp 0x140001c00
lea r9, [r15 + 3]
shl r10d, 0xc
or ebp, r10d
mov r11d, ebp
nop word cs:[rax + rax]
mov r10, r9
sub r10, r15
add r10, r14
cmp r11d, 0x20
ja 0x140001c1c
mov r15d, r11d
bt rdx, r15
jb 0x140001b40
cmp r11d, 0x80
jb 0x140001b5e
mov ebp, r11d
shr ebp, 8
cmp ebp, 0x1f
jg 0x140001c5a
test ebp, ebp
je 0x140001c81
cmp ebp, 0x16
jne 0x140001b5e
cmp r11d, 0x1680
sete r11b
test r11b, r11b
je 0x140001b5e
jmp 0x140001b40
cmp ebp, 0x20
je 0x140001c9c
cmp ebp, 0x30
jne 0x140001b5e
cmp r11d, 0x3000
sete r11b
test r11b, r11b
je 0x140001b5e
jmp 0x140001b40
movzx r11d, r11b
movzx r11d, byte [rcx + r11]
and r11b, 1
test r11b, r11b
je 0x140001b5e
jmp 0x140001b40
movzx r11d, r11b
movzx r11d, byte [rcx + r11]
shr r11b, 1
and r11b, 1
test r11b, r11b
je 0x140001b5e
jmp 0x140001b40
mov r9, rax
mov r11, r12
mov r14, rbx
cmp r14, r12
je 0x140001b4f
jmp 0x140001cfa
mov r10, r14
jmp 0x140001cc3
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
sub r14, r12
js 0x140001d41
mov rax, qword [0x14050df18]
movzx eax, byte [rax]
mov ebx, 1
mov edx, 1
mov rcx, r14
call sym.__rust_alloc
test rax, rax
je 0x140001d43
mov r15, rax
add rdi, r12
mov rcx, rax
mov rdx, rdi
mov r8, r14
call sym.memcpy
mov qword [rsi], r14
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r14
jmp 0x140001ce6
xor ebx, ebx
mov rcx, rbx
mov rdx, r14
call sym.alloc::raw_vec::handle_error::hb4a2c97b2f2cc7c5
int3
Function at 0x140019c40
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm6
mov rsi, rcx
movzx ebx, byte [rcx + 0x68]
mov rax, qword [rcx + 0x20]
shl rax, 9
mov edi, ebx
shl edi, 3
or rdi, rax
mov byte [rcx + rbx + 0x28], pe_nt_image_headers64
mov r8, rbx
xor r8, 0x3f
je 0x140019c8d
lea rcx, [rsi + rbx]
add rcx, 0x29
test rcx, rcx
je 0x140019c8d
xor edx, edx
call fcn.1402de3b8
lea rdx, [rsi + 0x28]
bswap rdi
xor ebx, 0x38
cmp ebx, 8
jae 0x140019cd1
mov r8d, 1
mov rcx, rsi
call sym.sha2::sha256::compress256::h1a84382f6b18ee43
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rdi
lea rdx, [rsp + 0x20]
jmp 0x140019cd5
mov qword [rsi + 0x60], rdi
mov r8d, 1
mov rcx, rsi
call sym.sha2::sha256::compress256::h1a84382f6b18ee43
movdqu xmm6, xmmword [rsi]
movdqu xmm7, xmmword [rsi + 0x10]
movups xmm0, xmmword [0x1404436e0]
movups xmmword [rsi], xmm0
movdqu xmm0, xmmword [0x1404436f0]
movdqu xmmword [rsi + 0x10], xmm0
mov qword [rsi + 0x20], 0
mov byte [rsi + 0x68], 0
mov rax, qword [0x14050df18]
movzx eax, byte [rax]
mov ecx, 0x20
mov edx, 1
call sym.__rust_alloc
test rax, rax
je 0x140019d9c
pxor xmm0, xmm0
movdqa xmm1, xmm7
punpckhbw xmm1, xmm0
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
punpcklbw xmm7, xmm0
pshuflw xmm2, xmm7, 0x1b
pshufhw xmm2, xmm2, 0x1b
packuswb xmm2, xmm1
movdqa xmm1, xmm6
punpckhbw xmm1, xmm0
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
punpcklbw xmm6, xmm0
pshuflw xmm0, xmm6, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm1
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm2
mov edx, 0x20
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
ret
mov ecx, 1
mov edx, 0x20
call sym.alloc::raw_vec::handle_error::hb4a2c97b2f2cc7c5
int3
Function at 0x140019db0
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, r8
cmp r8, 0x20
jne 0x140019edf
mov rbx, rdx
mov rdi, rcx
movzx r15d, byte [rcx + 0x68]
mov rax, qword [rcx + 0x20]
shl rax, 9
mov r14d, r15d
shl r14d, 3
or r14, rax
mov byte [rcx + r15 + 0x28], pe_nt_image_headers64
mov r8, r15
xor r8, 0x3f
je 0x140019e08
lea rcx, [rdi + r15]
add rcx, 0x29
test rcx, rcx
je 0x140019e08
xor edx, edx
call fcn.1402de3b8
lea rdx, [rdi + 0x28]
bswap r14
xor r15d, 0x38
cmp r15d, 8
jae 0x140019e4e
mov r8d, 1
mov rcx, rdi
call sym.sha2::sha256::compress256::h1a84382f6b18ee43
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], r14
lea rdx, [rsp + 0x20]
jmp 0x140019e52
mov qword [rdi + 0x60], r14
mov r8d, 1
mov rcx, rdi
call sym.sha2::sha256::compress256::h1a84382f6b18ee43
movdqu xmm0, xmmword [rdi]
pxor xmm1, xmm1
movdqa xmm2, xmm0
punpckhbw xmm2, xmm1
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm2, xmm2, 0x1b
punpcklbw xmm0, xmm1
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm2
movdqu xmmword [rbx], xmm0
movdqu xmm0, xmmword [rdi + 0x10]
movdqa xmm2, xmm0
punpckhbw xmm2, xmm1
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm2, xmm2, 0x1b
punpcklbw xmm0, xmm1
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm2
movdqu xmmword [rbx + 0x10], xmm0
movups xmm0, xmmword [0x1404436f0]
movups xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [0x1404436e0]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x20], 0
mov byte [rdi + 0x68], 0
cmp rsi, 0x20
setne al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14001c5b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14001c5f2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14001c5fa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14001c60b
jmp 0x14001c622
xor r10d, r10d
jmp 0x14001c6ad
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14001c622
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14001c639
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14001c659
add r11, r8
jmp 0x14001c78b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14001c722
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14001c6d0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14001c740
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14001c752
jmp 0x14001c76d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14001c76d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14001c787
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400203a0
Capabilities:
Hash data using sha256

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov rdi, rcx
mov rbx, qword [0x14050df18]
movzx eax, byte [rbx]
mov ecx, 0x70
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14002047f
mov rsi, rax
movups xmm7, xmmword [0x140445060]
movups xmmword [rax + 0x10], xmm7
movups xmm8, xmmword [0x140445050]
movups xmmword [rax], xmm8
xorps xmm6, xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x59], xmm6
movzx eax, byte [rbx]
mov ecx, 0x70
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14002048e
movups xmmword [rax + 0x10], xmm7
movups xmmword [rax], xmm8
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x59], xmm6
mov qword [rdi + 0x18], rsi
lea rcx, sym._ZN4core3ptr473drop_in_place_LT_digest..core_api..wrapper..CoreWrapper_LT_digest..core_api..ct_variable..CtVariableCoreWrapper
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x30], rcx
movabs rax, 0x8000000000000000
mov qword [rdi], rax
mov rax, rdi
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov ecx, 8
mov edx, 0x70
call sym.alloc::alloc::handle_alloc_error::hac6683127b8aa11c
mov ecx, 8
mov edx, 0x70
call sym.alloc::alloc::handle_alloc_error::hac6683127b8aa11c
ud2
Function at 0x1400233b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movdqa xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
mov rax, qword [0x1402e1030]
movzx eax, byte [rax]
cmp al, 1
jne 0x1400233ea
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
add rsp, 0x38
jmp sym._ZN8chacha208backends4avx25inner17h3140bbdda67cf7c4E.llvm.10360624751807762928
movdqu xmm4, xmmword [rcx]
movdqu xmm2, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [rcx + 0x20]
movdqu xmm0, xmmword [rcx + 0x30]
mov eax, 0xa
movdqa xmm6, xmm4
movdqa xmm3, xmm2
movdqa xmm5, xmm0
movdqa xmm7, xmm1
nop word cs:[rax + rax]
paddd xmm6, xmm3
pxor xmm5, xmm6
movdqa xmm8, xmm5
psrld xmm8, 0x10
pslld xmm5, 0x10
por xmm5, xmm8
paddd xmm7, xmm5
pxor xmm3, xmm7
movdqa xmm8, xmm3
psrld xmm8, 0x14
pslld xmm3, 0xc
por xmm3, xmm8
paddd xmm6, xmm3
pxor xmm5, xmm6
movdqa xmm8, xmm5
psrld xmm8, 0x18
pslld xmm5, 8
por xmm5, xmm8
paddd xmm7, xmm5
pxor xmm3, xmm7
movdqa xmm8, xmm3
psrld xmm8, 0x19
pslld xmm3, 7
por xmm3, xmm8
pshufd xmm7, xmm7, 0x39
pshufd xmm5, xmm5, 0x4e
pshufd xmm6, xmm6, 0x93
paddd xmm6, xmm3
pxor xmm5, xmm6
movdqa xmm8, xmm5
psrld xmm8, 0x10
pslld xmm5, 0x10
por xmm5, xmm8
paddd xmm7, xmm5
pxor xmm3, xmm7
movdqa xmm8, xmm3
psrld xmm8, 0x14
pslld xmm3, 0xc
por xmm3, xmm8
paddd xmm6, xmm3
pxor xmm5, xmm6
movdqa xmm8, xmm5
psrld xmm8, 0x18
pslld xmm5, 8
por xmm5, xmm8
paddd xmm7, xmm5
pxor xmm3, xmm7
movdqa xmm8, xmm3
psrld xmm8, 0x19
pslld xmm3, 7
por xmm3, xmm8
pshufd xmm7, xmm7, 0x93
pshufd xmm5, xmm5, 0x4e
pshufd xmm6, xmm6, 0x39
dec rax
jne 0x140023420
paddd xmm6, xmm4
paddd xmm3, xmm2
paddd xmm7, xmm1
paddd xmm5, xmm0
movdqu xmmword [rdx], xmm6
movdqu xmmword [rdx + 0x10], xmm3
movdqu xmmword [rdx + 0x20], xmm7
movdqu xmmword [rdx + 0x30], xmm5
movd eax, xmm0
inc eax
mov dword [rcx + 0x30], eax
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140023570
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
mov rax, qword [0x1402e1030]
movzx eax, byte [rax]
cmp al, 1
jne 0x1400235e0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
jmp sym.chacha20::backends::avx2::inner::h104851083efdf4fb
mov rax, qword [rdx + 0x10]
movdqu xmm0, xmmword [rcx + 0x30]
test rax, rax
je 0x1400237cb
mov r8, qword [rdx]
mov rdx, qword [rdx + 8]
movdqu xmm1, xmmword [rcx]
movdqu xmm2, xmmword [rcx + 0x10]
movdqu xmm3, xmmword [rcx + 0x20]
xor r9d, r9d
movdqa xmm4, xmmword [0x140445280]
nop word cs:[rax + rax]
mov r10d, 0xa
movdqa xmm7, xmm1
movdqa xmm5, xmm2
movdqa xmm6, xmm0
movdqa xmm8, xmm3
nop word [rax + rax]
paddd xmm7, xmm5
pxor xmm6, xmm7
movdqa xmm9, xmm6
psrld xmm9, 0x10
pslld xmm6, 0x10
por xmm6, xmm9
paddd xmm8, xmm6
pxor xmm5, xmm8
movdqa xmm9, xmm5
psrld xmm9, 0x14
pslld xmm5, 0xc
por xmm5, xmm9
paddd xmm7, xmm5
pxor xmm6, xmm7
movdqa xmm9, xmm6
psrld xmm9, 0x18
pslld xmm6, 8
por xmm6, xmm9
paddd xmm8, xmm6
pxor xmm5, xmm8
movdqa xmm9, xmm5
psrld xmm9, 0x19
pslld xmm5, 7
por xmm5, xmm9
pshufd xmm8, xmm8, 0x39
pshufd xmm6, xmm6, 0x4e
pshufd xmm7, xmm7, 0x93
paddd xmm7, xmm5
pxor xmm6, xmm7
movdqa xmm9, xmm6
psrld xmm9, 0x10
pslld xmm6, 0x10
por xmm6, xmm9
paddd xmm8, xmm6
pxor xmm5, xmm8
movdqa xmm9, xmm5
psrld xmm9, 0x14
pslld xmm5, 0xc
por xmm5, xmm9
paddd xmm7, xmm5
pxor xmm6, xmm7
movdqa xmm9, xmm6
psrld xmm9, 0x18
pslld xmm6, 8
por xmm6, xmm9
paddd xmm8, xmm6
pxor xmm5, xmm8
movdqa xmm9, xmm5
psrld xmm9, 0x19
pslld xmm5, 7
por xmm5, xmm9
pshufd xmm8, xmm8, 0x93
pshufd xmm6, xmm6, 0x4e
pshufd xmm7, xmm7, 0x39
dec r10
jne 0x140023640
mov r10, r9
shl r10, 6
movdqu xmm9, xmmword [r8 + r10]
movdqu xmm10, xmmword [r8 + r10 + 0x10]
movdqu xmm11, xmmword [r8 + r10 + 0x20]
movdqu xmm12, xmmword [r8 + r10 + 0x30]
paddd xmm6, xmm0
pxor xmm6, xmm12
paddd xmm8, xmm3
pxor xmm8, xmm11
paddd xmm5, xmm2
pxor xmm5, xmm10
paddd xmm7, xmm1
pxor xmm7, xmm9
inc r9
paddd xmm0, xmm4
movdqu xmmword [rdx + r10], xmm7
movdqu xmmword [rdx + r10 + 0x10], xmm5
movdqu xmmword [rdx + r10 + 0x20], xmm8
movdqu xmmword [rdx + r10 + 0x30], xmm6
cmp rax, r9
jne 0x140023620
movd dword [rcx + 0x30], xmm0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140025c00
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x20
call sym.__rand_core::os::OsRng_as_rand_core::RngCore_::try_fill_bytes::h06f3966c4be4dbc0
test rax, rax
je 0x140025c5a
mov rbx, rax
mov r14, rdx
mov rcx, rax
call qword [rdx]
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x140025cb2
mov r8, qword [r14 + 0x10]
mov rcx, rbx
call sym.__rust_dealloc
jmp 0x140025cb2
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x70]
lea r8, [0x140445430]
lea rdx, [rsp + 0x40]
mov r9d, 8
call sym.rand_chacha::guts::init_chacha::hb8c75b19b7969a91
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
jmp sym.rand_chacha::guts::refill_wide::h12c8a2d729ebaa83
Function at 0x140084e80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140084ec2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140084eca
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140084edb
jmp 0x140084ef2
xor r10d, r10d
jmp 0x140084f7d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140084ef2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140084f09
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140084f29
add r11, r8
jmp 0x14008505b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140084ff2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140084fa0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140085010
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140085022
jmp 0x14008503d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14008503d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140085057
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400aef90
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm6
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
xor ecx, ecx
call sub.KERNEL32.dll_GetLogicalProcessorInformation
mov esi, dword [rsp + 0x20]
cmp rsi, 0x20
jb 0x1400af011
mov eax, esi
and eax, 0x1f
jne 0x1400af011
mov rax, qword [0x14050df18]
movzx eax, byte [rax]
mov edx, 8
mov rcx, rsi
call sym.__rust_alloc
test rax, rax
je 0x1400af135
mov rdi, rax
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_GetLogicalProcessorInformation
test eax, eax
je 0x1400af000
mov ecx, dword [rsp + 0x20]
cmp rcx, 0x1f
ja 0x1400af042
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
call sym.__rust_dealloc
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov eax, ecx
shr eax, 5
cmp ecx, 0xa0
jae 0x1400af059
xor r9d, r9d
xor ecx, ecx
jmp 0x1400af0e9
mov ecx, eax
and ecx, 3
mov edx, 4
cmovne rdx, rcx
mov rcx, rax
sub rcx, rdx
lea rdx, [rdi + 0x68]
pxor xmm1, xmm1
movdqa xmm2, xmmword [0x140452390]
mov r8, rcx
pxor xmm3, xmm3
pxor xmm0, xmm0
nop dword [rax + rax]
movd xmm4, dword [rdx - 0x40]
movd xmm5, dword [rdx - 0x60]
punpckldq xmm5, xmm4
movd xmm4, dword [rdx]
movd xmm6, dword [rdx - 0x20]
punpckldq xmm6, xmm4
pshufd xmm4, xmm5, 0xd4
pcmpeqd xmm4, xmm1
pand xmm4, xmm2
paddq xmm3, xmm4
pshufd xmm4, xmm6, 0xd4
pcmpeqd xmm4, xmm1
pand xmm4, xmm2
paddq xmm0, xmm4
sub rdx, 0xffffffffffffff80
add r8, 0xfffffffffffffffc
jne 0x1400af090
paddq xmm0, xmm3
pshufd xmm1, xmm0, 0xee
paddq xmm1, xmm0
movq r9, xmm1
sub rax, rcx
shl rcx, 5
add rcx, rdi
add rcx, 8
nop word [rax + rax]
cmp dword [rcx], 1
adc r9, 0
add rcx, 0x20
dec rax
jne 0x1400af100
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
mov rsi, r9
call sym.__rust_dealloc
mov rax, rsi
test rsi, rsi
jne 0x1400af035
jmp 0x1400af011
mov ecx, 8
mov rdx, rsi
call sym.alloc::raw_vec::handle_error::hb4a2c97b2f2cc7c5
mov rbx, rax
mov r8d, 8
mov rcx, rdi
mov rdx, rsi
call sym.__rust_dealloc
mov rcx, rbx
call sym._Unwind_Resume
int3

Function at 0x1400af160
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x1400b1ac0
Capabilities:
Hash data using murmur3
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
movzx eax, byte [0x1402e1038]
cmp al, 0xff
je 0x1400b1ae6
cmp al, 1
je 0x1400b1b6e
jmp 0x1400b1b91
mov rbx, rcx
mov r14, rdx
mov r15, r8
lea rcx, [rsp + 0x20]
call sym.sha2::sha256::x86::shani_cpuid::init_get::cpuid::hea269ab8b5e1819f
lea rcx, [rsp + 0x30]
call sym.sha2::sha256::x86::shani_cpuid::init_get::cpuid_count::h6ab8dc6a182b9187
mov ebp, dword [rsp + 0x28]
mov eax, ebp
not eax
test eax, 0xc000000
jne 0x1400b1b81
call fcn.1400b1a70
mov rdi, rax
mov r12d, dword [rsp + 0x34]
shr r12d, 0x1d
call fcn.1400b1a70
mov rsi, rax
mov eax, dword [rsp + 0x2c]
shr eax, 0x1a
and esi, edi
shr esi, 1
and esi, r12d
and esi, eax
call fcn.1400b1a70
shr eax, 1
mov edi, ebp
shr edi, 9
and edi, eax
call fcn.1400b1a70
and eax, 2
shr eax, 1
shr ebp, 0x13
and ebp, eax
and ebp, edi
and ebp, esi
mov byte [0x1402e1038], bpl
mov r8, r15
mov rdx, r14
mov rcx, rbx
je 0x1400b1b91
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sym.sha2::sha256::x86::digest_blocks::hd29ecca16fdfbcd8
mov byte [0x1402e1038], 0
mov r8, r15
mov rdx, r14
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp sym.sha2::sha256::soft::compress::hc4a332212c1650ad
Function at 0x1400b4d80
Capabilities:
Encode data using base64
Hash data using sha512

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
movzx eax, byte [0x1402e1039]
cmp al, 0xff
je 0x1400b4da8
cmp al, 1
jne 0x1400b4e16
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp sym._ZN4sha26sha5123x8627sha512_compress_x86_64_avx217h07b75dafb314ceddE.llvm.9590918189516839170
mov rsi, rcx
mov rdi, rdx
mov rbx, r8
lea rcx, [rsp + 0x20]
mov edx, 1
call sym.sha2::sha512::x86::avx2_cpuid::init_get::cpuid::h8588d81113e1dddf
lea rcx, [rsp + 0x30]
xor r14d, r14d
mov edx, 7
xor r8d, r8d
call sym.sha2::sha512::x86::avx2_cpuid::init_get::cpuid_count::hc4341e8104287278
mov ebp, dword [rsp + 0x28]
mov eax, ebp
not eax
test eax, 0xc000000
jne 0x1400b4df1
call sym._ZN4core9core_arch3x865xsave7_xgetbv17h46fb1a7cb6554ed6E.llvm.9590918189516839170
not eax
test al, 6
sete r14b
mov eax, dword [rsp + 0x34]
and eax, 0x20
shr eax, 5
shr ebp, 0x1c
and bpl, r14b
and bpl, al
mov byte [0x1402e1039], bpl
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
jne 0x1400b4d99
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp sym.sha2::sha512::soft::compress::h9e36c909e0b670b0