joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a53b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x14010c598]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov edi, r8d
mov rbx, rdx
mov r8d, 5
lea rdx, [rsp + 0x20]
mov rsi, rcx
call fcn.1400bdd80
mov r8d, 5
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x60]
call fcn.1400bdd80
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x24], eax
mov eax, dword [rbx + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x2c], eax
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x30], eax
test edi, edi
je 0x1400a547d
nop dword [rax]
nop dword [rax + rax]
lea r8, [rsp + 0x60]
mov rcx, rsi
lea rdx, [rsp + 0x20]
call fcn.1400bdf50
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x60]
call fcn.1400bdf50
mov eax, dword [rsp + 0x20]
xor dword [rbx], eax
mov eax, dword [rsp + 0x24]
xor dword [rbx + 4], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx + 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x30]
xor dword [rbx + 0x10], eax
sub rdi, 1
jne 0x1400a5430
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400c7aa0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a5f70
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400a605f
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 4]
mov rsi, r8
mov ebx, dword [rcx]
mov rdi, rdx
mov qword [rsp + 0x40], rbp
mov r15, rcx
lea r14, [rcx + rax*4]
cmp ebx, 0x10
je 0x1400a5fca
nop dword [rax + rax]
mov eax, ebx
inc ebx
movzx ecx, byte [rax + r14 + 8]
xor byte [rdi], cl
inc rdi
sub rsi, 1
je 0x1400a5fca
cmp ebx, 0x10
jne 0x1400a5fb0
cmp rsi, 0x10
jb 0x1400a5ffd
mov rax, qword [0x140116800]
lea rcx, [r14 + 0x18]
mov rbx, rsi
mov rdx, rdi
shr rbx, 4
mov r8, rbx
call qword [case.0x140046c11.0]
shl rbx, 4
add rdi, rbx
sub rsi, rbx
mov ebx, 0x10
test rsi, rsi
je 0x1400a6044
xor ebx, ebx
lea rdx, [r14 + 8]
mov qword [r14 + 8], rbx
lea rcx, [r14 + 0x18]
mov qword [r14 + 0x10], rbx
mov rax, qword [0x140116800]
lea r8d, [rbx + 1]
call qword [case.0x140046c11.0]
nop word [rax + rax]
movzx ecx, byte [rbx + r14 + 8]
inc ebx
xor byte [rdi], cl
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x1400a6030
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov dword [r15], ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400a6540
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rbx
mov rbx, rdx
mov r11, rcx
mov eax, 0x12345678
mov r9d, 0x23456789
mov r10d, 0x34567890
test r8d, r8d
je 0x1400a65c7
mov qword [rsp + 0x10], rsi
lea rsi, [0x140114800]
mov qword [rsp + 0x18], rdi
mov edi, r8d
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov edx, eax
xor rdx, rcx
mov ecx, eax
shr ecx, 8
movzx r8d, dl
mov eax, dword [rsi + r8*4]
xor eax, ecx
movzx ecx, al
add ecx, r9d
imul r9d, ecx, 0x8088405
mov ecx, r10d
inc r9d
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
shr ecx, 8
movzx edx, dl
mov r10d, dword [rsi + rdx*4]
xor r10d, ecx
sub rdi, 1
jne 0x1400a6572
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
mov dword [r11 + 0x18], eax
xor eax, eax
mov dword [r11 + 0x1c], r9d
mov dword [r11 + 0x20], r10d
pop rbx
ret

Function at 0x1400a65e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov r10d, dword [rcx + 0x14]
mov rsi, rdx
mov ebx, dword [rcx + 0x18]
mov r11d, dword [rcx + 0x1c]
mov edi, r8d
test r8d, r8d
je 0x1400a6690
mov qword [rsp + 0x10], rbp
mov ebp, edi
mov qword [rsp + 0x18], r14
lea r14, [0x140114800]
nop dword [rax + rax]
mov eax, r11d
lea rsi, [rsi + 1]
or eax, 2
mov r9d, eax
xor r9d, 1
imul r9d, eax
mov eax, r10d
shr r9d, 8
xor r9b, byte [rsi - 1]
movzx edx, r9b
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov r10d, dword [r14 + r8*4]
xor r10d, eax
movzx eax, r10b
add eax, ebx
imul ebx, eax, 0x8088405
mov eax, r11d
inc ebx
mov edx, ebx
shr rdx, 0x18
xor rdx, rax
shr eax, 8
movzx edx, dl
mov r11d, dword [r14 + rdx*4]
xor r11d, eax
mov byte [rsi - 1], r9b
sub rbp, 1
jne 0x1400a6620
mov r14, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x28]
mov eax, edi
mov dword [rcx + 0x18], ebx
mov rbx, qword [rsp + 0x20]
mov dword [rcx + 0x14], r10d
mov dword [rcx + 0x1c], r11d
pop rdi
ret

Function at 0x1400a66b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov r9d, dword [rcx + 0x14]
mov rdi, rdx
mov r11d, dword [rcx + 0x18]
mov r10d, dword [rcx + 0x1c]
mov ebx, r8d
test r8d, r8d
je 0x1400a6761
mov qword [rsp + 0x10], rsi
mov esi, ebx
mov qword [rsp + 0x18], r14
lea r14, [0x140114800]
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [rdi]
lea rdi, [rdi + 1]
mov eax, r10d
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
mov eax, r9d
shr edx, 8
xor dl, r8b
mov byte [rdi - 1], dl
mov edx, r8d
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov r9d, dword [r14 + r8*4]
xor r9d, eax
movzx eax, r9b
add eax, r11d
imul r11d, eax, 0x8088405
mov eax, r10d
inc r11d
mov edx, r11d
shr rdx, 0x18
xor rdx, rax
shr eax, 8
movzx edx, dl
mov r10d, dword [r14 + rdx*4]
xor r10d, eax
sub rsi, 1
jne 0x1400a66f0
mov r14, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
mov eax, ebx
mov dword [rcx + 0x14], r9d
mov rbx, qword [rsp + 0x20]
mov dword [rcx + 0x18], r11d
mov dword [rcx + 0x1c], r10d
pop rdi
ret
Function at 0x1400a68f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x14010c598]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, r8
movzx edx, dl
mov rbx, rcx
mov r8d, 0x40
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll_memset
movdqu xmm0, xmmword [rbx]
lea rcx, [rsp + 0x80]
mov r9d, 4
lea rax, [rsp + 0x90]
sub rbx, rcx
pxor xmm0, xmmword [rsp + 0x80]
movdqu xmmword [rsp + 0x80], xmm0
nop word [rax + rax]
movzx ecx, byte [rbx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1400a6960
lea rcx, [rsp + 0x20]
call fcn.1400be590
mov r8d, 0x40
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.1400be5c0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400bde50
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400c7aa0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret

Function at 0x1400a69c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x110
mov rax, qword [0x14010c598]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbx, rdx
lea rdx, [rsp + 0xc0]
call fcn.1400bde50
movdqu xmm0, xmmword [rsp + 0xc0]
movabs rax, 0x3636363636363636
mov edx, 4
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
movdqu xmm1, xmmword [rsp + 0x80]
pxor xmm1, xmm0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov eax, 0x10
movdqu xmmword [rsp + 0x80], xmm1
nop
movzx ecx, byte [rsp + rax + 0xc0]
xor byte [rsp + rax + 0x80], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400a6a60
lea rcx, [rsp + 0x20]
call fcn.1400be590
mov r8d, 0x40
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.1400be5c0
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x20]
call fcn.1400bde50
lea r8, [rsp + 0xec]
mov dl, 0x5c
lea rcx, [rsp + 0xc0]
call fcn.1400a68f0
movups xmm0, xmmword [rsp + 0xd8]
movups xmm1, xmmword [rsp + 0xe8]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400c7aa0
add rsp, 0x110
pop rbx
ret
Function at 0x1400a82e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
mov r10d, dword [r9]
xor ebp, ebp
mov r14d, dword [rsp + 0x40]
and r10d, 7
mov r12, r9
mov r15d, r8d
mov rsi, rcx
mov r11d, ebp
cmp rdx, 5
jae 0x1400a8323
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
lea r9, [rdx - 4]
mov qword [rsp + 0x20], rbx
add r15d, 5
mov qword [rsp + 0x28], rdi
add r9, rsi
nop dword [rax + rax]
lea rax, [r11 + rsi]
cmp rax, r9
jae 0x1400a8363
nop dword [rax]
movzx ecx, byte [rax]
and cl, 0xfe
cmp cl, 0xe8
je 0x1400a8363
inc rax
cmp rax, r9
jb 0x1400a8350
mov rcx, rax
sub rcx, r11
mov r11, rax
sub r11, rsi
sub rcx, rsi
cmp rax, r9
jae 0x1400a847c
cmp rcx, 2
jbe 0x1400a83f7
mov r10d, ebp
movzx edx, byte [rax + 4]
lea ecx, [rdx + 1]
test cl, 0xfe
jne 0x1400a8468
movzx ecx, byte [rax + 3]
lea edi, [r11 + r15]
shl edx, 8
or edx, ecx
movzx ecx, byte [rax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [rax + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
sub ecx, edi
test r14d, r14d
lea ebx, [rdx + rdi]
cmove ebx, ecx
mov r8d, ebx
test r10d, r10d
je 0x1400a8436
and r10d, 6
mov edx, ebx
shl r10d, 2
mov ecx, r10d
shr edx, cl
inc edx
test dl, 0xfe
jne 0x1400a8433
mov r8d, 0x100
shl r8d, cl
dec r8d
xor r8d, ebx
test r14d, r14d
je 0x1400a8430
add r8d, edi
jmp 0x1400a8433
shr r10d, cl
test r10d, r10d
je 0x1400a8384
cmp r10d, 4
ja 0x1400a8421
cmp r10d, 3
je 0x1400a8421
mov ecx, r10d
shr rcx, 1
movzx edx, byte [rcx + rax + 1]
inc edx
test dl, 0xfe
jne 0x1400a8384
or r10d, 8
shr r10d, 1
inc r11
jmp 0x1400a8340
sub r8d, edi
mov r10d, ebp
mov ecx, r8d
mov byte [rax + 1], r8b
shr ecx, 8
mov byte [rax + 2], cl
mov ecx, r8d
shr r8d, 0x18
and r8b, 1
shr ecx, 0x10
neg r8b
mov byte [rax + 3], cl
mov byte [rax + 4], r8b
mov eax, 5
add r11, rax
jmp 0x1400a8340
or r10d, 8
mov eax, 1
shr r10d, 1
add r11, rax
jmp 0x1400a8340
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
cmp rcx, 2
ja 0x1400a8492
shr r10d, cl
mov ebp, r10d
mov rsi, qword [rsp + 0x38]
mov rax, r11
mov dword [r12], ebp
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop r12
ret
Function at 0x1400a9b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
nop
mov r10d, dword [rbx + 0x14]
mov r8, qword [rbx]
cmp r10d, 3
jae 0x1400a9b26
lea rax, [r8 + 1]
mov qword [rbx], rax
jmp 0x1400a9b87
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 + 1]
movzx edx, cx
movzx ecx, word [rbx + rax*4 + 0x78]
mov rax, qword [rbx + 0x28]
xor rdx, rcx
mov ecx, r10d
lea r8, [rax + rdx*4]
mov eax, dword [rbx + 8]
mov edx, dword [r8]
mov dword [r8], eax
mov eax, dword [rbx + 0x3c]
mov r9, qword [rbx]
mov r8d, dword [rbx + 8]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x1c]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400ab0f0
inc qword [rbx]
inc dword [rbx + 8]
inc dword [rbx + 0x18]
mov eax, dword [rbx + 8]
cmp eax, dword [rbx + 0xc]
jne 0x1400a9b9d
mov rcx, rbx
call fcn.1400aa860
add edi, 0xffffffff
jne 0x1400a9b10
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400aa400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
nop
cmp dword [rbx + 0x14], 3
mov r8, qword [rbx]
jae 0x1400aa422
lea rax, [r8 + 1]
mov qword [rbx], rax
jmp 0x1400aa45e
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 + 1]
movzx edx, cx
movzx ecx, word [rbx + rax*4 + 0x78]
mov rax, qword [rbx + 0x28]
xor rdx, rcx
lea rcx, [rax + rdx*4]
mov eax, dword [rbx + 8]
mov edx, dword [rcx]
mov dword [rcx], eax
mov ecx, dword [rbx + 0x18]
mov rax, qword [rbx + 0x30]
mov dword [rax + rcx*4], edx
inc qword [rbx]
inc dword [rbx + 8]
inc dword [rbx + 0x18]
mov eax, dword [rbx + 8]
cmp eax, dword [rbx + 0xc]
jne 0x1400aa474
mov rcx, rbx
call fcn.1400aa860
add edi, 0xffffffff
jne 0x1400aa410
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400aa990
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov qword [rcx + 0x480], 0xffffffffffffffff
mov qword [rcx + 0x40], rdx
lea r8, [rcx + 0x78]
mov word [rcx + 0x22], dx
mov qword [rcx + 0x28], rdx
mov dword [rcx + 0x3c], 0x20
mov byte [rcx + 0x21], 1
mov dword [rcx + 0x5c], 4
nop
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x1400aa9c0
ret
Function at 0x1400b3230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movzx eax, word [r8]
mov r15, r8
mov edi, edx
mov rsi, rcx
shl edx, 4
mov r14, r9
shr rax, 4
imul rbp, rdi, 0x440
lea rbx, [r8 + rdx*2]
mov edx, dword [r9 + rax*4]
lea r8, [rcx + 0x44]
mov rcx, rbx
add r8, rbp
call fcn.1400b5a20
movzx eax, word [r15]
lea r8, [rsi + 0x64]
xor rax, 0x7f0
lea rcx, [rbx + 0x10]
shr rax, 4
add r8, rbp
mov r9, r14
mov r12d, dword [r14 + rax*4]
movzx eax, word [r15 + 0x10]
shr rax, 4
mov edx, dword [r14 + rax*4]
add edx, r12d
call fcn.1400b5a20
movzx eax, word [r15 + 0x10]
mov r10d, 0x10
mov ebx, dword [rsi]
xor rax, 0x7f0
shr rax, 4
add r12d, dword [r14 + rax*4]
mov dword [rsi + rdi*4 + 4], ebx
cmp ebx, r10d
jbe 0x1400b333c
lea r11, [rsi + 0x84]
add r11, rbp
nop word [rax + rax]
xor r9d, r9d
lea eax, [r10 - 0x10]
bts eax, 8
nop dword [rax + rax]
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
shr rcx, 4
movzx r8d, word [r15 + rax*2 + 0x200]
and ecx, 0x7f
shr r8, 4
xor r8, rcx
add r9d, dword [r14 + r8*4]
cmp eax, 2
jae 0x1400b3300
lea eax, [r9 + r12]
inc r10d
mov dword [r11], eax
add r11, 4
cmp r10d, ebx
jb 0x1400b32f0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400b3420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
mov r10d, 0x100
or edx, r10d
mov r11d, r8d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
shr r8d, 8
mov ecx, edx
shr ecx, 7
mov eax, r10d
and ecx, 1
and eax, r11d
neg ecx
add eax, r10d
shr rcx, 4
add r8d, eax
and ecx, 0x7f
add edx, edx
movzx r8d, word [rdi + r8*2]
shr r8, 4
xor r8, rcx
mov ecx, edx
xor ecx, r11d
not ecx
and r10d, ecx
add ebx, dword [r9 + r8*4]
cmp edx, 0x10000
jb 0x1400b3440
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x1400b5a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov rsi, rcx
xor r11d, r11d
mov r10d, r11d
lea rdi, [rdi + 8]
shr r10d, 1
mov r9d, r11d
shr r9d, 2
mov ecx, r10d
and ecx, 1
add r11d, 2
neg ecx
shr rcx, 4
and ecx, 0x7f
lea eax, [r9 + 2]
movzx edx, word [rsi + rax*2]
movzx eax, word [rsi + 2]
shr rax, 4
shr rdx, 4
xor rdx, rcx
mov ecx, r9d
neg ecx
shr rcx, 4
and ecx, 0x7f
mov r8d, dword [rbx + rdx*4]
xor rcx, rax
lea eax, [r10 + 4]
movzx edx, word [rsi + rax*2]
mov eax, edx
xor rdx, 0x7f0
add r8d, dword [rbx + rcx*4]
add r8d, ebp
shr rax, 4
shr rdx, 4
mov ecx, dword [rbx + rax*4]
add ecx, r8d
mov dword [rdi - 8], ecx
mov ecx, dword [rbx + rdx*4]
add ecx, r8d
mov dword [rdi - 4], ecx
cmp r11d, 8
jb 0x1400b5a42
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1400bdcd0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x18]
xor ebp, ebp
and ebx, 0xf
mov rsi, rdx
mov rdi, rcx
mov dword [rcx + rbx*4 + 0x20], 0x80000000
inc ebx
cmp ebx, 0xe
je 0x1400bdd20
and ebx, 0xf
jne 0x1400bdd15
lea rdx, [rdi + 0x20]
mov r8, rdi
mov rcx, rdi
call fcn.1400bdf50
mov dword [rdi + rbx*4 + 0x20], ebp
inc ebx
cmp ebx, 0xe
jne 0x1400bdd01
mov rcx, qword [rdi + 0x18]
lea rdx, [rdi + 0x20]
shl rcx, 5
mov r8, rsi
mov rax, rcx
mov dword [rdi + 0x5c], ecx
shr rax, 0x20
mov rcx, rdi
mov dword [rdi + 0x58], eax
call fcn.1400bdf50
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov dword [rdi], 0x67452301
mov dword [rdi + 4], 0xefcdab89
mov dword [rdi + 8], 0x98badcfe
mov dword [rdi + 0xc], 0x10325476
mov dword [rdi + 0x10], 0xc3d2e1f0
mov qword [rdi + 0x18], rbp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400bde50
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x18]
mov rdi, rcx
and ebx, 0x3f
xor ebp, ebp
mov ecx, ebx
mov rsi, rdx
shr ebx, 2
mov r8d, ebp
and ecx, 3
je 0x1400bde84
mov r8d, dword [rdi + rbx*4 + 0x20]
lea ecx, [rcx*8]
mov eax, 0x80000000
shr eax, cl
or eax, r8d
mov dword [rdi + rbx*4 + 0x20], eax
inc ebx
cmp ebx, 0xe
je 0x1400bdebf
and ebx, 0xf
jne 0x1400bdeb4
lea rdx, [rdi + 0x20]
mov r8, rdi
mov rcx, rdi
call fcn.1400bdf50
mov dword [rdi + rbx*4 + 0x20], ebp
inc ebx
cmp ebx, 0xe
jne 0x1400bdea0
mov rcx, qword [rdi + 0x18]
lea rdx, [rdi + 0x20]
shl rcx, 3
mov r8, rdi
mov rax, rcx
mov dword [rdi + 0x5c], ecx
shr rax, 0x20
mov rcx, rdi
mov dword [rdi + 0x58], eax
call fcn.1400bdf50
mov eax, dword [rdi]
mov rbx, qword [rsp + 0x30]
bswap eax
mov dword [rsi], eax
mov eax, dword [rdi + 4]
bswap eax
mov dword [rsi + 4], eax
mov eax, dword [rdi + 8]
bswap eax
mov dword [rsi + 8], eax
mov eax, dword [rdi + 0xc]
bswap eax
mov dword [rsi + 0xc], eax
mov eax, dword [rdi + 0x10]
bswap eax
mov dword [rsi + 0x10], eax
mov rsi, qword [rsp + 0x40]
mov dword [rdi], 0x67452301
mov dword [rdi + 4], 0xefcdab89
mov dword [rdi + 8], 0x98badcfe
mov dword [rdi + 0xc], 0x10325476
mov dword [rdi + 0x10], 0xc3d2e1f0
mov qword [rdi + 0x18], rbp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400be590
Capabilities:
Hash data using sha1

Disassembly:
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x18], 0
ret

Function at 0x1400be730
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x20]
mov rsi, rdx
and ebx, 0x3f
mov rdi, rcx
mov byte [rbx + rcx + 0x28], 0x80
inc ebx
cmp ebx, 0x38
je 0x1400be770
and ebx, 0x3f
jne 0x1400be764
mov rcx, rdi
call fcn.1400be940
mov byte [rbx + rdi + 0x28], 0
inc ebx
cmp ebx, 0x38
jne 0x1400be757
mov rcx, qword [rdi + 0x20]
shl rcx, 3
mov rax, rcx
bswap ecx
shr rax, 0x20
bswap eax
mov dword [rdi + 0x64], ecx
mov rcx, rdi
mov dword [rdi + 0x60], eax
call fcn.1400be940
mov rdx, rdi
mov r8d, 4
nop word [rax + rax]
mov ecx, dword [rdx + 4]
lea rsi, [rsi + 8]
mov eax, dword [rdx]
lea rdx, [rdx + 8]
bswap eax
mov dword [rsi - 8], eax
bswap ecx
mov dword [rsi - 4], ecx
sub r8, 1
jne 0x1400be7a0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov dword [rdi], 0x6a09e667
mov dword [rdi + 4], 0xbb67ae85
mov dword [rdi + 8], 0x3c6ef372
mov dword [rdi + 0xc], 0xa54ff53a
mov dword [rdi + 0x10], 0x510e527f
mov dword [rdi + 0x14], 0x9b05688c
mov dword [rdi + 0x18], 0x1f83d9ab
mov dword [rdi + 0x1c], 0x5be0cd19
mov qword [rdi + 0x20], r8
add rsp, 0x20
pop rdi
ret

Function at 0x1400be810
Capabilities:
Hash data using sha256

Disassembly:
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x20], 0
ret
Function at 0x1400bf9e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov r9, r8
mov r8, rdx
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400bfa1b
xor eax, eax
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
mov eax, ecx
add rsp, 0x30
pop rbx
ret

Function at 0x1400bfad0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [rcx], edx
sub edx, 1
je 0x1400bfaf3
sub edx, 3
je 0x1400bfaea
cmp edx, 6
jne 0x1400bfafa
add rcx, 0x10
jmp fcn.1400be810
mov qword [rcx + 8], 0xffffffffffffffff
ret
mov dword [rcx + 4], 0xffffffff
ret
Function at 0x18030ff96
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
lea rsp, [rsp + 0x10]
jne 0x180315ac5

Function at 0x1803105d2
Capabilities:
Authenticate hmac

Disassembly:
dec r8b
mov qword [rsp + r11 - 0x438a4000], rax
shl ebx, 0x2d
rol r8b, 1
sal word [rsp + rbx - 0x6e803ff0], 0xe2
cmovns r11w, cx
js 0x18037614e
add r8b, 0xb4
ror ebx, cl
sbb r11b, al
call fcn.180334ab7

Function at 0x18031a305
Capabilities:
Encode data using base64

Disassembly:
lea rcx, [rdx*2 + 0x7802b0b6]
xor bl, bpl
sub bl, 0xa9
neg ax
mov qword [rsp + r11*4 - 0x2000000], 0x560ff8bd
neg bl
add bl, 0x1d
not bl
jmp 0x18037c8b4

Function at 0x180325299
Capabilities:
Encode data using base64

Disassembly:
xor r11d, ebp
inc dword [rsp + r10 + 0x6a]
xchg word [rsp + r10 + 0x66], ax
rol r10b, 0xa1
rol r11d, 3
not r11d
pop r8
movsx r8d, byte [rsp + r10*8 + 0x5b9]
dec r11d
lea rcx, [rbx + rdx*2 + 0x150f6204]
bswap r11d
mov qword [rsp + r10*2 + 0x176], rbp
bswap eax
jmp 0x18037a5b7

Function at 0x1803252f0
Capabilities:
Authenticate hmac

Disassembly:
shl word [rsp + r10*4 - 0xf683bba], 0x8e
dec edx
push r8
call fcn.18036d5dc
mov r11d, dword [rdi + rdx - 0x14a1b242]
mov ebx, r10d
or r10, rbx
lea rdi, [rdi + rdx - 0x14a1b23e]
xadd r10w, bx
lea rcx, [rbx + rdx*4 + 0x640221b9]
xor r11d, ebp
neg r11d
not r11d
sar rbx, 0x1a
rol r11d, 1
push rdx
sub r11d, 0xbf923b91
mov qword [rsp + rdx - 0x14a1b242], rbp
ror dl, 0x81
setno r8b
movsx ebp, bl
xor dword [rsp + rdx - 0x14a1b221], r11d
push rbx
mov qword [rsp + r10 - 0x3da0eeff], rbp
xor dword [rsp + rdx*8 - 0x2077ec90], ecx
pop rbp
shr r10, 0x44
ja 0x18035fa9c
jb 0x18037b3f7
sub bl, 0x14
neg qword [rsp + rbx - 0xeb]
add cx, dx
adc rsi, r11
mov qword [rsp + rax - 0x61cfeb9f], rsi
ret 0x10
inc ecx
mov eax, r8d
push rbx
not ecx
movsx r10d, dl
add edx, 0xfd070b39
bswap ecx
rol dl, 0x83
sub qword [rsp + r8*4 + 0x49d6b7e4], 0x273abaa2
lea r10, [r10 - 0x1afb874f]
not ecx
sar bx, 0x88
not qword [rsp + r8*4 + 0x49d6b7e4]
mov qword [rsp + r8 + 0x1275adf9], rbp
xor dword [rsp + r8*2 + 0x24eb5bf2], ecx
shr ebx, 0x7c
pop rbp
bswap edx
jae 0x18033c5c7
movsxd rcx, ecx
add rsi, rcx
mov r10, qword [r9 + rbx*2 - 0x16]
neg r11
ror eax, 0x8d
movzx r11w, byte ss:[rbx + r10 - 0xb]
movzx r10d, ax
lea r9, [r9 + rbx - 5]
sbb rax, 0x1627c93f
sar r10w, 0xa8
mov word [r9 + rbx - 0xb], r11w
call fcn.1803787a6
movsxd rcx, ecx
adc dl, bh
add rsi, rcx
mov edx, dword [rdi + rdx - 0x40efd8d]
movzx ecx, r8w
xor edx, ebp
sal cx, 0x21
push rcx
rol edx, 3
xor edx, r8d
jmp 0x18031ad4e