joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004de30
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
jne 0x18004de3b
mov eax, 0xffffff53
ret
xor eax, eax
mov qword [rcx + 0x70], rax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
ret

Function at 0x18004de80
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
jne 0x18004de8b
mov eax, 0xffffff53
ret
mov qword [rcx + 0x70], rdx
xor eax, eax
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret

Function at 0x18004ded0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x18004e02e
test rdx, rdx
je 0x18004e02e
call fcn.18004cea0
test eax, eax
jne 0x18004e033
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0x18], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18004e270
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
shr r8d, 3
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x18004e2f1
mov qword [rsp], rbx
sub r10, rcx
mov r11d, r8d
movabs rbx, 0xffff0000ffff
movabs r8, 0xff00ff00ff00ff
mov rcx, qword [r10 + r9]
lea r9, [r9 + 8]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r8
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, rbx
xor rcx, rdx
rol rcx, 0x20
mov qword [r9 - 8], rcx
sub r11, 1
jne 0x18004e2a1
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x18004e300
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x18004e30b
mov eax, 0xffffff53
ret
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret

Function at 0x180050ad0
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x180050adb
mov eax, 0xffffff53
ret
xor r8d, r8d
movabs rdx, 0x152fecd8f70e5939
mov qword [rcx + 0xd8], r8
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx + 0x18], rdx
movabs rdx, 0x67332667ffc00b31
mov qword [rcx + 0x20], rdx
movabs rdx, 0x8eb44a8768581511
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 0x28], rdx
movabs rdx, 0xdb0c2e0d64f98fa7
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x30], rdx
movabs rdx, 0x47b5481dbefa4fa4
mov qword [rcx + 0x10], rax
mov eax, r8d
mov qword [rcx + 0x38], rdx
mov dword [rcx + 0xc0], r8d
mov qword [rcx + 0xc8], r8
mov qword [rcx + 0xd0], r8
ret

Function at 0x180050b70
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x180050b7b
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret
Function at 0x180050c10
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x180050c1b
mov eax, 0xffffff53
ret
xor r8d, r8d
movabs rdx, 0xa54ff53a5f1d36f1
mov qword [rcx + 0xd8], r8
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 0x18], rdx
movabs rdx, 0x510e527fade682d1
mov qword [rcx + 0x20], rdx
movabs rdx, 0x9b05688c2b3e6c1f
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x28], rdx
movabs rdx, 0x1f83d9abfb41bd6b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x30], rdx
movabs rdx, 0x5be0cd19137e2179
mov qword [rcx + 0x10], rax
mov eax, r8d
mov qword [rcx + 0x38], rdx
mov dword [rcx + 0xc0], r8d
mov qword [rcx + 0xc8], r8
mov qword [rcx + 0xd0], r8
ret

Function at 0x180050f30
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x180050f3b
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret

Function at 0x180050fd0
Capabilities:
Hash data using sha384

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x18005101b
test rdx, rdx
je 0x18005101b
call fcn.18004e580
test eax, eax
jne 0x180051020
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18004e300
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180051370
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x18004e3ab
mov eax, 0xffffff53
ret
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1800513c3
test rdx, rdx
je 0x1800513c3
call fcn.18004e580
test eax, eax
jne 0x1800513c8
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x30], xmm1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x18004e3a0
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18005a870
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov r9d, eax
test r8d, r8d
jle 0x18005a949
cmp r8d, 8
jb 0x18005a949
mov qword [rsp + 0x10], rbx
lea r11, [rdx + 4]
mov qword [rsp], rdi
sub rcx, rdx
movsxd rbx, r8d
mov rdi, 0xfffffffffffffffc
and rbx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rdi, rdx
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r11 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r11 - 4]
lea r11, [r11 + 8]
punpcklbw xmm2, xmm0
lea rax, [rdi + r11]
punpcklwd xmm2, xmm0
add r9d, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r11 - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + r11 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rax, rbx
jl 0x18005a8c0
mov rdi, qword [rsp]
por xmm3, xmm4
mov rbx, qword [rsp + 0x10]
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
movsxd r11, r9d
movsxd r9, r8d
cmp r11, r9
jge 0x18005a978
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
nop
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x18005a960
add rsp, 8
ret

Function at 0x18005f380
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x78], 0
mov rbx, rcx
je 0x18005f395
call fcn.18005e690
mov ecx, 0x3e8
call fcn.18004b0c0
mov qword [rbx + 0x78], rax
test rax, rax
jne 0x18005f3b3
mov eax, 0xffffff83
add rsp, 0x20
pop rbx
ret
xor edx, edx
mov r8d, 0x3e8
mov rcx, rax
call fcn.1800a3140
mov rcx, qword [rbx + 0x78]
mov r8d, dword [rbx + 0x4e4]
add rcx, 0x1b0
mov rdx, qword [rbx + 0xa8]
call fcn.18004de80
test eax, eax
jne 0x18005f42a
mov rcx, qword [rbx + 0x78]
mov r8d, dword [rbx + 0x4e4]
add rcx, 0x228
mov rdx, qword [rbx + 0xa8]
call fcn.180050b70
test eax, eax
jne 0x18005f42a
mov rcx, qword [rbx + 0x78]
mov r8d, dword [rbx + 0x4e4]
add rcx, 0x308
mov rdx, qword [rbx + 0xa8]
add rsp, 0x20
pop rbx
jmp fcn.180050f30
add rsp, 0x20
pop rbx
ret
Function at 0x180067380
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
mov dword [rsp + 0x44], r9d
mov r12, rdx
mov ebp, r8d
xor edx, edx
mov r10d, r9d
mov r9, qword [rsp + 0x150]
mov r8d, edx
movzx eax, byte [rsi + 0x319]
mov r15d, edx
movzx r14d, byte [rsi + 0x31d]
mov ecx, edx
mov qword [rsp + 0x48], r9
cmp al, 1
jne 0x180067584
movzx r9d, word [rsi + 0x43c]
bt r9w, 0xe
jae 0x1800673fd
movzx r8d, word [rsi + 0x314]
mov eax, r8d
mov rcx, rbp
sub rcx, rax
mov dword [rsp + 0x40], 1
bt r9w, 0xd
mov rdi, rbp
movzx eax, byte [rcx + r12 - 1]
mov r15d, eax
mov r13d, eax
jae 0x180067509
sub ebp, r8d
lea r8, [r12 - 1]
movsxd rax, ebp
add r8, rax
mov eax, 0xff
lea ecx, [rbp - 1]
movzx r10d, byte [r8]
mov edi, r10d
sub edi, ebp
add edi, r14d
shr edi, 0x1f
dec dil
cmp ecx, eax
cmovg ecx, eax
movsxd r9, ecx
test ecx, ecx
jle 0x180067483
nop dword [rax]
mov ecx, r10d
lea r8, [r8 - 1]
sub ecx, edx
movzx eax, r10b
xor al, byte [r8 + 1]
inc edx
shr ecx, 0x1f
dec cl
and cl, al
or dil, cl
sub r9, 1
jne 0x180067460
mov eax, dword [rsp + 0x44]
lea rdx, [rsp + 0x90]
mov dword [rsp + 0x38], 1
mov r9d, ebp
sub r9d, r14d
mov dword [rsp + 0x30], 1
sub r9d, r15d
mov dword [rsp + 0x28], eax
dec r9d
mov dword [rsp + 0x20], r15d
mov r8, r12
mov rcx, rsi
call qword [rsi + 0xf0]
movzx r8d, byte [rsi + 0x31d]
lea r9, [rsp + 0x90]
mov edx, ebp
mov rcx, r12
mov ebx, eax
call fcn.180060000
or al, dil
not al
movzx ecx, al
shr cl, 4
and al, cl
movzx ecx, al
mov edx, ecx
shr edx, 2
and edx, ecx
mov eax, edx
shr eax, 1
and eax, edx
dec eax
add eax, ebx
je 0x18006757e
mov eax, 0xfffffecf
jmp 0x180067609
sub ebp, r14d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov r8, r12
mov dword [rsp + 0x28], r10d
lea ecx, [rbp - 1]
cmp r15d, ecx
mov dword [rsp + 0x44], ecx
cmova r15d, edx
cmp r13d, ecx
mov rcx, rsi
cmovbe edx, eax
sub ebp, edx
mov ebx, edx
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], ebx
lea r9d, [rbp - 1]
call qword [rsi + 0xf0]
sub rdi, rbx
lea rdx, [r12 - 1]
sub rdi, r14
lea rcx, [rsp + 0x50]
add rdx, rdi
mov r8d, r14d
mov ebp, eax
call fcn.18005a870
test eax, eax
jne 0x1800675dc
test ebp, ebp
jne 0x1800675dc
cmp r13d, dword [rsp + 0x44]
ja 0x1800675dc
mov ecx, dword [rsp + 0x40]
jmp 0x1800675e6
test al, al
jne 0x1800675eb
mov dword [rsp + 0x38], 1
lea rdx, [rsp + 0x50]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
sub r9d, r14d
mov r8, r12
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rsi
call qword [rsi + 0xf0]
mov rdx, rbp
lea rcx, [rsp + 0x50]
sub rdx, r14
mov r8d, r14d
add rdx, r12
mov ebx, eax
call fcn.18005a870
test eax, eax
jne 0x1800675dc
test ebx, ebx
je 0x1800675e3
mov eax, 0xfffffecf
jmp 0x180067609
mov ecx, r15d
mov r9, qword [rsp + 0x48]
cmp byte [rsi + 0x319], 2
jne 0x1800675fd
movzx eax, word [rsi + 0x316]
jmp 0x180067604
lea eax, [r14 + rcx]
add eax, r15d
mov dword [r9], eax
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1800a1bf0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800728e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, qword [rsp + 0xe0]
xorps xmm0, xmm0
mov r15, qword [rsp + 0xe8]
mov rbp, r8
mov r12, rdx
movzx r14d, r9w
mov rdi, rcx
mov rdx, rsi
mov rcx, qword [rcx + 0x138]
xor r8d, r8d
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call fcn.18008ab60
test eax, eax
jne 0x180072ac3
mov rcx, qword [rdi + 0x138]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x80], rbx
lea rdx, [rsp + 0x50]
mov ebx, 0x20
mov r9d, ebx
call fcn.18008ab20
test eax, eax
jne 0x180072abb
mov rcx, qword [rdi + 0x138]
lea r8d, [rbx - 0x1f]
mov rdx, rsi
call fcn.18008ab60
test eax, eax
jne 0x180072abb
mov rcx, qword [rdi + 0x4e8]
lea rdx, [rsp + 0x50]
mov r8d, ebx
call fcn.18008ffe0
lea rcx, [rsp + 0x50]
nop word [rax + rax]
mov byte [rcx], 0
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x1800729b0
test eax, eax
jne 0x180072abb
movzx r8d, word [rsp + 0xf0]
lea rax, [rsp + 0x40]
mov rcx, qword [rdi + 0x4e8]
mov ebx, r14d
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov r9, rbp
mov qword [rsp + 0x28], rax
mov rdx, r15
mov dword [rsp + 0x20], ebx
call fcn.180090310
test eax, eax
jne 0x180072abb
mov rcx, qword [rsp + 0xf8]
lea rax, [rsp + 0x40]
xor edx, edx
xorps xmm4, xmm4
sub rcx, rax
xorps xmm3, xmm3
nop dword [rax + rax]
xorps xmm0, xmm0
lea rax, [rsp + 0x40]
add rax, rdx
add rdx, 8
movd xmm2, dword [rcx + rax]
movd xmm1, dword [rax]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [rax + 4]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + rax + 4]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rdx, 0x10
jl 0x180072a20
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x180072aa6
mov eax, 0xfffffecf
jmp 0x180072abb
mov rcx, qword [rdi + 0x138]
mov r9d, ebx
mov r8, rbp
mov rdx, r12
call fcn.18008ab20
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800a1bf0
add rsp, 0x88
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180078f20
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, r8d
mov dword [rsp + 0x20], 0xf0000000
mov rsi, rdx
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180078f6a
mov eax, 0xffffff99
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x180078f91
mov eax, 0xffffff98
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800794e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
xor ebx, ebx
lea edi, [rdx - 4]
xor r11d, r11d
mov esi, edx
mov rbp, rcx
test edi, edi
je 0x18007956b
mov qword [rsp + 0x10], r14
mov r14d, 4
cmp edi, r14d
mov r9d, r14d
cmovbe r9d, edi
xor r8d, r8d
test r9d, r9d
jle 0x18007954c
mov eax, r11d
add rax, rbp
mov r10d, r9d
nop word [rax + rax]
movzx edx, byte [r10 + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r8d, edx
sub r9, 1
jne 0x180079530
test r8d, r8d
jne 0x180079551
mov ebx, 3
add r11d, r14d
mov r9d, esi
sub r9d, r11d
cmp r9d, r14d
cmova r9d, r14d
cmp r11d, edi
jb 0x180079516
mov r14, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x28]
pop rdi
ret
Function at 0x18008f660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov eax, r8d
xor r9d, r9d
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x18008f757
shr r8d, 3
test r8d, r8d
je 0x18008f820
cmp r8d, 8
jb 0x18008f72c
lea eax, [r8 - 1]
lea r11, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp rcx, rax
ja 0x18008f6ab
cmp r11, rdx
jae 0x18008f72c
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + r9*8]
lea eax, [rbx - 2]
movdqu xmm1, xmmword [rdx + r9*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r9*8], xmm1
add r9d, 8
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
lea eax, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r9d, r11d
jb 0x18008f6c0
cmp r9d, r8d
jae 0x18008f820
sub rdx, r10
lea rcx, [rcx + r9*8]
sub r8d, r9d
mov r9d, r8d
nop dword [rax]
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r9, 1
jne 0x18008f740
mov rbx, qword [rsp + 8]
ret
test r8d, r8d
je 0x18008f820
cmp r8d, 0x40
jb 0x18008f7fc
lea eax, [r8 - 1]
lea r11, [rax + rcx]
add rax, rdx
cmp r10, rax
ja 0x18008f783
cmp r11, rdx
jae 0x18008f7fc
mov ebx, r8d
and ebx, 0xffffffc0
mov r11d, 0x20
nop
movdqu xmm0, xmmword [r9 + rcx]
lea eax, [r11 - 0x10]
movdqu xmm1, xmmword [r9 + rdx]
pxor xmm1, xmm0
movdqu xmmword [r9 + rcx], xmm1
add r9d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, r11d
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r9d, ebx
jb 0x18008f790
cmp r9d, r8d
jae 0x18008f820
mov eax, r9d
sub rdx, r10
add rax, r10
sub r8d, r9d
mov r9d, r8d
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x18008f810
mov rbx, qword [rsp + 8]
ret
Function at 0x18008f830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, r9d
xor r11d, r11d
or al, cl
mov r10, rdx
or al, dl
or al, r8b
test al, 7
jne 0x18008f950
shr r9d, 3
test r9d, r9d
je 0x18008fa34
cmp r9d, 8
jb 0x18008f912
lea eax, [r9 - 1]
mov edx, eax
lea rbx, [rcx + rax*8]
lea rax, [r8 + rax*8]
cmp rcx, rax
ja 0x18008f885
cmp rbx, r8
jae 0x18008f912
lea rax, [r10 + rdx*8]
cmp rcx, rax
ja 0x18008f893
cmp rbx, r10
jae 0x18008f912
mov ebx, r9d
and ebx, 0xfffffff8
mov edi, 4
nop
movdqu xmm0, xmmword [r8 + r11*8]
lea eax, [rdi - 2]
movdqu xmm1, xmmword [r10 + r11*8]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r8 + rax*8]
movdqu xmmword [rcx + r11*8], xmm1
add r11d, 8
movdqu xmm1, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
mov eax, edi
movdqu xmm0, xmmword [r8 + rax*8]
movdqu xmm1, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
lea eax, [rdi + 2]
add edi, 8
movdqu xmm1, xmmword [r10 + rax*8]
movdqu xmm0, xmmword [r8 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r11d, ebx
jb 0x18008f8a0
cmp r11d, r9d
jae 0x18008fa34
sub r10, r8
lea rdx, [r8 + r11*8]
sub rcx, r8
sub r9d, r11d
mov r8d, r9d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + rdx]
xor rax, qword [rdx]
mov qword [rcx + rdx], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x18008f930
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
test r9d, r9d
je 0x18008fa34
cmp r9d, 0x40
jb 0x18008fa0e
lea eax, [r9 - 1]
mov edx, eax
lea rbx, [rax + rcx]
add rax, r10
cmp rcx, rax
ja 0x18008f97e
cmp rbx, r10
jae 0x18008fa0e
lea rax, [rdx + r8]
cmp rcx, rax
ja 0x18008f990
cmp rbx, r8
jae 0x18008fa0e
mov edi, r9d
and edi, 0xffffffc0
mov ebx, 0x20
nop dword [rax + rax]
movdqu xmm0, xmmword [r11 + r8]
lea eax, [rbx - 0x10]
movdqu xmm1, xmmword [r11 + r10]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax + r8]
movdqu xmmword [r11 + rcx], xmm1
add r11d, 0x40
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rax + r8]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rbx + 0x10]
add ebx, 0x40
movdqu xmm1, xmmword [rax + r10]
movdqu xmm0, xmmword [rax + r8]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r11d, edi
jb 0x18008f9a0
cmp r11d, r9d
jae 0x18008fa34
sub r8, r10
mov edx, r11d
add rdx, r10
sub rcx, r10
sub r9d, r11d
mov r10d, r9d
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
sub r10, 1
jne 0x18008fa20
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret