joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ad320
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, r8d
mov r9, rdx
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x1400ad403
shr r8d, 3
xor eax, eax
test r8d, r8d
je 0x1400ad511
cmp r8d, 8
jb 0x1400ad3de
lea ecx, [r8 - 1]
lea r11, [r10 + rcx*8]
lea rcx, [rdx + rcx*8]
cmp r10, rcx
ja 0x1400ad366
cmp r11, rdx
jae 0x1400ad3de
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
movdqu xmm0, xmmword [r10 + rax*8]
lea ecx, [rbx - 2]
movdqu xmm1, xmmword [rdx + rax*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rax*8], xmm1
add eax, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
mov ecx, ebx
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
lea ecx, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
cmp eax, r11d
jb 0x1400ad372
cmp eax, r8d
jae 0x1400ad511
sub r9, r10
lea rdx, [r10 + rax*8]
sub r8d, eax
mov ecx, r8d
nop dword [rax + rax]
mov rax, qword [r9 + rdx]
xor qword [rdx], rax
lea rdx, [rdx + 8]
sub rcx, 1
jne 0x1400ad3f0
pop rbx
ret
xor eax, eax
test r8d, r8d
je 0x1400ad511
cmp r8d, 8
jb 0x1400ad4f1
lea ecx, [r8 - 1]
lea r11, [rcx + r10]
add rcx, rdx
cmp r10, rcx
ja 0x1400ad431
cmp r11, r9
jae 0x1400ad4f1
cmp r8d, 0x40
jb 0x1400ad4c1
mov qword [rsp + 0x10], rdi
mov ebx, r8d
and ebx, 0x3f
mov edi, r8d
sub edi, ebx
mov r11d, 0x20
movdqu xmm0, xmmword [rax + r10]
lea ecx, [r11 - 0x10]
movdqu xmm1, xmmword [rax + rdx]
xorps xmm1, xmm0
movdqu xmmword [rax + r10], xmm1
add eax, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
mov ecx, r11d
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
lea ecx, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
cmp eax, edi
jb 0x1400ad451
mov rdi, qword [rsp + 0x10]
cmp ebx, 8
jb 0x1400ad4ec
mov edx, r8d
and edx, 0xfffffff8
nop word [rax + rax]
movq xmm0, qword [rax + r10]
movq xmm1, qword [rax + r9]
xorps xmm1, xmm0
movq qword [rax + r10], xmm1
add eax, 8
cmp eax, edx
jb 0x1400ad4d0
cmp eax, r8d
jae 0x1400ad511
mov edx, eax
sub r9, r10
add rdx, r10
sub r8d, eax
mov ecx, r8d
nop
movzx eax, byte [rdx + r9]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x1400ad500
pop rbx
ret
Function at 0x1400afec0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400aff9d
test rdx, rdx
je 0x1400aff9d
call fcn.1400afda0
test eax, eax
jne 0x1400affa2
movups xmm0, xmmword [rbx]
movabs rax, 0x6a09e667f3bcc908
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x30], xmm1
mov qword [rbx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rbx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rbx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbx + 0x38], rax
xor eax, eax
mov dword [rbx + 0xc0], eax
mov qword [rbx + 0xc8], rax
mov qword [rbx + 0xd0], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b3270
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x438
mov rax, qword [0x140126240]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov r11d, r9d
mov r10, rdx
neg r11d
mov rdx, rcx
cmp r8d, 0x101
jle 0x1400b32bb
mov eax, 0xfffffffd
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1400ccc80
add rsp, 0x438
ret
mov qword [rsp + 0x450], rbx
mov ebx, dword [rcx]
mov eax, ebx
xor eax, dword [r10]
and eax, r11d
mov qword [rsp + 0x428], rdi
mov edi, dword [rcx + 8]
mov ecx, edi
xor ecx, dword [r10 + 8]
and ecx, r11d
movsxd r8, r8d
mov dword [rsp], eax
mov dword [rsp + 8], ecx
test r8, r8
jle 0x1400b33b2
mov qword [rsp + 0x430], rsi
lea rcx, [rdx + 0xc]
mov qword [rsp + 0x420], r14
mov rsi, r10
sub rsi, rdx
lea r14, [rsp]
sub r14, rdx
mov r9, r8
nop dword [rax + rax]
mov eax, dword [rsi + rcx]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
and eax, r11d
mov dword [r14 + rcx - 4], eax
sub r9, 1
jne 0x1400b3320
xor edi, dword [rsp + 8]
lea r9, [rsp]
mov r11d, dword [rsp]
lea rcx, [rdx + 0xc]
mov r14, qword [rsp + 0x420]
xor ebx, r11d
mov rsi, qword [rsp + 0x430]
sub r9, rdx
mov dword [rdx], ebx
mov dword [rdx + 8], edi
mov rdx, r8
nop word [rax + rax]
mov eax, dword [rcx + r9]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x1400b3370
xor dword [r10], r11d
lea r9, [rsp]
sub r9, r10
mov dword [r10 + 8], edx
lea rcx, [r10 + 0xc]
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r9 + rcx]
xor dword [rcx], edx
lea rcx, [rcx + 4]
sub r8, 1
jne 0x1400b33a0
jmp 0x1400b33c6
xor ebx, eax
xor edi, ecx
mov dword [rdx], ebx
mov dword [rdx + 8], edi
xor dword [r10], eax
mov dword [r10 + 8], 0
mov rbx, qword [rsp + 0x450]
xor eax, eax
mov rdi, qword [rsp + 0x428]
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1400ccc80
add rsp, 0x438
ret
Function at 0x1400bab40
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400bac86
test rdx, rdx
je 0x1400bac86
call fcn.1400ba640
test eax, eax
jne 0x1400bac8b
mov ecx, dword [rbx]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx], ecx
mov ecx, dword [rbx + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 8], ecx
mov ecx, dword [rbx + 0xc]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0xc], ecx
mov ecx, dword [rbx + 0x10]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x10], ecx
mov ecx, dword [rbx + 0x14]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x14], ecx
mov ecx, dword [rbx + 0x18]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x18], ecx
mov ecx, dword [rbx + 0x1c]
mov eax, ecx
ror eax, 8
rol ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400bad60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, r9d
mov r11, rdx
or al, cl
mov r10, rcx
or al, dl
or al, r8b
test al, 7
jne 0x1400bae6c
shr r9d, 3
xor eax, eax
test r9d, r9d
je 0x1400bafa5
cmp r9d, 8
jb 0x1400bae3f
lea ecx, [r9 - 1]
mov edx, ecx
lea rbx, [r10 + rcx*8]
lea rcx, [r8 + rcx*8]
cmp r10, rcx
ja 0x1400badb3
cmp rbx, r8
jae 0x1400bae3f
lea rcx, [r11 + rdx*8]
cmp r10, rcx
ja 0x1400badc1
cmp rbx, r11
jae 0x1400bae3f
mov ebx, r9d
and ebx, 0xfffffff8
mov edi, 4
nop dword [rax]
movdqu xmm0, xmmword [r8 + rax*8]
lea ecx, [rdi - 2]
movdqu xmm1, xmmword [r11 + rax*8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r11 + rcx*8]
movdqu xmmword [r10 + rax*8], xmm1
add eax, 8
movdqu xmm1, xmmword [r8 + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
mov ecx, edi
movdqu xmm0, xmmword [r11 + rcx*8]
movdqu xmm1, xmmword [r8 + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
lea ecx, [rdi + 2]
add edi, 8
movdqu xmm1, xmmword [r8 + rcx*8]
movdqu xmm0, xmmword [r11 + rcx*8]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
cmp eax, ebx
jb 0x1400badd0
cmp eax, r9d
jae 0x1400bafa5
sub r11, r8
lea rdx, [r8 + rax*8]
sub r10, r8
sub r9d, eax
mov ecx, r9d
nop
mov rax, qword [r11 + rdx]
xor rax, qword [rdx]
mov qword [r10 + rdx], rax
lea rdx, [rdx + 8]
sub rcx, 1
jne 0x1400bae50
mov rbx, qword [rsp + 0x18]
pop rdi
ret
xor eax, eax
test r9d, r9d
je 0x1400bafa5
cmp r9d, 8
jb 0x1400baf71
lea ecx, [r9 - 1]
mov edx, ecx
lea rbx, [rcx + r10]
add rcx, r11
cmp r10, rcx
ja 0x1400bae9c
cmp rbx, r11
jae 0x1400baf71
lea rcx, [rdx + r8]
cmp r10, rcx
ja 0x1400baeae
cmp rbx, r8
jae 0x1400baf71
cmp r9d, 0x40
jb 0x1400baf40
mov qword [rsp + 0x10], rsi
mov edi, r9d
and edi, 0x3f
mov esi, r9d
sub esi, edi
mov ebx, 0x20
nop dword [rax]
movdqu xmm0, xmmword [rax + r8]
lea ecx, [rbx - 0x10]
movdqu xmm1, xmmword [rax + r11]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + r8]
movdqu xmmword [rax + r10], xmm1
add eax, 0x40
movdqu xmm1, xmmword [rcx + r11]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
mov ecx, ebx
movdqu xmm0, xmmword [rcx + r8]
movdqu xmm1, xmmword [rcx + r11]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
lea ecx, [rbx + 0x10]
add ebx, 0x40
movdqu xmm1, xmmword [rcx + r11]
movdqu xmm0, xmmword [rcx + r8]
xorps xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
cmp eax, esi
jb 0x1400baed0
mov rsi, qword [rsp + 0x10]
cmp edi, 8
jb 0x1400baf6c
mov edx, r9d
and edx, 0xfffffff8
nop word [rax + rax]
movq xmm1, qword [rax + r11]
movq xmm0, qword [rax + r8]
xorps xmm1, xmm0
movq qword [rax + r10], xmm1
add eax, 8
cmp eax, edx
jb 0x1400baf50
cmp eax, r9d
jae 0x1400bafa5
mov edx, eax
sub r8, r11
add rdx, r11
sub r10, r11
sub r9d, eax
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [r10 + rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x1400baf90
mov rbx, qword [rsp + 0x18]
pop rdi
ret
Function at 0x1400c0f00
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0x100
mov rax, qword [0x140126240]
xor rax, rsp
mov qword [rbp - 9], rax
mov r15, qword [rbp + 0x67]
mov rdi, rdx
mov r12, qword [rbp + 0x77]
mov esi, 0x37
mov byte [rsp + 0x28], r9b
test rcx, rcx
jne 0x1400c0f44
lea eax, [rsi - 0x36]
jmp 0x1400c1115
mov ecx, 0x1b8
mov qword [rsp + 0x130], rbx
mov eax, ecx
mov qword [rsp + 0xf8], r13
rol ecx, 8
mov r13d, 2
ror eax, 8
xor ecx, eax
mov qword [rsp + 0xf0], r14
and ecx, 0xff00ff
mov byte [rsp + 0x20], 1
xor ecx, eax
mov dword [rsp + 0x30], ecx
xor r14d, r14d
nop word [rax + rax]
mov r8d, 1
mov dword [rsp + 0x40], 0x6a09e667
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x44], 0xbb67ae85
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
mov qword [rbp - 0x49], r14
mov dword [rbp - 0x41], r14d
mov qword [rbp - 0x39], r14
call fcn.1400ba1a0
mov ebx, eax
test eax, eax
jne 0x1400c10cb
inc byte [rsp + 0x20]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400ba1a0
mov ebx, eax
test eax, eax
jne 0x1400c10cb
cmp byte [rsp + 0x28], 4
je 0x1400c1040
lea r8d, [rax + 1]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1400ba1a0
mov ebx, eax
test eax, eax
jne 0x1400c10cb
test r15, r15
jne 0x1400c1052
cmp dword [rbp + 0x6f], r14d
jbe 0x1400c1069
mov ebx, 0xffffff53
jmp 0x1400c10cb
mov r8d, dword [rbp + 0x6f]
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.1400ba1a0
mov ebx, eax
test eax, eax
jne 0x1400c10cb
test r12, r12
je 0x1400c108b
mov eax, dword [rbp + 0x7f]
test eax, eax
je 0x1400c108b
mov r8d, eax
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.1400ba1a0
mov ebx, eax
test eax, eax
jne 0x1400c10cb
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x40]
call fcn.1400bab40
mov ebx, eax
test eax, eax
jne 0x1400c10cb
cmp esi, 0x20
jbe 0x1400c10bc
movups xmm0, xmmword [rbp - 0x29]
add esi, 0xffffffe0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
add rdi, 0x20
jmp 0x1400c10cb
mov r8d, esi
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.1400f7100
sub r13, 1
jne 0x1400c0f90
mov r13, qword [rsp + 0xf8]
lea rdx, [rbp - 0x29]
mov ecx, 0x20
nop word [rax + rax]
mov byte [rdx], r14b
lea rdx, [rdx + 1]
add ecx, 0xffffffff
jne 0x1400c10f0
test ebx, ebx
mov rbx, qword [rsp + 0x130]
setne r14b
mov eax, r14d
mov r14, qword [rsp + 0xf0]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1400ccc80
add rsp, 0x100
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c1260
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push r12
push r13
push r14
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rax, qword [0x140126240]
xor rax, rsp
mov qword [rbp + 8], rax
mov r12, rdx
mov r13, rcx
mov r14d, 1
test rcx, rcx
jne 0x1400c129b
mov eax, r14d
jmp 0x1400c14c6
movups xmm0, xmmword [r9]
mov qword [rsp + 0x130], rbx
test r8d, r8d
movups xmm1, xmmword [r9 + 0x10]
mov qword [rsp + 0x128], rsi
mov esi, r14d
cmovne esi, r8d
mov qword [rsp + 0x120], rdi
test sil, 0x1f
mov qword [rsp + 0x118], r15
mov r15d, 0
mov eax, esi
mov ecx, r15d
mov dword [rsp + 0x20], r15d
setne cl
shr eax, 5
add ecx, eax
mov eax, dword [r9 + 0x30]
mov dword [rbp], eax
lea ebx, [r15 + 0x37]
movzx eax, word [r9 + 0x34]
movups xmmword [rbp - 0x30], xmm0
mov word [rbp + 4], ax
movups xmm0, xmmword [r9 + 0x20]
movzx eax, byte [r9 + 0x36]
mov byte [rbp + 6], al
mov dword [rsp + 0x24], ecx
movups xmmword [rbp - 0x20], xmm1
movups xmmword [rbp - 0x10], xmm0
je 0x1400c1483
mov r8d, ebx
mov dword [rsp + 0x50], 0x6a09e667
lea rdx, [rbp - 0x30]
mov dword [rsp + 0x54], 0xbb67ae85
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x58], 0x3c6ef372
mov dword [rsp + 0x5c], 0xa54ff53a
mov dword [rsp + 0x60], 0x510e527f
mov dword [rsp + 0x64], 0x9b05688c
mov dword [rsp + 0x68], 0x1f83d9ab
mov dword [rsp + 0x6c], 0x5be0cd19
mov qword [rbp - 0x50], r15
mov dword [rbp - 0x48], r15d
mov qword [rbp - 0x40], r15
call fcn.1400ba1a0
mov r14d, eax
test eax, eax
jne 0x1400c1483
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1400bab40
mov r14d, eax
test eax, eax
jne 0x1400c1483
cmp dword [r13], 1
mov eax, dword [rsp + 0x28]
jbe 0x1400c13df
cmp eax, dword [r13 + 4]
jne 0x1400c13df
cmp byte [r13 + 0x80], 1
je 0x1400c14e1
mov r8d, dword [rsp + 0x24]
mov dl, 1
lea eax, [r8 - 1]
cmp dword [rsp + 0x20], eax
lea ecx, [r8 + 1]
cmovne ecx, r8d
mov dword [rsp + 0x24], ecx
jmp 0x1400c13e5
mov dword [r13 + 4], eax
xor dl, dl
mov byte [r13 + 0x80], dl
test r12, r12
je 0x1400c146f
test esi, esi
je 0x1400c146f
cmp esi, 0x20
jb 0x1400c145c
movups xmm0, xmmword [rsp + 0x28]
add esi, 0xffffffe0
lea rcx, [rbp + 4]
movups xmm1, xmmword [rsp + 0x38]
mov edx, 0x36
lea rax, [rbp + 4]
movups xmmword [r12], xmm0
movups xmmword [r12 + 0x10], xmm1
add r12, 0x20
sub rdx, rcx
nop word [rax + rax]
add byte [rax + 2], 1
jne 0x1400c146f
add byte [rax + 1], 1
jne 0x1400c146f
add byte [rax], 1
jne 0x1400c146f
add byte [rax - 1], 1
jne 0x1400c146f
add byte [rax - 2], 1
jne 0x1400c146f
sub rax, 5
lea rcx, [rdx + rax]
test rcx, rcx
jns 0x1400c1430
jmp 0x1400c146f
mov r8d, esi
lea rdx, [rsp + 0x28]
mov rcx, r12
call fcn.1400f7100
mov esi, r15d
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp eax, dword [rsp + 0x24]
jl 0x1400c1321
lea rcx, [rbp - 0x30]
nop word [rax + rax]
mov byte [rcx], r15b
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x1400c1490
test r14d, r14d
setne r15b
mov eax, r15d
mov rdi, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x130]
mov r15, qword [rsp + 0x118]
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1400ccc80
add rsp, 0x138
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 3
jmp 0x1400c14a6
Function at 0x1400c1bd0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x140126240]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
test rcx, rcx
jne 0x1400c1bfa
mov eax, 0xffffff53
jmp 0x1400c1df4
mov qword [rsp + 0xb8], rbp
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov byte [rcx + 0x18], bpl
mov qword [rcx + 8], r9
xor ecx, ecx
mov qword [rsp + 0xc8], rdi
call fcn.1400c2370
test eax, eax
jne 0x1400c1dd9
mov rax, qword [0x1401d8dc8]
mov ecx, 0x88
mov qword [rsp + 0xc0], rsi
test rax, rax
je 0x1400c1c44
call rax
jmp 0x1400c1c49
call fcn.1400d5cf0
mov qword [rbx + 0x10], rax
mov esi, 0x34
test rax, rax
jne 0x1400c1c63
lea edi, [rax - 0x7d]
mov byte [rbx + 0x18], 2
jmp 0x1400c1d9e
mov edi, 1
mov dword [rsp + 0x20], 0xf0000000
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400c1d78
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400c1d78
mov rcx, qword [rbx]
xor edx, edx
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], r15
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r12d, 4
mov edi, ebp
mov r14d, ebp
mov r8d, r12d
mov r15, rbp
lea r13d, [r12 - 1]
nop dword [rax]
nop word [rax + rax]
mov eax, r8d
lea rdx, [rsp + 0x40]
add rax, r15
lea rcx, [rsp + 0x40]
add rdx, rax
add rcx, r15
call fcn.14006f710
test eax, eax
mov r8d, esi
cmove edi, r13d
add r14d, r12d
sub r8d, r14d
add r15, r12
cmp r8d, r12d
cmova r8d, r12d
cmp r14d, 0x30
jb 0x1400c1cf0
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
test edi, edi
jne 0x1400c1d7c
mov rax, qword [rbx + 8]
lea r8d, [rdi + 0x30]
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x44]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], ebp
call fcn.1400c1b10
mov edi, eax
test eax, eax
je 0x1400c1d9e
jmp 0x1400c1d7c
mov byte [rbx + 0x18], 2
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400c1d9a
mov rax, qword [0x1401d8db8]
test rax, rax
je 0x1400c1d95
call rax
jmp 0x1400c1d9a
call fcn.1400d5044
mov qword [rbx + 0x10], rbp
lea rax, [rsp + 0x40]
mov byte [rax], bpl
lea rax, [rax + 1]
add esi, 0xffffffff
jne 0x1400c1da3
mov rsi, qword [rsp + 0xc0]
test edi, edi
jne 0x1400c1dc1
mov byte [rbx + 0x18], 1
jmp 0x1400c1de2
cmp edi, 3
je 0x1400c1dd9
cmp edi, 1
mov byte [rbx + 0x18], 2
mov eax, 0xffffff39
cmove edi, eax
mov ebp, edi
jmp 0x1400c1de2
mov byte [rbx + 0x18], 3
mov ebp, 0xffffff2f
mov rdi, qword [rsp + 0xc8]
mov eax, ebp
mov rbp, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400ccc80
add rsp, 0xa0
pop rbx
ret
Function at 0x1400c9ce0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
push r13
mov rbp, r8
mov rbx, rdx
mov r11, rcx
mov rsi, rdx
movabs r12, 0x82434fe90edcef39
movabs r13, 0xec99bf0d8372caab
cmp rdx, 0x20
jbe 0x1400c9ddd
mov qword [rsp + 0x28], rdi
mov rdi, r8
mov qword [rsp + 0x30], r14
mov r14, rdx
ror r14, 0x11
ror rdi, 0x11
add r14, r8
mov qword [rsp + 0x38], r15
xor rdi, rdx
lea r15, [rdx - 0x1f]
add r15, rcx
nop
mov r10, qword [r11 + 0x10]
mov rax, qword [r11]
mov r8, qword [r11 + 0x18]
mov r9, qword [r11 + 8]
add r11, 0x20
lea rdx, [r10 + rdi]
ror rdx, 0x11
xor rdx, rax
lea rcx, [r8 + r14]
ror rax, 0x29
xor rax, rbp
ror rcx, 0x11
add r14, rax
xor rcx, r9
ror r9, 0x1f
lea rax, [rdx + r8]
imul rax, r12
xor r9, rsi
xor rbp, rax
sub rdi, r9
lea rax, [rcx + r10]
imul rax, r13
xor rsi, rax
cmp r11, r15
jb 0x1400c9d40
mov r15, qword [rsp + 0x38]
mov rax, r14
ror rax, 0x11
movabs rcx, 0xcb5af53ae3aaac31
add rax, rdi
ror rdi, 0x11
add rdi, r14
mov r14, qword [rsp + 0x30]
imul rax, rcx
xor rbp, rax
movabs rax, 0xc060724a8424f345
imul rdi, rax
xor rsi, rdi
mov rdi, qword [rsp + 0x28]
and ebx, 0x1f
movabs r8, 0x9c06faf4d023e3ab
cmp rbx, 0x18
ja case.default.0x1400c9e06
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0xc9ec8]
mov ecx, dword [rdx + rax*4 + 0xc9eb8]
add rcx, rdx
jmp rcx
mov rax, r8
mul qword [r11]
xor rdx, rax
add rsi, rdx
add r11, 8
movabs rax, 0xbd9cacc22c6e9571
mul qword [r11]
xor rdx, rax
add rbp, rdx
add r11, 8
movabs rax, 0xd4f06db99d67be4b
mul qword [r11]
xor rdx, rax
add rsi, rdx
add r11, 8
neg ebx
and ebx, 7
lea ecx, [rbx*8]
test r11, 0xff8
je 0x1400c9e68
mov eax, ebx
sub r11, rax
mov rdx, qword [r11]
shr rdx, cl
jmp 0x1400c9e75
mov rdx, 0xffffffffffffffff
shr rdx, cl
and rdx, qword [r11]
mov rax, r12
mul rdx
xor rdx, rax
add rbp, rdx
mov rbx, qword [rsp + 0x40]
lea rcx, [rsi + rbp]
ror rcx, 0x11
xor rsi, rbp
imul rsi, r13
mov rax, r8
mul rcx
mov rcx, rax
mov rax, rsi
ror rax, 0x29
xor rdx, rcx
xor rax, rsi
add rax, rdx
pop r13
pop r12
pop rsi
pop rbp
ret

Function at 0x1400cba60
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400cba9a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400cba9f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400cbae8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400fbad0]
cmp byte [rcx + rax], 0
je 0x1400cbae8
dec r8
sub rdx, 1
jne 0x1400cbace
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret