joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b6a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
xor ebx, ebx
mov esi, edx
xor r11d, r11d
mov edi, edx
mov rbp, rcx
add rsi, 0xfffffffffffffff8
je 0x14000b73d
mov qword [rsp + 0x10], r14
lea eax, [rdi - 8]
mov r14d, 8
mov edx, r14d
cmp rsi, rdx
cmovbe edx, eax
nop dword [rax]
xor r8d, r8d
test edx, edx
jle 0x14000b71c
mov eax, r11d
add rax, rbp
mov r10d, edx
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + r10]
movzx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r8d, edx
sub r9, 1
jne 0x14000b700
test r8d, r8d
jne 0x14000b721
mov ebx, 3
add r11d, r14d
mov edx, edi
sub edx, r11d
mov ecx, r11d
cmp edx, r14d
cmova edx, r14d
cmp rcx, rsi
jb 0x14000b6e0
mov r14, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x28]
pop rdi
ret

Function at 0x14000bd10
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
test byte [0x140397864], 8
mov rsi, rdx
mov edx, 1
mov edi, r8d
mov rbx, rcx
je 0x14000bd69
xor ebp, ebp
mov r10d, r8d
mov r9, rsi
test r8d, 0xfffffff8
jbe 0x14000bda5
nop dword [rax]
mov ecx, ebp
rdseed rax
mov qword [r9], rax
mov eax, ebp
cmovb eax, edx
test eax, eax
jne 0x14000bd94
inc ecx
cmp ecx, 0x20
jl 0x14000bd52
mov r9d, edx
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x14000be32
mov eax, 0xffffff99
jmp 0x14000be58
add r10d, 0xfffffff8
add r9, 8
test r10d, 0xfffffff8
ja 0x14000bd50
test r10d, r10d
je 0x14000be56
mov ecx, ebp
rdseed rax
mov qword [rsp + 0x58], rax
mov eax, ebp
cmovb eax, edx
test eax, eax
jne 0x14000bdcb
inc ecx
cmp ecx, 0x20
jl 0x14000bdb0
jmp 0x14000bd69
mov r8d, r10d
lea rdx, [rsp + 0x58]
mov rcx, r9
call fcn.1400b14c0
lea rdx, [rsp + 0x58]
mov ecx, 8
neg edx
lea rax, [rsp + 0x58]
and edx, 7
sub ecx, edx
test edx, edx
je 0x14000be00
mov byte [rax], bpl
inc rax
add edx, 0xffffffff
jne 0x14000bdf5
cmp ecx, 8
jb 0x14000be20
mov edx, ecx
shr rdx, 3
nop dword [rax + rax]
mov qword [rax], rbp
add ecx, 0xfffffff8
add rax, 8
sub rdx, 1
jne 0x14000be10
test ecx, ecx
je 0x14000be56
mov byte [rax], bpl
lea rax, [rax + 1]
add ecx, 0xffffffff
jne 0x14000be24
jmp 0x14000be56
mov rcx, qword [rbx]
mov r8, rsi
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x14000be4b
mov eax, 0xffffff98
jmp 0x14000be58
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000c080
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rdx
mov rsi, r9
mov edx, dword [rbp + 0xf0]
mov rbx, rcx
sub edx, 4
je 0x14000c176
cmp edx, 1
je 0x14000c0cf
mov eax, 0xffffff18
jmp 0x14000c220
mov rax, qword [rcx + 0xa8]
xor r8d, r8d
movdqa xmm0, xmmword [0x1400fcfb0]
lea rcx, [rbp - 0x60]
movdqa xmm1, xmmword [0x1400fd010]
xor edx, edx
mov qword [rbp + 0x78], rax
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rbp - 0x60], rax
movabs rax, 0x629a292a367cd507
mov qword [rbp - 0x58], rax
xor eax, eax
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1400fcfe0]
mov dword [rbp + 0x60], eax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], rax
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmmword [rbp - 0x30], xmm0
call fcn.14002a340
test eax, eax
jne 0x14000c16c
lea rcx, [rbp - 0x60]
call fcn.14002a930
test eax, eax
jne 0x14000c16c
movaps xmm0, xmmword [rbp - 0x60]
lea rcx, [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm1
call fcn.14002b710
mov edx, gethostbyname
lea ecx, [rdx - 0x29]
jmp 0x14000c1d8
mov rax, qword [rcx + 0xa8]
lea rdx, [rsp + 0x60]
mov qword [rbp + 0x10], rax
lea rcx, [rbp - 0x60]
xor eax, eax
mov dword [rbp - 0x60], 0x6a09e667
mov qword [rbp], rax
mov dword [rbp + 8], eax
mov dword [rbp - 0x5c], 0xbb67ae85
mov dword [rbp - 0x58], 0x3c6ef372
mov dword [rbp - 0x54], 0xa54ff53a
mov dword [rbp - 0x50], 0x510e527f
mov dword [rbp - 0x4c], 0x9b05688c
mov dword [rbp - 0x48], 0x1f83d9ab
mov dword [rbp - 0x44], 0x5be0cd19
call fcn.1400342c0
mov edx, 0x20
lea ecx, [rdx - 0x1a]
test eax, eax
jne 0x14000c220
cmp byte [rbx + 0x2f1], 4
je 0x14000c1ec
mov eax, 0xfffffeba
jmp 0x14000c220
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], edx
mov r9d, edx
mov qword [rsp + 0x40], rax
mov r8, rsi
lea rax, str.derived
mov dword [rsp + 0x38], 7
mov rcx, rdi
mov qword [rsp + 0x30], rax
call fcn.14000bf10
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400b06c0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x190
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014200
Capabilities:
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x140014231
mov rax, qword [0x140398920]
test rax, rax
je 0x140014228
call rax
jmp 0x14001422d
call fcn.1400b8268
mov qword [rbx + 0x78], rdi
mov rax, qword [0x140397868]
mov ecx, 0x3f0
test rax, rax
je 0x140014246
call rax
jmp 0x14001424b
call fcn.1400b85d8
mov qword [rbx + 0x78], rax
test rax, rax
jne 0x140014264
mov eax, 0xffffff83
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, 0x3f0
mov rcx, rax
call fcn.1400b1300
mov rcx, qword [rbx + 0x78]
add rcx, 0x1b0
je 0x14001439b
mov rax, qword [rbx + 0xa8]
xorps xmm0, xmm0
mov qword [rcx + 0x70], rax
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x60], rdi
mov dword [rcx + 0x68], edi
mov rcx, qword [rbx + 0x78]
add rcx, 0x230
je 0x14001439b
mov rax, qword [rbx + 0xa8]
mov qword [rcx + 0xd8], rax
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], edi
mov qword [rcx + 0xc8], rdi
mov qword [rcx + 0xd0], rdi
mov rcx, qword [rbx + 0x78]
mov rdx, qword [rbx + 0xa8]
add rcx, 0x310
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140029190
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffff53
add rsp, 0x20
pop rdi
ret
Function at 0x14001bfc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
mov dword [rsp + 0x44], r9d
mov r12, rdx
mov ebp, r8d
xor edx, edx
mov r10d, r9d
mov r9, qword [rsp + 0x150]
mov r8d, edx
movzx eax, byte [rsi + 0x2fd]
mov r15d, edx
movzx r14d, byte [rsi + 0x301]
mov ecx, edx
mov qword [rsp + 0x48], r9
cmp al, 1
jne 0x14001c1c4
movzx r9d, word [rsi + 0x460]
bt r9w, 0xe
jae 0x14001c03d
movzx r8d, word [rsi + 0x2f8]
mov eax, r8d
mov rcx, rbp
sub rcx, rax
mov dword [rsp + 0x40], 1
bt r9w, 0xd
mov rdi, rbp
movzx eax, byte [rcx + r12 - 1]
mov r15d, eax
mov r13d, eax
jae 0x14001c149
sub ebp, r8d
lea r8, [r12 - 1]
movsxd rax, ebp
add r8, rax
mov eax, 0xff
lea ecx, [rbp - 1]
movzx r10d, byte [r8]
mov edi, r10d
sub edi, ebp
add edi, r14d
shr edi, 0x1f
dec dil
cmp ecx, eax
cmovg ecx, eax
movsxd r9, ecx
test ecx, ecx
jle 0x14001c0c3
nop dword [rax]
mov ecx, r10d
lea r8, [r8 - 1]
sub ecx, edx
movzx eax, r10b
xor al, byte [r8 + 1]
inc edx
shr ecx, 0x1f
dec cl
and cl, al
or dil, cl
sub r9, 1
jne 0x14001c0a0
mov eax, dword [rsp + 0x44]
lea rdx, [rsp + 0x90]
mov dword [rsp + 0x38], 1
mov r9d, ebp
sub r9d, r14d
mov dword [rsp + 0x30], 1
sub r9d, r15d
mov dword [rsp + 0x28], eax
dec r9d
mov dword [rsp + 0x20], r15d
mov r8, r12
mov rcx, rsi
call qword [rsi + 0xf0]
movzx r8d, byte [rsi + 0x301]
lea r9, [rsp + 0x90]
mov edx, ebp
mov rcx, r12
mov ebx, eax
call fcn.14001ba20
or al, dil
not al
movzx ecx, al
shr cl, 4
and al, cl
movzx ecx, al
mov edx, ecx
shr edx, 2
and edx, ecx
mov eax, edx
shr eax, 1
and eax, edx
dec eax
add eax, ebx
je 0x14001c1be
mov eax, 0xfffffecf
jmp 0x14001c249
sub ebp, r14d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov r8, r12
mov dword [rsp + 0x28], r10d
lea ecx, [rbp - 1]
cmp r15d, ecx
mov dword [rsp + 0x44], ecx
cmova r15d, edx
cmp r13d, ecx
mov rcx, rsi
cmovbe edx, eax
sub ebp, edx
mov ebx, edx
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], ebx
lea r9d, [rbp - 1]
call qword [rsi + 0xf0]
sub rdi, rbx
lea rdx, [r12 - 1]
sub rdi, r14
lea rcx, [rsp + 0x50]
add rdx, rdi
mov r8d, r14d
mov ebp, eax
call fcn.14000a7c0
test eax, eax
jne 0x14001c21c
test ebp, ebp
jne 0x14001c21c
cmp r13d, dword [rsp + 0x44]
ja 0x14001c21c
mov ecx, dword [rsp + 0x40]
jmp 0x14001c226
test al, al
jne 0x14001c22b
mov dword [rsp + 0x38], 1
lea rdx, [rsp + 0x50]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
sub r9d, r14d
mov r8, r12
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rsi
call qword [rsi + 0xf0]
mov rdx, rbp
lea rcx, [rsp + 0x50]
sub rdx, r14
mov r8d, r14d
add rdx, r12
mov ebx, eax
call fcn.14000a7c0
test eax, eax
jne 0x14001c21c
test ebx, ebx
je 0x14001c223
mov eax, 0xfffffecf
jmp 0x14001c249
mov ecx, r15d
mov r9, qword [rsp + 0x48]
cmp byte [rsi + 0x2fd], 2
jne 0x14001c23d
movzx eax, word [rsi + 0x2fa]
jmp 0x14001c244
lea eax, [r14 + rcx]
add eax, r15d
mov dword [r9], eax
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400b06c0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140028170
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0xa8
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor esi, esi
mov ebx, edx
mov qword [rsp + 0x80], rsi
mov r14, r8
mov dword [rsp + 0x6c], 0x67452301
mov rdi, rcx
mov dword [rsp + 0x70], 0xefcdab89
mov dword [rsp + 0x74], 0x98badcfe
mov dword [rsp + 0x78], 0x10325476
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], esi
test rcx, rcx
jne 0x1400281e1
test edx, edx
je 0x140028265
mov eax, 0xffffff53
jmp 0x140028276
mov dword [rsp + 0x24], ebx
cmp ebx, 0x40
jb 0x140028249
mov qword [rsp + 0xa0], rbp
mov rbp, rbx
shr rbp, 6
nop dword [rax]
movups xmm0, xmmword [rdi]
lea rdx, [rsp + 0x2c]
add ebx, 0xffffffc0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x2c], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x3c], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rsp + 0x4c], xmm0
movups xmm1, xmmword [rdi + 0x30]
add rdi, 0x40
movups xmmword [rsp + 0x5c], xmm1
call fcn.140057fe0
mov esi, eax
sub rbp, 1
jne 0x140028200
mov rbp, qword [rsp + 0xa0]
test ebx, ebx
je 0x140028261
mov r8d, ebx
lea rcx, [rsp + 0x2c]
mov rdx, rdi
call fcn.1400b14c0
mov dword [rsp + 0x20], ebx
test esi, esi
jne 0x140028274
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.140058940
jmp 0x140028276
mov eax, esi
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b06c0
add rsp, 0xa8
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400282a0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x6c], 0x67452301
mov rbx, r8
mov qword [rsp + 0x80], rax
mov r8d, edx
mov dword [rsp + 0x70], 0xefcdab89
mov rdx, rcx
mov dword [rsp + 0x74], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x78], 0x10325476
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.140036a30
test eax, eax
jne 0x14002831a
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140036f30
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b06c0
add rsp, 0xa0
pop rbx
ret

Function at 0x140028340
Capabilities:
Hash data using sha224

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov rbx, r8
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x20], 0xc1059ed8
mov dword [rsp + 0x24], 0x367cd507
mov dword [rsp + 0x28], 0x3070dd17
mov dword [rsp + 0x2c], 0xf70e5939
mov dword [rsp + 0x30], 0xffc00b31
mov dword [rsp + 0x34], 0x68581511
mov dword [rsp + 0x38], 0x64f98fa7
mov dword [rsp + 0x3c], 0xbefa4fa4
mov qword [r11 - 0x38], rax
mov dword [r11 - 0x30], eax
test rcx, rcx
jne 0x1400283be
test edx, edx
je 0x1400283be
mov eax, 0xffffff53
jmp 0x1400283df
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140033850
test eax, eax
jne 0x1400283df
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140034430
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400b06c0
add rsp, 0xb0
pop rbx
ret
Function at 0x140028400
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x14010bcf8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov rbx, r8
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x38], rax
mov dword [r11 - 0x30], eax
test rcx, rcx
jne 0x14002847e
test edx, edx
je 0x140028492
mov eax, 0xffffff53
jmp 0x14002849f
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140033850
test eax, eax
jne 0x14002849f
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400342c0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400b06c0
add rsp, 0xb0
pop rbx
ret

Function at 0x140029060
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
shr r8d, 3
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x1400290e1
mov qword [rsp], rbx
sub r10, rcx
mov r11d, r8d
movabs rbx, 0xffff0000ffff
movabs r8, 0xff00ff00ff00ff
mov rcx, qword [r10 + r9]
lea r9, [r9 + 8]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r8
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, rbx
xor rcx, rdx
rol rcx, 0x20
mov qword [r9 - 8], rcx
sub r11, 1
jne 0x140029091
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x1400290f0
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x1400290fb
mov eax, 0xffffff53
ret
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret

Function at 0x140029190
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x14002919b
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret
Function at 0x14002b710
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x14002b71b
mov eax, 0xffffff53
ret
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret

Function at 0x14002b9d0
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x14002b9db
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret
Function at 0x1400342c0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14003441e
test rdx, rdx
je 0x14003441e
call fcn.140033d50
test eax, eax
jne 0x140034423
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0x18], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140034430
Capabilities:
Hash data using sha224

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14003457b
test rdx, rdx
je 0x14003457b
call fcn.140033d50
test eax, eax
jne 0x140034580
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
rol eax, 8
and eax, 0xff00ff
ror ecx, 8
and ecx, 0xff00ff00
or ecx, eax
mov dword [rbx + 0x18], ecx
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [rdi + 0x10], xmm1
mov eax, dword [rbx + 0x18]
mov dword [rdi + 0x18], eax
xor eax, eax
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140042b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, r9d
xor r11d, r11d
or al, cl
mov r10, rdx
or al, dl
or al, r8b
test al, 7
jne 0x140042c80
shr r9d, 3
test r9d, r9d
je 0x140042d64
cmp r9d, 8
jb 0x140042c42
lea eax, [r9 - 1]
mov edx, eax
lea rbx, [rcx + rax*8]
lea rax, [r8 + rax*8]
cmp rcx, rax
ja 0x140042bb5
cmp rbx, r8
jae 0x140042c42
lea rax, [r10 + rdx*8]
cmp rcx, rax
ja 0x140042bc3
cmp rbx, r10
jae 0x140042c42
mov ebx, r9d
and ebx, 0xfffffff8
mov edi, 4
nop
movdqu xmm0, xmmword [r8 + r11*8]
lea eax, [rdi - 2]
movdqu xmm1, xmmword [r10 + r11*8]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r8 + rax*8]
movdqu xmmword [rcx + r11*8], xmm1
add r11d, 8
movdqu xmm1, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
mov eax, edi
movdqu xmm0, xmmword [r8 + rax*8]
movdqu xmm1, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
lea eax, [rdi + 2]
add edi, 8
movdqu xmm1, xmmword [r10 + rax*8]
movdqu xmm0, xmmword [r8 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r11d, ebx
jb 0x140042bd0
cmp r11d, r9d
jae 0x140042d64
sub r10, r8
lea rdx, [r8 + r11*8]
sub rcx, r8
sub r9d, r11d
mov r8d, r9d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + rdx]
xor rax, qword [rdx]
mov qword [rcx + rdx], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x140042c60
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
test r9d, r9d
je 0x140042d64
cmp r9d, 0x40
jb 0x140042d3e
lea eax, [r9 - 1]
mov edx, eax
lea rbx, [rax + rcx]
add rax, r10
cmp rcx, rax
ja 0x140042cae
cmp rbx, r10
jae 0x140042d3e
lea rax, [rdx + r8]
cmp rcx, rax
ja 0x140042cc0
cmp rbx, r8
jae 0x140042d3e
mov edi, r9d
and edi, 0xffffffc0
mov ebx, 0x20
nop dword [rax + rax]
movdqu xmm0, xmmword [r11 + r8]
lea eax, [rbx - 0x10]
movdqu xmm1, xmmword [r11 + r10]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax + r8]
movdqu xmmword [r11 + rcx], xmm1
add r11d, 0x40
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rax + r8]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rbx + 0x10]
add ebx, 0x40
movdqu xmm1, xmmword [rax + r10]
movdqu xmm0, xmmword [rax + r8]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r11d, edi
jb 0x140042cd0
cmp r11d, r9d
jae 0x140042d64
sub r8, r10
mov edx, r11d
add rdx, r10
sub rcx, r10
sub r9d, r11d
mov r10d, r9d
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
sub r10, 1
jne 0x140042d50
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret