joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bd730
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r13
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov rdi, r9
mov rsi, rdx
mov r13, rcx
test eax, eax
jle 0x1400bd822
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x28], r14
lea r14d, [rax - 1]
sub rdi, r8
shr r14d, 3
mov qword [rsp + 0x20], r15
lea r12, [r9 + 2]
inc r14d
lea rbp, [r8 + 2]
nop dword [rax]
movzx eax, byte [rbp - 2]
lea rbx, [rdi + rbp - 2]
lea rdx, [r13 + 8]
xor al, byte [rsi]
mov r9, rbx
mov r8, rbx
mov byte [rbx], al
movzx eax, byte [rbp - 1]
mov rcx, r13
xor al, byte [rsi + 1]
mov byte [r12 - 1], al
movzx eax, byte [rbp]
xor al, byte [rsi + 2]
mov byte [r12], al
movzx eax, byte [rbp + 1]
xor al, byte [rsi + 3]
mov byte [r12 + 1], al
movzx eax, byte [rbp + 2]
xor al, byte [rsi + 4]
mov byte [r12 + 2], al
movzx eax, byte [rbp + 3]
xor al, byte [rsi + 5]
mov byte [r12 + 3], al
movzx eax, byte [rbp + 4]
xor al, byte [rsi + 6]
mov byte [r12 + 4], al
movzx eax, byte [rbp + 5]
xor al, byte [rsi + 7]
mov byte [r12 + 5], al
call fcn.1400bac40
mov r11, qword [rbx]
add r12, 8
add rbp, 8
dec r14
mov qword [rsi], r11
jne 0x1400bd780
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret

Function at 0x1400bd910
Capabilities:
Encode data using xor

Disassembly:
push rsi
push r12
push r13
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov rsi, r9
mov r13, rdx
mov r12, rcx
test eax, eax
jle 0x1400bd9de
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x28], r14
lea r14d, [rax - 1]
sub rsi, r8
shr r14d, 3
mov qword [rsp + 0x20], r15
lea rdi, [r9 + 2]
inc r14d
lea rbp, [r8 + 2]
nop
lea rbx, [rsi + rbp - 2]
lea rdx, [r12 + 8]
mov r8, r13
mov r9, rbx
mov rcx, r12
call fcn.1400bac40
movzx r11d, byte [rbp - 2]
add rdi, 8
xor byte [rbx], r11b
movzx eax, byte [rbp - 1]
add rbp, 8
xor byte [rdi - 9], al
movzx eax, byte [rbp - 8]
xor byte [rdi - 8], al
movzx eax, byte [rbp - 7]
xor byte [rdi - 7], al
movzx eax, byte [rbp - 6]
xor byte [rdi - 6], al
movzx eax, byte [rbp - 5]
xor byte [rdi - 5], al
movzx eax, byte [rbp - 4]
xor byte [rdi - 4], al
movzx eax, byte [rbp - 3]
xor byte [rdi - 3], al
dec r14
mov rax, qword [rbx]
mov qword [r13], rax
jne 0x1400bd960
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rsi
ret
Function at 0x1400bdc60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r13
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov rdi, r9
mov rsi, rdx
mov r13, rcx
test eax, eax
jle 0x1400bdd52
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x28], r14
lea r14d, [rax - 1]
sub rdi, r8
shr r14d, 3
mov qword [rsp + 0x20], r15
lea r12, [r9 + 2]
inc r14d
lea rbp, [r8 + 2]
nop dword [rax]
movzx eax, byte [rbp - 2]
lea rbx, [rdi + rbp - 2]
lea rdx, [r13 + 8]
xor al, byte [rsi]
mov r9, rbx
mov r8, rbx
mov byte [rbx], al
movzx eax, byte [rbp - 1]
mov rcx, r13
xor al, byte [rsi + 1]
mov byte [r12 - 1], al
movzx eax, byte [rbp]
xor al, byte [rsi + 2]
mov byte [r12], al
movzx eax, byte [rbp + 1]
xor al, byte [rsi + 3]
mov byte [r12 + 1], al
movzx eax, byte [rbp + 2]
xor al, byte [rsi + 4]
mov byte [r12 + 2], al
movzx eax, byte [rbp + 3]
xor al, byte [rsi + 5]
mov byte [r12 + 3], al
movzx eax, byte [rbp + 4]
xor al, byte [rsi + 6]
mov byte [r12 + 4], al
movzx eax, byte [rbp + 5]
xor al, byte [rsi + 7]
mov byte [r12 + 5], al
call fcn.1400bb810
mov r11, qword [rbx]
add r12, 8
add rbp, 8
dec r14
mov qword [rsi], r11
jne 0x1400bdcb0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret

Function at 0x1400bdd60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push r12
push r13
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov rsi, r9
mov r13, rdx
mov r12, rcx
test eax, eax
jle 0x1400bde2e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x28], r14
lea r14d, [rax - 1]
sub rsi, r8
shr r14d, 3
mov qword [rsp + 0x20], r15
lea rdi, [r9 + 2]
inc r14d
lea rbp, [r8 + 2]
nop
lea rbx, [rsi + rbp - 2]
lea rdx, [r12 + 8]
mov r8, r13
mov r9, rbx
mov rcx, r12
call fcn.1400bb810
movzx r11d, byte [rbp - 2]
add rdi, 8
xor byte [rbx], r11b
movzx eax, byte [rbp - 1]
add rbp, 8
xor byte [rdi - 9], al
movzx eax, byte [rbp - 8]
xor byte [rdi - 8], al
movzx eax, byte [rbp - 7]
xor byte [rdi - 7], al
movzx eax, byte [rbp - 6]
xor byte [rdi - 6], al
movzx eax, byte [rbp - 5]
xor byte [rdi - 5], al
movzx eax, byte [rbp - 4]
xor byte [rdi - 4], al
movzx eax, byte [rbp - 3]
xor byte [rdi - 3], al
dec r14
mov rax, qword [rbx]
mov qword [r13], rax
jne 0x1400bddb0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rsi
ret
Function at 0x1400c4730
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140634590]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov esi, dword [rcx + 0x50]
mov rdi, rcx
sub esi, 6
movsxd rbx, esi
test esi, esi
jle 0x1400c476d
mov r8, rbx
lea rcx, [rbp - 0x30]
shl r8, 2
call fcn.14035fcd0
xor r11d, r11d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
test esi, esi
jle 0x1400c47c7
lea r10d, [r11 + 0x15]
cmp r11d, dword [rdi + 0x50]
jg 0x1400c47c7
cmp r8, rbx
jge 0x1400c47b0
nop dword [rax + rax]
cmp rdx, 4
jge 0x1400c47b4
mov eax, dword [rbp + r8*4 - 0x30]
lea rcx, [r10 + rdx]
inc r8
inc r9d
inc rdx
mov dword [rdi + rcx*4], eax
cmp r8, rbx
jl 0x1400c4790
cmp rdx, 4
jne 0x1400c47c2
inc r11d
add r10, 4
xor r9d, r9d
xor edx, edx
cmp r8, rbx
jl 0x1400c4780
movsxd r10, r11d
movsxd r8, r9d
cmp r11d, dword [rdi + 0x50]
jg 0x1400c4921
mov qword [rsp + 0x78], r12
lea r9, [0x140627d60]
lea r12, [0x140624b60]
nop word [rax + rax]
movzx ecx, byte [rbp + rbx*4 - 0x33]
movzx eax, byte [rbp - 0x30]
add r9, 4
xor al, byte [rcx + r12]
mov byte [rbp - 0x30], al
movzx eax, byte [rbp + rbx*4 - 0x32]
movzx eax, byte [rax + r12]
xor byte [rbp - 0x2f], al
movzx eax, byte [rbp + rbx*4 - 0x31]
movzx eax, byte [rax + r12]
xor byte [rbp - 0x2e], al
movzx eax, byte [rbp + rbx*4 - 0x34]
movzx eax, byte [rax + r12]
xor byte [rbp - 0x2d], al
movzx eax, byte [r9 - 4]
xor byte [rbp - 0x30], al
cmp esi, 8
je 0x1400c4862
mov ecx, 1
cmp rcx, rbx
jge 0x1400c48d0
nop word [rax + rax]
mov eax, dword [rbp + rcx*4 - 0x34]
inc rcx
xor dword [rbp + rcx*4 - 0x34], eax
cmp rcx, rbx
jl 0x1400c4850
jmp 0x1400c48d0
lea rcx, [rbp - 0x2c]
mov edx, 3
nop dword [rax + rax]
mov eax, dword [rcx - 4]
add rcx, 4
xor dword [rcx - 4], eax
dec rdx
jne 0x1400c4870
movzx eax, byte [rbp - 0x24]
mov ecx, 5
movzx eax, byte [rax + r12]
xor byte [rbp - 0x20], al
movzx eax, byte [rbp - 0x23]
movzx eax, byte [rax + r12]
xor byte [rbp - 0x1f], al
movzx eax, byte [rbp - 0x22]
movzx eax, byte [rax + r12]
xor byte [rbp - 0x1e], al
movzx eax, byte [rbp - 0x21]
movzx eax, byte [rax + r12]
xor byte [rbp - 0x1d], al
cmp rcx, rbx
jge 0x1400c48d0
nop dword [rax]
mov eax, dword [rbp + rcx*4 - 0x34]
inc rcx
xor dword [rbp + rcx*4 - 0x34], eax
cmp rcx, rbx
jl 0x1400c48c0
xor edx, edx
test esi, esi
jle 0x1400c4912
cmp r11d, dword [rdi + 0x50]
jg 0x1400c491c
cmp rdx, rbx
jge 0x1400c48fe
cmp r8, 4
jge 0x1400c4902
mov eax, dword [rbp + rdx*4 - 0x30]
lea rcx, [r8 + r10*4]
inc rdx
inc r8
mov dword [rdi + rcx*4 + 0x54], eax
cmp rdx, rbx
jl 0x1400c48e1
cmp r8, 4
jne 0x1400c490d
inc r11d
inc r10
xor r8d, r8d
cmp rdx, rbx
jl 0x1400c48d6
cmp r11d, dword [rdi + 0x50]
jle 0x1400c47f0
mov r12, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140360fe0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c4940
Capabilities:
Encode data using xor

Disassembly:
mov r10d, 1
mov r8, rcx
cmp dword [rcx + 0x50], r10d
jle 0x1400c4a51
lea r9, [rcx + 0x66]
lea r11, [0x140000000]
nop
movzx edx, byte [r9 + 1]
movzx eax, byte [r9 - 1]
inc r10d
mov ecx, dword [r11 + rdx*4 + 0x627960]
add r9, 0x10
xor ecx, dword [r11 + rax*4 + 0x627160]
movzx eax, byte [r9 - 0x10]
xor ecx, dword [r11 + rax*4 + 0x627560]
movzx eax, byte [r9 - 0x12]
xor ecx, dword [r11 + rax*4 + 0x626d60]
mov dword [r9 - 0x12], ecx
movzx ecx, byte [r9 - 0xb]
movzx eax, byte [r9 - 0xc]
mov edx, dword [r11 + rcx*4 + 0x627960]
xor edx, dword [r11 + rax*4 + 0x627560]
movzx eax, byte [r9 - 0xd]
xor edx, dword [r11 + rax*4 + 0x627160]
movzx eax, byte [r9 - 0xe]
xor edx, dword [r11 + rax*4 + 0x626d60]
mov dword [r9 - 0xe], edx
movzx ecx, byte [r9 - 7]
movzx eax, byte [r9 - 8]
mov edx, dword [r11 + rcx*4 + 0x627960]
xor edx, dword [r11 + rax*4 + 0x627560]
movzx eax, byte [r9 - 9]
xor edx, dword [r11 + rax*4 + 0x627160]
movzx eax, byte [r9 - 0xa]
xor edx, dword [r11 + rax*4 + 0x626d60]
mov dword [r9 - 0xa], edx
movzx eax, byte [r9 - 4]
movzx ecx, byte [r9 - 3]
mov edx, dword [r11 + rcx*4 + 0x627960]
xor edx, dword [r11 + rax*4 + 0x627560]
movzx eax, byte [r9 - 5]
xor edx, dword [r11 + rax*4 + 0x627160]
movzx eax, byte [r9 - 6]
xor edx, dword [r11 + rax*4 + 0x626d60]
mov dword [r9 - 6], edx
cmp r10d, dword [r8 + 0x50]
jl 0x1400c4960
repz ret
Function at 0x1400c5650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r12, qword [rsp + 0x70]
mov rsi, rcx
mov rbx, r9
mov rcx, r12
mov r13d, r8d
mov rbp, rdx
call fcn.140098650
cmp eax, 0x10
jae 0x1400c569f
mov edi, reloc.WS2_32.dll_recv
nop dword [rax + rax]
xor edx, edx
mov rcx, r12
call fcn.14006c5f0
dec rdi
jne 0x1400c5690
cmp byte [rsp + 0x78], 0
jne 0x1400c56c2
mov rcx, r12
call fcn.140098640
test rax, rax
je 0x1400c56c2
mov rcx, qword [rax]
mov qword [rsi + 0x40], rcx
mov rax, qword [rax + 8]
mov qword [rsi + 0x48], rax
cmp dword [rsi + 0x34], 0
je 0x1400c56d2
mov eax, 0xfffffffb
jmp 0x1400c57f4
cmp dword [rsi + 0x3c], 0
je 0x1400c56e2
mov eax, 0xfffffffa
jmp 0x1400c57f4
test rbp, rbp
je 0x1400c57f2
test r13d, r13d
jle 0x1400c57f2
mov eax, r13d
cdq
and edx, 0x7f
lea r12d, [rdx + rax]
mov eax, dword [rsi + 0x38]
sar r12d, 7
test eax, eax
je 0x1400c57c0
dec eax
je 0x1400c571a
or eax, 0xffffffff
jmp 0x1400c57f4
mov eax, dword [rsi + 0x40]
lea rdx, [rsp + 0x20]
mov r8, rbx
xor eax, dword [rbp]
mov rcx, rsi
mov dword [rsp + 0x20], eax
mov eax, dword [rbp + 4]
xor eax, dword [rsi + 0x44]
mov dword [rsp + 0x24], eax
mov eax, dword [rbp + 8]
xor eax, dword [rsi + 0x48]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0xc]
xor eax, dword [rsi + 0x4c]
mov dword [rsp + 0x2c], eax
call fcn.1400c4a60
lea edi, [r12 - 1]
add rbp, 0x10
test edi, edi
jle 0x1400c57e9
add rbx, 8
nop word [rax + rax]
mov eax, dword [rbx - 8]
add rbx, 0x10
lea rdx, [rsp + 0x20]
xor eax, dword [rbp]
lea r8, [rbx - 8]
mov rcx, rsi
mov dword [rsp + 0x20], eax
mov eax, dword [rbx - 0x14]
xor eax, dword [rbp + 4]
mov dword [rsp + 0x24], eax
mov eax, dword [rbp + 8]
xor eax, dword [rbx - 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx - 0xc]
xor eax, dword [rbp + 0xc]
mov dword [rsp + 0x2c], eax
call fcn.1400c4a60
dec edi
add rbp, 0x10
test edi, edi
jg 0x1400c5770
shl r12d, 7
mov eax, r12d
jmp 0x1400c57f4
mov edi, r12d
test r12d, r12d
jle 0x1400c57e9
sub rbp, rbx
nop dword [rax + rax]
lea rdx, [rbx + rbp]
mov r8, rbx
mov rcx, rsi
call fcn.1400c4a60
dec edi
add rbx, 0x10
test edi, edi
jg 0x1400c57d0
shl r12d, 7
mov eax, r12d
jmp 0x1400c57f4
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x1400c63d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r12
mov rbp, rsp
sub rsp, 0x68
cmp dword [rcx + 0x34], 0
mov rbx, r9
mov eax, r8d
mov rdi, rdx
mov r12, rcx
je 0x1400c63fe
mov eax, 0xfffffffb
add rsp, 0x68
pop r12
pop rdi
pop rbx
pop rbp
ret
mov r8d, dword [rcx + 0x38]
cmp r8d, 2
je 0x1400c641d
cmp dword [rcx + 0x3c], 0
jne 0x1400c641d
mov eax, 0xfffffffa
add rsp, 0x68
pop r12
pop rdi
pop rbx
pop rbp
ret
test rdx, rdx
je 0x1400c65d8
test eax, eax
jle 0x1400c65d8
cdq
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], r13
and edx, 0x7f
add eax, edx
sar eax, 7
mov r13d, eax
mov dword [rbp - 0x40], eax
test r8d, r8d
je 0x1400c65a9
dec r8d
je 0x1400c6478
or eax, 0xffffffff
mov rsi, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa0]
add rsp, 0x68
pop r12
pop rdi
pop rbx
pop rbp
ret
cmp byte [rbp + 0x50], 0
mov rsi, qword [rbp + 0x48]
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0x60], r15
je 0x1400c64a5
mov eax, dword [rcx + 0x48]
mov r14d, dword [rcx + 0x40]
mov r15d, dword [rcx + 0x44]
mov dword [rbp + 0x28], eax
mov dword [rbp - 0x20], eax
mov eax, dword [rcx + 0x4c]
jmp 0x1400c64b8
mov eax, dword [rsi + 8]
mov r14d, dword [rsi]
mov r15d, dword [rsi + 4]
mov dword [rbp + 0x28], eax
mov dword [rbp - 0x20], eax
mov eax, dword [rsi + 0xc]
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x48], eax
mov dword [rbp - 0x24], r15d
mov dword [rbp - 0x28], r14d
mov dword [rbp - 0x44], r13d
test r13d, r13d
jle 0x1400c6581
mov esi, dword [rbp + 0x28]
mov r13d, dword [rbp - 0x48]
lea rax, [rdi + 8]
lea r8, [r9 + 8]
mov qword [rbp - 0x38], rax
sub rdi, rbx
mov qword [rbp - 0x30], r8
nop dword [rax]
lea rbx, [rdi + r8 - 8]
lea r8, [rbp - 0x18]
mov rcx, r12
mov rdx, rbx
call fcn.1400c4ee0
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x38]
mov r11d, dword [rbp - 0x18]
mov eax, dword [rbp - 0x14]
mov ecx, dword [rbp - 0x10]
mov edx, dword [rbp - 0xc]
xor eax, r15d
xor r11d, r14d
mov r14d, dword [rbx]
mov dword [r8 - 8], r11d
mov r15d, dword [r9 - 4]
mov dword [r8 - 4], eax
xor ecx, esi
mov esi, dword [r9]
xor edx, r13d
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x44]
mov dword [r8], ecx
mov r13d, dword [r9 + 4]
dec eax
add r9, 0x10
mov dword [r8 + 4], edx
add r8, 0x10
mov dword [rbp - 0x18], r11d
mov dword [rbp - 0x10], ecx
mov dword [rbp - 0xc], edx
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x30], r8
mov dword [rbp - 0x44], eax
test eax, eax
jg 0x1400c64f0
mov dword [rbp - 0x20], esi
mov rsi, qword [rbp + 0x48]
mov dword [rbp - 0x1c], r13d
mov r13d, dword [rbp - 0x40]
mov dword [rbp - 0x28], r14d
mov dword [rbp - 0x24], r15d
mov rax, qword [rbp - 0x28]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0xa8]
mov qword [rsi], rax
mov rax, qword [rbp - 0x20]
shl r13d, 7
mov qword [rsi + 8], rax
mov eax, r13d
jmp 0x1400c645e
mov esi, eax
test eax, eax
jle 0x1400c65cc
nop
mov r8, rbx
mov rdx, rdi
mov rcx, r12
call fcn.1400c4ee0
dec esi
add rdi, 0x10
add rbx, 0x10
test esi, esi
jg 0x1400c65b0
shl r13d, 7
mov eax, r13d
jmp 0x1400c645e
xor eax, eax
add rsp, 0x68
pop r12
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400d2e00
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [rcx + 0x10], 0x67452301
mov dword [rcx + 0x14], 0xefcdab89
mov dword [rcx + 0x18], 0x98badcfe
mov dword [rcx + 0x1c], 0x10325476
mov dword [rcx + 0x20], 0xc3d2e1f0
mov dword [rcx + 0x24], eax
mov qword [rcx + 8], rax
ret
Function at 0x1400d3ce0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rdi, r9
mov rbx, rcx
mov dword [rcx + 0x10], 0x67452301
mov dword [rcx + 0x14], 0xefcdab89
mov dword [rcx + 0x18], 0x98badcfe
mov dword [rcx + 0x24], eax
mov qword [rcx + 8], rax
mov dword [rcx + 0x1c], 0x10325476
mov dword [rcx + 0x20], 0xc3d2e1f0
call fcn.1400d32f0
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400d38e0

Function at 0x1400d4700
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
lea r8, [rcx + 0x28]
mov r9d, reloc.WS2_32.dll_recv
nop dword [rax]
movzx edx, byte [r8 + 0x20]
movzx eax, byte [r8 - 0x10]
inc r8
xor al, dl
dec r9
mov byte [r8 - 1], dl
mov byte [r8 + 0xf], al
jne 0x1400d4710
xor cl, cl
lea r11, str._.C
xor edx, edx
nop word [rax + rax]
lea r8, [r10 + 0x19]
mov r9d, 8
nop word [rax + rax]
movzx eax, cl
add r8, 6
movzx ecx, byte [rax + r11]
movzx eax, byte [r8 - 7]
xor ecx, eax
movzx eax, cl
mov byte [r8 - 7], cl
movzx ecx, byte [rax + r11]
movzx eax, byte [r8 - 6]
xor ecx, eax
movzx eax, cl
mov byte [r8 - 6], cl
movzx ecx, byte [rax + r11]
movzx eax, byte [r8 - 5]
xor ecx, eax
movzx eax, cl
mov byte [r8 - 5], cl
movzx ecx, byte [rax + r11]
movzx eax, byte [r8 - 4]
xor ecx, eax
movzx eax, cl
mov byte [r8 - 4], cl
movzx ecx, byte [rax + r11]
movzx eax, byte [r8 - 3]
xor ecx, eax
movzx eax, cl
mov byte [r8 - 3], cl
movzx ecx, byte [rax + r11]
movzx eax, byte [r8 - 2]
xor ecx, eax
dec r9
mov byte [r8 - 2], cl
jne 0x1400d4750
add cl, dl
inc edx
cmp edx, 0x12
jl 0x1400d4740
repz ret

Function at 0x1400d47e0
Capabilities:
Encode data using xor

Disassembly:
movzx edx, byte [rcx + 0x17]
lea r8, [rcx + 8]
mov r9d, 4
lea r10, str._.C
nop word [rax + rax]
movzx ecx, byte [r8 + 0x40]
movzx eax, dl
add r8, 4
xor rcx, rax
movzx eax, byte [r8 - 4]
movzx edx, byte [rcx + r10]
movzx ecx, byte [r8 + 0x3d]
xor edx, eax
movzx eax, dl
mov byte [r8 - 4], dl
xor rcx, rax
movzx eax, byte [r8 - 3]
movzx edx, byte [rcx + r10]
movzx ecx, byte [r8 + 0x3e]
xor edx, eax
movzx eax, dl
mov byte [r8 - 3], dl
xor rcx, rax
movzx eax, byte [r8 - 2]
movzx edx, byte [rcx + r10]
movzx ecx, byte [r8 + 0x3f]
xor edx, eax
movzx eax, dl
mov byte [r8 - 2], dl
xor rcx, rax
movzx eax, byte [r8 - 1]
movzx edx, byte [rcx + r10]
xor edx, eax
dec r9
mov byte [r8 - 1], dl
jne 0x1400d4800
repz ret
Function at 0x1400d5040
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov edx, dword [rcx]
test edx, edx
je 0x1400d5189
dec edx
je 0x1400d514a
dec edx
je 0x1400d50c9
dec edx
jne 0x1400d51b2
mov rax, qword [0x1404b3f40]
mov qword [rcx + 0xac], rax
mov rax, qword [0x1404b3f48]
mov qword [rcx + 0xb4], rax
mov rax, qword [0x1404b3f50]
mov qword [rcx + 0xbc], rax
mov rax, qword [0x1404b3f58]
mov qword [rcx + 0xc4], rax
mov rax, qword [0x1404b3f60]
mov qword [rcx + 0xcc], rax
mov rax, qword [0x1404b3f68]
mov qword [rcx + 0xd4], rax
mov rax, qword [0x1404b3f70]
mov qword [rcx + 0xdc], rax
mov rax, qword [0x1404b3f78]
jmp 0x1400d5132
mov rax, qword [0x1404b3c80]
mov qword [rcx + 0xac], rax
mov rax, qword [0x1404b3c88]
mov qword [rcx + 0xb4], rax
mov rax, qword [0x1404b3c90]
mov qword [rcx + 0xbc], rax
mov rax, qword [0x1404b3c98]
mov qword [rcx + 0xc4], rax
mov rax, qword [str.g3g1_v]
mov qword [rcx + 0xcc], rax
mov rax, qword [0x1404b3ca8]
mov qword [rcx + 0xd4], rax
mov rax, qword [0x1404b3cb0]
mov qword [rcx + 0xdc], rax
mov rax, qword [0x1404b3cb8]
mov qword [rcx + 0xe4], rax
xor eax, eax
mov qword [rcx + 0xec], rax
mov qword [rcx + 0xf4], rax
ret
xor eax, eax
mov dword [rcx + 4], 0x6a09e667
mov dword [rcx + 8], 0xbb67ae85
mov dword [rcx + 0xc], 0x3c6ef372
mov dword [rcx + 0x10], 0xa54ff53a
mov dword [rcx + 0x14], 0x510e527f
mov dword [rcx + 0x18], 0x9b05688c
mov dword [rcx + 0x1c], 0x1f83d9ab
mov qword [rcx + 0x20], 0x5be0cd19
mov dword [rcx + 0x28], eax
ret
xor eax, eax
mov dword [rcx + 4], 0x67452301
mov dword [rcx + 8], 0xefcdab89
mov dword [rcx + 0xc], 0x98badcfe
mov dword [rcx + 0x10], 0x10325476
mov dword [rcx + 0x14], 0xc3d2e1f0
mov qword [rcx + 0x24], rax
repz ret
Function at 0x1400e1d90
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140634590]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov rdi, rcx
mov ecx, 0xfc
mov rbp, r8
mov esi, edx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call fcn.1402245bc
mov rbx, rax
test rax, rax
je 0x1400e1e23
mov dword [rax + 4], 0x6a09e667
mov dword [rax + 8], 0xbb67ae85
mov dword [rax + 0xc], 0x3c6ef372
mov dword [rax + 0x10], 0xa54ff53a
mov dword [rax + 0x14], 0x510e527f
mov dword [rax + 0x18], 0x9b05688c
mov dword [rax + 0x1c], 0x1f83d9ab
mov qword [rax + 0x20], 0x5be0cd19
mov dword [rax + 0x28], 0
mov dword [rax], 1
jmp 0x1400e1e25
xor ebx, ebx
mov rcx, rbx
call fcn.1400d5040
mov r8d, esi
mov rdx, rdi
call fcn.1400e15e0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400e17f0
mov rcx, rbx
call fcn.140224608
lea rdx, [rsp + 0x20]
mov r8d, 0x20
mov rcx, rbp
call fcn.14006c950
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140360fe0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e3980
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x108]
sub rsp, 0x208
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x140634590]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov ebx, r9d
mov r12, r8
mov dword [rsp + 0x20], edx
mov r15, rcx
mov r14, qword [rbp + 0x178]
mov rcx, r14
call fcn.14006ba20
mov esi, 0x40
mov eax, 0x80
mov r13d, dword [rbp + 0x170]
cmp r13d, 3
cmove esi, eax
lea rcx, [rbp - 0x58]
call fcn.14006baf0
nop
cmp ebx, esi
jle 0x1400e3a24
lea r9, [rbp - 0x58]
mov r8d, r13d
mov edx, ebx
mov rcx, r12
call fcn.1400941c0
lea rcx, [rbp - 0x58]
call fcn.140098640
mov r12, rax
mov ecx, r13d
call fcn.140094180
mov ebx, eax
cmp eax, esi
cmovg ebx, esi
movsxd rdi, esi
mov r8, rdi
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.140361a80
mov r8, rdi
xor edx, edx
lea rcx, [rbp + 0x60]
call fcn.140361a80
movsxd rbx, ebx
mov r8, rbx
mov rdx, r12
lea rcx, [rbp - 0x30]
call fcn.14035fcd0
mov r8, rbx
mov rdx, r12
lea rcx, [rbp + 0x60]
call fcn.14035fcd0
xor r11d, r11d
test esi, esi
jle 0x1400e3a84
nop dword [rax + rax]
xor byte [rbp + r11 - 0x30], 0x36
xor byte [rbp + r11 + 0x60], 0x5c
inc r11
cmp r11, rdi
jl 0x1400e3a70
lea rcx, [rsp + 0x28]
call fcn.14006baf0
nop
mov r8d, esi
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x28]
call fcn.14006c950
mov r8d, dword [rsp + 0x20]
mov rdx, r15
lea rcx, [rsp + 0x28]
call fcn.14006c950
lea rcx, [rbp - 0x80]
call fcn.14006baf0
nop
lea rcx, [rsp + 0x28]
call fcn.140098650
mov ebx, eax
lea rcx, [rsp + 0x28]
call fcn.140098640
mov rcx, rax
lea r9, [rbp - 0x80]
mov r8d, r13d
mov edx, ebx
call fcn.1400941c0
lea rcx, [rsp + 0x50]
call fcn.14006baf0
nop
mov r8d, esi
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.14006c950
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.14006d330
lea rcx, [rsp + 0x50]
call fcn.140098650
mov ebx, eax
lea rcx, [rsp + 0x50]
call fcn.140098640
mov rcx, rax
mov r9, r14
mov r8d, r13d
mov edx, ebx
call fcn.1400941c0
nop
lea rcx, [rsp + 0x50]
call fcn.14006c370
nop
lea rcx, [rbp - 0x80]
call fcn.14006c370
nop
lea rcx, [rsp + 0x28]
call fcn.14006c370
nop
lea rcx, [rbp - 0x58]
call fcn.14006c370
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140360fe0
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret