joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400105e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov eax, dword [rcx + 8]
test eax, eax
jne 0x1400105fe
mov rcx, rsi
call fcn.1400100b1
mov eax, dword [rsi + 8]
cmp eax, 2
je 0x140010625
cmp eax, 1
jne 0x140010695
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140065137
mov r9, qword [rsi]
test r9, r9
jne 0x140010649
lea rcx, str.ctx__lgfp
lea rdx, str..._logging.c
mov r8d, 0x2f
call fcn.140090118
mov r9, qword [rsi]
mov rcx, qword [rdi]
mov r8, qword [rdi + 8]
mov edx, 1
call fcn.140092d0c
cmp rax, qword [rdi + 8]
jae 0x140010695
mov rcx, qword [rsi]
test rcx, rcx
je 0x140010674
call fcn.140092320
mov qword [rsi], 0
mov dword [rsi + 8], 3
mov rcx, qword [rsi + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, str.Disabled_writing_session_log_due_to_error_while_writing
add rsp, 0x28
pop rdi
pop rsi
jmp rax
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x1400156b1
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx]
cmp rax, qword [rdx]
je 0x1400156e5
lea rcx, str.x0__nw__x1__nw
lea rdx, str..._mpint.c
mov r8d, 0x9a
call fcn.140090118
mov rax, qword [rdi]
and ebx, 1
neg rbx
mov qword [rsp + 0x28], rbx
test rax, rax
je 0x140015727
xor eax, eax
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx + rax*8]
xor rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x28]
and rcx, rdx
mov rdx, qword [rdi + 8]
xor qword [rdx + rax*8], rcx
mov rdx, qword [rsi + 8]
xor qword [rdx + rax*8], rcx
inc rax
cmp rax, qword [rdi]
jb 0x1400156f7
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400159f3
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov rax, qword [rcx + 8]
mov rcx, rax
shr rcx, 0x3e
je 0x140015a29
lea rcx, str.hex.len_____size_t_0____4
lea rdx, str..._mpint.c
mov r8d, 0xfa
call fcn.140090118
mov rax, qword [r14 + 8]
lea rax, [rax*4 + 0x3f]
shr rax, 6
mov ecx, 1
cmovne rcx, rax
call fcn.1400154ec
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140015ad1
mov r8, 0xffffffffffffffff
xor r9d, r9d
xor r10d, r10d
add rcx, qword [r14]
movsx ecx, byte [r8 + rcx]
movsxd rcx, ecx
lea rbx, [rcx - 0x61]
mov edx, 0x66
sub rdx, rcx
or rdx, rbx
sar rdx, 0x3f
lea rsi, [rcx - 0x41]
mov ebx, 0x46
sub rbx, rcx
or rbx, rsi
sar rbx, 0x3f
lea esi, [rcx - 0x30]
lea edi, [rcx - 0x57]
xor esi, edi
and edx, esi
add ecx, 0xffffffc9
xor edi, ecx
xor edi, edx
and ebx, edi
xor ebx, ecx
and ebx, 0xf
mov rdx, r10
shr rdx, 4
mov ecx, r9d
and cl, 0x3c
shl rbx, cl
mov rcx, qword [rax + 8]
or qword [rcx + rdx*8], rbx
inc r10
mov rcx, qword [r14 + 8]
dec r8
add r9, 4
cmp r10, rcx
jb 0x140015a5d
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14001601d
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov r9, rcx
test r8, r8
je 0x14001604e
lea rax, [r8 - 1]
movzx ecx, byte [r9 + rax]
xor rcx, 0x30
dec rcx
sar rcx, 0x3f
xor r8, rax
and r8, rcx
xor r8, rax
add rax, 0xffffffffffffffff
jb 0x14001602d
jmp 0x140016051
xor r8d, r8d
test rdx, rdx
je 0x1400160ae
xor ecx, ecx
mov r10, r8
shr r10, cl
mov edi, 1
shl rdi, cl
cmp rdi, rdx
jae 0x1400160a0
and r10b, 1
neg r10b
mov r11, rdx
sub r11, rdi
add rdi, r9
xor esi, esi
mov bl, byte [r9 + rsi]
mov bpl, byte [rdi + rsi]
mov eax, ebp
xor al, bl
and al, r10b
xor bl, al
mov byte [r9 + rsi], bl
xor al, bpl
mov byte [rdi + rsi], al
inc rsi
cmp r11, rsi
jne 0x14001607d
inc rcx
mov rax, rdx
shr rax, cl
test rax, rax
jne 0x140016058
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14001dfe5
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x37
call fcn.140003607
cmp byte [rax], 0
je 0x14001e009
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.1400649d1
mov rcx, rsi
mov edx, 0x38
call fcn.1400033da
test al, al
je 0x14001e024
add rsp, 0x20
pop rsi
jmp fcn.140079f77
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14001fea9
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov ebp, dword [rsp + 0x70]
mov rcx, r8
mov edx, r9d
call fcn.140003491
cmp eax, 1
je 0x14001ff15
cmp eax, 2
je 0x14001ff1e
cmp eax, 3
jne 0x14001ff27
mov rcx, rbx
mov edx, ebp
call fcn.140003607
lea rcx, str.custom:
mov rdx, rax
xor r8d, r8d
call fcn.140064a12
mov rbx, rax
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.14007fb02
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140012312
lea r8, str.implicit
jmp 0x14001ff2e
lea r8, str.explicit
jmp 0x14001ff2e
lea r8, str.none
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14007fb02
Function at 0x140022630
Capabilities:
Hide graphical window

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov rax, qword [0x1400d80e0]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
cmp byte [0x1400d8cd0], 0
je 0x14002283a
mov edi, r8d
mov ebx, edx
mov r14, rcx
cmp qword [0x1400d8cd8], 0
jne 0x14002273c
cmp word [0x1400d8ce0], 0
jne 0x1400226cc
lea rcx, [rsp + 0x80]
mov dword [rcx], 3
lea rax, [0x14002285a]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], 0
mov rax, qword [0x1400d9a88]
mov qword [rcx + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
lea rax, str.SizeTipClass
mov qword [rcx + 0x40], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
mov word [0x1400d8ce0], ax
mov rsi, qword [sym.imp.USER32.dll_GetSysColor]
mov ecx, 0x18
call rsi
mov dword [0x1400d8ce4], eax
mov ecx, 0x17
call rsi
mov dword [0x1400d8ce8], eax
lea rsi, [rsp + 0x84]
mov r8d, 0x150
mov rcx, rsi
xor edx, edx
call fcn.140085770
mov dword [rsi - 4], 0x154
lea r8, [rsp + 0x80]
mov ecx, 0x29
mov edx, 0x154
xor r9d, r9d
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
lea rcx, [rsp + 0x15c]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov qword [0x1400d8cf0], rax
lea rdx, str._dx_d
lea rcx, [rsp + 0x80]
mov r8d, ebx
mov r9d, edi
call fcn.140004330
mov rcx, qword [0x1400d8cd8]
test rcx, rcx
je 0x140022775
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x14002283a
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rsi, rax
lea r15, [rsp + 0x80]
mov rcx, r15
call fcn.1400943f0
lea rbx, [rsp + 0x78]
mov rcx, rsi
mov rdx, r15
mov r8d, eax
mov r9, rbx
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
lea rsi, [rsp + 0x68]
mov rcx, r14
mov rdx, rsi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsi]
mov ecx, dword [rsi + 4]
mov edx, 0x10
cmp eax, edx
cmovle eax, edx
mov esi, dword [rbx]
mov ebx, dword [rbx + 4]
sub ecx, ebx
cmp ecx, 0x10
cmovle ecx, edx
mov rdi, qword [0x1400d9a88]
movzx edx, word [0x1400d8ce0]
mov qword [rsp + 0x50], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x58], 0
mov ecx, 0x88
mov r8, r15
mov r9d, 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400d8cd8], rax
mov rcx, rax
mov edx, 4
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.1400841b0
nop
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14003ba5e
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
mov r10b, byte [rcx]
mov r9b, byte [rcx + 1]
test r8d, r8d
jle 0x14003babe
mov r8d, r8d
neg r8
mov eax, 1
inc r10b
movzx r11d, r10b
movzx esi, byte [rcx + r11 + 2]
add r9b, sil
movzx edi, r9b
mov bl, byte [rcx + rdi + 2]
mov byte [rcx + r11 + 2], bl
mov byte [rcx + rdi + 2], sil
movzx ebx, byte [rcx + r11 + 2]
add esi, ebx
movzx ebx, sil
mov bl, byte [rcx + rbx + 2]
xor byte [rdx + rax - 1], bl
lea rbx, [r8 + rax]
inc rbx
inc rax
cmp rbx, 1
jne 0x14003ba78
mov byte [rcx], r10b
mov byte [rcx + 1], r9b
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003c874
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov qword [rsp + 0x58], r9
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x50], ecx
mov rbx, qword [rsp + 0x140]
mov rax, qword [0x1400d80e0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
imul eax, r8d, 0x3e8
imul r14, rax, 0x10624dd3
shr r14, 0x26
mov ebp, 1
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, 1
mov r12d, r15d
mov r15d, ebp
call r13
mov esi, eax
mov rax, qword [rsp + 0x120]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x90], xmm0
mov rax, qword [rsp + 0x128]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x130]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x138]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x60], xmm0
mov rdi, rbx
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x50]
mov edx, dword [rsp + 0x54]
mov r8d, ebp
mov r9d, dword [rsp + 0x110]
call fcn.14003bb87
call r13
mov ebp, r12d
add ebp, r15d
jb 0x14003c9a0
sub eax, esi
cmp eax, r14d
jae 0x14003c9a0
mov rbx, rdi
mov rcx, rdi
xor edx, edx
call fcn.140064cd2
jmp 0x14003c8d2
mov rax, qword [rsp + 0x58]
mov dword [rax], r15d
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400841b0
nop
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14003ca45
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc28
mov rsi, rcx
mov rax, qword [0x1400d80e0]
xor rax, rsp
mov qword [rsp + 0xc20], rax
xor eax, eax
mov rcx, qword [r8 + rax*8]
xor rcx, qword [rdx + rax*8]
mov qword [rsp + rax*8 + 0x820], rcx
inc rax
cmp rax, 0x80
jne 0x14003ca65
xor edi, edi
lea r8, [rsp + rdi]
add r8, 0x820
lea rcx, [rsp + rdi]
add rcx, 0x420
mov edx, 2
mov r9d, 2
call fcn.14003cb53
sub rdi, 0xffffffffffffff80
cmp rdi, 0x400
jne 0x14003ca82
xor edi, edi
lea r8, [rsp + rdi]
add r8, 0x420
lea rcx, [rsp + rdi]
add rcx, 0x20
mov edx, 0x10
mov r9d, 0x10
call fcn.14003cb53
add rdi, 0x10
cmp rdi, 0x80
jne 0x14003cab7
xor eax, eax
mov rcx, qword [rsp + rax*8 + 0x20]
xor rcx, qword [rsp + rax*8 + 0x820]
xor qword [rsi + rax*8], rcx
inc rax
cmp rax, 0x80
jne 0x14003cae9
lea rcx, [rsp + 0x820]
mov edx, 0x400
call fcn.14007a7d4
lea rcx, [rsp + 0x420]
mov edx, 0x400
call fcn.14007a7d4
lea rcx, [rsp + 0x20]
mov edx, 0x400
call fcn.14007a7d4
mov rcx, qword [rsp + 0xc20]
xor rcx, rsp
call fcn.1400841b0
nop
add rsp, 0xc28
pop rdi
pop rsi
ret
Function at 0x14003f6c8
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movaps xmm0, xmmword [str.expand_32_byte_k_v]
movups xmmword [rcx], xmm0
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
mov dword [rcx + 0x80], 0x40
ret
Function at 0x140040c08
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov r9, qword [rdx + 8]
test r9, r9
je 0x140040c6b
mov r8, qword [rdx]
xor r10d, r10d
movzx ecx, byte [r8 + r10]
xor ecx, eax
mov eax, ecx
and eax, 0xf
shr ecx, 4
imul edx, eax, 0x11111044
xor edx, ecx
imul r11d, eax, 0x8840020
imul ecx, eax, 0x4220000
xor ecx, r11d
xor ecx, edx
and edx, 0xf
shr ecx, 4
imul eax, edx, 0x11111044
imul r11d, edx, 0x8840020
xor r11d, eax
imul eax, edx, 0x4220000
xor eax, ecx
xor eax, r11d
inc r10
cmp r9, r10
jne 0x140040c19
ret

Function at 0x1400424d7
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
mov rax, rcx
mov qword [rsp + 8], rcx
shr rax, 0x20
mov r10d, dword [rdx + r8*4]
mov r11d, eax
rol r11d, 4
xor r11d, dword [rdx + r8*4 + 0x40]
mov qword [rsp + 0x10], rax
xor r10d, eax
mov eax, 0xfc00fc
mov ebp, r11d
and ebp, eax
mov edx, 0xff00ff00
or ebp, edx
shr r11d, 8
and r11d, eax
or r11d, edx
mov r8d, r10d
and r8d, eax
or r8d, edx
shr r10d, 8
and r10d, eax
or r10d, edx
xor r13d, r13d
lea rax, [0x1400ae870]
mov r12d, 0x80008
lea r15, [0x1400aea70]
mov dword [rsp], ebp
xor esi, esi
xor edi, edi
xor ebx, ebx
mov edx, r10d
mov dword [rsp + 4], r8d
mov r14d, r11d
mov r9d, dword [rax]
and r9d, ebp
xor ebx, r9d
add ebp, r12d
mov ecx, dword [rax + 4]
and ecx, r14d
xor edi, ecx
add r14d, r12d
mov ecx, dword [rax + 8]
and ecx, r8d
xor esi, ecx
add r8d, r12d
mov ecx, dword [rax + 0xc]
and ecx, edx
xor r13d, ecx
add edx, r12d
add rax, 0x10
cmp rax, r15
jb 0x140042564
mov eax, 0x100
mov edx, dword [rsp + 4]
add edx, eax
mov ebp, dword [rsp]
add ebp, eax
add r11d, eax
add r10d, eax
mov ecx, ebx
shl ecx, 4
mov r8d, 0x40004
and ebp, r8d
imul eax, ebp, 0x3c00
and eax, ecx
xor eax, ebx
mov ebp, edi
shl ebp, 4
and r11d, r8d
imul ecx, r11d, 0x3c00
and ecx, ebp
xor ecx, edi
mov ebx, esi
shl ebx, 4
and edx, r8d
imul ebp, edx, 0x3c00
and ebp, ebx
xor ebp, esi
mov ebx, r13d
shl ebx, 4
and r10d, r8d
imul edx, r10d, 0x3c00
and edx, ebx
xor edx, r13d
and edx, 0xf000f000
shr eax, 0xc
and eax, 0xf000f
shr ecx, 4
and ecx, 0xf000f00
shr ebp, 8
and ebp, 0xf000f0
or ebp, ecx
or ebp, edx
or eax, ebp
shr ebp, 4
xor ebp, eax
and ebp, 0x7030702
xor eax, ebp
shl ebp, 4
xor ebp, eax
mov ecx, ebp
shr ecx, 8
xor ecx, eax
and ecx, 0x4e009e
xor ebp, ecx
shl ecx, 8
xor ecx, ebp
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0xd9d3
xor ecx, eax
shl eax, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 4
xor ecx, eax
and ecx, 0x5040004
mov edx, ecx
xor edx, eax
shl ecx, 4
shr eax, 1
xor eax, edx
and eax, 0x4045015
xor ecx, dword [rsp + 8]
xor ecx, edx
xor ecx, eax
add eax, eax
xor eax, ecx
shl rax, 0x20
add rax, qword [rsp + 0x10]
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400475be
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 8], 0
mov r8, qword [rcx + 0x10]
test r8, r8
je 0x14004762d
xor ecx, ecx
sub r8, rcx
add rcx, qword [rsi]
mov edx, 1
mov r9, rdi
call fcn.140092a48
mov rbx, rax
mov rcx, rdi
call fcn.140092408
test eax, eax
jne 0x14004761b
mov rcx, qword [rsi + 8]
test rbx, rbx
je 0x140047622
add rcx, rbx
mov qword [rsi + 8], rcx
mov r8, qword [rsi + 0x10]
cmp r8, rcx
ja 0x1400475de
jmp 0x140047626
mov eax, 2
jmp 0x140047665
mov r8, qword [rsi + 0x10]
xor eax, eax
cmp rcx, r8
jne 0x140047643
mov rcx, rdi
call fcn.140092788
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi]
lea rbx, [rsi + 0x18]
mov qword [rsi + 0x18], rdx
mov qword [rsi + 0x28], rcx
mov qword [rsi + 0x20], 0
mov dword [rsi + 0x30], 0
mov qword [rsi + 0x38], rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14004bc20
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.140015bdc

Function at 0x14004bdf9
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov rsi, r9
mov ebx, r8d
mov r14, rdx
mov r12, rcx
mov ebp, dword [rsp + 0x110]
mov rax, qword [0x1400d80e0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [rcx]
mov rdi, rax
test rax, rax
je 0x14004be44
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
test ebp, ebp
jle 0x14004bed9
movsxd r15, ebx
xor ebx, ebx
mov r13d, ebp
mov rax, qword [r12 + 0x28]
cmp rax, r13
cmovb r13, rax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
cmp qword [r12 + 0x28], 0x73
jb 0x14004be8a
lea rcx, str.h__hlen___MAX_HASH_LEN
lea rdx, str..._sshrsa.c
mov r8d, 0x393
call fcn.140090118
mov rcx, qword [rdi + 8]
mov rdx, r14
mov r8, r15
call fcn.140011c08
mov rcx, qword [rdi + 8]
mov edx, ebx
call fcn.140011d0c
mov rax, qword [rdi]
mov rcx, rdi
lea rdx, [rsp + 0x20]
call qword [rax + 0x18]
test r13d, r13d
jle 0x14004bec8
xor eax, eax
mov cl, byte [rsp + rax + 0x20]
xor byte [rsi + rax], cl
inc rax
cmp r13, rax
jne 0x14004beb9
inc ebx
movsxd rax, r13d
add rsi, rax
sub ebp, r13d
jg 0x14004be51
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x20]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400841b0
nop
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14004dd24
Capabilities:
Hash data using sha1 via x86 extensions

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm9, xmmword [rcx]
movdqa xmm8, xmmword [rcx + 0x10]
movdqa xmm6, xmmword [0x1400ac710]
movdqu xmm5, xmmword [rdx]
movdqu xmm4, xmmword [rdx + 0x10]
movdqu xmm3, xmmword [rdx + 0x20]
movdqu xmm2, xmmword [rdx + 0x30]
pshufb xmm5, xmm6
movdqa xmm7, xmm8
paddd xmm7, xmm5
movdqa xmm1, xmm9
sha1rnds4 xmm1, xmm7, 0
pshufb xmm4, xmm6
movdqa xmm7, xmm9
sha1nexte xmm7, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm5, xmm4
pshufb xmm3, xmm6
sha1nexte xmm1, xmm3
movaps xmm7, xmm0
sha1rnds4 xmm7, xmm1, 0
sha1msg1 xmm4, xmm3
pshufb xmm2, xmm6
sha1nexte xmm0, xmm2
pxor xmm5, xmm3
sha1msg2 xmm5, xmm2
movaps xmm1, xmm7
sha1rnds4 xmm1, xmm0, 0
sha1msg1 xmm3, xmm2
sha1nexte xmm7, xmm5
pxor xmm4, xmm2
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm6, xmm2
sha1msg2 xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 1
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm1, xmm5
sha1msg2 xmm4, xmm5
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm0, xmm4
sha1msg2 xmm3, xmm4
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm6, xmm3
sha1msg2 xmm2, xmm3
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm1, xmm2
sha1msg2 xmm5, xmm2
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm0, xmm5
sha1msg2 xmm4, xmm5
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 2
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm6, xmm4
sha1msg2 xmm3, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm1, xmm3
sha1msg2 xmm2, xmm3
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm0, xmm2
sha1msg2 xmm5, xmm2
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 3
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm6, xmm5
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 3
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm5, xmm0
sha1rnds4 xmm5, xmm1, 3
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm5
sha1rnds4 xmm1, xmm0, 3
sha1nexte xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm5, 3
paddd xmm0, xmm9
movdqa xmmword [rcx], xmm0
sha1nexte xmm1, xmm8
movaps xmmword [rcx + 0x10], xmm1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14005968e
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
mov rax, rcx
xor edi, edi
test edx, edx
cmovs edx, edi
mov cl, byte [rsp + 0x88]
mov byte [rsp + 7], cl
test r8d, r8d
cmovns edi, r8d
mov ecx, dword [rsp + 0x80]
mov ebp, dword [rax + 0x178]
lea r8d, [rbp - 1]
cmp ebp, r9d
cmovg r8d, r9d
movsxd rbx, dword [rax + 0x174]
lea r11d, [rbx - 1]
cmp ebx, ecx
cmovg r11d, ecx
cmp edi, r11d
jg 0x1400597e7
mov r9d, edx
shr r9d, 1
mov r13d, r8d
shr r13d, 0x1f
add r13d, r8d
sar r13d, 1
inc r13d
cmp r9d, r13d
mov esi, r13d
cmovg esi, r9d
mov edi, edi
cmp rdi, rbx
jge 0x1400597e7
mov ebx, edx
mov r15, rbx
shr r15, 1
add esi, r15d
sub esi, r9d
inc esi
lea r10d, [r8 + 1]
inc r11d
lea rcx, [r15 + r15*4]
lea r12, [rcx*4 + 4]
mov qword [rsp + 0x10], rbx
lea rcx, [rbx + rbx*4]
lea rcx, [rcx*4 + 4]
mov qword [rsp + 8], rcx
mov rcx, qword [rax + 0x28]
mov rcx, qword [rcx + rdi*8]
test byte [rcx], 3
je 0x140059795
cmp r9d, r13d
jg 0x1400597cf
mov rbp, r12
mov rcx, r15
movsxd rbx, dword [rax + 0x178]
cmp rcx, rbx
jge 0x1400597cf
mov rbx, qword [rax + 0x28]
mov rbx, qword [rbx + rdi*8]
mov rbx, qword [rbx + 0x18]
or dword [rbx + rbp], 0x3ffff
inc rcx
add rbp, 0x14
cmp rsi, rcx
jne 0x140059768
jmp 0x1400597cf
cmp edx, r8d
jg 0x1400597cf
mov rbp, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
movsxd rcx, dword [rax + 0x178]
cmp r14, rcx
jge 0x1400597cf
mov rcx, qword [rax + 0x28]
mov rcx, qword [rcx + rdi*8]
mov rcx, qword [rcx + 0x18]
or dword [rcx + rbp], 0x3ffff
inc r14
add rbp, 0x14
cmp r10, r14
jne 0x1400597a4
inc rdi
cmp rdi, r11
je 0x1400597e7
movsxd rcx, dword [rax + 0x174]
cmp rdi, rcx
jl 0x140059750
cmp byte [rsp + 7], 0
je 0x140059806
mov rcx, rax
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140056091
cmp byte [rax + 0x10e9], 0
je 0x140059820
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rax + 0x10e9], 1
lea rcx, [0x1400609a5]
mov rdx, rax
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400017aa