joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400204b4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
xor esi, esi
xor edi, edi
mov r11, r8
mov rbx, rcx
test r8, r8
je 0x140020543
lea r14, [rdx - 8]
sub rbx, rdx
lea r14, [r14 + r8*8]
mov r9, qword [r14]
mov r10, qword [rbx + r14]
mov r8, r9
xor r8, r10
lea r14, [r14 - 8]
mov rax, r10
mov rcx, r9
sub rcx, r10
shr rax, 0x3f
shr rcx, 0x3f
sub r10, r9
shr r10, 0x3f
mov rdx, r8
shr r8, 0x3f
not rdx
shr rdx, 0x3f
and eax, r8d
and ecx, edx
shr r9, 0x3f
or ecx, eax
and r10d, edx
or esi, ecx
and r9d, r8d
or r10d, r9d
mov ecx, 1
sub ecx, esi
or esi, r10d
and ecx, r10d
or edi, ecx
sub r11, 1
jne 0x1400204e1
mov rbx, qword [rsp + 8]
mov eax, edi
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
mov r14, qword [rsp + 0x20]
ret

Function at 0x14002055c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov r10, r9
xor esi, esi
mov r12, r9
mov rdi, rdx
xor dl, dl
mov r11, rcx
mov r15, r8
lea rbx, [rdi - 0xb]
movzx eax, byte [r11]
cmp r9, rbx
movzx r9d, byte [rcx + 1]
lea ecx, [rsi + 2]
cmova r10, rbx
xor r9d, ecx
or r9d, eax
jmp 0x1400205ce
mov al, byte [rcx + r11]
neg al
or al, byte [rcx + r11]
not al
shr al, 7
or dl, al
mov al, dl
neg al
or al, dl
not al
movzx eax, al
shr rax, 7
add rsi, rax
inc rcx
cmp rcx, rdi
jb 0x1400205a8
movzx ecx, dl
lea rax, [rsi - 8]
neg ecx
shr rax, 0x3f
shr ecx, 0x1f
mov r14d, edi
dec ecx
sub r14d, esi
and ecx, 1
sub r14d, 3
or ecx, eax
or r9d, ecx
mov rcx, r10
mov r8d, r9d
neg r8d
shr r8d, 0x1f
neg r8d
mov edx, r8d
mov eax, r8d
not edx
and eax, r10d
and r14d, edx
and r8d, 0x4100
or r14d, eax
sub rcx, r14
shr rcx, 0x3f
mov esi, ecx
or ecx, r9d
neg ecx
neg esi
shr esi, 0x1f
shr ecx, 0x1f
mov ebp, esi
neg ebp
neg ecx
and ebp, edx
and ebp, 0x4400
or ebp, r8d
neg ebp
mov dword [rsp + 0x80], ebp
cmp rdi, 0xb
jbe 0x140020666
not cl
lea rax, [r11 + 0xb]
and byte [rax], cl
inc rax
sub rbx, 1
jne 0x14002065b
neg esi
mov eax, r10d
mov ebx, esi
mov ecx, esi
not ebx
and rcx, rax
and rbx, r14
mov rdx, r11
sub rdx, r10
or rbx, rcx
add rdx, rdi
mov qword [rsp + 0x88], rdx
test r10, r10
je 0x140020724
xor esi, esi
test r10, r10
je 0x140020724
lea r13, [r10 - 1]
mov r12, rdx
mov r9, rsi
sub r9, rbx
shr r9, 0x3f
neg r9d
shr r9d, 0x1f
test r13, r13
je 0x1400206ec
mov ebp, r9d
mov r14, r12
neg ebp
mov r15d, ebp
not r15d
mov dl, byte [r14]
mov cl, r15b
mov al, byte [r14 + 1]
and dl, bpl
and cl, al
or cl, dl
mov byte [r14], cl
lea r14, [r14 + 1]
sub r13, 1
jne 0x1400206ca
lea r13, [r10 - 1]
movzx eax, byte [r11 + rdi - 1]
neg r9b
and r9b, al
inc rsi
mov byte [r11 + rdi - 1], r9b
cmp rsi, r10
jb 0x1400206a6
mov r12, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x88]
mov ebp, dword [rsp + 0x80]
mov r15, qword [rsp + 0x90]
test r12, r12
je 0x140020734
mov r8, r10
mov rcx, r15
call fcn.14014d59b
mov rcx, qword [rsp + 0xa0]
mov eax, ebp
mov qword [rcx], rbx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400209ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
mov rbp, rdx
mov rdi, rcx
movups xmmword [rsp + 0x30], xmm0
xor ebx, ebx
movups xmmword [rsp + 0x40], xmm0
mov eax, 0x10
add byte [rdi + rax - 1], 1
jne 0x140020a40
dec rax
test rax, rax
jg 0x140020a31
mov r9, rsi
lea rcx, [rdi + 0x28]
mov r8, rdi
mov edx, 1
call fcn.140016f20
mov edx, eax
test eax, eax
jne 0x140020ab5
add rsi, 0x10
add ebx, 0x10
cmp ebx, 0x30
jl 0x140020a2c
xor edx, edx
lea rax, [rsp + 0x20]
sub rbp, rax
lea rax, [rsp + 0x20]
add rax, rdx
add rdx, 0x10
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + rbp]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
cmp rdx, 0x30
jl 0x140020a70
mov r8d, 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x28]
call fcn.140015e84
mov edx, eax
test eax, eax
jne 0x140020ab5
movups xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
xor eax, eax
lea rdi, [rsp + 0x20]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
mov eax, edx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14014b850
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140021ec8
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r10d, dword [rdx]
mov ebp, 0xf0f0f0f
mov r9d, dword [rdx + 4]
mov rdi, rcx
bswap r10d
mov eax, r10d
mov rbx, r8
shr eax, 4
mov esi, 8
bswap r9d
xor eax, r9d
and eax, ebp
lea rbp, sym.MZ__z____L_h__Btd_qo_Tab_1tg9cSS_bQ__yRTw3S
xor r9d, eax
shl eax, 4
xor r10d, eax
mov eax, r10d
shr eax, 0x10
xor eax, r9d
movzx ecx, ax
xor r9d, ecx
shl ecx, 0x10
xor r10d, ecx
mov eax, r9d
shr eax, 2
xor eax, r10d
and eax, 0x33333333
xor r10d, eax
shl eax, 2
xor r9d, eax
mov eax, r9d
shr eax, 8
xor eax, r10d
and eax, 0xff00ff
xor r10d, eax
shl eax, 8
xor r9d, eax
mov r11d, r9d
shr r11d, 0x1f
lea eax, [r9 + r9]
or r11d, eax
mov eax, r11d
xor eax, r10d
and eax, 0xaaaaaaaa
xor r11d, eax
xor r10d, eax
ror r10d, 0x1f
mov r9d, r11d
mov eax, r11d
xor r9d, dword [rdi]
lea rdi, [rdi + 0x10]
ror eax, 4
xor eax, dword [rdi - 0xc]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x183040]
xor edx, dword [rbp + rax*4 + 0x183690]
mov eax, r8d
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x182e00]
mov eax, r9d
shr rax, 0x18
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x182f40]
mov eax, r9d
shr rax, 0x10
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x183590]
mov eax, r9d
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x183260]
xor edx, dword [rbp + r8*4 + 0x183470]
xor edx, dword [rbp + r9*4 + 0x183370]
xor r10d, edx
mov r9d, r10d
mov eax, r10d
xor r9d, dword [rdi - 8]
ror eax, 4
xor eax, dword [rdi - 4]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x183040]
xor edx, dword [rbp + rax*4 + 0x183690]
mov eax, r8d
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x182e00]
mov eax, r9d
shr rax, 0x18
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x182f40]
mov eax, r9d
shr rax, 0x10
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x183590]
mov eax, r9d
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x183260]
xor edx, dword [rbp + r8*4 + 0x183470]
xor edx, dword [rbp + r9*4 + 0x183370]
xor r11d, edx
sub rsi, 1
jne 0x140021f79
mov rsi, qword [rsp + 0x18]
mov r8d, r11d
mov rdi, qword [rsp + 0x20]
mov ebp, 0xf0f0f0f
shl r8d, 0x1f
shr r11d, 1
or r8d, r11d
mov eax, r8d
xor eax, r10d
and eax, 0xaaaaaaaa
xor r8d, eax
xor r10d, eax
mov edx, r10d
shr r10d, 1
shl edx, 0x1f
or edx, r10d
mov eax, edx
shr eax, 8
xor eax, r8d
and eax, 0xff00ff
xor r8d, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, r8d
and eax, 0x33333333
xor r8d, eax
shl eax, 2
xor edx, eax
mov eax, r8d
shr eax, 0x10
xor eax, edx
movzx ecx, ax
xor edx, ecx
shl ecx, 0x10
xor r8d, ecx
mov eax, r8d
shr eax, 4
xor eax, edx
and eax, ebp
mov rbp, qword [rsp + 0x10]
xor edx, eax
shl eax, 4
xor r8d, eax
xor eax, eax
bswap r8d
bswap edx
mov dword [rbx], r8d
mov dword [rbx + 4], edx
mov rbx, qword [rsp + 8]
ret
Function at 0x1400297ac
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x48], rax
and qword [r11 - 0x28], 0
lea rax, [r11 - 0x28]
xorps xmm0, xmm0
mov qword [r11 - 0x38], rax
lea r9, [r11 - 0x20]
mov r8d, 0x10
lea rdx, [r11 - 0x20]
mov rbx, rcx
movups xmmword [rsp + 0x38], xmm0
call fcn.14001eb98
test eax, eax
jne 0x1400298f8
mov edi, dword [rsp + 0x38]
lea r11d, [rax + 2]
mov ecx, dword [rsp + 0x3c]
mov esi, dword [rsp + 0x40]
bswap ecx
mov ecx, ecx
bswap edi
bswap esi
mov edi, edi
mov esi, esi
shl rdi, 0x20
or rdi, rcx
shl rsi, 0x20
mov ecx, dword [rsp + 0x44]
bswap ecx
mov ecx, ecx
or rsi, rcx
mov qword [rbx + 0x120], rdi
mov ecx, r11d
mov qword [rbx + 0xa0], rsi
call fcn.140017660
test eax, eax
jne 0x1400298f6
and qword [rbx + 0xe0], 0
and qword [rbx + 0x60], 0
mov r8d, 4
mov eax, esi
mov rcx, rdi
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, rsi
shr rax, 1
mov rsi, rcx
or rsi, rax
mov rax, rdi
shr rax, 1
mov qword [rbx + r8*8 + 0x60], rsi
mov ecx, edx
shl rcx, 0x20
mov rdi, rcx
xor rdi, rax
mov qword [rbx + r8*8 + 0xe0], rdi
shr r8d, 1
jne 0x140029861
mov rcx, r11
mov r9, qword [rbx + rcx*8 + 0xe0]
mov r10, qword [rbx + rcx*8 + 0x60]
cmp rcx, 1
jle 0x1400298e7
lea rdx, [rbx + 0x68]
lea r8, [rcx - 1]
mov rax, r9
xor rax, qword [rdx + 0x80]
mov qword [rdx + rcx*8 + 0x80], rax
mov rax, r10
xor rax, qword [rdx]
mov qword [rdx + rcx*8], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x1400298c1
lea eax, [r11 + r11]
add rcx, rcx
mov r11d, eax
cmp eax, 8
jle 0x1400298a6
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140029b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x50
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x48], rax
and qword [rsp + 0x30], 0
mov rsi, r9
mov r14, r8
mov rdi, rcx
test r9, r9
je 0x140029c74
movabs rax, 0x2000000000000000
cmp r9, rax
jae 0x140029c74
xorps xmm0, xmm0
lea rbx, [rcx + 0x180]
movups xmmword [rbx], xmm0
mov r12d, 0x10
movups xmmword [rcx + 0x190], xmm0
and qword [rcx + 0x160], 0
and qword [rcx + 0x168], 0
mov dword [rcx + 0x1a0], edx
cmp r9, 0xc
jne 0x140029bcc
movsd xmm0, qword [r8]
movsd qword [rbx], xmm0
mov eax, dword [r8 + 8]
mov dword [rbx + 8], eax
mov byte [rcx + 0x18f], 1
jmp 0x140029c53
and qword [rsp + 0x38], 0
lea rax, [r9*8]
bswap rax
mov qword [rsp + 0x40], rax
cmp rsi, r12
mov rbp, r12
cmovb rbp, rsi
test rbp, rbp
je 0x140029c0f
mov rdx, r14
mov rcx, rbx
sub rdx, rdi
mov r8, rbp
mov al, byte [rdx + rcx - 0x180]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140029bfd
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
call fcn.1400299b4
add r14, rbp
sub rsi, rbp
jne 0x140029be2
lea rdx, [rsp + 0x38]
mov rcx, rbx
sub rdx, rdi
mov r9, r12
mov al, byte [rdx + rcx - 0x180]
xor byte [rcx], al
inc rcx
sub r9, 1
jne 0x140029c33
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
call fcn.1400299b4
lea rax, [rsp + 0x30]
mov r8, r12
lea r9, [rdi + 0x170]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call fcn.14001eb98
jmp 0x140029c79
mov eax, 0xffffffec
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140029c9c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movabs rax, 0x2000000000000000
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
cmp r8, rax
jb 0x140029cdb
mov eax, 0xffffffec
jmp 0x140029de7
mov rax, qword [rcx + 0x168]
mov rcx, rax
and ecx, 0xf
je 0x140029d59
mov r14d, 0x10
sub r14, rcx
cmp r14, rdi
cmova r14, rdi
test r14, r14
je 0x140029d28
lea rdx, [rsi + 0x190]
mov r8, rbp
add rdx, rcx
sub r8, rcx
sub r8, rsi
mov r9, r14
mov al, byte [r8 + rdx - 0x190]
xor byte [rdx], al
inc rdx
sub r9, 1
jne 0x140029d15
lea rax, [r14 + rcx]
lea rbx, [rsi + 0x190]
cmp rax, 0x10
jne 0x140029d47
mov r8, rbx
mov rdx, rbx
mov rcx, rsi
call fcn.1400299b4
mov rax, qword [rsi + 0x168]
sub rdi, r14
add rbp, r14
add rax, r14
jmp 0x140029d60
lea rbx, [rsi + 0x190]
add rax, rdi
mov qword [rsi + 0x168], rax
cmp rdi, 0x10
jb 0x140029dcb
mov r15, rdi
lea r12, [rsi + 0x190]
shr r15, 4
mov r14, rbp
imul rax, r15, 0xfffffffffffffff0
sub r14, rsi
add rdi, rax
sub r14, 0x190
mov rax, r15
shl rax, 4
add rbp, rax
mov rcx, r12
mov edx, 0x10
mov al, byte [r14 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140029da4
mov r8, r12
mov rdx, r12
mov rcx, rsi
call fcn.1400299b4
add r14, 0x10
sub r15, 1
jne 0x140029d9c
test rdi, rdi
je 0x140029de5
sub rbp, rsi
mov al, byte [rbx + rbp - 0x190]
xor byte [rbx], al
inc rbx
sub rdi, 1
jne 0x140029dd3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029e08
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x98]
lea rax, [r11 - 0x38]
and qword [r11 - 0x38], 0
mov r15, rdx
mov rbx, r9
mov qword [r11 - 0x48], rax
mov r14, r8
lea rdx, [rcx + 0x180]
mov r9, r15
mov r8d, 0x10
mov rsi, rcx
call fcn.14001eb98
mov edx, eax
test eax, eax
je 0x140029e76
xor eax, eax
mov rdi, r15
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
mov eax, edx
jmp 0x140029f11
cmp dword [rsi + 0x1a0], 0
mov rcx, qword [rsp + 0x90]
jne 0x140029eb6
test rbx, rbx
je 0x140029edf
lea rdx, [rsi + 0x190]
mov rdi, rcx
add rdx, r14
sub rdi, r14
sub rdi, rsi
mov r8, rbx
mov al, byte [rdi + rdx - 0x190]
xor byte [rdx], al
inc rdx
sub r8, 1
jne 0x140029ea2
jmp 0x140029ebb
test rbx, rbx
je 0x140029edf
mov r8, r14
mov rdx, rbp
sub r8, rcx
mov rdi, rbx
add r8, r15
sub rdx, rcx
mov al, byte [r8 + rcx]
xor al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
sub rdi, 1
jne 0x140029ecd
cmp dword [rsi + 0x1a0], 1
jne 0x140029f0f
test rbx, rbx
je 0x140029f0f
lea rcx, [rsi + 0x190]
sub rbp, r14
add rcx, r14
sub rbp, rsi
mov al, byte [rcx + rbp - 0x190]
xor byte [rcx], al
inc rcx
sub rbx, 1
jne 0x140029efd
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002a344
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xe0]
lea rdi, [r11 - 0x38]
mov rsi, qword [rsp + 0xe8]
mov rbx, rdx
mov rdx, qword [rsp + 0xc0]
mov qword [r11 - 0x48], rdi
mov rdi, qword [rsp + 0xd8]
mov qword [r11 - 0x50], rdi
mov qword [r11 - 0x58], rsi
mov qword [r11 - 0x60], rax
mov rax, qword [rsp + 0xc8]
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x70], rdx
xor edx, edx
mov qword [r11 - 0x78], r9
mov r9, r8
mov r8, rbx
call fcn.14002a2a4
test eax, eax
jne 0x14002a411
xor r9d, r9d
xor r8d, r8d
test rdi, rdi
je 0x14002a40f
mov r10, qword [rsp + 0xd0]
lea rax, [rsp + 0x60]
sub r10, rax
lea rax, [rsp + 0x60]
add rax, r8
inc r8
movzx edx, byte [r10 + rax]
movzx eax, byte [rax]
xor edx, eax
or r9d, edx
cmp r8, rdi
jb 0x14002a3d7
test r9d, r9d
je 0x14002a40f
test rbx, rbx
je 0x14002a408
mov rdi, rsi
xor eax, eax
mov rcx, rbx
rep stosb byte [rdi], al
mov eax, 0xffffffee
jmp 0x14002a411
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014b850
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x14002ab64
Capabilities:
Hash data using sha1
Hash data using sha256
Hash data using sha512

Disassembly:
xor r8d, r8d
test rcx, rcx
je 0x14002abf6
mov rdx, qword [rcx]
test rdx, rdx
je 0x14002abf6
mov edx, dword [rdx + 8]
sub edx, 1
je 0x14002abcf
sub edx, 1
je 0x14002ab9e
sub edx, 1
je 0x14002abc1
sub edx, 1
je 0x14002abbd
sub edx, 1
je 0x14002abaf
sub edx, 1
je 0x14002abab
cmp edx, 1
jne 0x14002abf6
mov rax, qword [rcx + 8]
mov dword [rax + 0x18], 0xc3d2e1f0
jmp 0x14002abd3
xor edx, edx
jmp 0x14002abb4
mov edx, 1
mov rcx, qword [rcx + 8]
jmp fcn.140035a70
xor edx, edx
jmp 0x14002abc6
mov edx, 1
mov rcx, qword [rcx + 8]
jmp fcn.140034a94
mov rax, qword [rcx + 8]
mov dword [rax + 0x14], 0x10325476
mov dword [rax + 0x10], 0x98badcfe
mov dword [rax + 0xc], 0xefcdab89
mov dword [rax + 8], 0x67452301
mov qword [rax], r8
xor eax, eax
jmp 0x14002abfb
mov eax, 0xffffaf00
ret
Function at 0x14002bce0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x68]
xor ebx, ebx
mov rsi, qword [rbp + 0x60]
xor r14d, r14d
mov rdi, r9
mov qword [rbp - 0x40], rcx
mov r9, r8
mov qword [rbp - 0x30], rax
and qword [rax], rbx
mov r15d, edx
test edx, edx
jne 0x14002bd77
lea rax, [rdi + 8]
cmp qword [rbp + 0x70], rax
jb 0x14002bf0d
lea rax, [rdi - 0x10]
movabs rcx, 0x1ffffffffffffe8
cmp rax, rcx
ja 0x14002bf0d
test dil, 7
jne 0x14002bf0d
mov rax, qword [0x14018f3f8]
lea r12, [rsi + 8]
mov rcx, r12
mov qword [rsi], rax
mov r8, rdi
mov rdx, r9
call fcn.14014d312
jmp 0x14002bde3
mov rcx, rdi
mov eax, 8
and ecx, 7
sub rax, rcx
neg rcx
sbb r14, r14
and r14, rax
lea rax, [rdi + 8]
add rax, r14
cmp qword [rbp + 0x70], rax
jb 0x14002bf0d
lea rax, [rdi - 1]
mov ecx, 0xfffffffe
cmp rax, rcx
ja 0x14002bf0d
mov eax, dword [0x14018f3f0]
lea r12, [rsi + 8]
mov dword [rsi], eax
mov r8, rdi
mov eax, edi
mov rdx, r9
bswap eax
mov rcx, r12
mov dword [rsi + 4], eax
call fcn.14014d59b
lea rcx, [rsi + 8]
mov r8, r14
add rcx, rdi
xor edx, edx
call fcn.14014d30c
lea rax, [rdi + r14]
shr rax, 3
lea r13, [rax + rax*2]
add r13, r13
lea r14, [rax + 1]
cmp r15d, 1
jne 0x14002be58
cmp rdi, 8
ja 0x14002be58
movups xmm0, xmmword [rsi]
mov rcx, qword [rbp - 0x40]
lea rax, [rbp - 0x38]
mov r9, rsi
mov qword [rsp + 0x20], rax
lea r8d, [r15 + 0xf]
lea rdx, [rbp - 0x28]
movdqu xmmword [rbp - 0x28], xmm0
call fcn.14001eb98
mov ebx, eax
test eax, eax
jne 0x14002be66
mov rdx, qword [rbp - 0x30]
lea rax, [r14*8]
mov qword [rdx], rax
xor eax, eax
lea rdi, [rbp - 0x28]
lea edx, [rax + 0x10]
mov ecx, edx
rep stosb byte [rdi], al
lea rdi, [rbp - 0x18]
mov ecx, edx
rep stosb byte [rdi], al
mov eax, ebx
jmp 0x14002bf12
mov r15, r12
cmp r14, 3
jae 0x14002be7a
mov ebx, 0xffff9f00
lea r8, [r14*8]
xor edx, edx
mov rcx, rsi
call fcn.14014d30c
jmp 0x14002be3c
mov edi, 1
jmp 0x14002beff
mov rax, qword [rsi]
lea r9, [rbp - 0x18]
mov rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x28], rax
mov r8d, 0x10
mov rax, qword [r15]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call fcn.14001eb98
mov ebx, eax
test eax, eax
jne 0x14002be66
mov rax, qword [rbp - 0x18]
lea r9d, [rbx + 8]
mov qword [rsi], rax
mov rdx, rsi
xor r8d, r8d
mov ecx, 0x38
mov rax, rdi
sub cl, r8b
add r8, 8
shr rax, cl
xor byte [rdx], al
inc rdx
sub r9, 1
jne 0x14002bec6
mov rax, qword [rbp - 0x10]
lea rcx, [r15 + 8]
mov qword [r15], rax
inc rdi
lea rax, [rsi + r14*8]
mov r15, r12
cmp rcx, rax
cmovb r15, rcx
cmp rdi, r13
jbe 0x14002be81
jmp 0x14002be2d
mov eax, 0xffff9f00
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002bf38
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r12, qword [rsp + 0xe8]
xor esi, esi
mov rbp, qword [rsp + 0xe0]
mov r15, r9
mov rbx, r8
mov qword [rsp + 0x30], rcx
and qword [r12], rsi
cmp r8, 3
jae 0x14002bf89
mov eax, 0xffff9f00
jmp 0x14002c074
mov rax, qword [rdx]
lea rdi, [r8*8 - 8]
mov r8, rdi
mov qword [r9], rax
add rdx, 8
mov rcx, rbp
call fcn.14014d312
lea r13, [rbx*8]
lea rax, [rbx + rbx*2]
lea r14, [rbp - 0x10]
lea rbx, [rax*2 - 6]
add r14, r13
jmp 0x14002c04d
xor r8d, r8d
mov rdx, r15
lea r9d, [r8 + 8]
mov ecx, 0x38
mov rax, rbx
sub cl, r8b
add r8, 8
shr rax, cl
xor byte [rdx], al
inc rdx
sub r9, 1
jne 0x14002bfd0
mov rax, qword [r15]
lea r9, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov r8d, 0x10
mov rax, qword [r14]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.14001eb98
mov esi, eax
test eax, eax
jne 0x14002c092
mov rcx, qword [rsp + 0x50]
dec rbx
mov qword [r15], rcx
cmp r14, rbp
mov rcx, qword [rsp + 0x58]
mov qword [r14], rcx
lea rcx, [r14 - 8]
lea r14, [rbp - 0x10]
lea r14, [r14 + r13]
cmovne r14, rcx
cmp rbx, 1
jae 0x14002bfc6
mov qword [r12], rdi
xor eax, eax
lea rdi, [rsp + 0x40]
lea edx, [rax + 0x10]
mov ecx, edx
rep stosb byte [rdi], al
lea rdi, [rsp + 0x50]
mov ecx, edx
rep stosb byte [rdi], al
mov eax, esi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14014b850
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8, rdi
xor edx, edx
mov rcx, rbp
call fcn.14014d30c
jmp 0x14002c05b
Function at 0x14002c0a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140250028]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, qword [rbp + 0x68]
lea rax, [r9 - 8]
mov r15, qword [rbp + 0x60]
mov rsi, r9
mov rdi, r8
and qword [r14], 0
cmp qword [rbp + 0x70], rax
jb 0x14002c2ec
mov r13d, 1
test edx, edx
jne 0x14002c178
lea rax, [r9 - 0x18]
movabs rdx, 0x1ffffffffffffe8
cmp rax, rdx
ja 0x14002c2ec
test sil, 7
jne 0x14002c2ec
shr rsi, 3
lea r9, [rbp - 0x28]
mov r8, rsi
mov qword [rsp + 0x28], r14
mov rdx, rdi
mov qword [rsp + 0x20], r15
call fcn.14002bf38
mov ebx, eax
test eax, eax
jne 0x14002c2ba
xor eax, eax
lea r8, sym.MZ__z____L_h__Btd_qo_Tab_1tg9cSS_bQ__yRTw3S
xor edi, edi
movzx ecx, byte [rax + r8 + 0x18f3f8]
movzx edx, byte [rbp + rax - 0x28]
add rax, r13
xor edx, ecx
or edi, edx
cmp rax, 8
jb 0x14002c14a
test dil, dil
je 0x14002c2cb
mov ebx, 0xffff9d00
jmp 0x14002c2ba
cmp edx, r13d
jne 0x14002c2b5
lea rax, [r9 - 0x10]
mov edx, 0xfffffff0
cmp rax, rdx
ja 0x14002c2ec
test sil, 7
jne 0x14002c2ec
mov r12d, 0x10
mov rdx, rdi
cmp rsi, r12
jne 0x14002c1ed
lea rax, [rbp - 0x28]
mov r8d, r12d
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
call fcn.14001eb98
mov ebx, eax
test eax, eax
jne 0x14002c2ba
mov rax, qword [rbp - 0x20]
lea rdi, [rbp - 0x20]
mov qword [rbp - 0x28], rax
mov ecx, r12d
mov rax, qword [rbp - 0x18]
mov qword [r15], rax
xor eax, eax
rep stosb byte [rdi], al
mov qword [r14], 8
jmp 0x14002c211
mov r8, rsi
mov qword [rsp + 0x28], r14
shr r8, 3
lea r9, [rbp - 0x28]
mov qword [rsp + 0x20], r15
call fcn.14002bf38
mov ebx, eax
test eax, eax
jne 0x14002c2ba
xor edx, edx
lea r8, sym.MZ__z____L_h__Btd_qo_Tab_1tg9cSS_bQ__yRTw3S
xor r9d, r9d
movzx eax, byte [rdx + r8 + 0x18f3f0]
movzx ecx, byte [rbp + rdx - 0x28]
add rdx, r13
xor ecx, eax
or r9d, ecx
cmp rdx, 4
jb 0x14002c21d
mov r12d, dword [rbp - 0x24]
test r9b, r9b
mov rdx, qword [r14]
mov edi, ebx
mov ebx, 0xffff9d00
cmovne edi, ebx
bswap r12d
mov r12d, r12d
sub rsi, r12
lea rax, [rsi - 8]
cmp rax, 7
mov r9, rax
cmova edi, ebx
and r9d, 7
cmp rax, 7
cmovbe r9, rax
xor ecx, ecx
xor r8b, r8b
add rdx, 0xfffffffffffffff8
lea r10d, [rcx + 8]
sub r10, r9
add rdx, r15
cmp rcx, r10
jb 0x14002c28b
or r8b, byte [rdx]
add rcx, r13
add rdx, r13
cmp rcx, 8
jb 0x14002c283
test r8b, r8b
jne 0x14002c2ba
mov ebx, edi
test edi, edi
jne 0x14002c2ba
lea rcx, [r12 + r15]
mov r8, r9
xor edx, edx
call fcn.14014d30c
mov qword [r14], r12
jmp 0x14002c2cb
mov ebx, 0xffff9f80
mov r8, qword [r14]
xor edx, edx
mov rcx, r15
call fcn.14014d30c
and qword [r14], 0
xor eax, eax
lea rdi, [rbp - 0x30]
mov rcx, r13
rep stosb byte [rdi], al
lea rdi, [rbp - 0x2f]
mov rcx, r13
rep stosb byte [rdi], al
lea ecx, [rax + 8]
lea rdi, [rbp - 0x28]
rep stosb byte [rdi], al
mov eax, ebx
jmp 0x14002c2f1
mov eax, 0xffff9f00
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14014b850
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret