joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003ed40
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov rsi, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov rbp, r8
mov dword [rcx + 0x10], 0x98badcfe
mov rdi, rdx
mov dword [rcx + 0x14], 0x10325476
mov rcx, rdx
call fcn.18000f9b0
mov rcx, rdi
mov ebx, eax
call fcn.18000f9c0
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call fcn.18003eef0
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18003edc0

Function at 0x18003eec0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret
Function at 0x180050350
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r8
mov rdi, rcx
mov qword [rsp + 0x20], rcx
cmp dword [rcx + 8], 0x62cb09e3
je 0x180050398
xor al, al
jmp 0x1800505a2
xor esi, esi
mov r15d, esi
test rdx, rdx
cmovns r15, rdx
cmp byte [r8 + 0xd6], sil
je 0x1800503d1
cmp byte [rcx + 0xdc], sil
jne 0x1800503d1
cmp qword [rcx + 0xb8], rsi
jle 0x1800503d1
mov r8, r15
lea rdx, str.consumeProgress
mov rcx, r14
call fcn.180039750
mov byte [rsp + 0x30], sil
mov r13d, esi
cmp byte [rdi + 0xdc], sil
jne 0x180050476
cmp qword [rdi + 0xb8], rsi
jle 0x180050476
mov rbx, qword [rdi + 0xc0]
mov r8, qword [rdi + 0xb8]
mov rdx, rbx
mov rcx, rdi
call fcn.180050880
mov r13d, eax
lea rax, [rbx + r15]
mov qword [rdi + 0xc0], rax
cmp rax, qword [rdi + 0xb8]
jle 0x180050476
cmp byte [r14 + 0xd6], sil
je 0x180050468
mov rax, qword [r14]
lea rdx, str.Amount_consumed_is_greater_than_the_total.
mov rcx, r14
call qword [rax + 0x28]
mov r8, qword [rdi + 0xc0]
lea rdx, str.m_consumed64
mov rcx, r14
call fcn.180039750
mov r8, qword [rdi + 0xb8]
lea rdx, str.m_totalAmount64
mov rcx, r14
call fcn.180039750
mov rax, qword [rdi + 0xb8]
mov qword [rdi + 0xc0], rax
movzx ebx, byte [rdi + 0xdc]
test bl, bl
jne 0x18005049e
mov r8, qword [rdi + 0xb8]
test r8, r8
jle 0x18005049e
mov rdx, qword [rdi + 0xc0]
mov rcx, rdi
call fcn.180050880
mov esi, eax
mov rax, qword [rdi + 0xa8]
test rax, rax
je 0x18005059b
test bl, bl
jne 0x180050522
cmp esi, r13d
jbe 0x180050522
cmp esi, dword [rdi + 0xa0]
jbe 0x180050522
call sub.KERNEL32.dll_GetTickCount
mov dword [rdi + 0xb4], eax
cmp byte [rdi + 0xde], bl
je 0x1800504de
cmp esi, dword [rdi + 0xd4]
je 0x18005058d
mov dword [rdi + 0xa0], esi
cmp byte [r14 + 0xd6], 0
je 0x180050501
mov r8d, esi
lea rdx, str.percentDoneCB
mov rcx, r14
call fcn.1800397c0
nop
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x18005051e
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, esi
call qword [rax + 0x10]
jmp 0x180050586
test rax, rax
je 0x18005059b
cmp byte [rdi + 0xdd], 0
jne 0x18005059b
cmp dword [rdi + 0xd0], 0
je 0x18005059b
call sub.KERNEL32.dll_GetTickCount
mov edx, eax
mov ecx, eax
sub ecx, dword [rdi + 0xb4]
mov eax, dword [rdi + 0xd0]
mov r8d, 0x12c
test eax, eax
cmove eax, r8d
cmp ecx, eax
jbe 0x18005059b
mov dword [rdi + 0xd8], edx
mov dword [rdi + 0xb4], edx
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x180050586
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x18]
nop
jmp 0x18005058d
cmp byte [rsp + 0x30], 0
je 0x18005059b
mov byte [rdi + 0xb1], 1
movzx eax, byte [rdi + 0xb1]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800c9b90
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x180051710
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r8
mov esi, ecx
test ecx, ecx
jns 0x180051742
xor al, al
jmp 0x1800517b6
test rbx, rbx
je 0x18005173e
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea r8, str.getEntropy
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180039180
nop
xor bpl, bpl
call fcn.18001c380
mov rdi, rax
test rax, rax
jne 0x180051781
xor bl, bl
jmp 0x1800517a9
mov r8, rbx
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
movzx ebx, bpl
mov ecx, 1
test eax, eax
cmovne ebx, ecx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
nop
lea rcx, [rsp + 0x28]
call fcn.1800392a0
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800c9b90
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x180055c00
Capabilities:
Hash data using crc32b

Disassembly:
push rdi
sub rsp, 0x20
cmp byte [0x180180248], 0
jne 0x180055e22
movzx eax, byte [0x180180249]
mov qword [rsp + 0x30], rbx
test al, al
jne 0x180055df4
cmp qword [0x180180250], 0
jne 0x180055e1d
mov ecx, 0x100
mov byte [0x180180249], 1
call fcn.18002b2c0
mov rdi, rax
test rax, rax
je 0x180055e1d
xor ebx, ebx
mov r11, rax
mov r10d, ebx
nop word [rax + rax]
mov ecx, r10d
mov r8d, r10d
and ecx, 1
shr r8d, 1
shl ecx, 7
mov eax, r8d
mov edx, ecx
or edx, 0x40
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 0x20
and al, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
mov eax, r8d
or edx, 0x10
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 8
and al, 1
cmove ecx, edx
shr r8d, 1
mov edx, ecx
mov eax, r8d
or edx, 4
and al, 1
cmove edx, ecx
shr r8d, 1
mov ecx, edx
mov eax, r8d
or ecx, 2
and al, 1
cmove ecx, edx
mov eax, ecx
or eax, 1
and r8b, 2
cmove eax, ecx
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [rcx + rcx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [rdx + rdx]
xor ecx, eax
mov eax, ecx
sar eax, 0x1f
add ecx, ecx
and eax, 0x4c11db7
mov r9d, ebx
xor eax, ecx
mov r8d, 0x1e
mov dword [r11], eax
test al, 1
je 0x180055d76
lea ecx, [r8 + 1]
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
test al, 1
je 0x180055d89
mov ecx, r8d
mov edx, 1
shl edx, cl
or r9d, edx
shr eax, 1
sub r8d, 2
cmp r8d, 0xfffffffe
jg 0x180055d64
mov dword [r11], r9d
inc r10d
add r11, 4
cmp r10d, 0xff
jbe 0x180055c60
cmp qword [0x180180250], rbx
jne 0x180055dd4
mov byte [0x180180249], bl
mov rbx, qword [rsp + 0x30]
mov qword [0x180180250], rdi
mov byte [0x180180248], 1
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.1800c96f4
mov byte [0x180180249], bl
mov rbx, qword [rsp + 0x30]
mov byte [0x180180248], 1
add rsp, 0x20
pop rdi
ret
xor ebx, ebx
test al, al
je 0x180055e1d
nop word [rax + rax]
mov ecx, 2
call sub.KERNEL32.dll_Sleep
inc ebx
cmp ebx, 0xc8
ja 0x180055e1d
cmp byte [0x180180249], 0
jne 0x180055e00
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180055e30
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r11d, r8d
mov r10, rdx
mov rbx, rcx
test rdx, rdx
je 0x180055eed
test r8d, r8d
je 0x180055eed
cmp r11d, 0x10
jb 0x180055eb0
mov eax, dword [rcx + 8]
mov qword [rsp + 0x10], rdi
mov edi, r11d
shr rdi, 4
xor r9d, r9d
nop word [rax + rax]
movzx edx, byte [r9 + r10]
mov r8d, eax
movzx ecx, al
inc r9
xor rdx, rcx
shr r8d, 8
mov rcx, qword [0x180180250]
mov edx, dword [rcx + rdx*4]
xor edx, r8d
mov dword [rbx + 8], edx
mov eax, edx
cmp r9, 0x10
jl 0x180055e70
add r11d, 0xfffffff0
add r10, 0x10
sub rdi, 1
jne 0x180055e62
mov rdi, qword [rsp + 0x10]
test r11d, r11d
je 0x180055eed
mov r8d, dword [rbx + 8]
nop dword [rax]
movzx eax, byte [r10]
lea r10, [r10 + 1]
movzx ecx, r8b
mov edx, r8d
xor rcx, rax
shr edx, 8
mov rax, qword [0x180180250]
mov ecx, dword [rax + rcx*4]
xor ecx, edx
mov dword [rbx + 8], ecx
mov r8d, ecx
add r11d, 0xffffffff
jne 0x180055ec0
pop rbx
ret
Function at 0x18007a4a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
movsxd rdi, r8d
add rcx, 8
mov rsi, rdx
call fcn.180015b30
lea rcx, [rbx + 0x38]
mov rbp, rax
call fcn.180015b30
lea ecx, [rdi + 1]
mov r10, rax
movsxd r9, ecx
lea rdi, [rsi + rdi*4]
mov ebx, dword [rsi + r9*4]
lea r14, [rsi + r9*4]
mov r9d, dword [rdi]
xor r9d, dword [rbp]
xor r11d, r11d
nop word [rax + rax]
inc r11d
mov ecx, r9d
and ecx, 0xff0000
mov eax, r9d
shr rax, 0x18
bts rcx, 0x18
shr rcx, 0x10
mov edx, dword [r10 + rcx*4]
add edx, dword [r10 + rax*4]
mov eax, r9d
and eax, 0xff00
bts rax, 0x11
shr rax, 8
xor edx, dword [r10 + rax*4]
movzx eax, r9b
or rax, 0x300
add edx, dword [r10 + rax*4]
xor edx, dword [rbp + r11*4]
inc r11d
xor ebx, edx
mov ecx, ebx
and ecx, 0xff0000
mov eax, ebx
shr rax, 0x18
bts rcx, 0x18
shr rcx, 0x10
mov edx, dword [r10 + rcx*4]
add edx, dword [r10 + rax*4]
mov eax, ebx
and eax, 0xff00
bts rax, 0x11
shr rax, 8
xor edx, dword [r10 + rax*4]
movzx eax, bl
or rax, 0x300
add edx, dword [r10 + rax*4]
xor edx, dword [rbp + r11*4]
xor r9d, edx
cmp r11d, 0xe
jbe 0x18007a500
mov eax, dword [rbp + 0x44]
mov rbp, qword [rsp + 0x38]
xor eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov dword [rdi], eax
mov rdi, qword [rsp + 0x48]
mov dword [r14], r9d
add rsp, 0x20
pop r14
ret
Function at 0x18007a980
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rcx
xor ebx, ebx
add rcx, 8
mov qword [rsp + 0x20], rbx
mov r13d, r8d
call fcn.180015e00
cdq
lea rcx, [r14 + 0x38]
and edx, 3
add eax, edx
sar eax, 2
movsxd rsi, eax
call fcn.180015e00
cdq
lea rcx, [r14 + 8]
and edx, 3
add eax, edx
sar eax, 2
mov dword [rsp + 0x88], eax
call fcn.180015b30
lea rcx, [r14 + 0x38]
mov r15, rax
call fcn.180015b30
mov r12, rax
mov r11d, ebx
test rsi, rsi
jle 0x18007aa5e
mov r10, qword [rsp + 0x78]
mov eax, ebx
nop dword [rax + rax]
movsxd rcx, eax
inc eax
cdq
idiv r13d
movzx r8d, byte [rcx + r10]
movsxd rcx, edx
shl r8d, 8
lea eax, [rdx + 1]
movzx r9d, byte [rcx + r10]
cdq
idiv r13d
or r9d, r8d
movsxd rax, edx
shl r9d, 8
movzx r8d, byte [rax + r10]
lea eax, [rdx + 1]
cdq
or r8d, r9d
idiv r13d
shl r8d, 8
movsxd rax, edx
movzx ecx, byte [rax + r10]
lea eax, [rdx + 1]
cdq
or ecx, r8d
xor dword [r15 + r11*4], ecx
inc r11
idiv r13d
mov eax, edx
cmp r11, rsi
jl 0x18007aa00
mov rdi, rbx
test rsi, rsi
jle 0x18007aa9a
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.18007a4a0
mov eax, dword [rsp + 0x20]
mov dword [r15 + rdi*4], eax
mov eax, dword [rsp + 0x24]
mov dword [r15 + rdi*4 + 4], eax
add rdi, 2
cmp rdi, rsi
jl 0x18007aa70
movsxd rdi, dword [rsp + 0x88]
test rdi, rdi
jle 0x18007aada
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.18007a4a0
mov eax, dword [rsp + 0x20]
mov dword [r12 + rbx*4], eax
mov eax, dword [rsp + 0x24]
mov dword [r12 + rbx*4 + 4], eax
add rbx, 2
cmp rbx, rdi
jl 0x18007aab0
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18007ab00
Capabilities:
Encode data using xor

Disassembly:
push rdi
push r12
push r15
sub rsp, 0x30
xor eax, eax
movzx r12d, r8w
mov r15, rdx
movzx edi, ax
cmp ax, r8w
jae 0x18007ac56
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
lea rbp, [rcx + 0x38]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], r13
lea r13, [rcx + 8]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x68], rbp
nop word [rax + rax]
movzx eax, di
mov rcx, r13
lea ebx, [rax + rax]
call fcn.180015b30
mov rcx, rbp
mov rsi, rax
call fcn.180015b30
lea ecx, [rbx + 1]
mov r10, rax
mov ebp, dword [r15 + rcx*4]
lea r14, [r15 + rcx*4]
mov ecx, dword [r15 + rbx*4]
xor ecx, dword [rsi]
xor r11d, r11d
inc r11d
mov edx, ecx
and edx, 0xff0000
mov eax, ecx
shr rax, 0x18
bts rdx, 0x18
shr rdx, 0x10
mov r8d, dword [r10 + rdx*4]
add r8d, dword [r10 + rax*4]
mov eax, ecx
and eax, 0xff00
bts rax, 0x11
shr rax, 8
xor r8d, dword [r10 + rax*4]
movzx eax, cl
or rax, 0x300
add r8d, dword [r10 + rax*4]
xor r8d, dword [rsi + r11*4]
inc r11d
xor ebp, r8d
mov edx, ebp
and edx, 0xff0000
mov eax, ebp
shr rax, 0x18
bts rdx, 0x18
shr rdx, 0x10
mov r8d, dword [r10 + rdx*4]
add r8d, dword [r10 + rax*4]
mov eax, ebp
and eax, 0xff00
bts rax, 0x11
shr rax, 8
xor r8d, dword [r10 + rax*4]
movzx eax, bpl
or rax, 0x300
add r8d, dword [r10 + rax*4]
xor r8d, dword [rsi + r11*4]
xor ecx, r8d
cmp r11d, 0xe
jbe 0x18007ab80
mov eax, dword [rsi + 0x44]
inc di
xor eax, ebp
mov dword [r14], ecx
mov rbp, qword [rsp + 0x68]
mov dword [r15 + rbx*4], eax
cmp di, r12w
jb 0x18007ab50
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r12
pop rdi
ret
Function at 0x18007ae29
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rdx, rdx
je 0x18007af77
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x40
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx eax, byte [rcx + 0x130]
lea r8, [rcx + 8]
mov rbx, rdx
shl al, 3
movzx edx, byte [rcx + 0x134]
mov rsi, rcx
and dl, 7
mov qword [rsp + 0x60], rdi
or dl, al
mov eax, dword [rcx + 0x130]
shl dl, 3
lea rcx, [rsp + 0x22]
or dl, 1
sar eax, 2
lea rdi, [rsi + 0x10]
mov byte [rsp + 0x20], dl
mov byte [rsp + 0x21], al
mov rdx, r8
cmp r8, rdi
jae 0x18007aeb7
nop
movzx eax, byte [rdx]
mov byte [rcx], al
lea rcx, [rcx + 4]
movzx eax, byte [rdx + 1]
mov byte [rcx - 3], al
movzx eax, byte [rdx + 2]
mov byte [rcx - 2], al
movzx eax, byte [rdx + 3]
add rdx, 4
mov byte [rcx - 1], al
cmp rdx, rdi
jb 0x18007ae90
mov eax, dword [r8]
mov r8d, 0x76
shr eax, 3
and eax, 0x7f
cmp eax, 0x76
jb 0x18007aed1
mov r8d, 0xf6
sub r8d, eax
lea rdx, [0x180178670]
mov rcx, rsi
call fcn.18007af80
mov r8d, 0xa
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.18007af80
mov rcx, rsi
call fcn.180080940
mov eax, dword [rsi + 0x130]
sar eax, 5
movsxd rcx, eax
add rcx, 4
lea rcx, [rsi + rcx*4]
cmp rdi, rcx
jae 0x18007af5b
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rbx], al
lea rbx, [rbx + 4]
movzx eax, byte [rdi + 1]
mov byte [rbx - 3], al
movzx eax, byte [rdi + 2]
mov byte [rbx - 2], al
movzx eax, byte [rdi + 3]
add rdi, 4
mov byte [rbx - 1], al
mov eax, dword [rsi + 0x130]
sar eax, 5
movsxd rcx, eax
add rcx, 4
lea rcx, [rsi + rcx*4]
cmp rdi, rcx
jb 0x18007af20
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800c9b90
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret

Function at 0x180080de0
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
cmp dword [rcx + 0x10], 0x100
jle fcn.180081e40
jmp fcn.180083b20
Function at 0x180080e00
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov edx, dword [rcx + 0x10]
sub edx, 0xa0
je 0x180080f2a
sub edx, 0x60
je 0x180080eeb
sub edx, 0x80
je 0x180080e82
cmp edx, 0x80
jne 0x180080f53
mov rax, qword [0x1801815c0]
mov qword [rcx + 0x40], rax
mov rax, qword [0x1801815c8]
mov qword [rcx + 0x48], rax
mov rax, qword [0x1801815d0]
mov qword [rcx + 0x50], rax
mov rax, qword [0x1801815d8]
mov qword [rcx + 0x58], rax
mov rax, qword [0x1801815e0]
mov qword [rcx + 0x60], rax
mov rax, qword [0x1801815e8]
mov qword [rcx + 0x68], rax
mov rax, qword [0x1801815f0]
mov qword [rcx + 0x70], rax
mov rax, qword [0x1801815f8]
jmp 0x180080ed6
mov rax, qword [0x180181300]
mov qword [rcx + 0x40], rax
mov rax, qword [0x180181308]
mov qword [rcx + 0x48], rax
mov rax, qword [0x180181310]
mov qword [rcx + 0x50], rax
mov rax, qword [0x180181318]
mov qword [rcx + 0x58], rax
mov rax, qword [0x180181320]
mov qword [rcx + 0x60], rax
mov rax, qword [0x180181328]
mov qword [rcx + 0x68], rax
mov rax, qword [0x180181330]
mov qword [rcx + 0x70], rax
mov rax, qword [0x180181338]
mov qword [rcx + 0x78], rax
xor eax, eax
mov qword [rcx + 0x80], rax
mov qword [rcx + 0x88], rax
ret
xor eax, eax
mov dword [rcx + 0x14], 0x6a09e667
mov dword [rcx + 0x18], 0xbb67ae85
mov dword [rcx + 0x1c], 0x3c6ef372
mov dword [rcx + 0x20], 0xa54ff53a
mov dword [rcx + 0x24], 0x510e527f
mov dword [rcx + 0x28], 0x9b05688c
mov dword [rcx + 0x2c], 0x1f83d9ab
mov qword [rcx + 0x30], 0x5be0cd19
mov dword [rcx + 0x38], eax
ret
xor eax, eax
mov dword [rcx + 0x14], 0x67452301
mov dword [rcx + 0x18], 0xefcdab89
mov dword [rcx + 0x1c], 0x98badcfe
mov dword [rcx + 0x20], 0x10325476
mov dword [rcx + 0x24], 0xc3d2e1f0
mov qword [rcx + 0x34], rax
ret
Function at 0x180081890
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
cmp byte [0x180181600], 0
jne 0x180081a6b
movabs rax, 0xff00ff00ff00ff00
lea rdx, [0x180181348]
mov qword [0x180181608], rax
lea r8, [0x1801351e8]
movabs rax, 0xff00ff00ff00ff
mov qword [0x180181610], rax
movabs rax, 0xffff0000ffff0000
mov qword [0x180181618], rax
movabs rax, 0xffff0000ffff
mov qword [0x180181620], rax
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [0x180181300], rax
movabs rax, 0x629a292a367cd507
mov qword [0x180181308], rax
movabs rax, 0x9159015a3070dd17
mov qword [0x180181310], rax
movabs rax, 0x152fecd8f70e5939
mov qword [0x180181318], rax
movabs rax, 0x67332667ffc00b31
mov qword [0x180181320], rax
movabs rax, 0x8eb44a8768581511
mov qword [0x180181328], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [0x180181330], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [0x180181338], rax
lea rax, [0x180134ce8]
nop
mov rcx, qword [rax - 8]
lea rdx, [rdx + 0x28]
shl rcx, 0x20
or rcx, qword [rax]
mov qword [rdx - 0x30], rcx
mov rcx, qword [rax + 8]
shl rcx, 0x20
or rcx, qword [rax + 0x10]
mov qword [rdx - 0x28], rcx
mov rcx, qword [rax + 0x18]
shl rcx, 0x20
or rcx, qword [rax + 0x20]
mov qword [rdx - 0x20], rcx
mov rcx, qword [rax + 0x28]
shl rcx, 0x20
or rcx, qword [rax + 0x30]
mov qword [rdx - 0x18], rcx
mov rcx, qword [rax + 0x38]
shl rcx, 0x20
or rcx, qword [rax + 0x40]
add rax, 0x50
mov qword [rdx - 0x10], rcx
cmp rax, r8
jl 0x180081980
movabs rax, 0x6a09e667f3bcc908
mov byte [0x180181600], 1
mov qword [0x1801815c0], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [0x1801815c8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [0x1801815d0], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [0x1801815d8], rax
movabs rax, 0x510e527fade682d1
mov qword [0x1801815e0], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [0x1801815e8], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [0x1801815f0], rax
movabs rax, 0x5be0cd19137e2179
mov qword [0x1801815f8], rax
ret
Function at 0x180081ae0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
lea r8, [rcx + 0x90]
mov r9d, esi
mov rdi, rcx
movzx eax, byte [r8 + 1]
movzx edx, byte [r8]
lea r8, [r8 + 4]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 2]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 1]
shl edx, 8
or edx, eax
mov dword [rsp + r9*4], edx
inc r9
cmp r9, 0x10
jl 0x180081b20
lea rax, [rsp + 8]
mov edx, 0x40
nop dword [rax]
mov ecx, dword [rax + 0x2c]
xor ecx, dword [rax + 0x18]
xor ecx, dword [rax - 8]
xor ecx, dword [rax]
lea rax, [rax + 4]
rol ecx, 1
mov dword [rax + 0x34], ecx
sub rdx, 1
jne 0x180081b60
mov r15d, dword [rdi + 0x14]
mov ebx, r15d
mov r12d, dword [rdi + 0x18]
mov r10d, r12d
mov ebp, dword [rdi + 0x1c]
mov r9d, ebp
mov r13d, dword [rdi + 0x20]
mov r11d, r13d
mov r14d, dword [rdi + 0x24]
nop dword [rax]
mov eax, r9d
lea r8d, [r14 + 0x5a827999]
and eax, r10d
mov ecx, r10d
not ecx
mov edx, ebx
and ecx, r11d
rol edx, 5
or ecx, eax
mov r14d, r11d
add edx, ecx
mov r11d, r9d
add edx, dword [rsp + rsi*4]
mov r9d, r10d
add r8d, edx
ror r9d, 2
inc rsi
mov r10d, ebx
mov ebx, r8d
cmp rsi, 0x14
jl 0x180081ba0
mov edx, 0x14
nop word [rax + rax]
rol r8d, 5
add r14d, 0x6ed9eba1
add r8d, dword [rsp + rdx*4]
mov ecx, r11d
xor ecx, r9d
add r8d, r14d
xor ecx, r10d
mov r14d, r11d
mov r11d, r9d
add r8d, ecx
mov r9d, r10d
inc rdx
ror r9d, 2
mov r10d, ebx
mov ebx, r8d
cmp rdx, 0x28
jl 0x180081bf0
mov edx, 0x28
nop
mov ecx, r9d
rol r8d, 5
or ecx, r10d
mov eax, r9d
and ecx, r11d
add r14d, 0x8f1bbcdc
and eax, r10d
add r8d, r14d
or ecx, eax
mov r14d, r11d
add ecx, dword [rsp + rdx*4]
mov r11d, r9d
mov r9d, r10d
add r8d, ecx
ror r9d, 2
inc rdx
mov r10d, ebx
mov ebx, r8d
cmp rdx, 0x3c
jl 0x180081c30
mov edx, 0x3c
nop word [rax + rax]
mov eax, dword [rsp + rdx*4]
add r14d, 0xca62c1d6
rol r8d, 5
mov ecx, r11d
xor ecx, r9d
add r8d, r14d
xor ecx, r10d
mov r14d, r11d
mov r11d, r9d
add eax, ecx
mov r9d, r10d
add r8d, eax
ror r9d, 2
inc rdx
mov r10d, ebx
mov ebx, r8d
cmp rdx, 0x50
jl 0x180081c80
add dword [rdi + 0x24], r14d
lea eax, [r15 + r8]
mov dword [rdi + 0x14], eax
lea eax, [r12 + r10]
mov dword [rdi + 0x18], eax
lea eax, [r9 + rbp]
mov dword [rdi + 0x1c], eax
lea eax, [r11 + r13]
mov dword [rdi + 0x20], eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800c9b90
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret