joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8370
Capabilities:
Encode data using xor

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x90
mov rax, qword [rcx]
mov rbx, rdx
mov rdx, r8
mov r8, r9
lea r9, [rsp + 0x20]
call qword [rax + 0xd0]
mov r12d, eax
test al, al
jne 0x4e83b0
mov eax, r12d
add rsp, 0x90
pop rbx
pop rsi
pop r12
ret
movdqu xmm0, xmmword [rsp + 0x20]
movdqu xmm1, xmmword [rsp + 0x30]
lea rsi, [rsp + 0x40]
mov edx, 0x21
lea rcx, [rsp + 0x60]
mov r8, rsi
mov byte [rsp + 0x80], 0x8d
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm1
call sym.cn_fast_hash
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [rsi + rdx]
xor byte [rbx + rdx], cl
add rdx, 1
cmp rdx, 8
jne 0x4e83f0
mov eax, r12d
add rsp, 0x90
pop rbx
pop rsi
pop r12
ret

Function at 0x4fead0
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
mov rbx, rcx
shl r8d, 8
movzx ecx, dl
lea r9, [rsp + 0x20]
or r8d, ecx
mov rdx, r9
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rbx + 4], eax
add rsp, 0x1c0
pop rbx
ret

Function at 0x4ff4b0
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push r14
mov eax, 0xfd0
push r13
push r12
push rsi
push rbx
call fcn.006ef990
sub rsp, rax
mov rsi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rdx + 8]
lea r9d, [rax + 1]
mov rbx, r8
lea r14, [rsp + 0x30]
mov r12, rcx
mov dword [rsp + 0x28], 0x3e8
mov qword [rsp + 0x20], r14
mov ecx, 0xfde9
mov r8, qword [rdx]
xor edx, edx
call rsi
mov rax, qword [rbx + 8]
lea r13, [rsp + 0x800]
xor edx, edx
mov dword [rsp + 0x28], 0x3e8
mov ecx, 0xfde9
mov qword [rsp + 0x20], r13
lea r9d, [rax + 1]
mov r8, qword [rbx]
call rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ff53d
and eax, 0xfffffffe
mov rcx, r13
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r8d, 1
mov rdx, r13
mov rcx, r14
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4ff580
call method.std::_V2.system_category__
mov dword [r12], ebx
mov qword [r12 + 8], rax
mov rax, r12
add rsp, 0xfd0
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4ff555
Function at 0x505610
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
mov r12, rcx
lea rcx, str.LANG
call sym.getenv
mov r13, rax
test rax, rax
je 0x505750
cmp byte [rax], 0
je 0x505750
lea rsi, [r12 + 0x10]
mov rcx, r13
lea rbx, [rsp + 0x30]
mov qword [r12], rsi
call sym.strlen
xor r9d, r9d
mov rdx, r13
mov rcx, r12
lea r8, [r13 + rax]
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
xor r8d, r8d
mov r9d, 1
mov rcx, r12
lea rdx, [0x008aad6f]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.find_char_const__unsigned_long_long__unsigned_long_long__const
mov rcx, qword [r12 + 8]
mov rdx, qword [r12]
lea r10, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
cmp rax, rcx
cmova rax, rcx
xor r9d, r9d
mov rcx, r10
lea r8, [rdx + rax]
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
mov rax, qword [rsp + 0x20]
mov rcx, qword [r12]
mov r8, qword [rsp + 0x28]
cmp rax, rbx
je 0x5057b0
mov rdx, qword [rsp + 0x30]
cmp rcx, rsi
je 0x505788
mov r9, qword [r12 + 0x10]
mov qword [r12], rax
mov qword [r12 + 8], r8
mov qword [r12 + 0x10], rdx
test rcx, rcx
je 0x505796
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], 0
mov byte [rcx], 0
mov rcx, qword [rsp + 0x20]
cmp rcx, rbx
je 0x50570e
call sym.operator_delete_void_
mov rbx, qword [r12]
mov r13, qword [r12 + 8]
mov rsi, qword [sym.imp.msvcrt.dll_tolower]
add r13, rbx
cmp r13, rbx
je 0x505741
nop word cs:[rax + rax]
movsx ecx, byte [rbx]
add rbx, 1
call rsi
mov byte [rbx - 1], al
cmp r13, rbx
jne 0x505730
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
lea rcx, str.LC_ALL
call sym.getenv
mov r13, rax
test rax, rax
jne 0x505770
lea r13, [0x008aad60]
jmp 0x50563e
cmp byte [rax], 0
jne 0x50563e
lea r13, [0x008aad60]
jmp 0x50563e
mov qword [r12], rax
mov qword [r12 + 8], r8
mov qword [r12 + 0x10], rdx
mov qword [rsp + 0x20], rbx
lea rbx, [rsp + 0x30]
mov rcx, rbx
jmp 0x5056f3
test r8, r8
je 0x5057cc
cmp r8, 1
je 0x5057e0
mov rdx, rbx
call sym.memcpy
mov r8, qword [rsp + 0x28]
mov rcx, qword [r12]
mov qword [r12 + 8], r8
mov byte [rcx + r8], 0
mov rcx, qword [rsp + 0x20]
jmp 0x5056f3
movzx eax, byte [rsp + 0x30]
mov byte [rcx], al
mov r8, qword [rsp + 0x28]
mov rcx, qword [r12]
jmp 0x5057cc
Function at 0x51bbf0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, rcx
mov eax, edx
test edx, edx
jle 0x51bdfb
sub eax, 1
mov rdx, qword [rcx]
mov r14d, 1
lea r12, [rcx + 0x28]
lea r13, [0x008b3f88]
lea rsi, [rsp + 0x20]
mov r10d, 0xcccccccd
lea rax, [r13 + rax*8]
lea rbp, [0x008b3f20]
mov qword [rsp + 8], rax
lea rax, [rcx + 8]
lea rdi, [0x008b3ec0]
mov qword [rsp + 0x10], rax
lea rax, [rcx + 0xc8]
mov qword [rsp + 0x18], rax
nop dword [rax]
mov r8, qword [rsp + 0x10]
mov r9, rsi
mov r11, rbx
mov rcx, rdx
mov rax, qword [r8 + 0x20]
xor rax, qword [r8 + 0x48]
add r9, 8
xor rax, qword [r8 + 0x70]
xor rax, qword [r8 + 0x98]
xor rax, rcx
mov qword [r9 - 8], rax
cmp r12, r8
je 0x51bca0
mov rcx, qword [r8]
add r8, 8
jmp 0x51bc6e
mov r8, qword [rsp + 0x18]
xor r9d, r9d
lea ecx, [r9 + 4]
mov rax, rcx
imul rcx, r10
shr rcx, 0x22
lea ecx, [rcx + rcx*4]
sub eax, ecx
lea ecx, [r9 + 1]
mov r9, rcx
imul rcx, r10
cdqe
mov r15d, r9d
shr rcx, 0x22
lea ecx, [rcx + rcx*4]
sub r15d, ecx
movsxd rcx, r15d
mov rcx, qword [rsp + rcx*8 + 0x20]
rol rcx, 1
xor rcx, qword [rsp + rax*8 + 0x20]
lea rax, [r8 - 0xc8]
xor rdx, rcx
mov qword [rax], rdx
add rax, 0x28
cmp r8, rax
je 0x51bd0f
mov rdx, qword [rax]
add rax, 0x28
xor rdx, rcx
mov qword [rax - 0x28], rdx
cmp r8, rax
jne 0x51bcfc
add r8, 8
cmp r9d, 5
je 0x51bd28
mov rdx, qword [r8 - 0xc8]
jmp 0x51bca8
mov rdx, qword [rbx + 8]
xor eax, eax
mov r8d, 0xa
mov ecx, 1
jmp 0x51bd4b
mov ecx, dword [rbp + rax]
movsxd r8, dword [rdi + rax]
mov rdx, r9
lea r8, [rbx + r8*8]
rol rdx, cl
add rax, 4
mov r9, qword [r8]
mov qword [r8], rdx
cmp rax, 0x60
jne 0x51bd40
mov qword [rsp + 0x20], r9
xor r15d, r15d
xor eax, eax
mov rdx, qword [r11 + rax]
mov qword [rsi + rax], rdx
add rax, 8
cmp rax, 0x28
jne 0x51bd6c
mov r8, r11
xor edx, edx
lea ecx, [rdx + 1]
mov eax, edx
mov rdx, rcx
imul rcx, r10
mov r9d, edx
shr rcx, 0x22
lea ecx, [rcx + rcx*4]
sub r9d, ecx
movsxd rcx, r9d
lea r9d, [rax + 2]
mov rax, r9
imul r9, r10
mov rcx, qword [rsp + rcx*8 + 0x20]
not rcx
shr r9, 0x22
lea r9d, [r9 + r9*4]
sub eax, r9d
cdqe
and rcx, qword [rsp + rax*8 + 0x20]
xor qword [r8], rcx
add r8, 8
cmp edx, 5
jne 0x51bd83
add r15d, 5
add r11, 0x28
cmp r15d, 0x19
jne 0x51bd6a
mov rdx, qword [rbx]
xor rdx, r14
mov qword [rbx], rdx
cmp qword [rsp + 8], r13
je 0x51bdfb
mov r14, qword [r13]
add r13, 8
jmp 0x51bc60
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x51c030
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0xc8
jmp sym.keccak
Function at 0x51c070
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [rcx + 0x150]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, 0x80000000
jne 0x51c2a4
movabs rdx, 0xf0f0f0f0f0f0f0f1
lea rcx, [rbp + r8]
mov rax, rcx
mul rdx
shr rdx, 7
mov rax, rdx
shl rax, 4
add rax, rdx
shl rax, 3
sub rcx, rax
mov qword [rbx + 0x150], rcx
test rbp, rbp
jne 0x51c1a4
mov rbp, rsi
and ebp, 7
cmp rdi, 0x87
jbe 0x51c128
nop
mov rcx, rsi
test rbp, rbp
jne 0x51c140
xor eax, eax
nop word [rax + rax]
mov rdx, qword [rcx + rax]
xor qword [rbx + rax], rdx
add rax, 8
cmp rax, 0x88
jne 0x51c0f0
mov edx, 0x18
mov rcx, rbx
sub rdi, 0x88
add rsi, 0x88
call sym.keccakf
cmp rdi, 0x87
ja 0x51c0e0
test rdi, rdi
jne 0x51c210
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movdqu xmm0, xmmword [rsi]
lea rcx, [rbx + 0xc8]
movups xmmword [rbx + 0xc8], xmm0
movdqu xmm1, xmmword [rsi + 0x10]
movups xmmword [rcx + 0x10], xmm1
movdqu xmm2, xmmword [rsi + 0x20]
movups xmmword [rcx + 0x20], xmm2
movdqu xmm3, xmmword [rsi + 0x30]
movups xmmword [rcx + 0x30], xmm3
movdqu xmm4, xmmword [rsi + 0x40]
movups xmmword [rcx + 0x40], xmm4
movdqu xmm5, xmmword [rsi + 0x50]
movups xmmword [rcx + 0x50], xmm5
movdqu xmm0, xmmword [rsi + 0x60]
movups xmmword [rcx + 0x60], xmm0
movdqu xmm1, xmmword [rsi + 0x70]
movups xmmword [rcx + 0x70], xmm1
mov rax, qword [rsi + 0x80]
mov qword [rcx + 0x80], rax
jmp 0x51c0e8
mov r12d, 0x88
lea rcx, [rbx + rbp + 0xc8]
mov rdx, rsi
sub r12, rbp
cmp r8, r12
mov r8, r12
cmovbe r8, rdi
call sym.memcpy
mov rax, rbx
lea rcx, [rbx + 0x88]
cmp rdi, r12
jb 0x51c131
nop word [rax + rax]
mov rdx, qword [rax + 0xc8]
xor qword [rax], rdx
add rax, 8
cmp rcx, rax
jne 0x51c1e0
mov edx, 0x18
mov rcx, rbx
add rsi, r12
call sym.keccakf
lea rdi, [rbp + rdi - 0x88]
jmp 0x51c0d0
lea rdx, [rbx + 0xc8]
mov eax, edi
cmp edi, 8
jae 0x51c250
and edi, 4
jne 0x51c28f
test eax, eax
je 0x51c131
movzx ecx, byte [rsi]
mov byte [rbx + 0xc8], cl
test al, 2
je 0x51c131
movzx ecx, word [rsi + rax - 2]
mov word [rdx + rax - 2], cx
jmp 0x51c131
mov rax, qword [rsi]
add rbx, 0xd0
mov qword [rbx - 8], rax
mov eax, edi
and rbx, 0xfffffffffffffff8
mov rcx, qword [rsi + rax - 8]
mov qword [rdx + rax - 8], rcx
mov rax, rdx
sub rax, rbx
sub rsi, rax
add eax, edi
mov rdi, rbx
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, dword [rsi]
mov dword [rbx + 0xc8], ecx
mov ecx, dword [rsi + rax - 4]
mov dword [rdx + rax - 4], ecx
jmp 0x51c131
call sym.local_abort.constprop.0
nop
nop word [rax + rax]
Function at 0x51c2b0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdx, qword [rcx + 0x150]
mov rbx, rcx
mov rax, rdx
and eax, 0x80000000
je 0x51c2f8
test rsi, rsi
je 0x51c2ea
movdqu xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea r9, [rcx + 0xc8]
mov ecx, 0x88
sub rcx, rdx
lea r8, [r9 + rdx]
cmp rcx, 8
jae 0x51c388
test cl, 4
jne 0x51c3b2
test rcx, rcx
je 0x51c333
mov byte [r8], 0
test cl, 2
jne 0x51c3ce
mov rdx, qword [rbx + 0x150]
or byte [r9 + rdx], 1
mov rax, rbx
lea rcx, [rbx + 0x88]
or byte [rbx + 0x14f], 0x80
nop dword [rax]
mov rdx, qword [rax + 0xc8]
xor qword [rax], rdx
add rax, 8
cmp rax, rcx
jne 0x51c350
mov edx, 0x18
mov rcx, rbx
call sym.keccakf
mov eax, 0x80000000
mov qword [rbx + 0x150], rax
jmp 0x51c2ce
lea rdi, [r8 + 8]
mov qword [r8], 0
mov qword [r8 + rcx - 8], 0
and rdi, 0xfffffffffffffff8
sub r8, rdi
add rcx, r8
shr rcx, 3
rep stosq qword [rdi], rax
jmp 0x51c32c
mov dword [r8], 0
mov dword [r8 + rcx - 4], 0
mov rdx, qword [rbx + 0x150]
jmp 0x51c333
xor eax, eax
mov word [r8 + rcx - 2], ax
mov rdx, qword [rbx + 0x150]
jmp 0x51c333
Function at 0x51ff90
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
test rcx, rcx
je 0x52019e
mov rax, qword [rcx]
test rax, rax
je 0x52017a
mov rdx, qword [rax]
shr rdx, 2
mov qword [rax + 0x28], rdx
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x28]
add rax, 7
mov qword [rdx + 0x20], rax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
shl rax, 4
mov qword [rdx + 0x10], rax
mov rsi, qword [rcx]
mov edx, 1
mov rcx, qword [rsi + 0x10]
call sym.calloc
mov qword [rsi + 0x18], rax
mov rax, qword [rbx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x52018c
mov r8, qword [rax]
mov rdx, qword [rax + 8]
lea rdi, [rsp + 0x2c]
lea rbp, [0x008b6020]
lea rsi, [rsp + 0x28]
lea r12, [0x008b6120]
call sym.memcpy
mov r9, qword [rbx]
mov rax, qword [r9 + 0x20]
mov r10, qword [r9 + 0x28]
shl rax, 2
mov r8, r10
cmp r10, rax
jae 0x520130
nop dword [rax]
mov rax, qword [r9 + 0x18]
lea r11, [r10*4]
xor edx, edx
mov r13d, dword [rax + r11 - 4]
mov rax, r10
div r8
mov dword [rsp + 0x28], r13d
mov ecx, r13d
test rdx, rdx
je 0x5200d0
cmp rdx, 4
jne 0x52007e
cmp r8, 6
ja 0x520140
xor eax, eax
mov rdx, qword [r9 + 0x18]
mov r13, r10
sub r13, qword [r9 + 0x28]
lea r8, [rdx + rax]
lea rdx, [rdx + r13*4]
xor cl, byte [rdx + rax]
add rax, 1
mov byte [r8 + r11], cl
cmp rax, 4
je 0x5200b0
mov r9, qword [rbx]
movzx ecx, byte [rax + rsi]
jmp 0x520080
mov r9, qword [rbx]
add r10, 1
mov rax, qword [r9 + 0x20]
shl rax, 2
cmp rax, r10
jbe 0x520130
mov r8, qword [r9 + 0x28]
jmp 0x520048
movzx edx, word [rsp + 0x29]
mov rcx, rsi
mov word [rdi], dx
movzx edx, byte [rsp + 0x2b]
mov byte [rdi + 2], dl
mov byte [rsp + 0x2f], r13b
mov edx, dword [rsp + 0x2c]
mov dword [rsp + 0x28], edx
movzx edx, byte [rcx]
add rcx, 1
mov r8, rdx
and edx, 0xf0
and r8d, 0xf
add rdx, rbp
movzx edx, byte [rdx + r8]
mov byte [rcx - 1], dl
cmp rdi, rcx
jne 0x5200f0
movzx ecx, byte [r12 + rax - 1]
xor cl, byte [rsp + 0x28]
mov byte [rsp + 0x28], cl
jmp 0x52007e
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rax, [rsp + 0x28]
mov rdx, rcx
and ecx, 0xf0
add rax, 1
and edx, 0xf
add rcx, rbp
movzx edx, byte [rcx + rdx]
mov byte [rax - 1], dl
cmp rdi, rax
je 0x520170
movzx ecx, byte [rax]
jmp 0x520145
movzx ecx, byte [rsp + 0x28]
jmp 0x52007e
mov eax, 7
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, 8
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, 2
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x521250
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
test rcx, rcx
je 0x5212ea
test rdx, rdx
je 0x5212f6
mov rcx, rdx
lea r9, [rdx + 0x10]
lea r8, [0x008b6020]
nop dword [rax]
movzx eax, byte [rcx]
add rcx, 1
mov rdx, rax
and eax, 0xf0
and edx, 0xf
add rax, r8
movzx eax, byte [rax + rdx]
mov byte [rcx - 1], al
cmp r9, rcx
jne 0x521280
mov rcx, rbx
call sym.oaes_shift_rows
call sym.oaes_mix_cols
lea rcx, [rbx + 4]
call sym.oaes_mix_cols
lea rcx, [rbx + 8]
call sym.oaes_mix_cols
lea rcx, [rbx + 0xc]
call sym.oaes_mix_cols
xor eax, eax
nop dword [rax + rax]
movzx edx, byte [rsi + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x5212d0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, 2
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, 3
jmp 0x5212e3
Function at 0x5253e0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov ecx, dword [rcx + 0x30]
mov byte [rsp + 0x60], r8b
mov rsi, rdx
mov eax, dword [rbx + 0x38]
xor edx, edx
mov byte [rsp + 0x68], r9b
mov r8d, ecx
add r8d, eax
setb dl
add edx, dword [rbx + 0x34]
bswap edx
mov dword [rsp + 0x28], edx
mov edx, r8d
bswap edx
mov dword [rsp + 0x2c], edx
cmp eax, 0x1b8
je 0x5255d0
cmp eax, 0x1b7
jg 0x525578
test eax, eax
je 0x525568
sub r8d, 0x1b8
lea rdx, [0x008b64c0]
mov rcx, rbx
mov dword [rbx + 0x30], r8d
mov r8d, 0x1b8
sub r8d, eax
movsxd r8, r8d
call sym.blake256_update
lea rdx, [rsp + 0x68]
mov r8d, 8
mov rcx, rbx
call sym.blake256_update
mov eax, dword [rbx + 0x30]
sub eax, 8
sub eax, 0x40
lea rdx, [rsp + 0x28]
mov r8d, 0x40
mov rcx, rbx
mov dword [rbx + 0x30], eax
call sym.blake256_update
mov eax, dword [rbx]
shr eax, 0x18
mov byte [rsi], al
mov eax, dword [rbx]
shr eax, 0x10
mov byte [rsi + 1], al
mov eax, dword [rbx]
mov byte [rsi + 2], ah
mov eax, dword [rbx]
mov byte [rsi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rsi + 4], al
movzx eax, word [rbx + 6]
mov byte [rsi + 5], al
mov eax, dword [rbx + 4]
mov byte [rsi + 6], ah
mov eax, dword [rbx + 4]
mov byte [rsi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rsi + 8], al
movzx eax, word [rbx + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rbx + 8]
mov byte [rsi + 0xa], ah
mov eax, dword [rbx + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rsi + 0xc], al
movzx eax, word [rbx + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xe], ah
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rsi + 0x10], al
movzx eax, word [rbx + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x12], ah
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x13], al
movzx eax, byte [rbx + 0x17]
mov byte [rsi + 0x14], al
movzx eax, word [rbx + 0x16]
mov byte [rsi + 0x15], al
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x16], ah
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x17], al
movzx eax, byte [rbx + 0x1b]
mov byte [rsi + 0x18], al
movzx eax, word [rbx + 0x1a]
mov byte [rsi + 0x19], al
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1a], ah
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1b], al
movzx eax, byte [rbx + 0x1f]
mov byte [rsi + 0x1c], al
movzx eax, word [rbx + 0x1e]
mov byte [rsi + 0x1d], al
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1e], ah
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1f], al
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rbx + 0x3c], 1
jmp 0x525437
sub r8d, 0x200
lea rdx, [0x008b64c0]
mov rcx, rbx
mov dword [rbx + 0x30], r8d
mov r8d, 0x200
sub r8d, eax
movsxd r8, r8d
call sym.blake256_update
sub dword [rbx + 0x30], 0x1b8
mov r8d, 0x1b8
mov rcx, rbx
lea rdx, [0x008b64c1]
call sym.blake256_update
mov dword [rbx + 0x3c], 1
jmp 0x52545d
sub ecx, 8
lea rdx, [rsp + 0x60]
mov r8d, 8
mov dword [rbx + 0x30], ecx
mov rcx, rbx
call sym.blake256_update
mov eax, dword [rbx + 0x30]
jmp 0x525476

Function at 0x525600
Capabilities:
Enumerate pe sections

Disassembly:
mov r9d, 1
mov r8d, 0x81
jmp sym.blake256_final_h
Function at 0x525620
Capabilities:
Enumerate pe sections

Disassembly:
xor r9d, r9d
mov r8d, pe_nt_image_headers64
jmp sym.blake256_final_h

Function at 0x525780
Capabilities:
Authenticate hmac

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x88
mov rbx, rcx
mov r12, rdx
mov rsi, r8
cmp r8, 0x40
ja 0x525978
movabs rax, 0xbb67ae856a09e667
mov qword [rbx + 0x20], 0
movabs rdx, 0x3636363636363636
lea r13, [rsp + 0x40]
mov qword [rbx], rax
movabs rax, 0xa54ff53a3c6ef372
mov qword [rbx + 8], rax
movabs rax, 0x9b05688c510e527f
mov qword [rbx + 0x10], rax
movabs rax, 0x5be0cd191f83d9ab
mov qword [rbx + 0x18], rax
movabs rax, 0x3636363636363636
mov qword [rbx + 0x28], 0
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x38], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
test rsi, rsi
je 0x525865
mov rax, r12
mov rcx, r13
lea r8, [rsi + r12]
mov edx, 0x36
jmp 0x525853
movzx edx, byte [rcx]
xor dl, byte [rax]
add rax, 1
add rcx, 1
mov byte [rcx - 1], dl
cmp rax, r8
jne 0x525850
mov rdx, r13
mov r8d, 0x200
mov rcx, rbx
call sym.blake256_update
lea r9, [rbx + 0x80]
movabs rax, 0xbb67ae856a09e667
movabs rdx, 0x5c5c5c5c5c5c5c5c
mov qword [rbx + 0x80], rax
movabs rax, 0xa54ff53a3c6ef372
mov qword [rbx + 0x88], rax
movabs rax, 0x9b05688c510e527f
mov qword [rbx + 0x90], rax
movabs rax, 0x5be0cd191f83d9ab
mov qword [rbx + 0x98], rax
movabs rax, 0x5c5c5c5c5c5c5c5c
mov qword [rbx + 0xa0], 0
mov qword [rbx + 0xa8], 0
mov qword [rbx + 0xb0], 0
mov qword [rbx + 0xb8], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
test rsi, rsi
je 0x525955
mov rdx, r12
mov rcx, r13
lea r8, [r12 + rsi]
mov eax, 0x5c
jmp 0x525943
movzx eax, byte [rcx]
xor al, byte [rdx]
add rdx, 1
add rcx, 1
mov byte [rcx - 1], al
cmp r8, rdx
jne 0x525940
mov r8d, 0x200
mov rdx, r13
mov rcx, r9
call sym.blake256_update
nop
add rsp, 0x88
pop rbx
pop rsi
pop r12
pop r13
ret
lea r13, [rsp + 0x20]
mov esi, 0x20
mov rcx, r13
mov r12, r13
call sym.blake256_hash
jmp 0x5257a0
Function at 0x5259a0
Capabilities:
Authenticate hmac

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x88
mov rbx, rcx
mov r12, rdx
mov rsi, r8
cmp r8, 0x40
ja 0x525b98
movabs rax, 0x367cd507c1059ed8
mov qword [rbx + 0x20], 0
movabs rdx, 0x3636363636363636
lea r13, [rsp + 0x40]
mov qword [rbx], rax
movabs rax, 0xf70e59393070dd17
mov qword [rbx + 8], rax
movabs rax, 0x68581511ffc00b31
mov qword [rbx + 0x10], rax
movabs rax, 0xbefa4fa464f98fa7
mov qword [rbx + 0x18], rax
movabs rax, 0x3636363636363636
mov qword [rbx + 0x28], 0
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x38], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
test rsi, rsi
je 0x525a85
mov rax, r12
mov rcx, r13
lea r8, [rsi + r12]
mov edx, 0x36
jmp 0x525a73
movzx edx, byte [rcx]
xor dl, byte [rax]
add rax, 1
add rcx, 1
mov byte [rcx - 1], dl
cmp rax, r8
jne 0x525a70
mov rdx, r13
mov r8d, 0x200
mov rcx, rbx
call sym.blake256_update
lea r9, [rbx + 0x80]
movabs rax, 0x367cd507c1059ed8
movabs rdx, 0x5c5c5c5c5c5c5c5c
mov qword [rbx + 0x80], rax
movabs rax, 0xf70e59393070dd17
mov qword [rbx + 0x88], rax
movabs rax, 0x68581511ffc00b31
mov qword [rbx + 0x90], rax
movabs rax, 0xbefa4fa464f98fa7
mov qword [rbx + 0x98], rax
movabs rax, 0x5c5c5c5c5c5c5c5c
mov qword [rbx + 0xa0], 0
mov qword [rbx + 0xa8], 0
mov qword [rbx + 0xb0], 0
mov qword [rbx + 0xb8], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
test rsi, rsi
je 0x525b75
mov rdx, r12
mov rcx, r13
lea r8, [r12 + rsi]
mov eax, 0x5c
jmp 0x525b63
movzx eax, byte [rcx]
xor al, byte [rdx]
add rdx, 1
add rcx, 1
mov byte [rcx - 1], al
cmp r8, rdx
jne 0x525b60
mov r8d, 0x200
mov rdx, r13
mov rcx, r9
call sym.blake256_update
nop
add rsp, 0x88
pop rbx
pop rsi
pop r12
pop r13
ret
lea r13, [rsp + 0x20]
mov esi, 0x1c
mov rcx, r13
mov r12, r13
call sym.blake256_hash
jmp 0x5259c0
Function at 0x527710
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x120
mov rdi, rcx
mov r14, rdx
cmp r8d, 0x3f
jle 0x527900
lea r12d, [r8 - 0x40]
lea rsi, [rsp + 0xe0]
shr r12d, 6
lea rbp, [rsp + 0x20]
lea r13, [rsp + 0x60]
add r12, 1
lea rbx, [rsp + 0xa0]
shl r12, 6
add r12, rdx
nop
xor eax, eax
nop word [rax + rax]
mov edx, dword [r14 + rax]
mov dword [rsi + rax], edx
xor edx, dword [rdi + rax]
mov dword [rbp + rax], edx
add rax, 4
cmp rax, 0x40
jne 0x527768
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call sym.RND512Q
mov r8d, 0x1000000
mov rdx, rsi
mov rcx, rbx
call sym.RND512Q
mov r8d, 0x2000000
mov rdx, rbx
mov rcx, rsi
call sym.RND512Q
mov r8d, 0x3000000
mov rdx, rsi
mov rcx, rbx
call sym.RND512Q
mov r8d, 0x4000000
mov rdx, rbx
mov rcx, rsi
call sym.RND512Q
mov r8d, 0x5000000
mov rdx, rsi
mov rcx, rbx
call sym.RND512Q
mov r8d, 0x6000000
mov rdx, rbx
mov rcx, rsi
call sym.RND512Q
mov r8d, 0x7000000
mov rdx, rsi
mov rcx, rbx
call sym.RND512Q
mov r8d, 0x8000000
mov rdx, rbx
mov rcx, rsi
call sym.RND512Q
mov r8d, 0x9000000
mov rdx, r13
mov rcx, rbx
call sym.RND512Q
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
call sym.RND512P
mov r8d, 1
mov rdx, rsi
mov rcx, rbx
call sym.RND512P
mov r8d, 2
mov rdx, rbx
mov rcx, rsi
call sym.RND512P
mov r8d, 3
mov rdx, rsi
mov rcx, rbx
call sym.RND512P
mov r8d, 4
mov rdx, rbx
mov rcx, rsi
call sym.RND512P
mov r8d, 5
mov rdx, rsi
mov rcx, rbx
call sym.RND512P
mov r8d, 6
mov rdx, rbx
mov rcx, rsi
call sym.RND512P
mov r8d, 7
mov rdx, rsi
mov rcx, rbx
call sym.RND512P
mov r8d, 8
mov rdx, rbx
mov rcx, rsi
call sym.RND512P
mov r8d, 9
mov rdx, rbp
mov rcx, rbx
call sym.RND512P
xor eax, eax
mov edx, dword [rdi + rax]
xor edx, dword [rbp + rax]
xor edx, dword [r13 + rax]
mov dword [rdi + rax], edx
add rax, 4
cmp rax, 0x40
jne 0x5278d0
add dword [rdi + 0x40], 1
jne 0x5278f3
add dword [rdi + 0x44], 1
add r14, 0x40
cmp r14, r12
jne 0x527760
add rsp, 0x120
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret