joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140c35058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c351df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c35089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c3506f
add dl, dl
jne 0x140c35096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c350f6
xor eax, eax
add dl, dl
jne 0x140c350a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c351ad
add dl, dl
jne 0x140c350b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c350c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c350d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c350dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c350ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c3507e
mov eax, 1
add dl, dl
jne 0x140c35106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c35113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c350fb
sub eax, ebx
mov ebx, 1
jne 0x140c3514c
mov ecx, 1
add dl, dl
jne 0x140c3512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c3513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c35123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c35168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c35175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c3515d
cmp eax, 0x7d00
jae 0x140c3519b
cmp eax, 0x500
jb 0x140c35196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3507e
cmp eax, 0x7f
ja 0x140c3519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c351d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c3507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400030e0
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x320
mov edi, ecx
mov rax, qword [0x14006d038]
xor rax, rsp
mov qword [rsp + 0x318], rax
lea rsi, [rsp + 0x110]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.140010270
mov rcx, rsi
mov edx, 0x104
call fcn.140004178
mov esi, eax
test eax, eax
jns 0x140003146
mov rcx, qword [rsp + 0x318]
xor rcx, rsp
call fcn.14000e2f0
mov eax, esi
add rsp, 0x320
pop rbx
pop rdi
pop rsi
ret
lea rsi, [rsp + 0x110]
mov rcx, rsi
call fcn.14000c7a4
lea rdx, [rax + 0x28]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0xf0]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1400608a0]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.14003dff0
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
sub rdx, rcx
sar rdx, 1
mov dword [rsp + 0x20], edi
lea r8, [0x140060f94]
mov r9, rsi
call fcn.14003a152
test eax, eax
js 0x140003245
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
movaps xmmword [rax], xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
xor ecx, ecx
mov qword [rax + 0x60], rcx
mov dword [rax], 0x68
lea rbx, [rsp + 0x60]
mov qword [rbx + 0x10], rcx
movaps xmmword [rbx], xmm0
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x110]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140003249
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000325f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x140003287
mov esi, eax
jmp 0x14000329c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x14000329c
lea rdx, [rsp + 0x5c]
mov dword [rdx], 0xaaaaaaaa
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000322f
mov eax, dword [rsp + 0x5c]
test eax, eax
mov esi, 0x80004005
cmove esi, eax
mov rcx, qword [rsp + 0x68]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x60]
call rdi
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x140003129
mov qword [rsp + 0xf8], rcx
call fcn.14000c794
jmp 0x140003129
Function at 0x1400032bf
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, qword [0x14006d038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebx, 0x80070057
cmp r8d, 0x104
jb 0x14000335f
mov rdi, rdx
mov r14, rcx
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x28]
mov qword [rbx], rax
call fcn.140004703
lea rcx, section..rdata
lea rdx, [0x140055010]
test al, al
cmovne rdx, rcx
movups xmm0, xmmword [rdx]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
xor esi, esi
xor edx, edx
xor r8d, r8d
mov r9, rbx
call sub.SHELL32.dll_SHGetKnownFolderPath
mov ebx, eax
test eax, eax
jne 0x14000335f
mov rdx, qword [rsp + 0x28]
mov rcx, rdi
mov r8, r14
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
test rax, rax
mov eax, 0x80004005
cmove esi, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov ebx, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000e2f0
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000474e
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov ebp, r9d
mov r15, r8
mov esi, edx
mov r14, rcx
mov rax, qword [0x14006d038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movabs rbx, 0xaaaaaaaa00000000
mov dword [rsp + 0x6c], 0
lea rcx, [rsp + 0x50]
mov qword [rcx + 8], rbx
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
lea r8, str.SoftwareMicrosoftEdgeIEToEdge
mov rdx, 0xffffffff80000001
mov r9d, 0x20119
call fcn.14003e072
mov edi, eax
test eax, eax
jne 0x1400047e0
lea rax, [rsp + 0x38]
mov dword [rax], ebp
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x6c]
mov rdx, r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, 2
je 0x140004832
xor eax, eax
cmp dword [rsp + 0x6c], esi
mov ebx, 0x65e
cmove ebx, eax
test edi, edi
cmovne ebx, edi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140004808
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx esi, bx
or esi, 0x80070000
test ebx, ebx
cmovle esi, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000e2f0
mov eax, esi
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [rsp + 0x38]
mov qword [rcx + 8], rbx
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
lea r8, str.SoftwareMicrosoftEdgeIEToEdge
mov rdx, 0xffffffff80000002
mov r9d, 0x20119
call fcn.14003e072
mov edi, eax
test eax, eax
jne 0x14000488c
lea rax, [rsp + 0x34]
mov dword [rax], ebp
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x6c]
mov rdx, r14
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400047e5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400047e5
Function at 0x1400048a5
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x14006d038]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x54]
mov dword [r8], 0xaaaaaaaa
lea rcx, str.DisabledPendingAutoUpdateConsent
mov edx, 4
mov r9d, 4
call fcn.14000474e
test eax, eax
jne 0x1400048f8
xor esi, esi
cmp dword [rsp + 0x54], 0
jne 0x140004a2d
mov ebx, 0x10
movabs r15, 0xaaaaaaaa00000000
xor r13d, r13d
lea rdi, [0x140061770]
lea r12, [rsp + 0x38]
mov r14, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x48], r13
mov rdx, qword [rbx + rdi - 0x10]
mov r8, qword [rbx + rdi - 8]
mov rcx, r12
mov r9d, 0x20119
call fcn.14003e072
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jne 0x1400049cb
mov dword [rsp + 0x34], 0xaaaaaaaa
mov rdx, qword [rbx + rdi]
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x58], 4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor ebp, ebp
xor r8d, r8d
lea r9, [rsp + 0x5c]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x5c], 4
mov ecx, eax
mov edx, 0xd
cmovne ecx, edx
test eax, eax
cmovne ecx, eax
movzx edx, cx
or edx, 0x80070000
test ecx, ecx
cmovle edx, ecx
xor eax, eax
cmp dword [rsp + 0x34], 0
setne cl
test edx, edx
je 0x1400049f0
mov bpl, 1
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400049db
call r14
test bpl, bpl
je 0x140004a2d
add rbx, 0x18
cmp rbx, 0x40
jne 0x14000491d
jmp 0x1400049f6
mov al, cl
mov esi, eax
jmp 0x1400049ce
lea rsi, [rsp + 0x38]
mov dword [rsi], 0xaaaaaaaa
lea rcx, str.RedirectionMode
mov edx, 4
mov r8, rsi
mov r9d, 4
call fcn.14000474e
mov esi, dword [rsi]
cmp esi, 3
mov ecx, 1
cmovae esi, ecx
test eax, eax
cmovne esi, ecx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000e2f0
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400050aa
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x14006d038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rcx]
movsxd rax, dword [rax + 4]
mov rax, qword [rcx + rax + 0x30]
lea rdi, [rsp + 0x20]
mov qword [rdi], rax
lock inc dword [rax + 8]
lea rdx, [0x140070d20]
mov rcx, rdi
call fcn.1400084e8
mov rbx, qword [rax]
mov rcx, rax
mov dl, 0xa
call qword [rbx + 0x58]
mov ebx, eax
mov rcx, rdi
call fcn.14000849a
mov rcx, rsi
mov edx, ebx
call fcn.140053864
mov rcx, rsi
call fcn.14003de6e
lea rcx, [rsi + 8]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x1400608a0]
movaps xmmword [rdi], xmm0
lea rdi, [rsp + 0x20]
mov rdx, rdi
call fcn.14000a35a
mov eax, dword [0x1400703f8]
test al, 0x10
je 0x14000516e
movzx r8d, byte [rsp + 0x37]
test r8b, r8b
cmovs r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
cmovns rdx, rdi
lea rcx, [0x140070730]
call fcn.14003dd30
mov eax, dword [0x1400703f8]
test al, 0x20
je 0x1400051b3
cmp qword [0x140070330], 0
je 0x1400051b3
lea rdx, [rsp + 0x20]
movzx r8d, byte [rdx + 0x17]
test r8b, r8b
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
lea rcx, [0x1400702b0]
call fcn.14003dd30
cmp dword [rsi + 0x108], 2
jl 0x1400051b3
lea rcx, [0x1400702b0]
call fcn.14003de6e
test byte [0x1400703f8], 0x40
je 0x1400051db
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400051db
cmp byte [rsp + 0x37], 0
jns 0x1400051d2
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [rsi + 0x108], 3
jne 0x1400051ea
call qword [sym.imp.KERNEL32.dll_DebugBreak]
cmp byte [rsp + 0x37], 0
jns 0x1400051fb
mov rcx, qword [rsp + 0x20]
call fcn.14000c794
add rsi, 0x70
mov rcx, rsi
call fcn.14003e3d8
mov rcx, rsi
call fcn.14003da14
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000e2f0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000a090
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor edi, edi
mov dword [rbp + 0x13], 0x67452301
mov rbx, r8
mov qword [rbp + 0x27], rdi
mov r8d, edx
mov dword [rbp + 0x17], 0xefcdab89
mov rdx, rcx
mov dword [rbp + 0x1b], 0x98badcfe
lea rcx, [rbp - 0x39]
mov dword [rbp + 0x1f], 0x10325476
mov qword [rbp - 0x39], rdi
mov dword [rbp - 0x31], edi
call fcn.140035e00
test eax, eax
jne 0x14000a19c
test rbx, rbx
je 0x14000a197
mov eax, dword [rbp - 0x39]
mov byte [rbp + rax - 0x2d], 0x80
mov ecx, dword [rbp - 0x39]
inc ecx
mov dword [rbp - 0x39], ecx
cmp ecx, 0x38
jbe 0x14000a141
mov eax, ecx
mov r8d, 0x40
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.14009caf0
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x39], 0x40
lea rcx, [rbp - 0x39]
call fcn.140035610
mov ecx, edi
mov dword [rbp - 0x39], edi
mov eax, ecx
mov r8d, 0x38
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.14009caf0
mov r9d, dword [rbp - 0x35]
mov edx, r9d
mov ecx, dword [rbp - 0x31]
shr edx, 0x1d
shl r9d, 3
mov dword [rbp - 0x35], r9d
mov dword [rbp + 0xb], r9d
lea r8d, [rdx + rcx*8]
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x31], r8d
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], r8d
call fcn.140035610
movups xmm0, xmmword [rbp + 0x13]
mov eax, edi
movups xmmword [rbx], xmm0
jmp 0x14000a19c
mov eax, 0xffffff53
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14009a320
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret

Function at 0x14000a1c0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x6c], 0x67452301
mov rbx, r8
mov qword [rsp + 0x80], rax
mov r8d, edx
mov dword [rsp + 0x70], 0xefcdab89
mov rdx, rcx
mov dword [rsp + 0x74], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x78], 0x10325476
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.140024710
test eax, eax
jne 0x14000a23a
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140024c10
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14009a320
add rsp, 0xa0
pop rbx
ret

Function at 0x14000a260
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov rbx, r8
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x38], rax
mov dword [r11 - 0x30], eax
test rcx, rcx
jne 0x14000a2de
test edx, edx
je 0x14000a2f2
mov eax, 0xffffff53
jmp 0x14000a2ff
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400215c0
test eax, eax
jne 0x14000a2ff
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140022030
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14009a320
add rsp, 0xb0
pop rbx
ret
Function at 0x1400168e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov r9d, eax
test r8d, r8d
jle 0x1400169b9
cmp r8d, 8
jb 0x1400169b9
mov qword [rsp + 0x10], rbx
lea r11, [rdx + 4]
mov qword [rsp], rdi
sub rcx, rdx
movsxd rbx, r8d
mov rdi, 0xfffffffffffffffc
and rbx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rdi, rdx
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r11 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r11 - 4]
lea r11, [r11 + 8]
punpcklbw xmm2, xmm0
lea rax, [rdi + r11]
punpcklwd xmm2, xmm0
add r9d, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r11 - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + r11 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rax, rbx
jl 0x140016930
mov rdi, qword [rsp]
por xmm3, xmm4
mov rbx, qword [rsp + 0x10]
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
movsxd r11, r9d
movsxd r9, r8d
cmp r11, r9
jge 0x1400169e8
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
nop
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x1400169d0
add rsp, 8
ret
Function at 0x140017c90
Capabilities:
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx + 0x78]
test rcx, rcx
je 0x140017cc1
mov rax, qword [0x140121b70]
test rax, rax
je 0x140017cb8
call rax
jmp 0x140017cbd
call fcn.1400a0b74
mov qword [rbx + 0x78], rdi
mov rax, qword [0x140121b80]
mov ecx, 0x3e8
test rax, rax
je 0x140017cd6
call rax
jmp 0x140017cdb
call fcn.1400a0b88
mov qword [rbx + 0x78], rax
test rax, rax
jne 0x140017cf4
mov eax, 0xffffff83
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, 0x3e8
mov rcx, rax
call fcn.14009caf0
mov rcx, qword [rbx + 0x78]
add rcx, 0x1b0
je 0x140017eb9
mov rax, qword [rbx + 0xa8]
xorps xmm0, xmm0
mov qword [rcx + 0x70], rax
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x60], rdi
mov dword [rcx + 0x68], edi
mov rcx, qword [rbx + 0x78]
add rcx, 0x228
je 0x140017eb9
mov rax, qword [rbx + 0xa8]
mov qword [rcx + 0xd8], rax
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], edi
mov qword [rcx + 0xc8], rdi
mov qword [rcx + 0xd0], rdi
mov rcx, qword [rbx + 0x78]
add rcx, 0x308
je 0x140017eb9
mov rax, qword [rbx + 0xa8]
mov qword [rcx + 0xd8], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], edi
mov qword [rcx + 0xc8], rdi
mov qword [rcx + 0xd0], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffff53
add rsp, 0x20
pop rdi
ret
Function at 0x14001b820
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
mov dword [rsp + 0x44], r9d
mov r12, rdx
mov ebp, r8d
xor edx, edx
mov r10d, r9d
mov r9, qword [rsp + 0x150]
mov r8d, edx
movzx eax, byte [rsi + 0x325]
mov r14d, edx
movzx r15d, byte [rsi + 0x329]
mov ecx, edx
mov qword [rsp + 0x48], r9
cmp al, 1
jne 0x14001ba14
movzx r9d, word [rsi + 0x448]
bt r9w, 0xe
jae 0x14001b89d
movzx r8d, word [rsi + 0x320]
mov eax, r8d
mov rcx, rbp
sub rcx, rax
mov dword [rsp + 0x40], 1
bt r9w, 0xd
mov rdi, rbp
movzx r14d, byte [rcx + r12 - 1]
mov ecx, r14d
mov r13d, r14d
jae 0x14001b9a1
sub ebp, r8d
mov eax, 0xff
movsxd r8, ebp
dec r8
add r8, r12
lea ecx, [rbp - 1]
movzx r10d, byte [r8]
mov edi, r10d
sub edi, ebp
add edi, r15d
shr edi, 0x1f
dec dil
cmp ecx, eax
cmovg ecx, eax
movsxd r9, ecx
test ecx, ecx
jle 0x14001b923
nop dword [rax + rax]
mov ecx, r10d
lea r8, [r8 - 1]
sub ecx, edx
movzx eax, r10b
xor al, byte [r8 + 1]
inc edx
shr ecx, 0x1f
dec cl
and cl, al
or dil, cl
sub r9, 1
jne 0x14001b900
mov eax, dword [rsp + 0x44]
lea rdx, [rsp + 0x90]
mov r9d, ebp
mov dword [rsp + 0x30], 1
sub r9d, r15d
mov dword [rsp + 0x28], eax
sub r9d, r14d
mov dword [rsp + 0x20], r14d
dec r9d
mov r8, r12
mov rcx, rsi
call qword [rsi + 0xf0]
movzx r8d, byte [rsi + 0x329]
lea r9, [rsp + 0x90]
mov edx, ebp
mov rcx, r12
mov ebx, eax
call fcn.14001b2f0
or al, dil
not al
movzx ecx, al
shr cl, 4
and al, cl
movzx ecx, al
mov edx, ecx
shr edx, 2
and edx, ecx
mov eax, edx
shr eax, 1
and eax, edx
dec eax
add eax, ebx
je 0x14001ba0e
mov eax, 0xfffffecf
jmp 0x14001ba92
sub ebp, r15d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
mov r8, r12
lea eax, [rbp - 1]
cmp r14d, eax
mov dword [rsp + 0x44], eax
cmova r14d, edx
cmp r13d, eax
cmovbe edx, ecx
mov rcx, rsi
sub ebp, edx
mov ebx, edx
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], ebx
lea r9d, [rbp - 1]
call qword [rsi + 0xf0]
sub rdi, rbx
lea rdx, [r12 - 1]
sub rdi, r15
lea rcx, [rsp + 0x50]
add rdx, rdi
mov r8d, r15d
mov ebp, eax
call fcn.1400168e0
test eax, eax
jne 0x14001b997
test ebp, ebp
jne 0x14001b997
cmp r13d, dword [rsp + 0x44]
ja 0x14001b997
mov ecx, dword [rsp + 0x40]
jmp 0x14001ba6f
test al, al
jne 0x14001ba74
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
lea rdx, [rsp + 0x50]
sub r9d, r15d
mov dword [rsp + 0x20], 0xffffffff
mov r8, r12
mov rcx, rsi
call qword [rsi + 0xf0]
mov rdx, rbp
lea rcx, [rsp + 0x50]
sub rdx, r15
mov r8d, r15d
add rdx, r12
mov ebx, eax
call fcn.1400168e0
test eax, eax
jne 0x14001b997
test ebx, ebx
jne 0x14001b997
mov ecx, r14d
mov r9, qword [rsp + 0x48]
cmp byte [rsi + 0x325], 2
jne 0x14001ba86
movzx eax, word [rsi + 0x322]
jmp 0x14001ba8d
lea eax, [r15 + rcx]
add eax, r14d
mov dword [r9], eax
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14009a320
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140022030
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14002218e
test rdx, rdx
je 0x14002218e
call fcn.140021ac0
test eax, eax
jne 0x140022193
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0x18], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret