joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093930
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x140554040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
mov ebp, r8d
mov r8, qword [rsp + 0x150]
mov r12, rdx
xor edx, edx
mov dword [rsp + 0x44], r9d
mov r10d, r9d
mov qword [rsp + 0x48], r8
movzx eax, byte [rsi + 0x323]
mov r14d, edx
movzx r15d, byte [rsi + 0x327]
mov ecx, edx
cmp al, 1
jne 0x140093b34
movzx r9d, word [rsi + 0x4e6]
mov r8d, edx
test r9b, 0x10
je 0x1400939ab
movzx r8d, word [rsi + 0x31e]
mov eax, r8d
mov rcx, rbp
sub rcx, rax
mov dword [rsp + 0x40], 1
mov rdi, rbp
movzx r14d, byte [rcx + r12 - 1]
mov ecx, r14d
mov r13d, r14d
test r9b, 8
je 0x140093ab9
sub ebp, r8d
mov eax, 0xff
movsxd r8, ebp
dec r8
add r8, r12
lea ecx, [rbp - 1]
movzx r10d, byte [r8]
mov edi, r10d
sub edi, ebp
add edi, r15d
shr edi, 0x1f
dec dil
cmp ecx, eax
cmovg ecx, eax
movsxd r9, ecx
test ecx, ecx
jle 0x140093a33
nop word [rax + rax]
mov ecx, r10d
lea r8, [r8 - 1]
sub ecx, edx
movzx eax, r10b
xor al, byte [r8 + 1]
inc edx
shr ecx, 0x1f
dec cl
and cl, al
or dil, cl
sub r9, 1
jne 0x140093a10
mov eax, dword [rsp + 0x44]
lea rdx, [rsp + 0x90]
mov dword [rsp + 0x38], 1
mov r9d, ebp
sub r9d, r15d
mov dword [rsp + 0x30], 1
sub r9d, r14d
mov dword [rsp + 0x28], eax
dec r9d
mov dword [rsp + 0x20], r14d
mov r8, r12
mov rcx, rsi
call qword [rsi + 0x118]
movzx r8d, byte [rsi + 0x327]
lea r9, [rsp + 0x90]
mov edx, ebp
mov rcx, r12
mov ebx, eax
call fcn.140092fa0
or al, dil
not al
movzx ecx, al
shr cl, 4
and al, cl
movzx ecx, al
mov edx, ecx
shr edx, 2
and edx, ecx
mov eax, edx
shr eax, 1
and eax, edx
dec eax
add eax, ebx
je 0x140093b2e
mov eax, 0xfffffecf
jmp 0x140093bba
sub ebp, r15d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov r8, r12
mov dword [rsp + 0x28], r10d
lea eax, [rbp - 1]
cmp r14d, eax
mov dword [rsp + 0x44], eax
cmova r14d, edx
cmp r13d, eax
cmovbe edx, ecx
mov rcx, rsi
sub ebp, edx
mov ebx, edx
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x20], ebx
lea r9d, [rbp - 1]
call qword [rsi + 0x118]
sub rdi, rbx
lea rdx, [r12 - 1]
sub rdi, r15
lea rcx, [rsp + 0x50]
add rdx, rdi
mov r8d, r15d
mov ebp, eax
call fcn.1400856c0
test eax, eax
jne 0x140093aaf
test ebp, ebp
jne 0x140093aaf
cmp r13d, dword [rsp + 0x44]
ja 0x140093aaf
mov ecx, dword [rsp + 0x40]
jmp 0x140093b97
test al, al
jne 0x140093b9c
mov dword [rsp + 0x38], 1
lea rdx, [rsp + 0x50]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
sub r9d, r15d
mov r8, r12
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rsi
call qword [rsi + 0x118]
mov rdx, rbp
lea rcx, [rsp + 0x50]
sub rdx, r15
mov r8d, r15d
add rdx, r12
mov ebx, eax
call fcn.1400856c0
test eax, eax
jne 0x140093aaf
test ebx, ebx
jne 0x140093aaf
mov ecx, r14d
mov r8, qword [rsp + 0x48]
cmp byte [rsi + 0x323], 2
jne 0x140093bae
movzx eax, word [rsi + 0x320]
jmp 0x140093bb5
lea eax, [r15 + rcx]
add eax, r14d
mov dword [r8], eax
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400e9c90
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a4610
Capabilities:
Hash data using sha1
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
xor r8d, r8d
sub edx, 3
je 0x1400a47f4
sub edx, 1
je 0x1400a47b6
sub edx, 2
je 0x1400a475f
sub edx, 1
je 0x1400a46df
cmp edx, 1
jne 0x1400a47f9
test rcx, rcx
je 0x1400a47f9
mov qword [rcx + 0xd8], r8
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
mov eax, r8d
mov dword [rcx + 0xc0], r8d
mov qword [rcx + 0xc8], r8
mov qword [rcx + 0xd0], r8
mov qword [rcx + 0x220], r8
ret
test rcx, rcx
je 0x1400a47f9
mov qword [rcx + 0xd8], r8
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
jmp 0x1400a46bb
test rcx, rcx
je 0x1400a47f9
mov dword [rcx], 0x6a09e667
mov eax, r8d
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov dword [rcx + 0x68], r8d
mov qword [rcx + 0x70], r8
mov qword [rcx + 0x60], r8
mov qword [rcx + 0x220], r8
ret
test rcx, rcx
je 0x1400a47f9
mov dword [rcx + 0x5c], 0xc3d2e1f0
mov dword [rcx + 8], r8d
mov eax, r8d
mov qword [rcx], r8
mov dword [rcx + 0x58], 0x10325476
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x4c], 0x67452301
mov qword [rcx + 0x60], r8
mov qword [rcx + 0x220], r8
ret
test rcx, rcx
jne 0x1400a47c2
mov eax, 0xffffff53
mov qword [rcx + 0x220], r8
ret
Function at 0x1400c5a70
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x140554040]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x6c], 0x67452301
mov rbx, r8
mov qword [rsp + 0x80], rax
mov r8d, edx
mov dword [rsp + 0x70], 0xefcdab89
mov rdx, rcx
mov dword [rsp + 0x74], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x78], 0x10325476
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.1400dcfa0
test eax, eax
jne 0x1400c5ae2
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400dd110
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400e9c90
add rsp, 0xa0
pop rbx
ret

Function at 0x1400c5b00
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x140554040]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x6c], 0x67452301
mov rbx, r8
mov qword [rsp + 0x80], rax
mov r8d, edx
mov dword [rsp + 0x70], 0xefcdab89
mov rdx, rcx
mov dword [rsp + 0x74], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x78], 0x10325476
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.1400c9880
test eax, eax
jne 0x1400c5b7a
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400c9d20
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400e9c90
add rsp, 0xa0
pop rbx
ret

Function at 0x1400c5ba0
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x140554040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov rbx, r8
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x38], rax
mov dword [r11 - 0x30], eax
mov qword [r11 - 0x28], rax
test rcx, rcx
jne 0x1400c5c1e
test edx, edx
je 0x1400c5c34
mov edx, 0xffffff53
jmp 0x1400c5c43
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400d7c30
mov edx, eax
test eax, eax
jne 0x1400c5c43
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400d85e0
mov edx, eax
mov ecx, 0x78
lea rax, [rsp + 0x20]
nop dword [rax]
mov byte [rax], 0
lea rax, [rax + 1]
add ecx, 0xffffffff
jne 0x1400c5c50
mov eax, edx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400e9c90
add rsp, 0xb0
pop rbx
ret
Function at 0x1400ca1d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r9, rcx
mov rax, rdx
and r9d, 7
and eax, 7
xor r10d, r10d
cmp r9, rax
jne 0x1400ca2b9
test r9, r9
je 0x1400ca20d
test r8d, r8d
je 0x1400ca20d
movzx eax, byte [rdx]
inc rdx
xor byte [rcx], al
inc rcx
dec r8d
jmp 0x1400ca1f8
mov r11d, r8d
mov ebx, r10d
shr r11d, 3
test r11d, r11d
je 0x1400ca2b5
cmp r11d, 8
jb 0x1400ca29b
lea eax, [r11 - 1]
lea rdi, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp rcx, rax
ja 0x1400ca23c
cmp rdi, rdx
jae 0x1400ca29b
mov eax, r11d
and eax, 0xfffffff8
movdqu xmm0, xmmword [rcx]
add ebx, 8
movdqu xmm1, xmmword [rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [rdx + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm0, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rdx + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm0, xmmword [rcx + 0x30]
movdqu xmm1, xmmword [rdx + 0x30]
add rdx, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp ebx, eax
jb 0x1400ca242
cmp ebx, r11d
jae 0x1400ca2b5
sub r11d, ebx
mov r9d, r11d
mov rax, qword [rdx]
add rdx, 8
xor qword [rcx], rax
add rcx, 8
sub r9, 1
jne 0x1400ca2a1
and r8d, 7
test r8d, r8d
je 0x1400ca3c2
cmp r8d, 8
jb 0x1400ca393
lea eax, [r8 - 1]
lea r11, [rax + rcx]
add rax, rdx
cmp rcx, rax
ja 0x1400ca2e5
cmp r11, rdx
jae 0x1400ca393
cmp r8d, 0x40
jb 0x1400ca365
mov r11d, r8d
mov ebx, r8d
and r11d, 0x3f
sub ebx, r11d
mov edi, 0x20
nop dword [rax]
movdqu xmm0, xmmword [r10 + rcx]
lea eax, [rdi - 0x10]
movdqu xmm1, xmmword [r10 + rdx]
xorps xmm1, xmm0
movdqu xmmword [r10 + rcx], xmm1
add r10d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, edi
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rdi + 0x10]
add edi, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r10d, ebx
jb 0x1400ca300
cmp r11d, 8
jb 0x1400ca38e
mov r9d, r8d
and r9d, 0xfffffff8
nop dword [rax]
movq xmm0, qword [r10 + rcx]
movq xmm1, qword [r10 + rdx]
xorps xmm1, xmm0
movq qword [r10 + rcx], xmm1
add r10d, 8
cmp r10d, r9d
jb 0x1400ca370
cmp r10d, r8d
jae 0x1400ca3c2
sub rdx, rcx
mov r9d, r10d
add r9, rcx
sub r8d, r10d
mov ecx, r8d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r9]
xor byte [r9], al
lea r9, [r9 + 1]
sub rcx, 1
jne 0x1400ca3b0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1400ccfc0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400cd09d
test rdx, rdx
je 0x1400cd09d
call fcn.1400cce80
test eax, eax
jne 0x1400cd0a2
movups xmm0, xmmword [rbx]
movabs rax, 0x6a09e667f3bcc908
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x30], xmm1
mov qword [rbx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rbx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rbx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbx + 0x38], rax
xor eax, eax
mov dword [rbx + 0xc0], eax
mov qword [rbx + 0xc8], rax
mov qword [rbx + 0xd0], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400cffe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, dword [rcx]
mov edi, r9d
xor eax, dword [rdx]
neg edi
mov r10, qword [rsp + 0x28]
and eax, edi
mov ebp, r8d
mov r11, rdx
mov rbx, rcx
mov esi, r8d
mov dword [r10], eax
mov eax, dword [rdx + 8]
xor eax, dword [rcx + 8]
and eax, edi
mov dword [r10 + 8], eax
test r8d, r8d
je 0x1400d0057
mov r8, rbx
lea rcx, [rdx + 0xc]
sub r8, rdx
mov r9, r10
sub r9, rdx
mov edx, esi
nop word [rax + rax]
mov eax, dword [r8 + rcx]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
and eax, edi
mov dword [r9 + rcx - 4], eax
sub rdx, 1
jne 0x1400d0040
mov eax, dword [r10]
mov rdx, rsi
xor dword [rbx], eax
mov eax, dword [r10 + 8]
xor dword [rbx + 8], eax
test ebp, ebp
je 0x1400d00c2
mov r8, r10
lea rcx, [rbx + 0xc]
sub r8, rbx
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r8 + rcx]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x1400d0080
mov eax, dword [r10]
mov rdx, rsi
xor dword [r11], eax
lea rax, [r11 + 0xc]
sub r10, r11
mov dword [r11 + 8], 0
nop dword [rax + rax]
mov ecx, dword [rax + r10]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x1400d00b0
jmp 0x1400d00d0
mov eax, dword [r10]
xor dword [r11], eax
mov dword [r11 + 8], 0
mov rbx, qword [rsp + 8]
xor eax, eax
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1400d85e0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400d8726
test rdx, rdx
je 0x1400d8726
call fcn.1400d80d0
test eax, eax
jne 0x1400d872b
mov ecx, dword [rbx]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx], ecx
mov ecx, dword [rbx + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 4], ecx
mov ecx, dword [rbx + 8]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 8], ecx
mov ecx, dword [rbx + 0xc]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0xc], ecx
mov ecx, dword [rbx + 0x10]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x10], ecx
mov ecx, dword [rbx + 0x14]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x14], ecx
mov ecx, dword [rbx + 0x18]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x18], ecx
mov ecx, dword [rbx + 0x1c]
mov eax, ecx
ror eax, 8
rol ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d8820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, rdx
mov rax, rcx
and r10d, 7
and eax, 7
xor r11d, r11d
cmp rax, r10
jne 0x1400d895f
mov rax, r8
and eax, 7
cmp r10, rax
jne 0x1400d895f
test r10, r10
je 0x1400d887e
nop dword [rax]
test r9d, r9d
je 0x1400d887e
movzx eax, byte [r8]
dec r9d
xor al, byte [rdx]
inc r8
mov byte [rcx], al
inc rdx
inc rcx
test dl, 7
jne 0x1400d8860
mov ebx, r9d
mov edi, r11d
shr ebx, 3
test ebx, ebx
je 0x1400d895b
cmp ebx, 8
jb 0x1400d8930
lea eax, [rbx - 1]
mov r10d, eax
lea rsi, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp rcx, rax
ja 0x1400d88b4
cmp rsi, rdx
jae 0x1400d8930
lea rax, [r8 + r10*8]
cmp rcx, rax
ja 0x1400d88c2
cmp rsi, r8
jae 0x1400d8930
mov eax, ebx
and eax, 0xfffffff8
nop word [rax + rax]
movdqu xmm0, xmmword [rdx]
add edi, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x10]
movdqu xmmword [rcx], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x20]
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x30]
add rdx, 0x40
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp edi, eax
jb 0x1400d88d0
cmp edi, ebx
jae 0x1400d895b
sub ebx, edi
mov r10d, ebx
nop word [rax + rax]
mov rax, qword [r8]
add r8, 8
xor rax, qword [rdx]
add rdx, 8
mov qword [rcx], rax
add rcx, 8
sub r10, 1
jne 0x1400d8940
and r9d, 7
test r9d, r9d
je 0x1400d8a86
cmp r9d, 8
jb 0x1400d8a53
lea eax, [r9 - 1]
mov r10d, eax
lea rbx, [rax + rcx]
add rax, rdx
cmp rcx, rax
ja 0x1400d898e
cmp rbx, rdx
jae 0x1400d8a53
lea rax, [r10 + r8]
cmp rcx, rax
ja 0x1400d89a0
cmp rbx, r8
jae 0x1400d8a53
cmp r9d, 0x40
jb 0x1400d8a27
mov ebx, r9d
mov edi, r9d
and ebx, 0x3f
sub edi, ebx
mov esi, 0x20
nop word [rax + rax]
movdqu xmm0, xmmword [r11 + rdx]
lea eax, [rsi - 0x10]
movdqu xmm1, xmmword [r11 + r8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax + rdx]
movdqu xmmword [r11 + rcx], xmm1
add r11d, 0x40
movdqu xmm1, xmmword [rax + r8]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, esi
movdqu xmm0, xmmword [rax + rdx]
movdqu xmm1, xmmword [rax + r8]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rsi + 0x10]
add esi, 0x40
movdqu xmm1, xmmword [rax + r8]
movdqu xmm0, xmmword [rax + rdx]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r11d, edi
jb 0x1400d89c0
cmp ebx, 8
jb 0x1400d8a4e
mov r10d, r9d
and r10d, 0xfffffff8
nop
movq xmm1, qword [r11 + r8]
movq xmm0, qword [r11 + rdx]
xorps xmm1, xmm0
movq qword [r11 + rcx], xmm1
add r11d, 8
cmp r11d, r10d
jb 0x1400d8a30
cmp r11d, r9d
jae 0x1400d8a86
sub r8, rdx
mov r10d, r11d
add r10, rdx
sub rcx, rdx
sub r9d, r11d
mov edx, r9d
nop word [rax + rax]
movzx eax, byte [r8 + r10]
xor al, byte [r10]
mov byte [rcx + r10], al
lea r10, [r10 + 1]
sub rdx, 1
jne 0x1400d8a70
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400dbaf0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
mov rax, qword [0x140554040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
lea eax, [rdi - 0x10]
test eax, 0xffffffe7
jne 0x1400dbb4c
cmp edi, 0x28
je 0x1400dbb4c
test rcx, rcx
je 0x1400dbb4c
xorps xmm0, xmm0
movups xmmword [rcx + 0x134], xmm0
mov dword [rcx + 0x144], 0
movups xmmword [rsp + 0x20], xmm0
cmp edi, 0xf0
jbe 0x1400dbb66
or byte [rcx + 0x1ab], 1
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400e9c90
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
lea eax, [rdi - 0x10]
test eax, 0xffffffe7
jne 0x1400dbbf9
cmp edi, 0x28
je 0x1400dbbf9
mov qword [rsp + 0x78], rsi
mov r8, rdi
mov esi, edi
mov dword [rcx + 0xf4], edi
shr esi, 2
movups xmmword [rcx + 0xf8], xmm0
lea eax, [rsi + 6]
mov dword [rcx + 0xf0], eax
call sub.VCRUNTIME140.dll_memcpy
test esi, esi
je 0x1400dbbd3
mov r9, rbx
mov r8d, esi
nop
mov ecx, dword [r9]
lea r9, [r9 + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [r9 - 4], ecx
sub r8, 1
jne 0x1400dbbb0
xor r9d, r9d
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
call fcn.1400da8b0
movups xmm0, xmmword [rsp + 0x20]
mov rsi, qword [rsp + 0x78]
xor eax, eax
movups xmmword [rbx + 0xf8], xmm0
jmp 0x1400dbbfe
mov eax, 0xffffff53
or byte [rbx + 0x1ab], 1
test eax, eax
jne 0x1400dbb51
mov r9d, dword [rbx + 0xf0]
shr r9d, 1
lea eax, [r9 - 1]
cmp eax, 6
ja 0x1400dbc3b
lea r8, [rbx + 0x124]
mov rcx, rbx
lea rdx, [rsp + 0x20]
call fcn.1400d8aa0
xor eax, eax
jmp 0x1400dbb51
mov eax, 0xffffff1e
jmp 0x1400dbb51
Function at 0x1400dd110
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400dd21a
test rdx, rdx
je 0x1400dd21a
mov eax, dword [rcx]
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 0xc]
cmp eax, 0x3f
jbe 0x1400dd157
mov rdi, qword [rsp + 0x38]
mov eax, 0xffffff7c
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov byte [rax + rdi], 0x80
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov dword [rbx], ecx
cmp ecx, 0x38
jbe 0x1400dd195
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov rdx, rdi
mov dword [rbx], 0x40
mov rcx, rbx
call fcn.1400dc7b0
mov ecx, ebp
mov dword [rbx], ebp
mov r8d, 0x38
xor edx, edx
sub r8d, ecx
add rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rbx + 4]
mov rdx, rdi
mov eax, dword [rbx + 8]
mov ecx, r8d
shr ecx, 0x1d
lea ecx, [rcx + rax*8]
mov dword [rbx + 8], ecx
lea eax, [r8*8]
mov dword [rbx + 4], eax
mov rcx, rbx
mov dword [rdi + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0x3c], eax
call fcn.1400dc7b0
movups xmm0, xmmword [rbx + 0x4c]
mov rdi, qword [rsp + 0x38]
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rbx], rbp
mov dword [rbx + 8], ebp
mov rbp, qword [rsp + 0x30]
mov dword [rbx + 0x4c], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffff53
add rsp, 0x20
pop rsi
ret
Function at 0x1400dd230
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r8, rcx
mov rax, rdx
and r8d, 7
and eax, 7
xor r10d, r10d
mov r9d, 8
cmp r8, rax
jne 0x1400dd331
mov qword [rsp + 0x10], rbx
test r8, r8
je 0x1400dd275
nop dword [rax]
test r9d, r9d
je 0x1400dd275
movzx eax, byte [rdx]
inc rdx
xor byte [rcx], al
inc rcx
dec r9d
jmp 0x1400dd260
mov r11d, r9d
mov ebx, r10d
shr r11d, 3
test r11d, r11d
je 0x1400dd328
mov qword [rsp], rdi
cmp r11d, 8
jb 0x1400dd309
lea eax, [r11 - 1]
lea rdi, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp rcx, rax
ja 0x1400dd2a8
cmp rdi, rdx
jae 0x1400dd309
mov eax, r11d
and eax, 0xfffffff8
nop
movdqu xmm0, xmmword [rcx]
add ebx, 8
movdqu xmm1, xmmword [rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [rdx + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm0, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rdx + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm0, xmmword [rcx + 0x30]
movdqu xmm1, xmmword [rdx + 0x30]
add rdx, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp ebx, eax
jb 0x1400dd2b0
cmp ebx, r11d
jae 0x1400dd324
sub r11d, ebx
mov r8d, r11d
nop
mov rax, qword [rdx]
add rdx, 8
xor qword [rcx], rax
add rcx, 8
sub r8, 1
jne 0x1400dd310
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
and r9d, 7
test r9d, r9d
je 0x1400dd3b0
cmp r9d, 8
jb 0x1400dd383
lea eax, [r9 - 1]
lea r11, [rax + rcx]
add rax, rdx
cmp rcx, rax
ja 0x1400dd351
cmp r11, rdx
jae 0x1400dd383
mov r8d, r9d
and r8d, 0xfffffff8
nop dword [rax + rax]
movq xmm0, qword [r10 + rcx]
movq xmm1, qword [r10 + rdx]
xorps xmm1, xmm0
movq qword [r10 + rcx], xmm1
add r10d, 8
cmp r10d, r8d
jb 0x1400dd360
cmp r10d, r9d
jae 0x1400dd3b0
mov eax, r10d
sub rdx, rcx
add rax, rcx
sub r9d, r10d
mov r8d, r9d
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1400dd3a0
add rsp, 8
ret