joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140116710
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140157988]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r8
mov dword [rbp - 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x38]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140116847
movzx edx, byte [rdi + 1]
movzx ecx, byte [rdi]
movzx eax, dl
movzx r8d, byte [rdi + 5]
shr al, 1
mov byte [rbp - 0x1c], cl
shl cl, 7
or al, cl
shl dl, 6
movzx ecx, byte [rdi + 2]
mov byte [rbp - 0x1b], al
movzx eax, cl
shr al, 2
or al, dl
shl cl, 5
movzx edx, byte [rdi + 3]
mov byte [rbp - 0x1a], al
movzx eax, dl
shr al, 3
or al, cl
shl dl, 4
movzx ecx, byte [rdi + 4]
mov byte [rbp - 0x19], al
movzx eax, cl
shr al, 4
or al, dl
shl cl, 3
mov byte [rbp - 0x18], al
movzx eax, r8b
shr al, 5
or al, cl
shl r8b, 2
movzx ecx, byte [rdi + 6]
mov byte [rbp - 0x17], al
movzx eax, cl
add cl, cl
shr al, 6
or al, r8b
mov byte [rbp - 0x15], cl
mov qword [rsp + 0xa0], r14
lea rcx, [rbp - 0x1c]
xor r14d, r14d
mov byte [rbp - 0x16], al
mov dword [rbp - 0x28], 0x208
mov dword [rbp - 0x24], 0x6601
mov dword [rbp - 0x20], 8
lea edx, [r14 + 8]
call fcn.140060a31
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea r8d, [r14 + 0x14]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
lea rdx, [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov r14, qword [rsp + 0xa0]
test eax, eax
jne 0x14011684b
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x140116890
mov rax, qword [rsi]
xor r9d, r9d
mov rcx, qword [rbp - 0x30]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rbp - 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14006008b
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001640
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push r14
sub rsp, 0x20
mov r10, r8
xor r9d, r9d
mov r8d, dword [rcx]
mov r14, rcx
lea eax, [r8*4]
test eax, eax
je 0x14000167c
nop
movzx eax, byte [r9 + rdx]
mov byte [r10 + r9], al
inc r9d
mov r8d, dword [rcx]
lea eax, [r8*4]
cmp r9d, eax
jb 0x140001660
mov eax, dword [rcx + 4]
lea r9d, [r8*4]
inc eax
shl eax, 4
cmp r9d, eax
jae 0x1400017fd
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 8], r12
lea r12, [0x1400044f0]
mov qword [rsp], r15
lea r15d, [r9 + 2]
nop dword [rax]
mov ebp, dword [r14]
lea eax, [r9 - 4]
movzx r8d, byte [rax + r10]
xor edx, edx
lea eax, [r9 - 3]
movzx r11d, r8b
movzx ebx, byte [rax + r10]
lea eax, [r9 - 2]
movzx edi, byte [rax + r10]
lea eax, [r9 - 1]
movzx esi, byte [rax + r10]
mov eax, r9d
shr eax, 2
div ebp
test edx, edx
jne 0x14000174b
movzx r11d, byte [rbx + r12]
xor edx, edx
movzx ebx, byte [rdi + r12]
mov eax, r9d
movzx edi, byte [rsi + r12]
mov cl, 1
movzx esi, byte [r8 + r12]
lea r8d, [rbp*4]
div r8d
sub eax, 1
je 0x140001746
mov r8d, eax
nop word [rax + rax]
movzx eax, cl
add cl, cl
shr al, 7
movzx eax, al
imul edx, eax, 0x1b
xor cl, dl
sub r8, 1
jne 0x140001730
xor r11b, cl
jmp 0x140001769
cmp ebp, 6
jbe 0x140001769
cmp edx, 4
jne 0x140001769
movzx r11d, byte [r8 + r12]
movzx ebx, byte [rbx + r12]
movzx edi, byte [rdi + r12]
movzx esi, byte [rsi + r12]
mov ecx, r9d
lea eax, [rbp*4]
sub ecx, eax
xor r11b, byte [rcx + r10]
mov ecx, r9d
mov byte [r9 + r10], r11b
mov eax, dword [r14]
shl eax, 2
sub ecx, eax
lea eax, [r15 - 1]
inc ecx
xor bl, byte [rcx + r10]
mov ecx, r9d
mov byte [rax + r10], bl
mov eax, dword [r14]
shl eax, 2
sub ecx, eax
add ecx, 2
xor dil, byte [rcx + r10]
mov ecx, r9d
mov byte [r15 + r10], dil
add r9d, 4
mov eax, dword [r14]
shl eax, 2
sub ecx, eax
lea eax, [r15 + 1]
add ecx, 3
add r15d, 4
xor sil, byte [rcx + r10]
mov byte [rax + r10], sil
mov eax, dword [r14 + 4]
inc eax
shl eax, 4
cmp r9d, eax
jb 0x1400016c0
mov r15, qword [rsp]
mov r12, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140001870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movsxd rax, dword [rcx + 0x3c]
xor r10d, r10d
mov esi, edx
mov rbx, rcx
mov r8d, dword [rax + rcx + 0x88]
mov edi, dword [r8 + rcx + 0x1c]
mov r11d, dword [r8 + rcx + 0x20]
mov r14d, dword [r8 + rcx + 0x24]
add r11, rcx
add r14, rcx
lea rbp, [rcx + rdi]
test edi, edi
je 0x14000191a
nop word [rax + rax]
mov edx, dword [r11]
mov rax, 0xffffffffffffffff
add rdx, rbx
mov r8d, 0x99
inc rax
cmp byte [rdx + rax], 0
jne 0x1400018d3
xor r9d, r9d
test rax, rax
je 0x140001909
nop dword [rax]
nop dword [rax + rax]
movsx ecx, byte [rdx]
lea r8d, [r8 + r8*2]
inc r9d
lea rdx, [rdx + 1]
add r8d, ecx
movsxd rcx, r9d
cmp rcx, rax
jb 0x1400018f0
cmp r8d, esi
je 0x140001933
inc r10d
add r11, 4
cmp r10d, edi
jb 0x1400018c0
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
movzx ecx, word [r14 + r10*2]
mov eax, dword [rbp + rcx*4]
add rax, rbx
jmp 0x14000191c
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140386900]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140386910]
mov dword [rax], 1
mov rax, qword [0x140386920]
mov dword [rax], 1
mov rax, qword [0x140386890]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1403868f0]
mov dword [0x14039c020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1403869e0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1403869c0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140386760]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x14000a760
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x38], edx
inc ecx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret

Function at 0x14000a7b0
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
vmovups xmmword [rsp + 0x250], xmm6
mov rsi, rcx
mov rcx, rdx
mov r12, rdx
call sym.strlen
lea ebx, [rax + 1]
cdqe
mov byte [r12 + rax], 0xa
test ebx, ebx
jle 0x14000a863
mov rdi, qword [sym.imp.WS2_32.dll_select]
lea rax, [rsp + 0x34]
xor r15d, r15d
lea r14, [rsp + 0x40]
mov rbp, qword [sym.imp.libcurl_4.dll_curl_easy_send]
lea r13, [rsp + 0x38]
vmovq xmm6, rax
nop dword [rax]
mov rcx, qword [rsi + 0x118]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], r13
mov r8, r14
mov qword [rsp + 0x48], rcx
inc ecx
call rdi
test eax, eax
jle 0x14000a899
mov rcx, qword [rsi + 8]
lea rdx, [r12 + r15]
vmovq r9, xmm6
movsxd r8, ebx
call rbp
test eax, eax
jne 0x14000a890
movsxd rax, dword [rsp + 0x34]
sub ebx, eax
test ebx, ebx
jg 0x14000a89d
mov eax, 1
vmovups xmm6, xmmword [rsp + 0x250]
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 0x51
je 0x14000a810
xor eax, eax
jmp 0x14000a868
add r15, rax
jmp 0x14000a810
Function at 0x14000b1b0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea r12, [0x140327e6a]
mov rbx, rcx
mov rcx, r8
mov rsi, rdx
lea r13, [rsp + 0x30]
call sym.strdup
mov rcx, rax
mov rdi, rax
call dbg.dirname
mov edx, 0x5c
mov rcx, rax
mov rbp, rax
call sym.strchr
vpxor xmm0, xmm0, xmm0
lea rcx, str.APPDATA
test rax, rax
vmovdqu8 ymmword [rsp + 0x30], ymm0
vmovdqu8 xmmword [rsp + 0x50], xmm0
lea rax, [0x140327e6c]
cmove r12, rax
vzeroupper
call sym.getenv
mov rdx, rsi
mov rcx, rbx
mov r9, rax
lea r8, str._scpuminercpuminer_conf.json
call sym.snprintf_1
mov rdx, r13
mov rcx, rbx
call dbg.stat
test eax, eax
jne 0x14000b290
mov rdx, r13
mov rcx, rbx
call dbg.stat
test eax, eax
je 0x14000b270
mov byte [rbx], 0
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rdi
mov byte [rbx + rsi - 1], 0
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.free
mov qword [rsp + 0x20], r12
mov r9, rbp
lea r8, str._s_scpuminer_conf.json
mov rdx, rsi
mov rcx, rbx
call sym.snprintf_1
jmp 0x14000b249
Function at 0x14000bfa0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x140
vpxor xmm0, xmm0, xmm0
vmovdqu64 zmmword [rsp + 0x40], zmm0
vmovdqu64 zmmword [rsp + 0x80], zmm0
vmovdqu64 zmmword [rsp + 0xc0], zmm0
mov rdi, rdx
vmovdqu64 zmmword [rsp + 0x100], zmm0
vpxor xmm0, xmm0, xmm0
mov qword [rsp + 0x170], rcx
vmovdqu8 ymmword [rsp + 0x20], ymm0
vzeroupper
call qword [sym.imp.libcurl_4.dll_curl_easy_init]
test rax, rax
mov r8, qword [rsp + 0x170]
mov rbx, rax
je 0x14000c190
lea rbp, [rsp + 0x40]
mov rsi, qword [sym.imp.libcurl_4.dll_curl_easy_setopt]
mov edx, 0x2712
mov rcx, rax
call rsi
mov r8d, 1
mov edx, 0x4a
mov rcx, rbx
call rsi
mov r8d, 0xf
mov edx, 0x4e
mov rcx, rbx
call rsi
mov r8, rbp
mov edx, 0x271a
mov rcx, rbx
call rsi
mov r8d, 1
mov edx, 0x63
mov rcx, rbx
call rsi
mov r8d, 1
mov edx, 0x79
mov rcx, rbx
call rsi
lea r8, [sym.all_data_cb]
mov edx, 0x4e2b
mov rcx, rbx
call rsi
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, rbx
call rsi
mov rax, qword [0x140386d00]
mov r8, qword [rax]
test r8, r8
je 0x14000c120
mov edx, 0x2714
mov rcx, rbx
call rsi
mov rax, qword [0x140386d10]
mov edx, 0x65
mov rcx, rbx
mov r8d, dword [rax]
call rsi
mov rcx, rbx
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
jne 0x14000c170
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14000c0dc
cmp qword [rsp + 0x28], 0
jne 0x14000c110
lea rdx, str.Empty_data_received_for_config
mov ecx, 1
call sym.applog.constprop.1
xor esi, esi
mov rcx, rbx
call qword [sym.imp.libcurl_4.dll_curl_easy_cleanup]
mov rax, rsi
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, rdi
xor edx, edx
call sym.json_loads
mov rsi, rax
jmp 0x14000c0ef
lea rcx, str.http_proxy
call sym.getenv
test rax, rax
je 0x14000c0b9
lea r12, str.all_proxy
mov rcx, r12
call sym.getenv
test rax, rax
je 0x14000c1b0
mov rcx, r12
call sym.getenv
mov rcx, rbx
mov edx, 0x2714
mov r8, rax
call rsi
mov rcx, rbx
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
je 0x14000c0ca
nop dword [rax + rax]
mov r8, rbp
lea rdx, str.Remote_config_read_failed:__s
mov ecx, 1
call sym.applog.constprop.1
jmp 0x14000c0ed
lea rdx, str.Remote_config_init_failed_
mov ecx, 1
xor esi, esi
call sym.applog.constprop.1
jmp 0x14000c0f8
lea r12, str.ALL_PROXY
mov rcx, r12
call sym.getenv
test rax, rax
jne 0x14000c145
lea r8, [0x140327cf8]
mov edx, 0x2714
mov rcx, rbx
call rsi
jmp 0x14000c0b9
Function at 0x14000f2e0
Capabilities:
Get socket status

Disassembly:
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x14000f300
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp sym.socket_full
Function at 0x14000f310
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa88
vmovups xmmword [rsp + 0xa60], xmm6
vmovups xmmword [rsp + 0xa70], xmm8
mov rsi, qword [rcx + 0x128]
mov edx, 0xa
mov rbx, rcx
mov rcx, rsi
call sym.strchr
test rax, rax
je 0x14000f3e0
mov rcx, rsi
call sym.strlen
mov rcx, rsi
lea rdx, [0x1403282f8]
mov rdi, rax
call sym.strtok
mov rcx, rax
test rax, rax
je 0x14000f600
call sym.strdup
mov rcx, rax
mov rsi, rax
call sym.strlen
lea rdx, [rax + 1]
cmp rdx, rdi
jl 0x14000f480
mov rax, qword [rbx + 0x128]
mov byte [rax], 0
mov rax, qword [0x140386cf0]
cmp byte [rax], 0
jne 0x14000f460
vmovups xmm6, xmmword [rsp + 0xa60]
vmovups xmm8, xmmword [rsp + 0xa70]
mov rax, rsi
add rsp, 0xa88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x38]
mov r14, qword [sym.imp.msvcrt.dll__time64]
call r14
lea r12, [rsp + 0x260]
mov rax, qword [0x140329358]
mov rcx, qword [rbx + 0x118]
xor r9d, r9d
xor r8d, r8d
mov rbp, qword [sym.imp.WS2_32.dll_select]
mov dword [rsp + 0x260], 1
mov rdx, r12
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x268], rcx
inc ecx
vmovq xmm6, rax
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
jg 0x14000f4a0
lea rdx, str.stratum_recv_line_timed_out
mov ecx, 2
xor esi, esi
call sym.applog
jmp 0x14000f3b2
mov r8, rsi
lea rdx, str.___s
mov ecx, 5
call sym.applog.constprop.0
jmp 0x14000f3b2
mov rcx, qword [rbx + 0x128]
sub rdi, rax
lea r8, [rdi + 1]
add rdx, rcx
call sym.memmove
jmp 0x14000f3a2
lea rax, [rsp + 0x48]
mov rdi, qword [sym.imp.libcurl_4.dll_curl_easy_recv]
lea r15, [rsp + 0x40]
vmovq xmm8, rax
jmp 0x14000f535
cmp qword [rsp + 0x40], 0
je 0x14000f5a1
mov rsi, qword [rbx + 0x128]
mov rcx, rsi
call sym.strlen
mov rcx, r12
mov r13, rax
call sym.strlen
lea rdx, [r13 + rax + 1]
cmp rdx, qword [rbx + 0x120]
jae 0x14000f5c0
lea rcx, [rsi + r13]
mov rdx, r12
call sym.strcpy
xor ecx, ecx
call r14
sub rax, qword [rsp + 0x38]
cmp rax, 0x3b
jg 0x14000f5f0
mov rsi, qword [rbx + 0x128]
mov edx, 0xa
mov rcx, rsi
call sym.strchr
test rax, rax
jne 0x14000f355
xor edx, edx
mov r8d, 0x800
mov rcx, r12
call sym.memset
mov rcx, qword [rbx + 8]
mov r9, r15
mov r8d, 0x7fc
mov rdx, r12
call rdi
test eax, eax
je 0x14000f4c0
cmp eax, 0x51
jne 0x14000f5a1
mov rcx, qword [rbx + 0x118]
mov rax, qword [0x140329360]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 1
vmovq qword [rsp + 0x20], xmm8
vmovq rdx, xmm6
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rax
inc ecx
call rbp
test eax, eax
jg 0x14000f504
lea rdx, str.stratum_recv_line_failed
mov ecx, 2
xor esi, esi
call sym.applog
jmp 0x14000f3b2
and rdx, 0xfffffffffffff800
mov rcx, rsi
add rdx, 0x800
mov qword [rbx + 0x120], rdx
call sym.realloc
mov rsi, rax
mov qword [rbx + 0x128], rax
jmp 0x14000f4f8
mov rsi, qword [rbx + 0x128]
jmp 0x14000f355
lea rdx, str.stratum_recv_line_failed_to_parse_a_newline_terminated_string
mov ecx, 1
xor esi, esi
call sym.applog.constprop.1
jmp 0x14000f3b2
Function at 0x140016450
Capabilities:
Hash data using sha512

Disassembly:
test rdx, rdx
je 0x140016563
test rcx, rcx
je 0x140016563
vmovdqu64 zmm1, zmmword [0x14032a8c0]
mov rax, rdx
vpxor xmm0, xmm0, xmm0
not rax
vmovdqu8 zmmword [rcx + 0x80], zmm0
vmovdqu8 zmmword [rcx + 0x40], zmm0
vmovdqu8 zmmword [rcx + 0xb0], zmm0
add rax, rcx
vmovdqu64 zmmword [rcx], zmm1
cmp rax, 0x3e
jbe 0x1400164d0
vmovdqu64 zmm0, zmmword [0x14032a8c0]
vpxorq zmm0, zmm0, zmmword [rdx]
vmovdqu64 zmmword [rcx], zmm0
movzx eax, byte [rdx]
mov dword [rcx + 0xe4], eax
xor eax, eax
vzeroupper
ret
movabs rax, 0x6a09e667f3bcc908
xor rax, qword [rdx]
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
xor rax, qword [rdx + 8]
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
xor rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
xor rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
xor rax, qword [rdx + 0x20]
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
xor rax, qword [rdx + 0x28]
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
xor rax, qword [rdx + 0x30]
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
xor rax, qword [rdx + 0x38]
mov qword [rcx + 0x38], rax
jmp 0x1400164b3
mov eax, 0xffffffff
ret
Function at 0x140018eb0
Capabilities:
Encode data using xor

Disassembly:
lea r8, [rdx + 8]
mov rax, rcx
sub rax, r8
cmp rax, 0x30
jbe 0x140019015
vmovdqu64 zmm1, zmmword [rcx]
vmovdqu64 zmm2, zmmword [rcx + 0x40]
vpxorq zmm0, zmm1, zmmword [rdx]
vmovdqu64 zmm3, zmmword [rcx + 0x80]
vmovdqu64 zmm4, zmmword [rcx + 0xc0]
vmovdqu64 zmm5, zmmword [rcx + 0x100]
vmovdqu64 zmm1, zmmword [rcx + 0x140]
vmovdqu64 zmmword [rcx], zmm0
vpxorq zmm0, zmm2, zmmword [rdx + 0x40]
vmovdqu64 zmm2, zmmword [rcx + 0x180]
vmovdqu64 zmmword [rcx + 0x40], zmm0
vpxorq zmm0, zmm3, zmmword [rdx + 0x80]
vmovdqu64 zmm3, zmmword [rcx + 0x1c0]
vmovdqu64 zmmword [rcx + 0x80], zmm0
vpxorq zmm0, zmm4, zmmword [rdx + 0xc0]
vmovdqu64 zmm4, zmmword [rcx + 0x200]
vmovdqu64 zmmword [rcx + 0xc0], zmm0
vpxorq zmm0, zmm5, zmmword [rdx + 0x100]
vmovdqu64 zmm5, zmmword [rcx + 0x240]
vmovdqu64 zmmword [rcx + 0x100], zmm0
vpxorq zmm0, zmm1, zmmword [rdx + 0x140]
vmovdqu64 zmm1, zmmword [rcx + 0x280]
vmovdqu64 zmmword [rcx + 0x140], zmm0
vpxorq zmm0, zmm2, zmmword [rdx + 0x180]
vmovdqu64 zmmword [rcx + 0x180], zmm0
vpxorq zmm0, zmm3, zmmword [rdx + 0x1c0]
vmovdqu64 zmmword [rcx + 0x1c0], zmm0
vpxorq zmm0, zmm4, zmmword [rdx + 0x200]
vmovdqu64 zmmword [rcx + 0x200], zmm0
vpxorq zmm0, zmm5, zmmword [rdx + 0x240]
vmovdqu64 zmmword [rcx + 0x240], zmm0
vpxorq zmm0, zmm1, zmmword [rdx + 0x280]
vmovdqu64 zmmword [rcx + 0x280], zmm0
vmovdqu64 zmm2, zmmword [rcx + 0x2c0]
vmovdqu64 zmm3, zmmword [rcx + 0x300]
vpxorq zmm0, zmm2, zmmword [rdx + 0x2c0]
vmovdqu64 zmm4, zmmword [rcx + 0x340]
vmovdqu64 zmm5, zmmword [rcx + 0x380]
vmovdqu64 zmmword [rcx + 0x2c0], zmm0
vpxorq zmm0, zmm3, zmmword [rdx + 0x300]
vmovdqu64 zmmword [rcx + 0x300], zmm0
vpxorq zmm0, zmm4, zmmword [rdx + 0x340]
vmovdqu64 zmmword [rcx + 0x340], zmm0
vpxorq zmm0, zmm5, zmmword [rdx + 0x380]
vmovdqu64 zmmword [rcx + 0x380], zmm0
vmovdqu64 zmm0, zmmword [rdx + 0x3c0]
vpxorq zmm0, zmm0, zmmword [rcx + 0x3c0]
vmovdqu64 zmmword [rcx + 0x3c0], zmm0
vzeroupper
ret
xor eax, eax
nop word [rax + rax]
mov r8, qword [rdx + rax]
xor qword [rcx + rax], r8
add rax, 8
cmp rax, 0x400
jne 0x140019020
ret

Function at 0x14001b590
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r9, r8
test rcx, rcx
je 0x14001b5e0
test rdx, rdx
je 0x14001b5e0
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
cmp rax, 1
mov qword [rbx], rax
sbb eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 0xffffffff
jmp 0x14001b5cc
Function at 0x14005d1b0
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
vpbroadcastq zmm0, rax
movabs rax, 0xbb67ae8584caa73b
vmovdqu64 zmmword [rcx + 0x400], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x710], 0
vmovdqu64 zmmword [rcx + 0x440], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0xa54ff53a5f1d36f1
vmovdqu64 zmmword [rcx + 0x480], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0x510e527fade682d1
vmovdqu64 zmmword [rcx + 0x4c0], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0x9b05688c2b3e6c1f
vmovdqu64 zmmword [rcx + 0x500], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0x1f83d9abfb41bd6b
vmovdqu64 zmmword [rcx + 0x540], zmm0
vpbroadcastq zmm0, rax
movabs rax, 0x5be0cd19137e2179
vmovdqu64 zmmword [rcx + 0x580], zmm0
vpbroadcastq zmm0, rax
vmovdqu64 zmmword [rcx + 0x5c0], zmm0
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x700], xmm0
vzeroupper
ret
Function at 0x14006db50
Capabilities:
Hash data using sha256

Disassembly:
vpxor xmm0, xmm0, xmm0
vmovdqu8 zmmword [rcx + 0x20], zmm0
vmovdqu8 zmmword [rcx + 0x60], zmm0
vmovdqu8 ymmword [rcx + 0xa0], ymm0
vmovdqu ymm0, ymmword [0x14032b800]
mov rax, rdx
not rax
add rax, rcx
vmovdqu ymmword [rcx], ymm0
cmp rax, 0x1e
jbe 0x14006dba0
vpxor ymm0, ymm0, ymmword [rdx]
xor eax, eax
vmovdqu ymmword [rcx], ymm0
vzeroupper
ret
mov eax, dword [rdx]
xor eax, 0x6a09e667
mov dword [rcx], eax
mov eax, dword [rdx + 4]
xor eax, 0xbb67ae85
mov dword [rcx + 4], eax
mov eax, dword [rdx + 8]
xor eax, 0x3c6ef372
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0xc]
xor eax, 0xa54ff53a
mov dword [rcx + 0xc], eax
mov eax, dword [rdx + 0x10]
xor eax, 0x510e527f
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
xor eax, 0x9b05688c
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 0x18]
xor eax, 0x1f83d9ab
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0x1c]
xor eax, 0x5be0cd19
mov dword [rcx + 0x1c], eax
xor eax, eax
vzeroupper
ret

Function at 0x14006dc00
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 0x28
lea eax, [rdx - 1]
cmp al, 0x1f
ja 0x14006dc77
vpxor xmm0, xmm0, xmm0
mov byte [rsp], dl
mov byte [rsp + 1], 0
mov word [rsp + 2], 0x101
vmovdqu8 zmmword [rcx + 0x20], zmm0
vmovdqu8 zmmword [rcx + 0x60], zmm0
vmovdqu8 ymmword [rcx + 0xa0], ymm0
xor eax, eax
mov dword [rsp + 4], 0
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
vmovdqu ymm0, ymmword [0x14032b800]
vpxor ymm0, ymm0, ymmword [rsp]
vmovdqu ymmword [rcx], ymm0
vzeroupper
add rsp, 0x28
ret
mov eax, 0xffffffff
jmp 0x14006dc72
Function at 0x14006e840
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x60
movzx eax, dl
mov ebx, r9d
dec edx
mov ah, bl
cmp dl, 0x1f
ja 0x14006e9c6
lea edx, [r9 - 1]
cmp dl, 7
ja 0x14006e9c6
test r8, r8
je 0x14006e9c6
mov word [rsp], ax
mov rax, qword [0x14032b820]
vmovdqu ymm1, ymmword [0x14032b800]
mov dword [rsp + 0xa], 0
mov word [rsp + 0xe], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
vpxor xmm0, xmm0, xmm0
movzx r9d, r9b
vmovdqu8 zmmword [rcx + 0x20], zmm0
vmovdqu8 zmmword [rcx + 0x60], zmm0
vmovdqu8 ymmword [rcx + 0xa0], ymm0
vmovdqu8 zmmword [rsp + 0x20], zmm0
mov rdx, r8
mov qword [rsp + 2], rax
vpxor ymm1, ymm1, ymmword [rsp]
lea rax, [rsp + 0x20]
mov r10, rax
vmovdqu ymmword [rcx], ymm1
cmp r9d, 8
jae 0x14006e9a0
xor r8d, r8d
test r9b, 4
jne 0x14006e980
test r9b, 2
jne 0x14006e960
and r9d, 1
jne 0x14006e950
vmovdqu64 zmm2, zmmword [rsp + 0x20]
mov qword [rcx + 0xb0], 0x40
vmovdqu64 zmmword [rcx + 0x30], zmm2
nop dword [rax]
mov rdx, rax
lea rbx, [rsp + 0x60]
inc rax
mov byte [rdx], 0
cmp rax, rbx
jne 0x14006e930
xor eax, eax
vzeroupper
add rsp, 0x60
pop rbx
ret
movzx edx, byte [rdx + r8]
mov byte [r10 + r8], dl
jmp 0x14006e90c
movzx r11d, word [rdx + r8]
mov word [r10 + r8], r11w
add r8, 2
and r9d, 1
je 0x14006e90c
jmp 0x14006e950
mov r8d, dword [rdx]
mov dword [r10], r8d
mov r8d, 4
test r9b, 2
je 0x14006e906
jmp 0x14006e960
mov ebx, r9d
xor edx, edx
and ebx, 0xfffffff8
mov r10d, edx
add edx, 8
mov r11, qword [r8 + r10]
mov qword [rax + r10], r11
cmp edx, ebx
jb 0x14006e9a8
lea r10, [rax + rdx]
add rdx, r8
jmp 0x14006e8f3
mov eax, 0xffffffff
jmp 0x14006e948