joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d6a40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r10, r8
mov r11, rcx
test r9, r9
jne 0x1400d6a78
mov edx, 0xe2
mov dword [rsp + 0x20], 0x9a
lea r9, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 4]
call fcn.14006c2b0
xor eax, eax
add rsp, 0x38
ret
movzx r8d, byte [r8]
and r8d, 0x80
test rdx, rdx
je 0x1400d6a8b
mov dword [rdx], r8d
cmp r9, 1
jne 0x1400d6aaf
test r11, r11
je 0x1400d6aa5
movzx eax, byte [r10]
test r8d, r8d
je 0x1400d6aa3
not al
inc al
mov byte [rcx], al
mov eax, 1
add rsp, 0x38
ret
movzx ecx, byte [r10]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov eax, ebx
test cl, cl
jne 0x1400d6acc
mov eax, 1
mov ebx, eax
jmp 0x1400d6b7f
cmp cl, 0xff
jne 0x1400d6bbd
mov eax, 1
lea rcx, [r9 - 1]
mov edx, ebx
cmp r9, rax
jbe 0x1400d6b6f
cmp rcx, 8
jb 0x1400d6b5b
and ecx, 7
mov rdx, r9
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm3, xmm3
nop
movd xmm1, dword [r10 + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
movd xmm1, dword [r10 + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
cmp rax, rdx
jb 0x1400d6b00
por xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r9
jae 0x1400d6b6f
movzx ecx, byte [rax + r10]
inc rax
or edx, ecx
cmp rax, r9
jb 0x1400d6b60
test edx, edx
mov eax, ebx
setne al
test edx, edx
setne bl
test edx, edx
je 0x1400d6bbd
movzx ecx, byte [r10 + 1]
and ecx, 0x80
cmp r8d, ecx
jne 0x1400d6bbd
mov edx, 0xe2
mov dword [rsp + 0x20], 0xbb
lea r9, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_asn1_a_int.c
mov ecx, reloc.WS2_32.dll_listen
lea r8d, [rdx - 5]
call fcn.14006c2b0
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x38
ret
mov ecx, eax
sub r9, rcx
test r11, r11
je 0x1400d6c11
neg r8d
mov qword [rsp + 0x30], rdi
lea r8, [rbx + r10]
sbb edi, edi
add r8, r9
movzx edi, dil
mov ecx, edi
and ecx, 1
test r9, r9
je 0x1400d6c0c
mov rdx, r8
sub rdx, rbx
sub rdx, r10
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
dec rdx
xor eax, edi
add ecx, eax
mov byte [rdx + r11], cl
shr ecx, 8
test rdx, rdx
jne 0x1400d6bf0
mov rdi, qword [rsp + 0x30]
mov rax, r9
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x1400d6cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
and r8d, 0x100
mov rcx, qword [rcx + 8]
jmp fcn.1400d6d10
Function at 0x1400d6d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
xor r10d, r10d
xor bl, bl
mov r14, r9
mov rdi, rcx
test rcx, rcx
je 0x1400d6e26
test rdx, rdx
je 0x1400d6e26
movzx eax, byte [rcx]
test r8d, r8d
jne 0x1400d6d5a
cmp al, 0x7f
jbe 0x1400d6e1e
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d6e2e
mov bl, 0xff
cmp al, 0x80
jbe 0x1400d6d71
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d6e2e
jne 0x1400d6e1e
mov eax, 1
lea rcx, [rdx - 1]
cmp rdx, rax
jbe 0x1400d6e0f
cmp rcx, 8
jb 0x1400d6dfa
and ecx, 7
mov r8, rdx
sub r8, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop
movd xmm1, dword [rdi + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
movd xmm1, dword [rdi + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, r8
jb 0x1400d6da0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r10d, xmm2
cmp rax, rdx
jae 0x1400d6e0f
nop
movzx ecx, byte [rax + rdi]
inc rax
or r10d, ecx
cmp rax, rdx
jb 0x1400d6e00
neg r10d
sbb bl, bl
movzx ebx, bl
mov r10d, ebx
and r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d6e2e
mov eax, 1
mov rdx, r10
mov qword [rsp + 0x10], rsi
test r14, r14
je 0x1400d6e84
mov rsi, qword [r9]
test rsi, rsi
je 0x1400d6e84
movzx r8d, bl
lea r11, [rdi + rdx]
and r8d, 1
mov byte [rsi], bl
test rdx, rdx
je 0x1400d6e81
mov r9, r11
mov r10d, r10d
sub r9, rdi
add r10, rsi
nop
movzx edx, byte [r11 - 1]
lea r11, [r11 - 1]
dec r9
movzx ecx, bl
xor edx, ecx
add r8d, edx
mov byte [r10 + r9], r8b
shr r8d, 8
test r9, r9
jne 0x1400d6e60
add qword [r14], rax
mov rsi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
pop r14
ret
Function at 0x1400e5040
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x10], rbx
mov rbx, rdx
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov rdi, rcx
test rcx, rcx
je 0x1400e518f
test rdx, rdx
je 0x1400e518f
call fcn.1401760e4
mov dword [rax], 0
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1400e51ba
xor eax, eax
mov rcx, rbx
cmp byte [rbx], al
je 0x1400e50a1
nop
cmp eax, 0x80000000
jae 0x1400e50a1
inc rcx
inc eax
cmp byte [rcx], 0
jne 0x1400e5090
mov esi, eax
btr esi, 0x1f
lea rax, [rsi - 1]
cmp rax, 0x7ffffffb
ja 0x1400e51ad
mov ecx, 0x248
call fcn.140176114
mov qword [rdi], rax
test rax, rax
jne 0x1400e50d9
call fcn.1401760e4
mov dword [rax], listen
jmp 0x1400e519a
xor edx, edx
mov r8d, 0x248
mov rcx, rax
call fcn.140174b20
cmp byte [rsi + rbx - 1], 0x2a
je 0x1400e5160
lea rax, [rsi + 3]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400e5107
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140173f60
sub rsp, rcx
lea rdx, [rsp + 0x20]
mov rcx, rdx
sub rcx, rbx
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400e5121
movzx eax, byte [rdx + rsi - 1]
cmp al, 0x2f
je 0x1400e5154
cmp al, 0x5c
je 0x1400e5154
movzx eax, word [0x1401feab8]
mov word [rdx + rsi], ax
movzx eax, byte [0x1401feaba]
mov byte [rdx + rsi + 2], al
jmp 0x1400e515d
mov eax, 0x2a
mov word [rdx + rsi], ax
mov rbx, rdx
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rdi]
mov qword [rcx + 0x140], rax
mov rcx, qword [rdi]
cmp qword [rcx + 0x140], 0xffffffffffffffff
jne 0x1400e51ce
call fcn.14017610c
mov qword [rdi], 0
call fcn.1401760e4
mov dword [rax], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
mov rsp, rbp
pop rbp
ret
call fcn.1401760e4
mov dword [rax], 2
jmp 0x1400e519a
mov rdx, rcx
mov rcx, qword [rcx + 0x140]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400e519a
mov rcx, qword [rdi]
mov r8d, 0xff
lea rdx, [rcx + 0x2c]
add rcx, 0x148
call fcn.140187e40
mov rax, qword [rdi]
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov byte [rax + 0x247], 0
mov rax, qword [rdi]
mov rdi, qword [rbp + 0x20]
add rax, 0x148
mov rsp, rbp
pop rbp
ret
Function at 0x1400e6750
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xa8
mov rax, qword [rdx + 8]
xor esi, esi
mov r15, qword [rdx + 0x10]
sub rax, r8
mov qword [rsp + 0xe8], rax
mov rdi, r8
mov r13, rdx
mov r12, rcx
mov ebp, esi
cmp r15, r8
jb 0x1400e6908
cmp r8, 0x40
ja 0x1400e6908
lea rax, [rsp + 0x20]
mov qword [r11 + 0x20], rbx
neg rax
mov qword [r11 - 0x38], r14
and eax, 0x3f
lea r14, [rsp + 0x20]
add r14, rax
lea rax, [r8 + 0x100]
cmp r15, rax
jbe 0x1400e67ce
mov rbp, r15
sub rbp, r8
sub rbp, 0x100
xor edx, edx
mov rcx, r14
mov rbx, rsi
call fcn.140174b20
mov r9, rsi
cmp rbp, r15
jae 0x1400e689e
mov rcx, qword [r13 + 0x20]
mov r12, rsi
mov r10, qword [r13 + 8]
mov r11, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rcx
lea r13, [rcx + r10]
nop word [rax + rax]
add rcx, rbp
mov rax, rbp
xor rax, r11
mov rdx, rcx
sub rdx, r13
xor rdx, r10
lea r8, [rax - 1]
not rax
shr rax, 0x3f
shr r8, 0x3f
and r8, rax
mov rax, rbp
xor rax, r10
neg r8
or rdx, rax
or r12, r8
xor rdx, rbp
and r8, r9
shr rdx, 0x3f
or rbx, r8
neg rdx
inc rbp
and r12, rdx
movzx eax, r12b
and al, byte [rcx]
or byte [r9 + r14], al
inc r9
mov rcx, r9
mov rax, r9
sub rcx, rdi
xor rax, rdi
xor rcx, rdi
or rcx, rax
xor rcx, r9
shr rcx, 0x3f
neg rcx
and r9, rcx
mov rcx, qword [rsp + 0xf0]
cmp rbp, r15
jb 0x1400e6810
mov r12, qword [rsp + 0xe0]
test rdi, rdi
je 0x1400e68e2
mov rax, rbx
xor rax, 0x20
movzx eax, byte [rax + r14]
movzx eax, byte [rbx + r14]
inc rbx
mov byte [rsi + r12], al
mov rcx, rbx
sub rcx, rdi
mov rax, rbx
xor rcx, rdi
xor rax, rdi
or rcx, rax
inc rsi
xor rcx, rbx
shr rcx, 0x3f
neg rcx
and rbx, rcx
cmp rsi, rdi
jb 0x1400e68a3
mov r14, qword [rsp + 0xa0]
mov eax, 1
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, 0x612
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_ssl_record_ssl3_record.c
lea rcx, str.Assertion_failed:_rec__orig_len___md_size__md_size___EVP_MAX_MD_SIZE
call fcn.14006e890
xor eax, eax
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e7b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov rdx, qword [rdx + 8]
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x1400e7b82
lea rax, [rsi + r8]
cmp rax, rdx
jbe 0x1400e7b6d
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
jmp 0x1400e7b87
cmp rsi, rdx
ja 0x1400e7b60
mov rax, qword [rbx + 0x20]
mov rcx, qword [rcx + 0x430]
mov qword [rsp + 0x40], rdi
movzx edi, byte [rax + rdx - 1]
call fcn.140060fe0
mov rcx, rax
call fcn.1400611c0
mov r8, qword [rbx + 8]
and eax, 0x200000
je 0x1400e7bc4
sub r8, rdi
mov eax, 1
dec r8
jmp 0x1400e7c76
lea rcx, [rdi + rsi]
mov qword [rsp + 0x38], rbp
mov ebp, 0x100
mov r9, r8
sub r9, rcx
mov rax, r8
xor r9, rcx
xor rax, rcx
or r9, rax
xor r9, r8
shr r9, 0x3f
dec r9
cmp r8, rbp
cmovb rbp, r8
xor r10d, r10d
test rbp, rbp
je 0x1400e7c4d
mov r11, qword [rbx + 0x20]
mov rsi, rdi
shr rsi, 0x3f
dec r11
add r11, r8
nop
mov rax, r10
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r10
inc r10
shr rcx, 0x3f
xor cl, al
xor al, sil
or cl, al
movzx eax, byte [r11 + 1]
dec cl
movzx edx, cl
mov rcx, rdi
xor rcx, rax
and rdx, rcx
not rdx
and r9, rdx
cmp r10, rbp
jb 0x1400e7c10
mov rbp, qword [rsp + 0x38]
lea rax, [rdi + 1]
not r9
movzx ecx, r9b
dec rcx
shr rcx, 0x3f
neg rcx
and rax, rcx
sub r8, rax
mov eax, ecx
and eax, 1
not ecx
or eax, ecx
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400ec4e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov rax, qword [rcx]
xor r14d, r14d
movsxd rdi, r8d
mov rbp, r9
mov rsi, rdx
mov rbx, rcx
mov r13d, r14d
lea r12d, [r14 + 1]
test r9, r9
je 0x1400ec535
cmp r9, rax
je 0x1400ec52d
test rdx, rdx
je 0x1400ec526
test r8d, r8d
jns 0x1400ec52d
xor eax, eax
jmp 0x1400ec738
mov r13d, r12d
mov qword [rcx], r9
jmp 0x1400ec53d
test rax, rax
je 0x1400ec526
mov rbp, rax
mov qword [rsp + 0xe0], r15
mov r15, qword [rsp + 0x100]
test rsi, rsi
je 0x1400ec754
mov rcx, rbp
mov r13d, r12d
call fcn.140061750
cmp eax, 0x90
mov r12d, r14d
mov r15d, eax
setle r12b
jle 0x1400ec58b
mov r8d, 0x29
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_hmac_hmac.c
lea rcx, str.Assertion_failed:_j____int_sizeof_ctx__key_
call fcn.14006e890
test r12d, r12d
je 0x1400ec5db
cmp r15d, edi
jge 0x1400ec5e2
mov r15, qword [rsp + 0x100]
mov rdx, rbp
mov rcx, qword [rbx + 8]
mov r8, r15
call fcn.140079400
test eax, eax
je 0x1400ec5db
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.140079650
test eax, eax
je 0x1400ec5db
mov rcx, qword [rbx + 8]
lea rsi, [rbx + 0x20]
mov r8, rsi
lea rdx, [rbx + 0x24]
call fcn.140079330
test eax, eax
jne 0x1400ec607
xor eax, eax
jmp 0x1400ec730
cmp edi, 0x90
ja 0x1400ec5db
mov r8, rdi
lea rcx, [rbx + 0x24]
mov rdx, rsi
call fcn.140174ce0
mov r15, qword [rsp + 0x100]
lea rsi, [rbx + 0x20]
mov dword [rsi], edi
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x1400ec62a
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.140174b20
mov r12d, r13d
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, r14
lea rdi, [rax + 0x24]
lea rsi, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1400ec650
mov rcx, qword [rbx + 0x10]
mov r8, r15
mov rdx, rbp
call fcn.140079400
test eax, eax
je 0x1400ec719
mov rcx, rbp
call fcn.140061750
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.140079650
test eax, eax
je 0x1400ec719
mov rdx, r14
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1400ec6b0
mov rcx, qword [rbx + 0x18]
mov r8, r15
mov rdx, rbp
call fcn.140079400
test eax, eax
je 0x1400ec719
mov rcx, rbp
call fcn.140061750
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.140079650
test eax, eax
je 0x1400ec719
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.140079690
test eax, eax
cmovne r14d, r12d
test r13d, r13d
je 0x1400ec72d
mov edx, 0x90
lea rcx, [rsp + 0x20]
call fcn.14006c690
mov eax, r14d
mov r15, qword [rsp + 0xe0]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
test r13d, r13d
je 0x1400ec706
jmp 0x1400ec62d
Function at 0x1400fb440
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
xor r11d, r11d
test rcx, rcx
je 0x1400fb459
test byte [rcx + 0x5c], 2
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x1400fb460
lea r10, [0x140209510]
test r9d, r9d
jle 0x1400fb54f
inc r8
mov qword [rsp], rbx
movzx eax, byte [r8 - 1]
cmp r9d, 3
jl 0x1400fb4d1
movzx ecx, al
movzx eax, byte [r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [rdx], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 1], al
mov rax, rcx
shr rax, 6
and eax, 0x3f
and ecx, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 2], al
movzx ecx, byte [rcx + r10]
jmp 0x1400fb521
movzx ecx, al
shl ecx, 0x10
cmp r9d, 2
jne 0x1400fb4e6
movzx eax, byte [r8]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [rdx], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 1], al
cmp r9d, 1
jne 0x1400fb510
mov al, 0x3d
jmp 0x1400fb51c
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + r10]
mov byte [rdx + 2], al
mov cl, 0x3d
lea rax, [rdx + 3]
add r11d, 4
lea rdx, [rax + 1]
mov byte [rax], cl
add r8, 3
sub r9d, 3
test r9d, r9d
jg 0x1400fb470
mov rbx, qword [rsp]
mov eax, r11d
mov byte [rdx], 0
add rsp, 8
ret
mov byte [rdx], r11b
mov eax, r11d
add rsp, 8
ret

Function at 0x140100ff0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x100
test r8, r8
mov dword [rsp + 0xf4], 0x40
movabs rax, 0x6a09e667f3bcc908
lea rbx, [0x14027c680]
mov qword [rsp + 0x20], rax
cmovne rbx, r8
movabs rax, 0xbb67ae8584caa73b
mov r8, rdx
mov qword [rsp + 0x28], rax
mov rdx, rcx
movabs rax, 0x3c6ef372fe94f82b
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
call fcn.140101960
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401010e0
mov edx, 0xd8
lea rcx, [rsp + 0x20]
call fcn.14006c690
mov rax, rbx
add rsp, 0x100
pop rbx
ret
Function at 0x140105d90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov r12, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r15d, r15d
movzx r11d, byte [rax]
mov r14d, r8d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rbp - 8], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rbp - 0x10], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 4], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 9], al
test r8d, r8d
je 0x140105f38
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r11b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x140105ed6
lea r8d, [rbx + 1]
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.140102200
mov r11d, dword [rbp - 8]
mov eax, r11d
mov edx, dword [rbp - 4]
movzx r9d, byte [rbp - 8]
movzx r8d, byte [rbp - 4]
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
inc r15d
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x140105e70
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x140105f38
mov rax, qword [rbp + 0x50]
mov byte [rax], r9b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], r8b
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140106af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rax, qword [rsp + 0x90]
mov r15, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r12, qword [rsp + 0x98]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r14d, r14d
movzx r11d, byte [rax]
mov ebp, r8d
movzx eax, byte [rdi]
mov ebx, dword [r12]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rsp + 0x28], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rsp + 0x20], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rsp + 0x21], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x22], al
mov eax, r11d
shr eax, 0x18
mov byte [rsp + 0x23], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x25], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x26], al
mov eax, edx
shr eax, 0x18
mov dword [rsp + 0x2c], edx
mov byte [rsp + 0x24], dl
mov byte [rsp + 0x27], al
test r8d, r8d
je 0x140106cb1
mov r12, qword [rsp + 0x78]
sub r15, rsi
mov qword [rsp + 0x60], r13
mov r13, qword [rsp + 0x88]
dec ebp
test ebx, ebx
jne 0x140106c44
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x28]
mov r9, r13
mov rdx, r12
call fcn.1401046c0
mov r11d, dword [rsp + 0x28]
mov eax, r11d
mov edx, dword [rsp + 0x2c]
shr eax, 8
mov byte [rsp + 0x21], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x22], al
mov eax, r11d
shr eax, 0x18
mov byte [rsp + 0x23], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x25], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x26], al
mov eax, edx
shr eax, 0x18
mov byte [rsp + 0x27], al
inc r14d
mov byte [rsp + 0x20], r11b
mov byte [rsp + 0x24], dl
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x20]
xor cl, byte [r15 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x140106bd8
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x98]
test r14d, r14d
je 0x140106cb1
mov rax, qword [rsp + 0x90]
mov byte [rax], r11b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], dl
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rbp, qword [rsp + 0x70]
mov dword [r12], ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140108010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov rsi, rdx
movzx edx, byte [rax + 4]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
lea r9, [rdi + 5]
mov r12, rcx
shl edx, 0x18
movzx r10d, byte [rax]
xor r15d, r15d
movzx eax, byte [rdi]
mov r14d, r8d
movzx ecx, byte [r9]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 8
or r10d, eax
movzx eax, byte [rdi + 2]
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 0x10
or edx, eax
mov dword [rbp - 8], r10d
movzx eax, byte [r9 + 1]
or ecx, eax
mov byte [rbp - 0xd], r10b
or edx, ecx
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 8
mov dword [rbp - 4], edx
mov byte [rbp - 0xa], al
mov byte [rbp - 9], dl
test r8d, r8d
je 0x1401081ad
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r10b
nop
dec r14d
test ebx, ebx
jne 0x14010814f
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.140107600
mov r10d, dword [rbp - 8]
mov eax, r10d
mov edx, dword [rbp - 4]
movzx r9d, r10b
shr eax, 0x18
movzx r8d, dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xa], al
inc r15d
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x1401080f0
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x1401081ad
mov rcx, qword [rbp + 0x50]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi], al
mov eax, edx
shr eax, 0x18
shr r10d, 8
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov byte [rdi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [rdi + 4], al
shr edx, 8
mov byte [rdi + 5], dl
mov byte [rdi + 6], r8b
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret