joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800853a0
Capabilities:
Authenticate hmac

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov rbx, r8
mov r14, rdx
mov rsi, rcx
call fcn.180091530
lea rdi, [rsi + 0x60]
mov rcx, rdi
call fcn.180091530
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
cmp rbx, 0x40
ja 0x180085404
mov rcx, rbp
mov rdx, r14
mov r8, rbx
call fcn.1800d7e70
jmp 0x18008546b
lea rcx, [rbp - 0x60]
call fcn.180091530
xor r12d, r12d
lea r15, [rbp - 0x60]
jmp 0x180085428
inc r12
cmp rbx, r12
je 0x180085454
movzx eax, byte [r14 + r12]
movzx ecx, byte [rbp - 0xc]
lea edx, [rcx + 1]
mov byte [rbp - 0xc], dl
mov byte [rbp + rcx - 0x60], al
add qword [rbp - 8], 8
cmp byte [rbp - 0xc], 0x40
jne 0x180085420
mov byte [rbp - 0xc], 0
mov rcx, r15
call fcn.180091800
jmp 0x180085420
lea rbx, [rbp - 0x60]
mov rcx, rbx
call fcn.180091560
mov rdx, rbp
mov rcx, rbx
call fcn.180092b50
xor ebx, ebx
jmp 0x180085479
inc rbx
cmp rbx, 0x40
je 0x1800854e6
movzx eax, byte [rbp + rbx]
mov ecx, eax
xor cl, 0x36
movzx edx, byte [rsi + 0x54]
lea r8d, [rdx + 1]
mov byte [rsi + 0x54], r8b
mov byte [rsi + rdx], cl
add qword [rsi + 0x58], 8
cmp byte [rsi + 0x54], 0x40
jne 0x1800854ae
mov byte [rsi + 0x54], 0
mov rcx, rsi
call fcn.180091800
movzx eax, byte [rbp + rbx]
xor al, 0x5c
movzx ecx, byte [rsi + 0xb4]
lea edx, [rcx + 1]
mov byte [rsi + 0xb4], dl
mov byte [rsi + rcx + 0x60], al
add qword [rsi + 0xb8], 8
cmp byte [rsi + 0xb4], 0x40
jne 0x180085470
mov byte [rsi + 0xb4], 0
mov rcx, rdi
call fcn.180091800
jmp 0x180085470
mov rax, rsi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x180090910
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, rcx
movaps xmm0, xmmword [0x18010e0f0]
movups xmmword [rbp - 0x20], xmm0
movaps xmm0, xmmword [0x18010e100]
movups xmmword [rbp - 0x10], xmm0
mov byte [rbp], 0
mov qword [rbp + 8], 0
test r8, r8
je 0x1800909a4
mov rdi, r8
mov rbx, rdx
xor r15d, r15d
lea r14, [rbp - 0x60]
jmp 0x180090978
inc r15
cmp rdi, r15
je 0x1800909a4
movzx eax, byte [rbx + r15]
movzx ecx, byte [rbp]
lea edx, [rcx + 1]
mov byte [rbp], dl
mov byte [rbp + rcx - 0x60], al
add qword [rbp + 8], 8
cmp byte [rbp], 0x40
jne 0x180090970
mov byte [rbp], 0
mov rcx, r14
call fcn.180090d20
jmp 0x180090970
lea rcx, [rbp - 0x60]
call fcn.180090a80
mov qword [rsi + 8], 0
mov ecx, 0x30
call fcn.1800aa410
mov qword [rsi], rax
mov qword [rsi + 0x10], 0x20
mov qword [rsi + 0x18], 0x2f
mov byte [rax + 0x20], 0
mov ecx, dword [rbp - 0x20]
bswap ecx
mov dword [rax], ecx
mov ecx, dword [rbp - 0x1c]
bswap ecx
mov dword [rax + 4], ecx
mov ecx, dword [rbp - 0x18]
bswap ecx
mov dword [rax + 8], ecx
mov ecx, dword [rbp - 0x14]
bswap ecx
mov dword [rax + 0xc], ecx
mov ecx, dword [rbp - 0x10]
bswap ecx
mov dword [rax + 0x10], ecx
mov ecx, dword [rbp - 0xc]
bswap ecx
mov dword [rax + 0x14], ecx
mov ecx, dword [rbp - 8]
bswap ecx
mov dword [rax + 0x18], ecx
mov ecx, dword [rbp - 4]
bswap ecx
mov dword [rax + 0x1c], ecx
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x180090a80
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rcx + 0x68]
movzx eax, byte [rcx + 0x60]
lea ecx, [rax + 1]
mov byte [rsi + 0x60], cl
mov byte [rsi + rax], 0x80
add qword [rsi + 0x68], 8
movzx eax, byte [rsi + 0x60]
cmp al, 0x40
jne 0x180090ac0
nop dword [rax + rax]
mov byte [rsi + 0x60], 0
mov rcx, rsi
call fcn.180090d20
movzx eax, byte [rsi + 0x60]
cmp al, 0x38
je 0x180090ae0
lea ecx, [rax + 1]
mov byte [rsi + 0x60], cl
movzx eax, al
mov byte [rsi + rax], 0
add qword [rsi + 0x68], 8
movzx eax, byte [rsi + 0x60]
cmp al, 0x40
je 0x180090ab0
jmp 0x180090ac0
mov rax, rbx
shr rax, 0x38
mov byte [rsi + 0x38], al
mov rax, rbx
shr rax, 0x30
mov byte [rsi + 0x39], al
mov rax, rbx
shr rax, 0x28
mov byte [rsi + 0x3a], al
mov rax, rbx
shr rax, 0x20
mov byte [rsi + 0x3b], al
mov eax, ebx
shr eax, 0x18
mov byte [rsi + 0x3c], al
mov eax, ebx
shr eax, 0x10
mov byte [rsi + 0x3d], al
mov byte [rsi + 0x3e], bh
mov byte [rsi + 0x3f], bl
add qword [rsi + 0x68], 0x40
mov byte [rsi + 0x60], 0
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.180090d20
Function at 0x180091560
Capabilities:
Hash data using sha1

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [rcx + 0x58]
movzx eax, byte [rcx + 0x54]
lea ecx, [rax + 1]
mov byte [rsi + 0x54], cl
mov byte [rsi + rax], 0x80
add qword [rsi + 0x58], 8
movzx eax, byte [rsi + 0x54]
cmp al, 0x40
jne 0x1800915a0
nop dword [rax + rax]
mov byte [rsi + 0x54], 0
mov rcx, rsi
call fcn.180091800
movzx eax, byte [rsi + 0x54]
cmp al, 0x38
je 0x1800915c0
lea ecx, [rax + 1]
mov byte [rsi + 0x54], cl
movzx eax, al
mov byte [rsi + rax], 0
add qword [rsi + 0x58], 8
movzx eax, byte [rsi + 0x54]
cmp al, 0x40
je 0x180091590
jmp 0x1800915a0
mov rax, rbx
shr rax, 0x38
mov byte [rsi + 0x38], al
mov rax, rbx
shr rax, 0x30
mov byte [rsi + 0x39], al
mov rax, rbx
shr rax, 0x28
mov byte [rsi + 0x3a], al
mov rax, rbx
shr rax, 0x20
mov byte [rsi + 0x3b], al
mov eax, ebx
shr eax, 0x18
mov byte [rsi + 0x3c], al
mov eax, ebx
shr eax, 0x10
mov byte [rsi + 0x3d], al
mov byte [rsi + 0x3e], bh
mov byte [rsi + 0x3f], bl
add qword [rsi + 0x58], 0x40
mov byte [rsi + 0x54], 0
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.180091800
Function at 0x180092d40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rsi, rdx
and rsi, 0xfffffffffffffff0
je 0x180092de8
mov rdi, rcx
mov r15, qword [rsp + 0x160]
mov rbx, r9
shr rbx, 2
add ebx, 6
lea r14, [rsp + 0x20]
mov rcx, r14
mov rdx, r8
mov r8, r9
call fcn.180092e10
mov rax, qword [r15]
xor qword [rdi], rax
mov rax, qword [r15 + 8]
xor qword [rdi + 8], rax
mov rcx, rdi
mov rdx, rdi
mov r8, r14
mov r9d, ebx
call fcn.180093240
cmp rsi, 0x10
je 0x180092de8
add rsi, 0xfffffffffffffff0
add rdi, 0x10
lea r14, [rsp + 0x20]
nop word cs:[rax + rax]
movups xmm0, xmmword [rdi - 0x10]
movups xmm1, xmmword [rdi]
xorps xmm1, xmm0
movups xmmword [rdi], xmm1
mov rcx, rdi
mov rdx, rdi
mov r8, r14
mov r9d, ebx
call fcn.180093240
add rdi, 0x10
add rsi, 0xfffffffffffffff0
jne 0x180092dc0
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180093760
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
mov r14, qword [rsp + 0x190]
lea rcx, [rsp + 0x40]
mov rdx, r8
mov r8, r9
call fcn.180093810
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x20], xmm0
and rdi, 0xfffffffffffffff0
je 0x1800937f8
shr rsi, 2
add esi, 6
lea r15, [rsp + 0x20]
lea rax, [rsp + 0x30]
lea r14, [rsp + 0x40]
nop word cs:[rax + rax]
mov r12, rax
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
mov rcx, rbx
mov rdx, rbx
mov r8, r14
mov r9d, esi
call fcn.1800938c0
mov rax, qword [r15]
xor qword [rbx], rax
mov rax, qword [r15 + 8]
xor qword [rbx + 8], rax
add rbx, 0x10
mov rax, r15
mov r15, r12
add rdi, 0xfffffffffffffff0
jne 0x1800937c0
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x180093810
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, r8
mov rsi, rcx
call fcn.180092e10
mov eax, dword [0x18014fc10]
mov ecx, dword [0x1801514bc]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x30]
jg 0x18009388e
test byte [0x18014fbf7], 2
jne 0x180093852
add rsp, 0x28
pop rdi
pop rsi
ret
cmp rdi, 0x20
je 0x180093872
cmp rdi, 0x18
je 0x180093880
cmp rdi, 0x10
jne 0x18009384b
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1800a2720
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1800a2830
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1800a2790
lea rcx, [0x18014fc10]
call fcn.1800aabec
cmp dword [0x18014fc10], 0xffffffff
jne 0x180093842
lea rcx, [0x18014fbd0]
call fcn.180041610
lea rcx, [0x18014fc10]
call fcn.1800aab80
jmp 0x180093842
Function at 0x1800942c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], r8
mov r13, rdx
mov r14, rcx
mov rsi, qword [rsp + 0x210]
mov rbx, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x200]
mov r8, qword [rsp + 0x208]
mov r15, r8
shr r15, 2
add r15d, 6
lea rdi, [rsp + 0xa0]
mov rcx, rdi
call fcn.180092e10
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
lea r12, [rsp + 0x90]
mov rcx, r12
mov rdx, r12
mov r8, rdi
mov r9d, r15d
call fcn.180093240
lea rcx, [rsp + 0x70]
mov rdx, r12
mov r8, rsi
mov r9, rbx
call fcn.180094520
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x7c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x6c], eax
mov rdi, r13
xor r12d, r12d
and rdi, 0xfffffffffffffff0
je 0x1800943d7
lea rbp, [rsp + 0x60]
lea rsi, [rsp + 0x50]
lea rbx, [rsp + 0xa0]
nop dword [rax]
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
mov r9d, r15d
call fcn.180093240
movups xmm0, xmmword [r14 + r12]
xorps xmm0, xmmword [rsp + 0x50]
movups xmmword [r14 + r12], xmm0
mov eax, dword [rsp + 0x6c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x6c], eax
add r12, 0x10
cmp r12, rdi
jb 0x1800943a0
mov rbp, qword [rsp + 0x220]
mov rsi, r13
and rsi, 0xf
je 0x180094491
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0xa0]
mov r9d, r15d
call fcn.180093240
mov eax, r13d
and eax, 3
cmp esi, 4
jae 0x180094415
xor ecx, ecx
jmp 0x180094464
sub rsi, rax
lea rdx, [r12 + r14]
add rdx, 3
xor ecx, ecx
nop word cs:[rax + rax]
movzx r8d, byte [rsp + rcx + 0x50]
xor byte [rdx + rcx - 3], r8b
movzx r8d, byte [rsp + rcx + 0x51]
xor byte [rdx + rcx - 2], r8b
movzx r8d, byte [rsp + rcx + 0x52]
xor byte [rdx + rcx - 1], r8b
movzx r8d, byte [rsp + rcx + 0x53]
xor byte [rdx + rcx], r8b
add rcx, 4
cmp rsi, rcx
jne 0x180094430
test rax, rax
je 0x180094491
add r12, rcx
add r12, r14
add rcx, rsp
add rcx, 0x50
xor edx, edx
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
xor byte [r12 + rdx], r8b
inc rdx
cmp rax, rdx
jne 0x180094480
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, r14
mov r8, r13
mov r9, qword [rsp + 0x88]
call fcn.180094810
nop
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180094af0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
mov r15, r9
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rdx, qword [rsp + 0x210]
mov r8, qword [rsp + 0x218]
mov rbx, r8
shr rbx, 2
add ebx, 6
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call fcn.180092e10
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
lea r12, [rsp + 0xa0]
mov rcx, r12
mov rdx, r12
mov r8, rsi
mov r9d, ebx
call fcn.180093240
lea r13, [rsp + 0x80]
mov rcx, r13
mov rdx, r12
mov r8, qword [rsp + 0x220]
mov r9, qword [rsp + 0x228]
call fcn.180094520
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x90]
mov rdx, rdi
mov r8, rbp
mov r9, r14
call fcn.180094810
mov rax, qword [rsp + 0x230]
movdqu xmm0, xmmword [rax]
pcmpeqb xmm0, xmmword [rsp + 0x90]
pmovmskb eax, xmm0
xor ecx, ecx
cmp eax, 0xffff
setne cl
jne 0x180094d13
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x8c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x7c], eax
mov rsi, rbp
and rsi, 0xfffffffffffffff0
mov dword [rsp + 0x6c], ecx
je 0x180094c78
xor r13d, r13d
lea r14, [rsp + 0x70]
lea r15, [rsp + 0x50]
lea r12, [rsp + 0xb0]
nop word cs:[rax + rax]
mov rcx, r14
mov rdx, r15
mov r8, r12
mov r9d, ebx
call fcn.180093240
movdqu xmm0, xmmword [rdi + r13]
pxor xmm0, xmmword [rsp + 0x50]
movdqu xmmword [rdi + r13], xmm0
mov eax, dword [rsp + 0x7c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x7c], eax
add r13, 0x10
cmp r13, rsi
jb 0x180094c30
mov r14, rbp
and r14, 0xf
jne 0x180094c88
jmp 0x180094d0f
xor r13d, r13d
mov r14, rbp
and r14, 0xf
je 0x180094d0f
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0xb0]
mov r9d, ebx
call fcn.180093240
and ebp, 3
cmp r14d, 4
jae 0x180094caf
xor eax, eax
jmp 0x180094cec
sub r14, rbp
lea rcx, [rdi + r13]
add rcx, 3
xor eax, eax
nop dword [rax]
movzx edx, byte [rsp + rax + 0x50]
xor byte [rcx + rax - 3], dl
movzx edx, byte [rsp + rax + 0x51]
xor byte [rcx + rax - 2], dl
movzx edx, byte [rsp + rax + 0x52]
xor byte [rcx + rax - 1], dl
movzx edx, byte [rsp + rax + 0x53]
xor byte [rcx + rax], dl
add rax, 4
cmp r14, rax
jne 0x180094cc0
test rbp, rbp
je 0x180094d0f
add r13, rax
add rdi, r13
add rax, rsp
add rax, 0x50
xor ecx, ecx
movzx edx, byte [rax + rcx]
xor byte [rdi + rcx], dl
inc rcx
cmp rbp, rcx
jne 0x180094d00
mov ecx, dword [rsp + 0x6c]
test ecx, ecx
sete al
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180094e00
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rdx, qword [rcx]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
lea rax, str.cw
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rcx, qword [rcx + 0x18]
movzx edx, byte [rcx + 3]
mov r8d, edx
and r8d, 0xfffffff0
and edx, 0xf
add r8, rax
movzx eax, byte [rdx + r8]
mov byte [rcx + 3], al
ret
Function at 0x1800953a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rdx, qword [rcx]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
lea rax, [0x18010f280]
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rcx, qword [rcx + 0x18]
movzx edx, byte [rcx + 3]
mov r8d, edx
and r8d, 0xfffffff0
and edx, 0xf
add r8, rax
movzx eax, byte [rdx + r8]
mov byte [rcx + 3], al
ret
Function at 0x180095d70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r12, qword [r8 + 8]
sub r12, qword [r8]
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
cmp r12, 0x10
jb 0x180095de2
mov rsi, r8
mov rdi, rdx
shr r12, 4
xor r13d, r13d
lea r14, [rsp + 0x20]
lea r15, [rsp + 0x30]
nop dword [rax]
mov rax, qword [rsi]
movups xmm0, xmmword [rax + r13]
movups xmm1, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rbx]
xorps xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.180096150
add r13, 0x10
dec r12
jne 0x180095db0
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800987e0
Capabilities:
Generate random numbers via winapi

Disassembly:
jmp 0x1800987e0
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
lea rdx, [rbp - 0x10]
xor ecx, ecx
mov r8d, 8
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
mov rax, qword [rbp - 0x10]
add rsp, 0x30
pop rbp
ret
Function at 0x18009d480
Capabilities:
Hash data using sha384

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.18009da80
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rbp + 0x20], rax
movabs rax, 0x629a292a367cd507
mov qword [rbp + 0x28], rax
movabs rax, 0x9159015a3070dd17
mov qword [rbp + 0x30], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rbp + 0x38], rax
movabs rax, 0x67332667ffc00b31
mov qword [rbp + 0x40], rax
movabs rax, 0x8eb44a8768581511
mov qword [rbp + 0x48], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rbp + 0x50], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rbp + 0x58], rax
test rdi, rdi
je 0x18009d564
xor r15d, r15d
lea r14, [rbp - 0x60]
jmp 0x18009d538
inc r15
cmp rdi, r15
je 0x18009d564
movzx eax, byte [rbx + r15]
movzx ecx, byte [rbp + 0x60]
lea edx, [rcx + 1]
mov byte [rbp + 0x60], dl
mov byte [rbp + rcx - 0x60], al
add qword [rbp + 0x68], 8
cmp byte [rbp + 0x60], 0x80
jne 0x18009d530
mov byte [rbp + 0x60], 0
mov rcx, r14
call fcn.18009dc90
jmp 0x18009d530
lea rcx, [rbp - 0x60]
call fcn.18009db20
mov qword [rsi + 8], 0
mov ecx, 0x40
call fcn.1800aa410
mov qword [rsi], rax
mov qword [rsi + 0x10], 0x30
mov qword [rsi + 0x18], 0x3f
xorps xmm0, xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov byte [rax + 0x30], 0
lea rcx, [rbp - 0x60]
mov rdx, rax
call fcn.18009d720
mov rax, rsi
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x18009d5f0
Capabilities:
Hash data using sha384

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.18009da80
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rsi + 0x80], rax
movabs rax, 0x629a292a367cd507
mov qword [rsi + 0x88], rax
movabs rax, 0x9159015a3070dd17
mov qword [rsi + 0x90], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rsi + 0x98], rax
movabs rax, 0x67332667ffc00b31
mov qword [rsi + 0xa0], rax
movabs rax, 0x8eb44a8768581511
mov qword [rsi + 0xa8], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rsi + 0xb0], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rsi + 0xb8], rax
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x18009d900
Capabilities:
Hash data using sha512

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x70], 0xfffffffffffffffe
mov rsi, rcx
movabs rax, 0x6a09e667f3bcc908
mov qword [rbp + 0x20], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rbp + 0x28], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rbp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbp + 0x58], rax
mov byte [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
test r8, r8
je 0x18009d9f4
mov rdi, r8
mov rbx, rdx
xor r15d, r15d
lea r14, [rbp - 0x60]
jmp 0x18009d9c8
inc r15
cmp rdi, r15
je 0x18009d9f4
movzx eax, byte [rbx + r15]
movzx ecx, byte [rbp + 0x60]
lea edx, [rcx + 1]
mov byte [rbp + 0x60], dl
mov byte [rbp + rcx - 0x60], al
add qword [rbp + 0x68], 8
cmp byte [rbp + 0x60], 0x80
jne 0x18009d9c0
mov byte [rbp + 0x60], 0
mov rcx, r14
call fcn.18009dc90
jmp 0x18009d9c0
lea rcx, [rbp - 0x60]
call fcn.18009db20
mov qword [rsi + 8], 0
mov ecx, 0x50
call fcn.1800aa410
mov qword [rsi], rax
mov qword [rsi + 0x10], 0x40
mov qword [rsi + 0x18], 0x4f
xorps xmm0, xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov byte [rax + 0x40], 0
lea rcx, [rbp - 0x60]
mov rdx, rax
call fcn.18009df60
mov rax, rsi
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret