joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14037de70
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1f0
mov rax, qword [0x14057c500]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rbx, rcx
mov dword [rcx], 0
mov ecx, 2
lea rdx, [rsp + 0x40]
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x14037ded8
xorps xmm0, xmm0
mov qword [rsp + 0x20], 2
lea rax, [0x1401ad6d0]
lea rdx, [0x14004a0f0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x28], xmm0
call fcn.14035ef00
jmp 0x14037dede
mov dword [rbx], 0x20
mov rax, rbx
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1404e17d0
add rsp, 0x1f0
pop rbx
ret

Function at 0x14037e330
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14057c500]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [0x140582abc], 0xfffffffe
mov rbx, rcx
mov dword [rsp + 0x20], 0
jle 0x14037e364
call fcn.14037e2a0
mov edx, 0x200
lea rcx, [rsp + 0x30]
call sub.WS2_32.dll_gethostname
cmp eax, 0xffffffff
jne 0x14037e384
lea rax, [0x1400495e0]
mov qword [rbx], rax
jmp 0x14037e39d
or r8d, 0xffffffff
mov byte [rsp + 0x22f], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14035c1e0
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1404e17d0
add rsp, 0x240
pop rbx
ret

Function at 0x14037e3c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0xc0
mov rax, qword [0x14057c500]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor eax, eax
lea rdx, [0x14004a130]
mov dword [rsp + 0x40], eax
mov rdi, rcx
mov qword [rsp + 0x38], rax
mov r9d, 0x20119
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14037e493
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x14004a170]
lea rax, [rsp + 0x60]
mov qword [rsp + 0xd8], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x4a
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
mov rbx, qword [rsp + 0xd8]
je 0x14037e493
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x60]
dec edx
mov qword [rsp + 0x50], rax
shr rdx, 1
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rdx
mov rdx, rdi
call fcn.14037ed60
jmp 0x14037e49d
lea rax, [0x1400495e0]
mov qword [rdi], rax
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1404e17d0
add rsp, 0xc0
pop rdi
ret
Function at 0x1403a5ae0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
movzx edi, cl
cmp dword [0x140579e20], 0xffffffff
jne 0x1403a5b36
lea rbx, [0x140583100]
mov rcx, rbx
call fcn.1403c35d0
or rbx, 1
cmp dword [0x140579e20], 0xffffffff
jne 0x1403a5b25
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140579e20], eax
test bl, 1
je 0x1403a5b36
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.1403c3a80
mov ecx, dword [0x140579e20]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x1403a5c3f
test dil, dil
je 0x1403a5c3f
lea ecx, [rax + 0x78]
call fcn.1404e17f4
mov qword [rsp + 0x78], rax
lea edx, [rsi + 1]
mov rcx, rax
call fcn.1403a4fb0
mov rsi, rax
mov qword [rsp + 0x88], rax
mov rdx, rax
mov ecx, dword [0x140579e20]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov ecx, select
call fcn.1404e17f4
mov qword [rsp + 0x78], rax
mov rdx, rsi
mov rcx, rax
call fcn.1403a4e30
nop
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsi + 0x38], rax
mov rcx, rsi
call fcn.1403a5510
mov byte [rsi + 0x72], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
mov qword [rsi + 0x40], rax
mov rax, qword [0x140582af8]
test rax, rax
jne 0x1403a5bea
mov rax, qword [rsi + 0x38]
mov qword [0x140582af8], rax
jmp 0x1403a5c3f
mov qword [rsp + 0x78], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x78]
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rsi + 0x38]
mov rcx, qword [rsp + 0x78]
call fcn.1403a6420
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1403a6420
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
mov rdi, rcx
lea rbx, [0x1405830f8]
mov rcx, rbx
call fcn.1403c35d0
or rbx, 1
mov qword [rsp + 0x60], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1405830e0]
jne 0x1403a6473
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1403a65b9
mov rax, qword [0x140579e28]
mov edx, dword [rax + 8]
btr edx, 0x1f
movsxd r8, dword [rax + 4]
lea ecx, [r8 + 1]
cmp dword [rax], 1
ja 0x1403a649c
cmp edx, ecx
jb 0x1403a649e
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + r8*8]
jmp 0x1403a64c9
cmp edx, ecx
sbb r8d, r8d
and r8d, 8
cmp ecx, edx
cmova edx, ecx
lea rcx, [0x140579e28]
call fcn.140318930
mov rax, qword [0x140579e28]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + rdx*8]
mov qword [rdx + rax], rdi
mov rax, qword [0x140579e28]
inc dword [rax + 4]
mov rax, qword [0x140579e30]
mov edx, dword [rax + 8]
btr edx, 0x1f
movsxd r8, dword [rax + 4]
lea ecx, [r8 + 1]
cmp dword [rax], 1
ja 0x1403a6500
cmp edx, ecx
jb 0x1403a6502
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + r8*8]
jmp 0x1403a652d
cmp edx, ecx
sbb r8d, r8d
and r8d, 8
cmp ecx, edx
cmova edx, ecx
lea rcx, [0x140579e30]
call fcn.1403a65e0
mov rax, qword [0x140579e30]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + rdx*8]
mov qword [rdx + rax], rsi
mov rax, qword [0x140579e30]
inc dword [rax + 4]
cmp dword [0x1405830e0], 0
jne 0x1403a65ab
cmp qword [0x1405830e8], 0
jne 0x1403a6578
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1405830e8], rax
lea rdx, [0x1405830e8]
lea rcx, [0x140579e28]
call fcn.1403a5e40
lea rax, [0x1405830e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1403a5f30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1403a65b9
mov rcx, qword [0x1405830e8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
test bl, 1
je 0x1403a65ca
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.1403c3a80
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1403a66b0
Capabilities:
Create thread
Resume thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
movsxd rsi, edx
mov rbp, rcx
mov rdi, qword [rcx + 8]
lea rbx, [rdi + 0x58]
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x1403a66f7
mov rcx, rbx
call fcn.1403c35d0
or rbx, 1
mov qword [rsp + 0x50], rbx
cmp byte [rdi + 0x66], 0
je 0x1403a6741
test bl, 1
je 0x1403a6717
and rbx, 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rcx, rbx
and rcx, 0xfffffffffffffffe
call fcn.1403c3a80
or edx, 0xffffffff
mov rcx, rbp
call fcn.1403a6ac0
test rbx, rbx
je 0x1403a6741
test bl, 1
jne 0x1403a6741
mov rcx, rbx
and rcx, 0xfffffffffffffffe
call fcn.1403c35d0
or rbx, 1
mov qword [rsp + 0x50], rbx
cmp byte [rdi + 0x64], 0
jne 0x1403a6837
mov word [rdi + 0x64], 1
mov byte [rdi + 0x68], 0
xor ebx, ebx
mov dword [rdi + 0x6c], ebx
mov eax, ebx
xchg byte [rdi + 0x67], al
lea rax, [rdi + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, rbp
lea r8, [0x1403a6880]
mov edx, dword [rdi + 0x70]
xor ecx, ecx
call fcn.140512b40
mov qword [rdi + 0x78], rax
test rax, rax
jne 0x1403a67a7
lea rcx, [0x14005f828]
call fcn.14035cac0
mov word [rdi + 0x64], 0x100
jmp 0x1403a6832
mov dword [rdi + 0x74], esi
cmp esi, 6
ja case.default.0x1403a67c0
lea rdx, [0x140000000]
mov ecx, dword [rdx + rsi*4 + 0x3a6860]
add rcx, rdx
jmp rcx
mov ebx, 0xfffffff1
jmp case.0x1403a67c0.3
mov ebx, 0xfffffffe
jmp case.0x1403a67c0.3
or ebx, 0xffffffff
jmp case.0x1403a67c0.3
mov ebx, 1
jmp case.0x1403a67c0.3
mov ebx, 2
jmp case.0x1403a67c0.3
mov ebx, select
jmp case.0x1403a67c0.3
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebx, eax
mov edx, ebx
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x1403a6817
lea rcx, [0x14005f850]
call fcn.14035cac0
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1403a6832
lea rcx, [0x14005f880]
call fcn.14035cac0
mov rbx, qword [rsp + 0x50]
test bl, 1
je 0x1403a6848
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.1403c3a80
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1403a6a40
Capabilities:
Terminate thread

Disassembly:
test edx, edx
jne 0x1403a594a
cmp r8d, 5
ja case.default.0x1403a5913
movsxd rax, r8d
lea r8, [0x140000000]
mov edx, dword [r8 + rax*4 + 0x3a5980]
add rdx, r8
jmp rdx
movzx edx, byte [rsp + 0x10]
jmp fcn.1403a5a60
movzx edx, byte [rsp + 0x10]
jmp fcn.1403a5730
mov rax, qword [r9 + 8]
mov edx, dword [rax]
jmp fcn.1403a66b0
mov edx, 7
jmp fcn.1403a66b0
jmp 0x1403a6a40
xor edx, edx
jmp fcn.1403a5660
cmp edx, 0xa
jne case.default.0x1403a5913
mov rax, qword [r9 + 8]
mov rcx, qword [r9]
mov rdx, qword [rax]
lea rax, [fcn.1403a5a60]
cmp rdx, rax
jne 0x1403a596c
mov dword [rcx], 0
ret
lea rax, [fcn.1403a5730]
cmp rdx, rax
jne case.default.0x1403a5913
mov dword [rcx], 1
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 8]
mov rsi, rcx
lea rbx, [rdi + 0x58]
test rbx, rbx
je 0x1403a6a6b
mov rcx, rbx
call fcn.1403c35d0
or rbx, 1
cmp byte [rdi + 0x64], 0
je 0x1403a6a99
cmp byte [rdi + 0x88], 0
jne 0x1403a6a83
mov byte [rdi + 0x89], 1
jmp 0x1403a6a99
mov rcx, qword [rdi + 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, rsi
call fcn.1403a5c70
test bl, 1
je 0x1403a6aaa
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.1403c3a80
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1403c5020
Capabilities:
Terminate process

Disassembly:
test edx, edx
jne 0x1403c504d
test r8d, r8d
je 0x1403c503b
cmp r8d, 1
jne 0x1403c506b
mov rax, qword [r9 + 8]
movzx edx, byte [rax]
jmp fcn.1403c5520
mov rdx, qword [r9 + 8]
movzx r8d, byte [rsp + 0x10]
mov rdx, qword [rdx]
jmp fcn.1403c4ee0
cmp edx, 0xa
jne 0x1403c506b
mov rax, qword [r9 + 8]
lea rcx, [fcn.1403c4ee0]
cmp qword [rax], rcx
jne 0x1403c506b
mov rax, qword [r9]
mov dword [rax], 0
ret

Function at 0x1403c5520
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rdi, qword [rcx + 8]
movzx esi, dl
mov rbp, rcx
cmp byte [rdi + 0x6c], dl
je 0x1403c560c
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x70], r14
mov byte [rdi + 0x6c], dl
mov r14, qword [rax + 0x48]
test r14, r14
jne 0x1403c5576
test dl, dl
jne 0x1403c5607
cmp qword [rdi + 0x60], r14
je 0x1403c5607
mov rcx, rdi
mov r14, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
jmp fcn.1403c56e0
mov qword [rsp + 0x60], rbx
call fcn.1403986d0
mov rbx, rax
call fcn.1403a54f0
cmp rbx, rax
mov rbx, qword [rsp + 0x60]
je 0x1403c55ce
xorps xmm0, xmm0
mov qword [rsp + 0x20], 2
lea rax, [0x1401ad6d0]
lea rdx, [0x140063ab0]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x28], xmm0
call fcn.14035ef00
mov r14, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rdx, rbp
mov rcx, r14
test sil, sil
je 0x1403c55fe
mov dword [rsp + 0x68], 0
mov eax, dword [rsp + 0x68]
mov dword [rdi + 0x68], eax
mov rax, qword [r14]
mov r14, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
jmp qword [rax + 0xa0]
mov rax, qword [r14]
call qword [rax + 0xa8]
mov r14, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1403c56e0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
or rdx, 0xffffffffffffffff
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
test eax, eax
je 0x1403c5709
mov qword [rbx + 0x60], 0
add rsp, 0x20
pop rbx
ret
lea rcx, [0x140063bb8]
add rsp, 0x20
pop rbx
jmp fcn.14035cac0

Function at 0x1403d6c50
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
test r8, r8
je 0x1403d6c86
nop dword [rax]
movzx eax, word [r9]
lea r9, [r9 + 2]
shl edx, 4
add edx, eax
mov eax, edx
shr edx, 0x17
and edx, 0x1e0
xor edx, eax
and edx, 0xfffffff
sub r8, 1
jne 0x1403d6c60
mov eax, edx
ret
Function at 0x1403ee400
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x268], rbx
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
cmp eax, 0x104
jbe 0x1403ee48d
mov dword [rsp + 0x260], eax
lea rcx, [rsp + 0x30]
lea rax, [rsp + 0x260]
cmp edi, dword [rsp + 0x30]
cmovge rcx, rax
mov r8d, dword [rcx]
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.1403ee4d0
mov edx, edi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
mov r8d, edi
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.1402d3550
nop
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
cmp rcx, rax
je 0x1403ee4b2
call fcn.1405050f4
mov rax, rbx
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x140422410
Capabilities:
Hash data using murmur3

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, word [rcx + 0x28]
mov rbx, rcx
cmp ax, 0x38
movsx rax, ax
mov byte [rax + rcx + 0x2a], dl
jl 0x14042245e
inc word [rcx + 0x28]
movzx eax, word [rcx + 0x28]
cmp ax, 0x40
jge 0x140422457
nop dword [rax]
movsx rax, ax
mov byte [rax + rcx + 0x2a], 0
inc word [rcx + 0x28]
movzx eax, word [rcx + 0x28]
cmp ax, 0x40
jl 0x140422440
call fcn.1404224d0
jmp 0x140422462
inc word [rcx + 0x28]
cmp word [rbx + 0x28], 0x38
jge 0x140422485
nop dword [rax]
movsx rax, word [rbx + 0x28]
mov byte [rax + rbx + 0x2a], 0
inc word [rbx + 0x28]
cmp word [rbx + 0x28], 0x38
jl 0x140422470
movzx eax, byte [rbx + 0x23]
mov rcx, rbx
mov byte [rbx + 0x62], al
movzx eax, byte [rbx + 0x22]
mov byte [rbx + 0x63], al
mov eax, dword [rbx + 0x20]
shr eax, 8
mov byte [rbx + 0x64], al
movzx eax, byte [rbx + 0x20]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 0x27]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 0x26]
mov byte [rbx + 0x67], al
mov eax, dword [rbx + 0x24]
shr eax, 8
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 0x24]
mov byte [rbx + 0x69], al
add rsp, 0x20
pop rbx
jmp fcn.1404224d0
Function at 0x1404224d0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x14057c500]
xor rax, rsp
mov qword [rsp + 0x110], rax
xor eax, eax
lea r8, [rcx + 0x2d]
mov edx, eax
lea r9, [rcx + 0x2c]
mov r10, rcx
lea r11, [rcx + 0x2b]
lea rbx, [rcx + 0x2a]
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 4]
movzx ecx, byte [rbx]
lea rbx, [rbx + 4]
shl ecx, 8
lea r9, [r9 + 4]
or ecx, eax
lea r8, [r8 + 4]
movzx eax, byte [r9 - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 - 4]
shl ecx, 8
or ecx, eax
mov dword [rsp + rdx*4 + 0x10], ecx
inc rdx
cmp rdx, 0x10
jl 0x140422520
lea rax, [rsp + 0x48]
mov r11d, 0x30
nop dword [rax + rax]
mov edx, dword [rax - 0x34]
mov r9d, edx
mov r8d, dword [rax]
lea rax, [rax + 4]
mov ecx, edx
rol r9d, 0xe
shr edx, 3
ror ecx, 7
xor r9d, ecx
mov ecx, r8d
xor r9d, edx
rol ecx, 0xd
mov edx, r8d
shr r8d, 0xa
rol edx, 0xf
xor edx, ecx
xor edx, r8d
add r9d, edx
add r9d, dword [rax - 0x3c]
add r9d, dword [rax - 0x18]
mov dword [rax + 4], r9d
sub r11, 1
jne 0x140422570
mov r9d, dword [r10]
lea r13, [0x1400a5860]
mov edi, dword [r10 + 4]
xor ebx, ebx
mov esi, dword [r10 + 8]
mov r15d, dword [r10 + 0xc]
mov r11d, dword [r10 + 0x10]
mov ebp, dword [r10 + 0x14]
mov r14d, dword [r10 + 0x18]
mov r12d, dword [r10 + 0x1c]
nop dword [rax]
nop word [rax + rax]
mov r8d, r11d
mov eax, r11d
rol eax, 7
mov ecx, r11d
ror r8d, 0xb
not ecx
xor r8d, eax
and ecx, r14d
mov eax, r11d
mov edx, r9d
ror eax, 6
xor r8d, eax
ror edx, 0xd
mov eax, ebp
and eax, r11d
xor ecx, eax
mov eax, r9d
add r8d, ecx
rol eax, 0xa
add r8d, dword [rbx + r13]
xor edx, eax
add r8d, dword [rsp + rbx + 0x10]
mov eax, r9d
ror eax, 2
add r8d, r12d
xor edx, eax
mov ecx, edi
xor ecx, r9d
mov eax, edi
and eax, r9d
and ecx, esi
xor ecx, eax
mov r12d, r14d
add edx, ecx
mov r14d, ebp
mov ebp, r11d
add rbx, 4
lea r11d, [r8 + r15]
mov r15d, esi
mov esi, edi
mov edi, r9d
lea r9d, [rdx + r8]
cmp rbx, 0x100
jl 0x1404225f0
add dword [r10], r9d
add dword [r10 + 4], edi
add dword [r10 + 8], esi
add dword [r10 + 0xc], r15d
add dword [r10 + 0x10], r11d
add dword [r10 + 0x14], ebp
add dword [r10 + 0x18], r14d
add dword [r10 + 0x1c], r12d
xor eax, eax
mov word [r10 + 0x28], ax
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1404e17d0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1404227b0
Capabilities:
Hash data using sha256

Disassembly:
mov rdx, rcx
test rcx, rcx
jne 0x1404227bc
lea eax, [rcx + 1]
ret
xor r8d, r8d
mov qword [rcx + 0x20], r8
mov word [rcx + 0x28], r8w
mov eax, dword [0x14057bcd0]
mov dword [rcx], eax
mov eax, dword [0x14057bcd4]
mov dword [rcx + 4], eax
mov eax, r8d
mov ecx, dword [0x14057bcd8]
mov dword [rdx + 8], ecx
mov ecx, dword [0x14057bcdc]
mov dword [rdx + 0xc], ecx
mov ecx, dword [0x14057bce0]
mov dword [rdx + 0x10], ecx
mov ecx, dword [0x14057bce4]
mov dword [rdx + 0x14], ecx
mov ecx, dword [0x14057bce8]
mov dword [rdx + 0x18], ecx
mov ecx, dword [0x14057bcec]
mov dword [rdx + 0x1c], ecx
mov qword [rdx + 0x6c], r8
ret

Function at 0x140422820
Capabilities:
Hash data using sha384

Disassembly:
mov rdx, rcx
test rcx, rcx
jne 0x14042282c
lea eax, [rcx + 1]
ret
xor r8d, r8d
mov word [rcx + 0x50], r8w
mov qword [rcx + 0x48], r8
mov qword [rcx + 0x40], r8
mov rax, qword [0x14057bcf0]
mov qword [rcx], rax
mov rax, qword [0x14057bcf8]
mov qword [rcx + 8], rax
mov eax, r8d
mov rcx, qword [0x14057bd00]
mov qword [rdx + 0x10], rcx
mov rcx, qword [0x14057bd08]
mov qword [rdx + 0x18], rcx
mov rcx, qword [0x14057bd10]
mov qword [rdx + 0x20], rcx
mov rcx, qword [0x14057bd18]
mov qword [rdx + 0x28], rcx
mov rcx, qword [0x14057bd20]
mov qword [rdx + 0x30], rcx
mov rcx, qword [0x14057bd28]
mov qword [rdx + 0x38], rcx
mov qword [rdx + 0xd4], r8
ret
Function at 0x1404229f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x14057c500]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor eax, eax
lea r8, [rcx + 0x59]
mov edx, eax
lea r9, [rcx + 0x58]
mov r10, rcx
lea r11, [rcx + 0x57]
lea rbx, [rcx + 0x56]
lea rdi, [rcx + 0x55]
lea rsi, [rcx + 0x54]
lea rbp, [rcx + 0x53]
lea r14, [rcx + 0x52]
nop dword [rax + rax]
movzx eax, byte [rbp]
lea rbp, [rbp + 8]
movzx ecx, byte [r14]
lea r14, [r14 + 8]
shl rcx, 8
lea rsi, [rsi + 8]
or rcx, rax
lea rdi, [rdi + 8]
movzx eax, byte [rsi - 8]
lea rbx, [rbx + 8]
shl rcx, 8
lea r11, [r11 + 8]
or rcx, rax
lea r9, [r9 + 8]
movzx eax, byte [rdi - 8]
lea r8, [r8 + 8]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx - 8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r11 - 8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 - 8]
shl rcx, 8
or rcx, rax
mov qword [rsp + rdx*8 + 0x10], rcx
inc rdx
cmp rdx, 0x10
jl 0x140422a50
lea rax, [rsp + 0x80]
mov r11d, 0x40
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rax - 0x68]
mov r8, qword [rax]
lea rax, [rax + 8]
mov r9, rdx
mov rcx, rdx
ror r9, 8
shr rdx, 7
ror rcx, 1
xor r9, rcx
mov rcx, r8
xor r9, rdx
rol rcx, 3
mov rdx, r8
shr r8, 6
ror rdx, 0x13
xor rdx, rcx
xor rdx, r8
add r9, rdx
add r9, qword [rax - 0x78]
add r9, qword [rax - 0x30]
mov qword [rax + 8], r9
sub r11, 1
jne 0x140422af0
mov r9, qword [r10]
lea r13, [0x1400a5960]
mov rdi, qword [r10 + 8]
xor ebx, ebx
mov rsi, qword [r10 + 0x10]
mov r15, qword [r10 + 0x18]
mov r11, qword [r10 + 0x20]
mov rbp, qword [r10 + 0x28]
mov r14, qword [r10 + 0x30]
mov r12, qword [r10 + 0x38]
nop word [rax + rax]
mov r8, r11
mov rax, r11
ror rax, 0x12
mov rcx, r11
rol r8, 0x17
not rcx
xor r8, rax
and rcx, r14
mov rax, r11
mov rdx, r9
ror rax, 0xe
xor r8, rax
rol rdx, 0x1e
mov rax, rbp
and rax, r11
xor rcx, rax
mov rax, r9
add r8, rcx
ror rax, 0x1c
add r8, qword [rbx + r13]
xor rdx, rax
add r8, qword [rsp + rbx + 0x10]
mov rax, r9
rol rax, 0x19
add r8, r12
xor rdx, rax
mov rcx, rdi
xor rcx, r9
mov rax, rdi
and rax, r9
and rcx, rsi
xor rcx, rax
mov r12, r14
add rdx, rcx
mov r14, rbp
mov rbp, r11
add rbx, 8
lea r11, [r8 + r15]
mov r15, rsi
mov rsi, rdi
mov rdi, r9
lea r9, [rdx + r8]
cmp rbx, 0x280
jl 0x140422b70
add qword [r10], r9
add qword [r10 + 8], rdi
add qword [r10 + 0x10], rsi
add qword [r10 + 0x18], r15
add qword [r10 + 0x20], r11
add qword [r10 + 0x28], rbp
add qword [r10 + 0x30], r14
add qword [r10 + 0x38], r12
xor eax, eax
mov word [r10 + 0x50], ax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1404e17d0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140422d60
Capabilities:
Hash data using sha512

Disassembly:
mov rdx, rcx
test rcx, rcx
jne 0x140422d6c
lea eax, [rcx + 1]
ret
xor r8d, r8d
mov word [rcx + 0x50], r8w
mov qword [rcx + 0x48], r8
mov qword [rcx + 0x40], r8
mov rax, qword [0x14057bd30]
mov qword [rcx], rax
mov rax, qword [0x14057bd38]
mov qword [rcx + 8], rax
mov eax, r8d
mov rcx, qword [0x14057bd40]
mov qword [rdx + 0x10], rcx
mov rcx, qword [0x14057bd48]
mov qword [rdx + 0x18], rcx
mov rcx, qword [0x14057bd50]
mov qword [rdx + 0x20], rcx
mov rcx, qword [0x14057bd58]
mov qword [rdx + 0x28], rcx
mov rcx, qword [0x14057bd60]
mov qword [rdx + 0x30], rcx
mov rcx, qword [0x14057bd68]
mov qword [rdx + 0x38], rcx
mov qword [rdx + 0xd4], r8
ret