joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001155a
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001f8e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001f900
xor al, al
jmp 0x14001f981
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001f913
xor al, al
jmp 0x14001f981
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001f93d
xor al, al
jmp 0x14001f981
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001f951
xor al, al
jmp 0x14001f981
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001f963
xor al, al
jmp 0x14001f981
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001f97f
xor al, al
jmp 0x14001f981
mov al, 1
add rsp, 0x38
ret
Function at 0x1400116c2
Capabilities:
Terminate process

Disassembly:
jmp 0x140018c40
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400350fc]
call fcn.140011785
mov edx, 0x44
lea rcx, [rbp + 0xc8]
call fcn.1400111cc
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400112df
lea rdx, [0x140027bf5]
mov rcx, rax
call fcn.1400110e6
lea rdx, [0x140011050]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 0x44
lea rcx, [rbp + 0xf8]
call fcn.1400111cc
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400112df
lea rdx, [0x140027bf5]
mov rcx, rax
call fcn.1400110e6
lea rdx, [0x140011050]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 1
lea rcx, [rbp + 0x128]
call fcn.1400111cc
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400112df
lea rdx, [0x140027c78]
mov rcx, rax
call fcn.1400110e6
lea rdx, [0x140011050]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 1
lea rcx, [rbp + 0x158]
call fcn.1400111cc
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400112df
lea rdx, [0x140027cc0]
mov rcx, rax
call fcn.1400110e6
lea rdx, [0x140011050]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1408a3058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408a31df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408a3089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408a306f
add dl, dl
jne 0x1408a3096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408a30f6
xor eax, eax
add dl, dl
jne 0x1408a30a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408a31ad
add dl, dl
jne 0x1408a30b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408a30c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408a30d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408a30dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408a30ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408a307e
mov eax, 1
add dl, dl
jne 0x1408a3106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408a3113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408a30fb
sub eax, ebx
mov ebx, 1
jne 0x1408a314c
mov ecx, 1
add dl, dl
jne 0x1408a312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408a313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408a3123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408a307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408a3168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408a3175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408a315d
cmp eax, 0x7d00
jae 0x1408a319b
cmp eax, 0x500
jb 0x1408a3196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408a307e
cmp eax, 0x7f
ja 0x1408a319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408a307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408a31d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408a307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0xb8
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
cmp eax, 1
je 0x140001243
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x9c]
movzx ecx, word [rsp + 0xac]
add eax, ecx
cmp eax, 0x1e
jl 0x14000123e
mov byte [rsp + 0x50], 0x8a
mov byte [rsp + 0x51], 0xb5
mov byte [rsp + 0x52], 0x94
mov byte [rsp + 0x53], 0xb0
mov byte [rsp + 0x54], 0x8a
mov byte [rsp + 0x55], 0x39
mov byte [rsp + 0x56], 0x18
mov byte [rsp + 0x57], 0x2a
mov byte [rsp + 0x58], 0xc2
mov byte [rsp + 0x59], 0x61
mov byte [rsp + 0x5a], 0xa5
mov byte [rsp + 0x5b], 0x49
mov byte [rsp + 0x5c], 0xa5
mov byte [rsp + 0x5d], 0x8e
mov byte [rsp + 0x5e], 0x81
mov byte [rsp + 0x5f], 0x1d
mov byte [rsp + 0x60], 0x84
mov byte [rsp + 0x61], 0xb3
mov byte [rsp + 0x62], 0xcf
mov byte [rsp + 0x63], 0xef
mov byte [rsp + 0x64], 0x95
mov byte [rsp + 0x65], 0x6c
mov byte [rsp + 0x66], 0x56
mov byte [rsp + 0x67], 0x61
mov byte [rsp + 0x68], 0xf5
mov byte [rsp + 0x69], 0x60
mov byte [rsp + 0x6a], 0xae
mov byte [rsp + 0x6b], 0x56
mov byte [rsp + 0x6c], 0xa3
mov byte [rsp + 0x6d], 0x84
mov byte [rsp + 0x6e], 0xc0
mov byte [rsp + 0x6f], 0x50
mov byte [rsp + 0x70], 0x91
mov byte [rsp + 0x71], 0xb2
mov byte [rsp + 0x72], 0
mov byte [rsp + 0x38], 0xb0
mov byte [rsp + 0x39], 0xb4
mov byte [rsp + 0x3a], 0x8e
mov byte [rsp + 0x3b], 0xb4
mov byte [rsp + 0x3c], 0x90
mov byte [rsp + 0x3d], 0x6e
mov byte [rsp + 0x3e], 0x52
mov byte [rsp + 0x3f], 0x47
mov byte [rsp + 0x40], pe_nt_image_headers64
mov byte [rsp + 0x41], 0x6b
mov byte [rsp + 0x42], 0xa0
mov byte [rsp + 0x43], 0x5e
mov byte [rsp + 0x44], 0xbe
mov byte [rsp + 0x45], 0xc4
mov byte [rsp + 0x46], 0x8b
mov byte [rsp + 0x47], 0x4b
mov byte [rsp + 0x48], 0x87
mov byte [rsp + 0x49], 0
mov byte [rsp + 0x20], 0xe2
mov byte [rsp + 0x21], 0xc1
mov byte [rsp + 0x22], 0xe0
mov byte [rsp + 0x23], 0xc0
mov byte [rsp + 0x24], 0xf9
mov byte [rsp + 0x25], 3
mov byte [rsp + 0x26], 0x37
mov byte [rsp + 0x27], 5
mov byte [rsp + 0x28], 0xaa
mov byte [rsp + 0x29], 4
mov byte [rsp + 0x2a], 0xcb
mov byte [rsp + 0x2b], 0x3b
mov byte [rsp + 0x2c], 0xcc
mov byte [rsp + 0x2d], 0xea
mov byte [rsp + 0x2e], 0xee
mov byte [rsp + 0x2f], 0x33
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x20]
call fcn.1400035c8
mov dword [rsp + 0x78], eax
lea rcx, [rsp + 0x38]
call fcn.1400035c8
mov ecx, dword [rsp + 0x78]
mov r9d, ecx
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.140003b58
lea rcx, [rsp + 0x20]
call fcn.1400035c8
mov r9d, eax
lea r8, [rsp + 0x20]
mov edx, 0x22
lea rcx, [rsp + 0x50]
call fcn.140003b58
mov r8d, 0x10
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.1400038f4
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call fcn.140002084
mov eax, dword [rsp + 0x88]
lea r8, [rsp + 0x38]
mov edx, eax
mov rcx, qword [rsp + 0x80]
call fcn.140001250
xor eax, eax
jmp 0x140001245
jmp 0x140001015
xor eax, eax
add rsp, 0xb8
ret
Function at 0x140003454
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process filename

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x268
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x50], 0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rax, 0x48
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax + 8], 0
jne 0x1400034eb
xor eax, eax
jmp 0x14000356c
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x28], eax
mov r8d, dword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x60]
call fcn.14000373c
mov eax, dword [rsp + 0x28]
xor edx, edx
mov ecx, 2
div rcx
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
mov rdx, qword [rsp + 0x270]
lea rcx, [rsp + 0x60]
call fcn.1400036b4
test eax, eax
jne 0x14000354a
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x50], rax
jmp 0x140003567
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x20], rax
jne 0x1400034ca
mov rax, qword [rsp + 0x50]
add rsp, 0x268
ret
Function at 0x14000394c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x58], 0
cmp qword [rsp + 0x90], 0
jne 0x140003981
xor eax, eax
jmp 0x140003b4e
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x60]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x98]
and eax, 0xffff0000
test eax, eax
jne 0x140003aa7
mov eax, dword [rsp + 0x98]
and eax, 0xffff
mov rcx, qword [rsp + 0x38]
sub eax, dword [rcx + 0x10]
mov eax, eax
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax*4]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
jmp 0x140003b49
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x28]
dec eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x50], 0
je 0x140003b49
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x70]
call fcn.1400036b4
test eax, eax
jne 0x140003b28
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax*4]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
jmp 0x140003b49
mov rax, qword [rsp + 0x40]
add rax, 4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
jmp 0x140003ab3
mov rax, qword [rsp + 0x58]
add rsp, 0x88
ret
Function at 0x140006210
Capabilities:
Hash data using sha256

Disassembly:
push rdi
sub rsp, 0xd0
mov rax, qword [0x140124040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov edi, ecx
cmp cl, 1
je 0x14000625a
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Invalid_flags
lea rdx, str._libsecp256k1__illegal_argument:__s_n
call fcn.1400061c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov ecx, 0xc8
mov qword [rsp + 0xe0], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14000629b
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.Out_of_memory
lea rdx, str._libsecp256k1__internal_consistency_check_failed:__s_n
call fcn.1400061c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov rcx, qword [str.For_this_sample__this_63_byte_string_will_be_used_as_input_data]
lea rdx, [rsp + 0xa0]
mov dword [rsp + 0x30], 0x6a09e667
mov dword [rsp + 0x34], 0xbb67ae85
mov dword [rsp + 0x38], 0x3c6ef372
movups xmm0, xmmword [rcx]
mov eax, dword [rcx + 0x38]
movups xmm1, xmmword [rcx + 0x10]
mov dword [rsp + 0x88], eax
movzx eax, word [rcx + 0x3c]
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rcx + 0x20]
mov word [rsp + 0x8c], ax
movzx eax, byte [rcx + 0x3e]
movaps xmmword [rsp + 0x60], xmm1
movsd xmm1, qword [rcx + 0x30]
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x3c], 0xa54ff53a
mov dword [rsp + 0x40], 0x510e527f
mov dword [rsp + 0x44], 0x9b05688c
mov dword [rsp + 0x48], 0x1f83d9ab
mov dword [rsp + 0x4c], 0x5be0cd19
mov qword [rsp + 0x90], 0x3f
movsd qword [rsp + 0x80], xmm1
mov byte [rsp + 0x8e], al
call fcn.14000b260
xor eax, eax
lea r8, [0x14000f500]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax + r8]
movzx edx, byte [rsp + rax + 0xa0]
cmp edx, ecx
jne 0x1400063d6
inc rax
cmp rax, 0x20
jb 0x140006360
movups xmm0, xmmword [0x14000f638]
xor edx, edx
mov rcx, rbx
movups xmmword [rbx + 0xa0], xmm0
movups xmm1, xmmword [0x14000f648]
movups xmmword [rbx + 0xb0], xmm1
call fcn.140006aa0
mov dword [rbx], 1
mov rax, rbx
shr edi, 0xa
and edi, 1
mov dword [rbx + 0xc0], edi
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000dcf0
add rsp, 0xd0
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea r8, str.self_test_failed
lea rdx, str._libsecp256k1__internal_consistency_check_failed:__s_n
call fcn.1400061c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
Function at 0x1400070d0
Capabilities:
Decompress data using quicklz

Disassembly:
mov eax, dword [rdx]
mov r9, rcx
and eax, 0x3ffffff
mov dword [rcx], eax
mov r8d, dword [rdx + 4]
mov eax, dword [rdx]
and r8d, 0xfffff
shr eax, 0x1a
shl r8d, 6
or r8d, eax
mov dword [rcx + 4], r8d
mov ecx, dword [rdx + 8]
mov eax, dword [rdx + 4]
and ecx, 0x3fff
shl ecx, 0xc
shr eax, 0x14
or ecx, eax
mov dword [r9 + 8], ecx
movzx ecx, byte [rdx + 0xc]
mov eax, dword [rdx + 8]
shr eax, 0xe
shl ecx, 0x12
or ecx, eax
mov dword [r9 + 0xc], ecx
mov ecx, dword [rdx + 0x10]
mov eax, dword [rdx + 0xc]
and ecx, 3
shr eax, 8
shl ecx, 0x18
or ecx, eax
mov dword [r9 + 0x10], ecx
mov eax, dword [rdx + 0x10]
shr eax, 2
and eax, 0x3ffffff
mov dword [r9 + 0x14], eax
mov ecx, dword [rdx + 0x14]
mov eax, dword [rdx + 0x10]
and ecx, 0x3fffff
shr eax, 0x1c
shl ecx, 4
or ecx, eax
mov dword [r9 + 0x18], ecx
movzx ecx, word [rdx + 0x18]
mov eax, dword [rdx + 0x14]
shr eax, 0x16
shl ecx, 0xa
or ecx, eax
mov dword [r9 + 0x1c], ecx
mov eax, dword [rdx + 0x1c]
movzx ecx, word [rdx + 0x1a]
and eax, 0x3ff
shl eax, 0x10
or ecx, eax
mov dword [r9 + 0x20], ecx
mov eax, dword [rdx + 0x1c]
shr eax, 0xa
mov dword [r9 + 0x24], eax
ret
Function at 0x140009760
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x100
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
mov rax, qword [0x140124040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, r8
mov rdi, rcx
cmp r8, 0x40
ja 0x1400097cf
lea rcx, [r11 - 0x78]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x40
lea rcx, [rsp + 0x90]
sub r8, rbx
add rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movdqu xmm0, xmmword [rsp + 0xc0]
movdqu xmm1, xmmword [rsp + 0xb0]
jmp 0x14000983d
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [rsp + 0x80], 0
call fcn.14000dbb0
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x20]
call fcn.14000b260
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqa xmm7, xmmword [str.jjjjjjjjjjjjjjjj_a]
lea rcx, [rdi + 0x68]
mov dword [rcx], 0x6a09e667
lea rax, [rsp + 0x90]
mov dword [rcx + 4], 0xbb67ae85
lea rdx, [rcx + 0x20]
mov dword [rcx + 8], 0x3c6ef372
movdqa xmm6, xmm7
xorps xmm6, xmmword [rsp + 0x90]
movdqa xmm5, xmm7
xorps xmm5, xmmword [rsp + 0xa0]
movdqa xmm4, xmm7
mov dword [rcx + 0xc], 0xa54ff53a
xorps xmm4, xmm1
mov dword [rcx + 0x10], 0x510e527f
xorps xmm7, xmm0
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x60], 0x40
movdqu xmmword [rsp + 0x90], xmm6
movdqu xmmword [rsp + 0xa0], xmm5
movdqu xmmword [rsp + 0xb0], xmm4
movdqu xmmword [rsp + 0xc0], xmm7
movups xmm0, xmmword [rax]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x50], xmm1
call fcn.14000b630
movdqa xmm3, xmmword [0x14000fc00]
lea rdx, [rdi + 0x20]
mov dword [rdi], 0x6a09e667
movdqa xmm2, xmm3
mov dword [rdi + 4], 0xbb67ae85
movdqa xmm1, xmm3
mov dword [rdi + 8], 0x3c6ef372
movdqa xmm0, xmm3
mov dword [rdi + 0xc], 0xa54ff53a
xorps xmm2, xmm6
mov dword [rdi + 0x10], 0x510e527f
xorps xmm1, xmm5
mov dword [rdi + 0x14], 0x9b05688c
xorps xmm0, xmm4
mov dword [rdi + 0x18], 0x1f83d9ab
xorps xmm3, xmm7
mov dword [rdi + 0x1c], 0x5be0cd19
mov rcx, rdi
mov qword [rdi + 0x60], 0x40
movups xmmword [rdx], xmm2
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm3
call fcn.14000b630
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14000dcf0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400099b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x140124040]
xor rax, rsp
mov qword [rbp + 0x17], rax
movups xmm1, xmmword [rdx + 0x10]
mov eax, dword [rdx + 0x20]
mov ebx, 0xffffffff
xorps xmm0, xmm0
mov dword [rbp - 0x41], eax
mov eax, dword [rcx + 0x20]
mov r15, rdx
movups xmmword [rsp + 0x34], xmm0
mov r13, rcx
mov dword [rsp + 0x30], 0
movups xmmword [rbp - 0x75], xmm0
mov dword [rbp - 0x11], 1
lea r12d, [rbx + 0x15]
movups xmmword [rbp - 0xd], xmm0
mov dword [rbp - 0x19], eax
movups xmmword [rbp + 3], xmm0
movups xmm0, xmmword [rdx]
movups xmmword [rbp - 0x51], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp - 0x61], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rbp - 0x29], xmm1
movups xmmword [rbp - 0x39], xmm0
nop word [rax + rax]
mov esi, dword [rbp - 0x61]
mov r9d, 1
mov eax, dword [rbp - 0x39]
xor r10d, r10d
xor r11d, r11d
mov edi, r9d
lea r14d, [r9 + 0x1d]
nop dword [rax]
mov r8d, ebx
mov edx, eax
sar r8d, 0x1f
and edx, 1
neg edx
mov ecx, r8d
xor ecx, esi
sub ecx, r8d
and ecx, edx
add eax, ecx
mov ecx, r8d
xor ecx, r9d
sub ecx, r8d
and ecx, edx
add r11d, ecx
mov ecx, r8d
xor ecx, r10d
sub ecx, r8d
and r8d, edx
and ecx, edx
xor ebx, r8d
add edi, ecx
dec ebx
mov ecx, r8d
and ecx, eax
shr eax, 1
add esi, ecx
mov ecx, r8d
and ecx, r11d
and r8d, edi
add r9d, ecx
add r10d, r8d
add r9d, r9d
add r10d, r10d
sub r14, 1
jne 0x140009a60
mov dword [rsp + 0x20], r9d
lea r8, [rsp + 0x20]
mov r9, r15
mov dword [rsp + 0x24], r10d
lea rdx, [rbp - 0x11]
mov dword [rsp + 0x28], r11d
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x2c], edi
call fcn.140009de0
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x61]
call fcn.14000a210
sub r12, 1
jne 0x140009a40
mov edx, dword [rbp - 0x41]
lea rcx, [rsp + 0x30]
mov r8, r15
call fcn.140009b60
movups xmm0, xmmword [rsp + 0x30]
mov eax, dword [rbp - 0x69]
movups xmm1, xmmword [rbp - 0x79]
movups xmmword [r13], xmm0
movups xmmword [r13 + 0x10], xmm1
mov dword [r13 + 0x20], eax
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14000dcf0
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret