joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400057a0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400487c0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400057c0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400057c8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400057c0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140005810
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140005807
test rcx, rcx
je 0x1400057c0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x1400057f8
xor eax, eax
ret

Function at 0x140005820
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400487c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000583f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140005848
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140005860
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400487c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140005880
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140005888
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140005880
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140005880
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400058d4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400058e0
add rdx, 0x28
cmp r9, rdx
jne 0x1400058c0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400058f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400487c0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140005912
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140005920
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140005912
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140005912
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140005912
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140005975
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140005988
add rdx, 0x28
cmp rdx, r10
jne 0x140005960
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140005997
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400059a7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000597e
test ecx, ecx
jg 0x140005990
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140013620
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 4]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 5]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 6]
xor rcx, rdx
imul rcx, rax
movzx r15d, byte [r8 + 7]
xor r15, rcx
imul r15, rax
mov rcx, qword [rdi + 0x30]
and rcx, r15
mov rdx, qword [rdi + 0x18]
mov rax, rcx
shl rax, 4
mov rbx, qword [rdx + rax + 8]
cmp rbx, qword [rdi + 8]
je 0x1400136f6
mov rax, qword [r14]
cmp rax, qword [rbx + 0x10]
je 0x1400136ef
add rcx, rcx
mov r12, qword [rdx + rcx*8]
nop dword [rax + rax]
cmp rbx, r12
je 0x1400136f9
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1400136e0
xor eax, eax
jmp 0x140013890
mov r12, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [rdi + 0x10], rax
je 0x1400138a9
mov ecx, 0x20
call fcn.14009ad20
mov rbx, rax
mov r13, qword [r14]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0
mov rax, qword [rdi + 0x10]
inc rax
js 0x140013739
cvtsi2ss xmm0, rax
jmp 0x14001374e
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
movss xmm1, dword [rdi]
mov r14, qword [rdi + 0x38]
test r14, r14
js 0x140013762
cvtsi2ss xmm2, r14
jmp 0x14001377a
mov rax, r14
shr rax, 1
mov ecx, r14d
and ecx, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm3, xmm0
divss xmm3, xmm2
ucomiss xmm3, xmm1
jbe 0x14001383a
divss xmm0, xmm1
call fcn.1400aad20
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x1400cd168]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rdx, 9
mov eax, 8
cmovae rax, rdx
cmp r14, rax
jae 0x1400137e1
lea rcx, [r14*8]
cmp rcx, rax
cmovb rcx, rax
cmp r14, 0x200
cmovae rcx, rax
mov r14, rcx
mov rcx, rdi
mov rdx, r14
call fcn.1400138c0
mov rax, qword [rdi + 0x30]
and rax, r15
mov rcx, qword [rdi + 0x18]
mov rdx, rax
shl rdx, 4
mov r12, qword [rcx + rdx + 8]
cmp r12, qword [rdi + 8]
je 0x14001383a
cmp r13, qword [r12 + 0x10]
je 0x140013831
add rax, rax
mov rax, qword [rcx + rax*8]
nop word [rax + rax]
cmp r12, rax
je 0x140013837
mov r12, qword [r12 + 8]
cmp r13, qword [r12 + 0x10]
jne 0x140013820
mov r12, qword [r12]
jmp 0x14001383a
mov r12, rax
mov rcx, qword [r12 + 8]
inc qword [rdi + 0x10]
mov qword [rbx], r12
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [r12 + 8], rbx
mov rax, qword [rdi + 0x18]
and r15, qword [rdi + 0x30]
shl r15, 4
lea rdx, [rax + r15]
lea r8, [rax + r15]
add r8, 8
mov rax, qword [rax + r15]
cmp rax, qword [rdi + 8]
je 0x140013885
cmp rax, r12
je 0x14001388b
mov al, 1
mov rdx, r8
cmp qword [r8], rcx
jne 0x140013890
jmp 0x14001388b
mov qword [rdx], rbx
mov rdx, r8
mov qword [rdx], rbx
mov al, 1
mov qword [rsi], rbx
mov byte [rsi + 8], al
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.unordered_map_set_too_long
call fcn.14009b570
int3
Function at 0x1400138c0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x140013a9e
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.14000eff0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov rax, qword [rax]
cmp rax, rdi
je 0x140013a92
movabs rcx, 0x100000001b3
movabs rdx, 0xcbf29ce484222325
jmp 0x140013961
mov qword [r9 + r10*8], r8
mov qword [r9 + rbx*8], r8
cmp rax, rdi
je 0x140013a92
mov r8, rax
mov rax, qword [rax]
movzx r9d, byte [r8 + 0x10]
xor r9, rdx
imul r9, rcx
movzx r10d, byte [r8 + 0x11]
xor r10, r9
imul r10, rcx
movzx r9d, byte [r8 + 0x12]
xor r9, r10
imul r9, rcx
movzx r10d, byte [r8 + 0x13]
xor r10, r9
imul r10, rcx
movzx r9d, byte [r8 + 0x14]
xor r9, r10
imul r9, rcx
movzx r10d, byte [r8 + 0x15]
xor r10, r9
imul r10, rcx
movzx r9d, byte [r8 + 0x16]
xor r9, r10
imul r9, rcx
movzx r11d, byte [r8 + 0x17]
xor r11, r9
imul r11, rcx
and r11, qword [rsi + 0x30]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11*2 + 1]
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x140013950
mov r14, qword [r9 + rbx*8]
mov r15, qword [r8 + 0x10]
cmp r15, qword [r14 + 0x10]
jne 0x140013a30
mov r10, qword [r14]
cmp r10, r8
je 0x140013954
mov r11, qword [r8 + 8]
mov qword [r11], rax
mov r14, qword [rax + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], r8
mov qword [r10 + 8], r14
mov qword [rax + 8], r11
mov qword [r8 + 8], r15
jmp 0x140013954
cmp r11, r14
je 0x140013a68
mov r14, qword [r14 + 8]
cmp r15, qword [r14 + 0x10]
jne 0x140013a30
mov r9, qword [r14]
mov r10, qword [r8 + 8]
mov qword [r10], rax
mov r11, qword [rax + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], r8
mov qword [r9 + 8], r11
mov qword [rax + 8], r10
mov qword [r8 + 8], rbx
jmp 0x140013958
mov rbx, qword [r8 + 8]
mov qword [rbx], rax
mov r14, qword [rax + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], r8
mov qword [r11 + 8], r14
mov qword [rax + 8], rbx
mov qword [r8 + 8], r15
mov qword [r9 + r10*8], r8
jmp 0x140013958
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.14009b570
int3
Function at 0x140016af0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rsi, rcx
mov rax, qword [0x1400f5980]
xor rax, rsp
mov qword [rsp + 0x58], rax
movabs r12, 0xcbf29ce484222325
movabs rax, 0x5c4d12f947bd853
movabs rcx, 0xf14a21a5abe6d649
movq xmm0, rcx
movq xmm1, rax
punpcklqdq xmm1, xmm0
xor eax, eax
not rax
movq xmm0, rax
pshufd xmm0, xmm0, 0x44
movabs rax, 0x2556ed8b6b8427ac
movabs rcx, 0xeb51d01227c2986
movq xmm2, rcx
movq xmm3, rax
punpcklqdq xmm3, xmm2
pxor xmm3, xmm1
pandn xmm3, xmm0
pshufd xmm1, xmm3, 0xee
movq rax, xmm1
movq rcx, xmm3
shl ecx, 0x10
movzx eax, ax
mov rax, qword gs:[rcx + rax]
movabs rcx, 0x9d8c100caedcc8a8
movabs rdx, 0x56bff93fbbf29223
movq xmm1, rdx
movq xmm2, rcx
punpcklqdq xmm2, xmm1
movabs rcx, 0xd322de4151233757
movabs rdx, 0xa9403772d3386dbc
movq xmm1, rdx
movq xmm3, rcx
punpcklqdq xmm3, xmm1
pxor xmm3, xmm2
pandn xmm3, xmm0
pshufd xmm0, xmm3, 0xee
movq rcx, xmm0
movq rdx, xmm3
mov edx, edx
shl rdx, 0x10
movabs r8, 0xffff00000000ffff
and r8, rcx
add r8, rax
mov rax, qword [rdx + r8]
mov qword [rsp + 0x28], rax
mov r13, qword [rax + 0x18]
add r13, 0x20
xorps xmm6, xmm6
lea rdi, [rsp + 0x30]
movabs rbp, 0x100000001b3
jmp 0x140016c3e
call fcn.14009ad64
cmp r14, rsi
je 0x140016d81
mov r13, qword [r13]
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
add rax, 0x20
cmp rax, r13
je 0x140016d7a
mov r14, qword [r13 + 0x50]
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov rcx, r14
call fcn.1400b3974
mov rcx, rdi
mov rdx, r14
mov r8, rax
call fcn.140003050
mov rax, qword [rsp + 0x48]
cmp rax, 8
mov rcx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, rdi
cmovae rbx, rcx
test r14, r14
je 0x140016cd2
add r14, r14
xor r15d, r15d
nop word cs:[rax + rax]
movzx ecx, word [rbx + r15]
call fcn.1400b3418
mov word [rbx + r15], ax
add r15, 2
cmp r14, r15
jne 0x140016cb0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
cmp rax, 8
mov rdx, rdi
cmovae rdx, rcx
mov r8, 0xffffffffffffffff
nop word cs:[rax + rax]
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x140016cf0
mov r14, r12
test r8, r8
je 0x140016d2a
xor r9d, r9d
mov r10, r12
nop dword [rax + rax]
movzx r14d, byte [rdx + r9*2]
xor r14, r10
imul r14, rbp
inc r9
mov r11d, r9d
mov r10, r14
cmp r8, r11
ja 0x140016d10
cmp r14, rsi
jne 0x140016d38
mov rdx, qword [r13 + 0x20]
mov qword [rsp + 0x20], rdx
cmp rax, 8
jb 0x140016c35
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140016c30
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140016da9
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
jmp 0x140016c30
xor eax, eax
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14009adb0
mov rax, qword [rsp + 0x20]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400a96e8
int3
Function at 0x1400318e0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov rax, qword [0x1400f5980]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov r12d, 0xfffffffc
test rdx, rdx
je 0x14003198b
mov ebp, r9d
mov ebx, r8d
mov rdi, rcx
lea rax, [0x1400ea301]
mov rcx, rdx
mov rdx, rax
call fcn.1400ab70c
test rax, rax
je 0x14003198b
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8d, 2
call fcn.1400a8b80
test eax, eax
jne 0x140031983
mov rcx, rsi
call fcn.1400ac100
mov r14d, eax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.1400a8b80
test eax, eax
jne 0x140031983
lea eax, [r14 - 0x400001]
cmp eax, 0xffbfffff
ja 0x1400319b2
mov rcx, rsi
call fcn.1400aada8
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14009adb0
mov eax, r12d
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r13d, r14d
cmp r14d, 0x401
jae 0x1400319c5
lea r15, [rsp + 0x60]
jmp 0x1400319d5
mov rcx, r13
call fcn.14003fcc0
mov r15, rax
test rax, rax
je 0x140031983
mov edx, 1
mov rcx, r15
mov r8, r13
mov r9, rsi
call fcn.1400abd3c
mov r12d, 0xfffffffc
cmp rax, r13
jne 0x140031af9
cmp ebp, 0x16
jne 0x140031a82
mov ebp, 5
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x50]
mov ecx, 5
call fcn.140065cc0
test eax, eax
je 0x140031a6d
xor ebp, ebp
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x50]
xor ecx, ecx
call fcn.140065cc0
test eax, eax
jne 0x140031a49
mov rdx, qword [rsp + 0x58]
mov rcx, r15
mov r8d, r14d
call fcn.140040b90
test rax, rax
jne 0x140031a82
cmp r14d, 0x401
jb 0x140031a5a
mov rcx, r15
call fcn.14003fce0
mov rcx, rsi
call fcn.1400aada8
mov r12d, 0xfffffff8
jmp 0x14003198b
mov rdx, qword [rsp + 0x58]
mov rcx, r15
mov r8d, r14d
call fcn.140040b90
test rax, rax
je 0x140031a1d
mov ecx, dword [rsp + 0x4e8]
mov rax, qword [rsp + 0x4d0]
cmp ebp, 5
sete dl
cmp ebp, 0xf
sete r8b
cmp ebx, 1
jne 0x140031ac4
or dl, r8b
je 0x140031ac4
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r15
mov r8d, r14d
mov r9d, ebp
call fcn.140031b20
jmp 0x140031af6
mov edx, dword [rsp + 0x4d8]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x30], 0
mov rcx, rdi
mov rdx, r15
mov r8d, r14d
mov r9d, ebx
call fcn.1400300b0
mov r12d, eax
mov rcx, rsi
call fcn.1400aada8
cmp r14d, 0x401
jb 0x14003198b
mov rcx, r15
call fcn.14003fce0
jmp 0x14003198b
Function at 0x14003c460
Capabilities:
Encrypt data using aes
Resolve function by parsing pe exports

Disassembly:
mov rax, rdx
mov rdx, r8
mov r8, rax
jmp fcn.14003c470
Function at 0x14003fd60
Capabilities:
Encrypt data using des

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov dword [rsp + 0x2c], edx
mov rax, qword [0x1400f5980]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor eax, eax
lea rdx, str.91__
lea r10, [0x1400d5f70]
nop dword [rax]
movzx r11d, byte [rax + rdx]
dec r11d
mov esi, r11d
and esi, 7
sar r11d, 3
movsxd r11, r11d
movzx r11d, byte [rcx + r11]
test dword [r10 + rsi*4], r11d
setne byte [rsp + rax + 0x30]
inc rax
cmp rax, 0x38
jne 0x14003fda0
xor r11d, r11d
lea rsi, [0x1400d5f90]
mov edi, 0xffffffe5
mov ebx, 0x1c
movabs r14, 0xaaaaaaaaaaaaaaab
lea r15, [0x1400d5fa0]
jmp 0x14003fe73
mov eax, dword [rsp + 0xa0]
shl eax, 0x18
movzx ecx, byte [rsp + 0xa2]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [rsp + 0xa4]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0xa6]
or ecx, eax
mov dword [r8 + r11*8], ecx
movzx eax, byte [rsp + 0xa1]
shl eax, 0x18
movzx ecx, byte [rsp + 0xa3]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [rsp + 0xa5]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0xa7]
or ecx, eax
mov dword [r8 + r11*8 + 4], ecx
inc r11
cmp r11, 0x10
je 0x14003ff4d
mov qword [rsp + 0xa0], 0
movzx eax, byte [r11 + rsi]
lea rcx, [rax + 1]
lea rdx, [rax + rdi]
xor r12d, r12d
nop
lea r13, [rax + r12]
cmp r12, 0x1c
mov ebp, 0x38
cmovb rbp, rbx
lea r9d, [rdx - 1]
cmp r13, rbp
cmovb r9, r13
movsxd r9, r9d
movzx r9d, byte [rsp + r9 + 0x30]
lea r13, [r12 + 1]
cmp r13, 0x1c
mov r13d, 0x38
cmovb r13, rbx
cmp rcx, r13
mov r13, rdx
cmovb r13, rcx
mov byte [rsp + r12 + 0x68], r9b
movsxd r9, r13d
movzx r9d, byte [rsp + r9 + 0x30]
mov byte [rsp + r12 + 0x69], r9b
add rcx, 2
add rdx, 2
add r12, 2
cmp r12, 0x38
jne 0x14003fe90
mov r12, r10
xor ecx, ecx
jmp 0x14003ff11
inc rcx
add r12, 4
cmp rcx, 0x30
je 0x14003fe00
mov rax, rcx
mul r14
movzx eax, byte [rcx + r15]
cmp byte [rsp + rax + 0x67], 0
je 0x14003ff00
add rdx, rdx
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
mov eax, dword [r12 + rax]
shr eax, 2
movzx edx, cl
imul edx, edx, 0xab
shr edx, 0xa
or byte [rsp + rdx + 0xa0], al
jmp 0x14003ff00
cmp dword [rsp + 0x2c], 1
jne 0x14003ffde
movdqu xmm0, xmmword [r8 + 0x70]
pshufd xmm0, xmm0, 0x4e
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
movdqu xmm3, xmmword [r8 + 0x20]
movdqu xmm4, xmmword [r8 + 0x30]
movdqu xmmword [r8], xmm0
pshufd xmm0, xmm1, 0x4e
movdqu xmmword [r8 + 0x70], xmm0
movdqu xmm0, xmmword [r8 + 0x60]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [r8 + 0x10], xmm0
pshufd xmm0, xmm2, 0x4e
movdqu xmmword [r8 + 0x60], xmm0
movdqu xmm0, xmmword [r8 + 0x50]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [r8 + 0x20], xmm0
pshufd xmm0, xmm3, 0x4e
movdqu xmmword [r8 + 0x50], xmm0
movdqu xmm0, xmmword [r8 + 0x40]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [r8 + 0x30], xmm0
pshufd xmm0, xmm4, 0x4e
movdqu xmmword [r8 + 0x40], xmm0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14009adb0
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140040910
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, dword [rcx]
mov esi, dword [rdx]
xor r9d, r9d
lea r10, [0x1400d5fd0]
nop word [rax + rax]
mov r11d, esi
rol esi, 0x1c
xor esi, dword [r8 + r9]
mov edi, esi
and edi, 0x3f
mov ebx, esi
shr ebx, 8
and ebx, 0x3f
mov r14d, esi
shr r14d, 0x10
and r14d, 0x3f
shr esi, 0x18
and esi, 0x3f
mov r15d, dword [r8 + r9 + 4]
xor r15d, r11d
mov r12d, r15d
and r12d, 0x3f
mov r13d, r15d
shr r13d, 8
and r13d, 0x3f
mov ebp, r15d
shr ebp, 0x10
and ebp, 0x3f
shr r15d, 0x18
and r15d, 0x3f
xor eax, dword [r10 + rdi*4 + 0x600]
xor eax, dword [r10 + rbx*4 + 0x400]
xor eax, dword [r10 + r14*4 + 0x200]
xor eax, dword [r10 + rsi*4]
xor eax, dword [r10 + r12*4 + 0x700]
xor eax, dword [r10 + r13*4 + 0x500]
xor eax, dword [r10 + rbp*4 + 0x300]
xor eax, dword [r10 + r15*4 + 0x100]
mov edi, eax
rol edi, 0x1c
xor edi, dword [r8 + r9 + 8]
mov esi, edi
and esi, 0x3f
mov esi, dword [r10 + rsi*4 + 0x600]
mov ebx, edi
shr ebx, 8
and ebx, 0x3f
mov r14d, edi
shr r14d, 0x10
and r14d, 0x3f
shr edi, 0x18
and edi, 0x3f
mov r15d, dword [r8 + r9 + 0xc]
xor r15d, eax
mov r12d, r15d
and r12d, 0x3f
mov r13d, r15d
shr r13d, 8
and r13d, 0x3f
mov ebp, r15d
shr ebp, 0x10
and ebp, 0x3f
shr r15d, 0x18
and r15d, 0x3f
xor esi, dword [r10 + rbx*4 + 0x400]
xor esi, dword [r10 + r14*4 + 0x200]
xor esi, dword [r10 + rdi*4]
xor esi, dword [r10 + r12*4 + 0x700]
xor esi, dword [r10 + r13*4 + 0x500]
xor esi, dword [r10 + rbp*4 + 0x300]
xor esi, dword [r10 + r15*4 + 0x100]
xor esi, r11d
add r9, 0x10
cmp r9, 0x80
jne 0x140040930
mov dword [rcx], eax
mov dword [rdx], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400413e0
Capabilities:
Generate random numbers via winapi

Disassembly:
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp fcn.140040eb0

Function at 0x1400413f0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov r9, rdx
xor edx, edx
xor r8d, r8d
jmp fcn.140040eb0
Function at 0x140042110
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14004215e
mov rcx, qword [rsi]
mov edx, ebx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140042165
mov rcx, qword [rsi]
xor esi, esi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x14004216a
mov esi, 0xffffff99
jmp 0x14004216a
mov esi, 0xffffff98
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14006b520
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, 0xffffff53
test rcx, rcx
je 0x14006b5f3
mov rdi, rdx
test rdx, rdx
je 0x14006b5f3
mov rsi, rcx
call fcn.14006d880
test eax, eax
jne 0x14006b5f3
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmm3, xmmword [rsi + 0x30]
movups xmmword [rdi + 0x30], xmm3
movups xmmword [rdi + 0x20], xmm2
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rsi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rsi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rsi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsi + 0x38], rax
mov dword [rsi + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0xc8], xmm0
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14006b600
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x14006b69a
mov qword [rcx + 0xd8], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0xc8], xmm0
xor eax, eax
ret
mov eax, 0xffffff53
ret
Function at 0x14006d7a0
Capabilities:
Hash data using sha384

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov eax, 0xffffff53
test rcx, rcx
je 0x14006d86b
mov rdi, rdx
test rdx, rdx
je 0x14006d86b
mov rsi, rcx
call fcn.14006d880
test eax, eax
jne 0x14006d86b
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmmword [rdi + 0x20], xmm2
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rsi], rax
movabs rax, 0x629a292a367cd507
mov qword [rsi + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rsi + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rsi + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rsi + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rsi + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rsi + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rsi + 0x38], rax
mov dword [rsi + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0xc8], xmm0
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x14006db50
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
je 0x14006dbe6
mov qword [rcx + 0xd8], rdx
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0xc8], xmm0
xor eax, eax
ret
mov eax, 0xffffff53
ret

Function at 0x14006dbf0
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
je 0x14006dc8a
mov qword [rcx + 0xd8], 0
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0xc8], xmm0
xor eax, eax
ret
mov eax, 0xffffff53
ret