joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a35f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x20], 0
mov rsi, r9
mov r15, r8
mov rbx, rcx
test r9, r9
je 0x1400a3772
movabs rax, 0x2000000000000000
cmp r9, rax
jae 0x1400a3772
xorps xmm0, xmm0
lea rdi, [rcx + 0x180]
movups xmmword [rdi], xmm0
mov r13d, 0x10
movups xmmword [rcx + 0x190], xmm0
and qword [rcx + 0x160], 0
and qword [rcx + 0x168], 0
mov dword [rcx + 0x1a0], edx
cmp r9, 0xc
jne 0x1400a368c
movsd xmm0, qword [r8]
movsd qword [rdi], xmm0
mov eax, dword [r8 + 8]
mov dword [rdi + 8], eax
mov byte [rcx + 0x18f], 1
jmp 0x1400a3752
and qword [rbp - 0x18], 0
lea rcx, [r9*8]
mov rax, rcx
mov byte [rbp - 9], cl
shr rax, 0x38
mov byte [rbp - 0x10], al
mov rax, rcx
shr rax, 0x30
mov byte [rbp - 0xf], al
mov rax, rcx
shr rax, 0x28
mov byte [rbp - 0xe], al
mov rax, rcx
shr rax, 0x20
mov byte [rbp - 0xd], al
mov rax, rcx
shr rax, 0x18
mov byte [rbp - 0xc], al
mov rax, rcx
shr rax, 0x10
mov byte [rbp - 0xb], al
mov rax, rcx
shr rax, 8
mov byte [rbp - 0xa], al
cmp rsi, r13
mov r14, r13
cmovb r14, rsi
test r14, r14
je 0x1400a370f
mov rdx, r15
mov rcx, rdi
sub rdx, rbx
mov r8, r14
mov al, byte [rdx + rcx - 0x180]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1400a36fd
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
call fcn.1400a345c
add r15, r14
sub rsi, r14
jne 0x1400a36e2
lea rdx, [rbp - 0x18]
mov rcx, rdi
sub rdx, rbx
mov r9, r13
mov al, byte [rdx + rcx - 0x180]
xor byte [rcx], al
inc rcx
sub r9, 1
jne 0x1400a3732
mov r8, rdi
mov rdx, rdi
mov rcx, rbx
call fcn.1400a345c
lea rax, [rbp - 0x20]
mov r8, r13
lea r9, [rbx + 0x170]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140098964
jmp 0x1400a3777
mov eax, 0xffffffec
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140140c70
add rsp, 0x50
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400a3794
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movabs rax, 0x2000000000000000
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
cmp r8, rax
jb 0x1400a37d3
mov eax, 0xffffffec
jmp 0x1400a38df
mov rax, qword [rcx + 0x168]
mov rcx, rax
and ecx, 0xf
je 0x1400a3851
mov r14d, 0x10
sub r14, rcx
cmp r14, rdi
cmova r14, rdi
test r14, r14
je 0x1400a3820
lea rdx, [rsi + 0x190]
mov r8, rbp
add rdx, rcx
sub r8, rcx
sub r8, rsi
mov r9, r14
mov al, byte [r8 + rdx - 0x190]
xor byte [rdx], al
inc rdx
sub r9, 1
jne 0x1400a380d
lea rax, [r14 + rcx]
lea rbx, [rsi + 0x190]
cmp rax, 0x10
jne 0x1400a383f
mov r8, rbx
mov rdx, rbx
mov rcx, rsi
call fcn.1400a345c
mov rax, qword [rsi + 0x168]
sub rdi, r14
add rbp, r14
add rax, r14
jmp 0x1400a3858
lea rbx, [rsi + 0x190]
add rax, rdi
mov qword [rsi + 0x168], rax
cmp rdi, 0x10
jb 0x1400a38c3
mov r15, rdi
lea r12, [rsi + 0x190]
shr r15, 4
mov r14, rbp
imul rax, r15, 0xfffffffffffffff0
sub r14, rsi
add rdi, rax
sub r14, 0x190
mov rax, r15
shl rax, 4
add rbp, rax
mov rcx, r12
mov edx, 0x10
mov al, byte [r14 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400a389c
mov r8, r12
mov rdx, r12
mov rcx, rsi
call fcn.1400a345c
add r14, 0x10
sub r15, 1
jne 0x1400a3894
test rdi, rdi
je 0x1400a38dd
sub rbp, rsi
mov al, byte [rbx + rbp - 0x190]
xor byte [rbx], al
inc rbx
sub rdi, 1
jne 0x1400a38cb
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400a3e8c
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xe0]
lea r10, [r11 - 0x38]
mov rdi, qword [rsp + 0xd8]
mov rbx, rdx
mov rdx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xe8]
mov qword [r11 - 0x48], r10
mov qword [r11 - 0x50], rdi
mov qword [r11 - 0x58], rsi
mov qword [r11 - 0x60], rax
mov rax, qword [rsp + 0xc8]
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x70], rdx
xor edx, edx
mov qword [r11 - 0x78], r9
mov r9, r8
mov r8, rbx
call fcn.1400a3dec
test eax, eax
jne 0x1400a3f5f
xor r9d, r9d
xor edx, edx
test rdi, rdi
je 0x1400a3f5d
mov r10, qword [rsp + 0xd0]
lea rax, [rsp + 0x60]
sub r10, rax
lea rax, [rsp + 0x60]
add rax, rdx
inc rdx
movzx ecx, byte [r10 + rax]
movzx eax, byte [rax]
xor ecx, eax
or r9d, ecx
cmp rdx, rdi
jb 0x1400a3f1e
test r9d, r9d
je 0x1400a3f5d
test rbx, rbx
je 0x1400a3f56
mov rax, qword [fcn.14014276a]
mov r8, rbx
xor edx, edx
mov rcx, rsi
call rax
mov eax, 0xffffffee
jmp 0x1400a3f5f
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140140c70
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a44e8
Capabilities:
Hash data using sha1
Hash data using sha256
Hash data using sha512

Disassembly:
xor r8d, r8d
test rcx, rcx
je 0x1400a457a
mov rdx, qword [rcx]
test rdx, rdx
je 0x1400a457a
mov edx, dword [rdx + 8]
sub edx, 1
je 0x1400a4553
sub edx, 1
je 0x1400a4522
sub edx, 1
je 0x1400a4545
sub edx, 1
je 0x1400a4541
sub edx, 1
je 0x1400a4533
sub edx, 1
je 0x1400a452f
cmp edx, 1
jne 0x1400a457a
mov rax, qword [rcx + 8]
mov dword [rax + 0x18], 0xc3d2e1f0
jmp 0x1400a4557
xor edx, edx
jmp 0x1400a4538
mov edx, 1
mov rcx, qword [rcx + 8]
jmp fcn.1400af618
xor edx, edx
jmp 0x1400a454a
mov edx, 1
mov rcx, qword [rcx + 8]
jmp fcn.1400ae668
mov rax, qword [rcx + 8]
mov dword [rax + 0x14], 0x10325476
mov dword [rax + 0x10], 0x98badcfe
mov dword [rax + 0xc], 0xefcdab89
mov dword [rax + 8], 0x67452301
mov qword [rax], r8
xor eax, eax
jmp 0x1400a457f
mov eax, 0xffffaf00
ret

Function at 0x1400a5f84
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [0x1401e6c20]
mov rcx, rbx
test rdi, rdi
je 0x1400a5fd9
cmp qword [0x1401e6c20], 0
je 0x1400a5fd9
mov rsi, qword [rdi + 8]
cmp qword [rcx + 8], rsi
jne 0x1400a5fcc
mov rdx, qword [rdi + 0x10]
mov r8, rsi
mov rcx, qword [rcx]
call fcn.140142a05
test eax, eax
je 0x1400a5feb
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x1400a5fb3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
jmp 0x1400a5fdb

Function at 0x1400a70dc
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r14
sub rsp, 0x40
xorps xmm0, xmm0
mov r14, r8
xor eax, eax
lea r8, [r11 - 0x28]
movups xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
mov rdi, r9
call fcn.140092aa8
test eax, eax
je 0x1400a7118
add eax, 0xffffc580
jmp 0x1400a715d
cmp qword [0x1401e71e0], 0
lea rbx, [0x1401e71e0]
mov rcx, rbx
je 0x1400a7158
mov rsi, qword [rsp + 0x28]
cmp qword [rcx + 8], rsi
jne 0x1400a714b
mov rdx, qword [rsp + 0x30]
mov r8, rsi
mov rcx, qword [rcx]
call fcn.140142a05
test eax, eax
je 0x1400a7173
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x1400a7131
mov eax, 0xffffc380
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
test rbx, rbx
je 0x1400a7158
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
cmp eax, 1
jne 0x1400a71a4
cmp dword [rdi], 5
je 0x1400a7194
cmp dword [rdi], 0
je 0x1400a7194
mov eax, 0xffffc580
jmp 0x1400a715d
mov rax, qword [rdi + 8]
neg rax
sbb eax, eax
and eax, 0xffffc580
jmp 0x1400a715d
xor eax, eax
jmp 0x1400a715d
Function at 0x1400ab56c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x490
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x480], rax
cmp dword [rcx + 0x148], 1
mov rbp, rcx
mov rax, qword [rsp + 0x508]
mov r13, qword [rsp + 0x4f8]
mov r9, qword [rsp + 0x500]
mov qword [rsp + 0x30], rax
jne 0x1400ab7a8
mov rsi, qword [rcx + 8]
lea rax, [rsi - 0x10]
cmp rax, 0x3f0
ja 0x1400ab7a8
lea rax, [0x1401e61c0]
mov ecx, 1
cmp ecx, dword [rbp + 0x14c]
je 0x1400ab5f5
mov ecx, dword [rax + 0x10]
add rax, 0xc
test ecx, ecx
jne 0x1400ab5e2
movzx edi, byte [rax + 8]
test edi, edi
je 0x1400ab7a8
lea r15d, [rdi + rdi]
lea ecx, [r15 + 2]
cmp rcx, rsi
ja 0x1400ab7a8
lea rax, [rsp + 0x80]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.1400aa9d0
mov ebx, eax
test eax, eax
jne 0x1400ab777
mov eax, dword [rbp + 0x14c]
lea rcx, [rsp + 0x81]
mov r14d, edi
mov dword [rsp + 0x20], eax
mov r12, rsi
mov edx, r14d
sub r12, rdi
lea rdi, [rsp + 0x81]
add rdi, r14
mov r8, rdi
lea r9, [r12 - 1]
call fcn.1400ab060
mov ebx, eax
test eax, eax
jne 0x1400ab777
mov eax, dword [rbp + 0x14c]
lea r8, [rsp + 0x81]
mov r9d, r14d
mov dword [rsp + 0x20], eax
lea rdx, [r12 - 1]
mov rcx, rdi
call fcn.1400ab060
mov ebx, eax
test eax, eax
jne 0x1400ab777
mov ecx, dword [rbp + 0x14c]
call fcn.1400a42d0
test rax, rax
jne 0x1400ab6b7
mov ebx, 0xffffbf80
jmp 0x1400ab777
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call fcn.1400a4660
mov ebx, eax
test eax, eax
jne 0x1400ab777
mov dl, byte [rsp + 0x80]
xor ecx, ecx
test r14, r14
je 0x1400ab6f4
mov al, byte [rsp + rcx + 0x40]
inc rcx
xor al, byte [rdi]
inc rdi
or dl, al
cmp rcx, r14
jb 0x1400ab6e1
mov eax, r15d
mov r10, rsi
sub r10, rax
xor r9d, r9d
xor r8b, r8b
xor ecx, ecx
add r10, 0xfffffffffffffffe
je 0x1400ab72b
or r8b, byte [rcx + rdi]
inc rcx
mov al, r8b
neg al
or al, r8b
not al
movzx eax, al
shr rax, 7
add r9, rax
cmp rcx, r10
jb 0x1400ab70b
add rdi, r9
mov al, byte [rdi]
inc rdi
xor al, 1
or dl, al
je 0x1400ab740
mov ebx, 0xffffbf00
jmp 0x1400ab777
sub rsi, rdi
lea r8, [rsp + 0x80]
add r8, rsi
cmp r8, qword [rsp + 0x510]
jbe 0x1400ab75f
mov ebx, 0xffffbc00
jmp 0x1400ab777
mov qword [r13], r8
test r8, r8
je 0x1400ab775
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
call fcn.140142a0b
xor ebx, ebx
mov rax, qword [fcn.14014276a]
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x400
call rax
mov rax, qword [fcn.14014276a]
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [rdx + 0x40]
call rax
mov eax, ebx
jmp 0x1400ab7ad
mov eax, 0xffffbf80
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140140c70
mov rbx, qword [rsp + 0x4e8]
add rsp, 0x490
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ae668
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov esi, edx
mov r14, rcx
cmp edx, 1
jbe 0x1400ae68f
mov eax, 0xffffff8c
jmp 0x1400ae758
and dword [rcx], 0
mov eax, esi
and dword [rcx + 4], 0
neg eax
mov eax, esi
sbb edi, edi
and edi, 0x7b152682
add edi, 0xbb67ae85
neg eax
mov eax, esi
sbb ebx, ebx
and ebx, 0xf401e9a5
add ebx, 0x3c6ef372
neg eax
mov eax, esi
sbb r11d, r11d
and r11d, 0x51be63ff
add r11d, 0xa54ff53a
neg eax
mov eax, esi
sbb r10d, r10d
and r10d, 0xaeb1b8b2
add r10d, 0x510e527f
neg eax
mov eax, esi
sbb r9d, r9d
and r9d, 0x4575b5fc
add r9d, 0x1f83d9ab
neg eax
mov eax, esi
sbb r8d, r8d
and r8d, 0xcd52ac85
add r8d, 0x9b05688c
neg eax
mov eax, esi
sbb edx, edx
and edx, 0x6319828b
add edx, 0x5be0cd19
neg eax
sbb ecx, ecx
and ecx, 0x56fbb871
add ecx, 0x6a09e667
mov dword [r14 + 8], ecx
xor eax, eax
mov dword [r14 + 0xc], edi
mov dword [r14 + 0x10], ebx
mov dword [r14 + 0x14], r11d
mov dword [r14 + 0x18], r10d
mov dword [r14 + 0x1c], r8d
mov dword [r14 + 0x20], r9d
mov dword [r14 + 0x24], edx
mov dword [r14 + 0x68], esi
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret

Function at 0x1400af618
Capabilities:
Hash data using sha512

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov esi, edx
mov rbp, rcx
cmp edx, 1
jbe 0x1400af63f
mov eax, 0xffffff8b
jmp 0x1400af775
mov eax, esi
xorps xmm0, xmm0
neg eax
movups xmmword [rcx], xmm0
sbb rdi, rdi
movabs rax, 0xa7327aa4b1b22dcc
and rdi, rax
movabs rax, 0xbb67ae8584caa73b
add rdi, rax
mov eax, esi
neg eax
movabs rax, 0x54ea0de731dbe4ec
sbb rbx, rbx
and rbx, rax
movabs rax, 0x3c6ef372fe94f82b
add rbx, rax
mov eax, esi
neg eax
movabs rax, 0x6fdff79e97f12248
sbb r11, r11
and r11, rax
movabs rax, 0xa54ff53a5f1d36f1
add r11, rax
mov eax, esi
neg eax
movabs rax, 0x1624d3e851d98860
sbb r10, r10
and r10, rax
movabs rax, 0x510e527fade682d1
add r10, rax
mov eax, esi
neg eax
movabs rax, 0xebd47b04ab7c2e2b
sbb r9, r9
and r9, rax
movabs rax, 0x5be0cd19137e2179
add r9, rax
mov eax, esi
neg eax
movabs rax, 0xbb88546169b7d23c
sbb r8, r8
and r8, rax
movabs rax, 0x1f83d9abfb41bd6b
add r8, rax
mov eax, esi
neg eax
movabs rax, 0xf3aee1fb3d19a8f2
sbb rdx, rdx
and rdx, rax
movabs rax, 0x9b05688c2b3e6c1f
add rdx, rax
mov eax, esi
neg eax
movabs rax, 0x61b1b6f5cd48d5d0
sbb rcx, rcx
and rcx, rax
movabs rax, 0x6a09e667f3bcc908
add rcx, rax
mov qword [rbp + 0x10], rcx
xor eax, eax
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], r11
mov qword [rbp + 0x30], r10
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x48], r9
mov dword [rbp + 0xd0], esi
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1400b276c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r10, qword [rcx]
mov rdi, rcx
cmp qword [r10 + 0x88], 0
je 0x1400b290b
mov r11, qword [r10 + 0x90]
test r11, r11
je 0x1400b290b
mov rdx, qword [rcx + 0x100]
mov rsi, qword [rcx + 0x148]
cmp rdx, 0x3d
jb 0x1400b2943
mov rbx, qword [rcx + 0xb0]
cmp byte [rbx], 0x16
jne 0x1400b2943
movzx ecx, byte [rbx + 3]
movzx eax, byte [rbx + 4]
shl rcx, 8
or rcx, rax
jne 0x1400b2943
movzx eax, byte [rbx + 0x14]
movzx ecx, byte [rbx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x15]
shl ecx, 8
or ecx, eax
jne 0x1400b2943
movzx ecx, byte [rbx + 0x3b]
lea rax, [rcx + 0x3d]
cmp rax, rdx
ja 0x1400b2943
movzx r8d, byte [rcx + rbx + 0x3c]
lea rax, [rcx + 0x3d]
add rax, r8
cmp rax, rdx
ja 0x1400b2943
mov r14, qword [rdi + 0x1b8]
lea rdx, [rbx + 0x3d]
mov rbp, qword [rdi + 0x1c0]
add rdx, rcx
mov rcx, qword [r10 + 0x98]
mov r9, r14
mov qword [rsp + 0x20], rbp
call r11
test eax, eax
je 0x1400b292d
movups xmm0, xmmword [rbx]
lea r8, [rsi + 0x4000]
mov qword [rsp + 0x20], rbp
mov r9, r14
lea rdx, [rsp + 0x30]
movups xmmword [rsi], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [rsi + 0x10], xmm1
mov al, byte [rbx + 0x18]
mov byte [rsi + 0x18], al
lea rax, [rsi + 0x1c]
mov qword [rsp + 0x30], rax
mov byte [rsi + 0xd], 3
mov word [rsi + 0x19], 0xfffe
mov rax, qword [rdi]
mov rcx, qword [rax + 0x98]
call qword [rax + 0x88]
test eax, eax
je 0x1400b28b8
mov eax, 0xffff9400
jmp 0x1400b290d
mov r8, qword [rsp + 0x30]
sub r8, rsi
lea rcx, [r8 - 0x19]
lea eax, [r8 - 0x1c]
mov byte [rsi + 0x18], cl
mov byte [rsi + 0x1b], al
mov rax, rcx
shr rax, 0x10
mov byte [rsi + 0x16], al
mov byte [rsi + 0xe], al
mov rax, rcx
shr rax, 8
mov byte [rsi + 0x17], al
mov byte [rsi + 0xf], al
lea rax, [r8 - 0xd]
shr rax, 8
mov byte [rsi + 0xb], al
lea eax, [r8 - 0xd]
mov byte [rsi + 0xc], al
mov byte [rsi + 0x10], cl
mov rdx, qword [rdi + 0x148]
mov rcx, qword [rdi + 0x48]
call qword [rdi + 0x30]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140140c70
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.1400b4748
test eax, eax
mov ecx, 0xffff9880
cmovne ecx, eax
mov eax, ecx
jmp 0x1400b290d
mov eax, 0xffff8d00
jmp 0x1400b290d
Function at 0x1400bfb44
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp + 0x47], rcx
mov qword [rbp - 0x31], rdx
mov byte [rbp - 0x29], 0
and dword [rbp + 0x1b], 0
and dword [rbp + 0x1f], 0
mov dword [rbp + 0x23], 0x67452301
mov dword [rbp + 0x27], 0xefcdab89
mov dword [rbp + 0x2b], 0x98badcfe
mov dword [rbp + 0x2f], 0x10325476
cmp qword [rdx + 0x18], 0x10
jb 0x1400bfba9
mov rdx, qword [rdx]
mov r8d, dword [rbx + 0x10]
lea rcx, [rbp - 0x29]
call fcn.1400bf9bc
cmp byte [rbp - 0x29], 0
jne 0x1400bfc41
mov r8d, 8
lea rdx, [rbp + 0x1b]
lea rcx, [rbp + 0x47]
call fcn.1400bf0c4
mov edx, dword [rbp + 0x1b]
shr edx, 3
and edx, 0x3f
lea eax, [r8 + 0x30]
sub eax, edx
mov r8d, 0x78
sub r8d, edx
cmp edx, 0x38
cmovb r8d, eax
lea rdx, [0x14025a520]
lea rcx, [rbp - 0x29]
call fcn.1400bf9bc
mov r8d, 8
lea rdx, [rbp + 0x47]
lea rcx, [rbp - 0x29]
call fcn.1400bf9bc
mov r8d, 0x10
lea rdx, [rbp + 0x23]
lea rcx, [rbp + 0x33]
call fcn.1400bf0c4
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [rbp - 0x28]
call fcn.14014276a
xor eax, eax
mov qword [rbp + 0x1b], rax
mov byte [rbp - 0x29], 1
mov rdx, rdi
lea rcx, [rbp - 0x29]
call fcn.1400bfa7c
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400bfc84
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400bfc7f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400bfcb8
mov rcx, r8
call fcn.140140cd4
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140140c70
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call 0x1405b5c8b
int3

Function at 0x1400c470c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
xor esi, esi
cmp byte [r8 + 0x10], sil
je 0x1400c4747
mov edx, esi
mov eax, 0x6835
add eax, edx
xor word [r8 + rdx*2], ax
inc rdx
cmp rdx, 7
jb 0x1400c472e
mov byte [r8 + 0x10], sil
add r8, 0xe
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140045cc4
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x1400c4767
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.140031ebc
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rsp + 0x28]
call fcn.1400109fc
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400c47bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
xor esi, esi
cmp byte [r8 + 0x14], sil
je 0x1400c47f7
mov edx, esi
mov eax, 0x69c9
add eax, edx
xor word [r8 + rdx*2], ax
inc rdx
cmp rdx, 9
jb 0x1400c47de
mov byte [r8 + 0x14], sil
add r8, 0x12
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.140045cc4
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x1400c4817
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.140031ebc
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
lea rcx, [rsp + 0x28]
call fcn.1400109fc
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400e4608
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
mov rax, qword [0x140240028]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r13, rcx
xor r12d, r12d
lea r15, [rcx + 0x10]
mov rsi, qword [r15]
mov r14, qword [rsi + 8]
jmp 0x1400e4680
mov r8, qword [r14 + 0x10]
mov rdx, r15
mov rcx, r15
call fcn.1400e5b0c
mov rdi, r14
mov r14, qword [r14]
lea rcx, [rdi + 0x40]
call fcn.1400e59b4
lea rcx, [rdi + 0x20]
call fcn.1400109fc
mov edx, 0x50
mov rcx, rdi
call fcn.140140cd4
cmp byte [r14 + 0x19], r12b
je 0x1400e464c
mov qword [rsi + 8], rsi
mov qword [rsi], rsi
mov qword [rsi + 0x10], rsi
mov qword [r15 + 8], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x20], r12
xor edx, edx
xor ecx, ecx
push rbp
call 0x140439c05
mov ebx, eax
test eax, eax
jns 0x1400e474a
mov rdi, qword [0x140150460]
movdqa xmm0, xmmword [0x14021e260]
movdqu xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x14021e2e0]
movdqu xmmword [rsp + 0x78], xmm1
movdqa xmm0, xmmword [0x14021d9b0]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rbp - 0x68], 0x5a
mov esi, 1
mov byte [rbp - 0x66], sil
mov rdx, r12
lea eax, [rdx - 0xe]
xor byte [rsp + rdx + 0x68], al
add rdx, rsi
cmp rdx, 0x31
jb 0x1400e46f7
mov byte [rbp - 0x66], r12b
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.140011824
lea rdx, [0x140010b80]
mov rcx, rdi
call 0x140b657e4
int3
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
call 0x1409dd67e
int3
Function at 0x1400e51f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [rdx]
xor esi, esi
mov rdi, r8
mov dword [rbp - 0x50], 0x69a46980
mov rbx, rdx
mov dword [rbp - 0x4c], 0x69b869b8
mov dword [rbp - 0x48], 0x69a269ac
mov ecx, esi
mov r10, qword [rax + 0x20]
mov dword [rbp - 0x44], 0x69b569a3
mov dword [rbp - 0x40], 0x69b5
mov byte [rbp - 0x3c], 1
mov eax, 0x69c9
add eax, ecx
xor word [rbp + rcx*2 - 0x50], ax
inc rcx
cmp rcx, 9
jb 0x1400e524a
mov qword [rsp + 0x28], rsi
lea rdx, [rbp - 0x50]
mov r9, rdi
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov byte [rbp - 0x3c], sil
mov rcx, rbx
call r10
test eax, eax
jne 0x1400e53ea
mov rax, qword [rbx]
mov rcx, rsi
mov dword [rbp - 0x28], 0x6873685b
mov dword [rbp - 0x24], 0x685d6863
mov dword [rbp - 0x20], 0x687b6877
mov r10, qword [rax + 0x20]
mov dword [rbp - 0x1c], 0x68706879
mov dword [rbp - 0x18], 0x687a6878
mov word [rbp - 0x14], si
mov byte [rbp - 0x12], 1
mov eax, 0x6815
add eax, ecx
xor word [rbp + rcx*2 - 0x28], ax
inc rcx
cmp rcx, 0xa
jb 0x1400e52ba
mov qword [rsp + 0x28], rsi
lea rdx, [rbp - 0x28]
mov r9, rdi
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov byte [rbp - 0x12], sil
mov rcx, rbx
call r10
test eax, eax
jne 0x1400e53ea
mov rax, qword [rbx]
mov rcx, rsi
mov dword [rbp - 0x50], 0xeef6eecd
mov r14d, 0x1163
mov dword [rbp - 0x4c], 0xeed3eee6
mov dword [rbp - 0x48], 0xeec1eec8
mov r10, qword [rax + 0x20]
mov dword [rbp - 0x44], 0xeec8eec2
mov dword [rbp - 0x40], 0xeec2eee4
mov dword [rbp - 0x3c], 0xeed8eec6
mov dword [rbp - 0x38], 0xeecfeedd
mov dword [rbp - 0x34], 0xeed9
mov byte [rbp - 0x30], 1
movzx eax, cx
sub ax, r14w
xor word [rbp + rcx*2 - 0x50], ax
inc rcx
cmp rcx, 0xf
jb 0x1400e5341
mov qword [rsp + 0x28], rsi
lea rdx, [rbp - 0x50]
mov r9, rdi
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov byte [rbp - 0x30], sil
mov rcx, rbx
call r10
test eax, eax
jne 0x1400e53ea
mov rax, qword [rbx]
mov rcx, rsi
mov dword [rbp - 0x28], 0xeed0eecd
mov dword [rbp - 0x24], 0xeee4eecf
mov dword [rbp - 0x20], 0xeed4eec4
mov r10, qword [rax + 0x20]
mov dword [rbp - 0x1c], 0xeec7eeca
mov dword [rbp - 0x18], 0xeeefeec0
mov dword [rbp - 0x14], 0xeee3
mov byte [rbp - 0x10], 1
movzx eax, cx
sub ax, r14w
xor word [rbp + rcx*2 - 0x28], ax
inc rcx
cmp rcx, 0xb
jb 0x1400e53b0
mov qword [rsp + 0x28], rsi
lea rdx, [rbp - 0x28]
mov r9, rdi
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov byte [rbp - 0x10], sil
mov rcx, rbx
call r10
test eax, eax
sete al
jmp 0x1400e53ec
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret