joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e9478
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r8d, dword [rcx + 0x9b8]
add rdx, 2
mov r9d, dword [rcx + 0x9bc]
mov ebx, 4
mov r10d, dword [rcx + 0x9c0]
mov r11d, dword [rcx + 0x9c4]
movzx eax, byte [rdx - 2]
xor r8d, dword [rcx + rax*4 + 0x4b8]
mov dword [rcx + 0x9b8], r8d
movzx eax, byte [rdx - 1]
xor r9d, dword [rcx + rax*4 + 0x4b8]
mov dword [rcx + 0x9bc], r9d
movzx eax, byte [rdx]
lea rdx, [rdx + 4]
xor r10d, dword [rcx + rax*4 + 0x4b8]
mov dword [rcx + 0x9c0], r10d
movzx eax, byte [rdx - 3]
xor r11d, dword [rcx + rax*4 + 0x4b8]
mov dword [rcx + 0x9c4], r11d
sub rbx, 1
jne 0x1400e94a2
mov rbx, qword [rsp + 8]
ret
Function at 0x1400e9e38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
movups xmm0, xmmword [r8]
mov rdi, qword [rbp + 0x130]
lea rax, [rbp - 0x10]
mov rbx, qword [rbp + 0x138]
lea r8, [rbp + 0x50]
mov rsi, qword [rbp + 0x140]
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov r12, rdx
mov qword [rsp + 0x38], r14
mov r15, rcx
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea r9d, [r14 + 0x14]
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0x1000000
call fcn.1400e9a80
movups xmm0, xmmword [rbp - 0x10]
mov eax, dword [rbp + 0x148]
movups xmm1, xmmword [rbp]
mov byte [rsp + 0x51], r14b
dec eax
mov byte [rsp + 0x50], r14b
mov r14d, 3
mov qword [rsp + 0x70], rbx
lea rbx, [rsp + 0x58]
mov qword [rsp + 0x78], rsi
lea rsi, [rsp + 0x68]
movups xmmword [rbp + 0x10], xmm0
lea r13d, [r14 + 0x1d]
mov dword [rsp + 0x58], eax
movups xmmword [rbp + 0x20], xmm1
mov dword [rsp + 0x5c], 0x10
mov dword [rsp + 0x60], 0x10
mov qword [rsp + 0x68], rdi
cmp dword [rbx], 0
jbe 0x1400e9fa7
mov edi, dword [rbx]
lea rax, [rsp + 0x50]
mov r9, r13
mov qword [rsp + 0x40], rax
lea r8, [rbp - 0x10]
lea rax, [rbp + 0x50]
mov rdx, r12
mov qword [rsp + 0x38], rax
mov rcx, r15
lea rax, [rsp + 0x51]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400e9a80
movups xmm0, xmmword [rbp + 0x30]
xor eax, eax
movups xmm1, xmmword [rbp + 0x40]
movups xmmword [rbp - 0x10], xmm0
lea ecx, [rax + 2]
movups xmmword [rbp], xmm1
movdqu xmm0, xmmword [rbp + rax + 0x10]
movdqu xmm1, xmmword [rbp + rax - 0x10]
lea rax, [rax + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rbp + rax], xmm1
sub rcx, 1
jne 0x1400e9f7a
sub rdi, 1
jne 0x1400e9f24
movups xmm1, xmmword [rbp + 0x20]
movups xmm0, xmmword [rbp + 0x10]
mov rax, qword [rsi]
add rbx, 4
add rsi, 8
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
sub r14, 1
jne 0x1400e9f19
xor eax, eax
lea rdi, [rbp + 0x50]
lea ecx, [rax + 0x44]
rep stosb byte [rdi], al
lea rdi, [rbp + 0x10]
mov rcx, r13
rep stosb byte [rdi], al
lea rdi, [rbp - 0x10]
mov rcx, r13
rep stosb byte [rdi], al
lea rdi, [rbp + 0x30]
mov rcx, r13
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x228]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ea3dc
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x70
cmp dword [rcx], 2
lea rbx, [rcx + 4]
mov rsi, rdx
mov rdi, rcx
mov r14d, 0x20
jne 0x1400ea465
and qword [r11 - 0x38], 0
lea r9d, [r14 - 0x1c]
and qword [r11 - 0x40], 0
lea r8, [r11 + 8]
mov eax, dword [rbx]
mov edx, r14d
and qword [r11 - 0x48], 0
mov rcx, rsi
and qword [r11 - 0x50], 0
mov dword [r11 + 8], eax
lea rax, [r11 - 0x28]
mov qword [r11 - 0x58], rax
call fcn.1400e9a80
xor r8d, r8d
lea r9, [rsp + 0x50]
xor edx, edx
movzx eax, byte [r9]
mov ecx, r8d
and ecx, 3
inc r8d
shl ecx, 3
inc r9
shl eax, cl
xor eax, edx
mov edx, eax
cmp r8d, r14d
jb 0x1400ea445
mov dword [rbx], eax
cmp dword [rdi], 3
jne 0x1400ea4ae
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
and qword [rsp + 0x38], 0
mov r9, r14
and qword [rsp + 0x30], 0
mov r8, rbx
and qword [rsp + 0x28], 0
mov rdx, r14
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1400e9a80
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400ea570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, rcx
mov r10, r8
mov ecx, dword [rcx + 0x3ac]
mov rdi, rdx
sub ecx, 1
je 0x1400ea7e6
sub ecx, 1
je 0x1400ea750
sub ecx, 1
je 0x1400ea5d4
sub ecx, 1
je 0x1400ea5c0
cmp ecx, 1
jne 0x1400ea814
lea rcx, [rbx + 0x3b0]
mov r9, rdx
call fcn.1400ef264
jmp 0x1400ea814
test r8, r8
je 0x1400ea814
lea rsi, [r8 - 1]
shr rsi, 4
inc rsi
mov r11d, dword [rbx + 0x9b8]
mov r12d, 0x1f
mov r10d, dword [rdi + 4]
mov r9d, r11d
mov ebp, dword [rbx + 0x9c0]
mov r13d, r12d
movups xmm0, xmmword [rdi]
xor r9d, dword [rdi]
xor r10d, dword [rbx + 0x9bc]
xor ebp, dword [rdi + 8]
mov r14d, dword [rdi + 0xc]
xor r14d, dword [rbx + 0x9c4]
movdqu xmmword [rsp + 0x20], xmm0
mov rax, r13
mov edx, r14d
and eax, 3
ror edx, 0x15
add edx, ebp
dec r13
mov r8d, dword [rbx + rax*4 + 0x9b8]
xor edx, r8d
mov eax, edx
shr rax, 0x10
movzx eax, al
movzx r15d, byte [rax + rbx + 0x8b8]
mov eax, edx
shr rax, 0x18
movzx ecx, byte [rax + rbx + 0x8b8]
mov eax, edx
shr rax, 8
movzx eax, al
shl ecx, 8
or r15d, ecx
shl r15d, 8
movzx ecx, byte [rax + rbx + 0x8b8]
or r15d, ecx
movzx ecx, dl
shl r15d, 8
mov edx, ebp
ror edx, 0xf
xor edx, r14d
movzx eax, byte [rcx + rbx + 0x8b8]
add edx, r8d
or r15d, eax
mov eax, edx
shr rax, 0x10
xor r15d, r9d
movzx eax, al
mov r9d, ebp
mov ebp, r15d
movzx r8d, byte [rax + rbx + 0x8b8]
mov eax, edx
shr rax, 0x18
movzx ecx, byte [rax + rbx + 0x8b8]
mov eax, edx
shl ecx, 8
or r8d, ecx
shr rax, 8
shl r8d, 8
movzx eax, al
movzx ecx, byte [rax + rbx + 0x8b8]
or r8d, ecx
movzx ecx, dl
shl r8d, 8
movzx eax, byte [rcx + rbx + 0x8b8]
or r8d, eax
xor r8d, r10d
mov r10d, r14d
sub r12d, 1
mov r14d, r8d
jns 0x1400ea626
xor r11d, r15d
lea rdx, [rsp + 0x20]
mov dword [rdi], r11d
mov rcx, rbx
xor r8d, dword [rbx + 0x9bc]
mov dword [rdi + 4], r8d
xor r9d, dword [rbx + 0x9c0]
mov dword [rdi + 8], r9d
xor r10d, dword [rbx + 0x9c4]
mov dword [rdi + 0xc], r10d
call fcn.1400e9478
add rdi, 0x10
sub rsi, 1
jne 0x1400ea5e8
jmp 0x1400ea814
test r8, r8
je 0x1400ea814
mov ecx, 0x1234
add cx, word [rbx + 0x9cc]
mov word [rbx + 0x9cc], cx
movzx r8d, cx
mov eax, r8d
shr rax, 1
movzx ecx, al
movzx eax, word [rbx + rcx*4 + 0x4b8]
xor word [rbx + 0x9ce], ax
movzx eax, word [rbx + rcx*4 + 0x4ba]
sub word [rbx + 0x9d0], ax
movzx eax, word [rbx + 0x9d2]
movzx edx, word [rbx + 0x9d0]
ror ax, 1
xor dx, r8w
xor ax, word [rbx + 0x9ce]
movzx ecx, ax
shr ax, 1
shl cx, 0xf
or cx, ax
xor dx, cx
mov word [rbx + 0x9d2], cx
mov word [rbx + 0x9cc], dx
shr dx, 8
xor byte [rdi], dl
inc rdi
sub r10, 1
jne 0x1400ea759
jmp 0x1400ea814
test r8, r8
je 0x1400ea814
mov al, byte [rbx + 0x9ca]
add byte [rbx + 0x9c9], al
mov al, byte [rbx + 0x9c9]
add byte [rbx + 0x9c8], al
mov al, byte [rbx + 0x9c8]
sub byte [rdi], al
inc rdi
sub r10, 1
jne 0x1400ea7eb
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400ea834
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov rax, qword [rbp + 0x5f0]
mov rsi, r9
mov r15, qword [rbp + 0x5d0]
mov ebx, r8d
mov r12, qword [rbp + 0x5d8]
mov r14b, dl
mov r13, qword [rbp + 0x5e8]
mov rdi, rcx
mov qword [rsp + 0x50], rax
xor eax, eax
test r8d, r8d
je 0x1400eaa7d
cmp byte [r9 + 0x18], al
je 0x1400eaa7d
mov dword [rcx + 0x3ac], ebx
lea rdx, [rbp + 0x160]
mov rcx, r9
call fcn.1400d1784
xor eax, eax
lea rdx, [rsp + 0x60]
mov r8d, 0x200
mov word [rbp + 0x25e], ax
lea rcx, [rbp + 0x160]
call fcn.1400d1c0c
xor ecx, ecx
mov byte [rbp - 0x21], cl
sub ebx, 1
je 0x1400eaa0e
sub ebx, 1
je 0x1400ea973
sub ebx, 1
je 0x1400ea961
sub ebx, 1
je 0x1400ea942
cmp ebx, 1
jne 0x1400eaa5f
mov rax, qword [rsp + 0x50]
lea r9, [rbp + 0x160]
mov qword [rsp + 0x40], rax
mov r8, rsi
mov eax, dword [rbp + 0x5e0]
mov dl, r14b
mov qword [rsp + 0x38], r13
mov rcx, rdi
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
call fcn.1400ea014
jmp 0x1400eaa5f
lea r9, [rbp + 0x160]
mov qword [rsp + 0x20], r15
mov r8, rsi
mov dl, r14b
mov rcx, rdi
call fcn.1400e9500
jmp 0x1400eaa5f
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1400e90ec
jmp 0x1400eaa5f
lea rcx, [rdi + 0x4b8]
call fcn.1400eb8c8
or r8, 0xffffffffffffffff
lea rax, [rsp + 0x60]
xor ebx, ebx
inc r8
cmp byte [rax + r8], bl
jne 0x1400ea98a
lea rdx, [rsp + 0x60]
or ecx, 0xffffffff
call fcn.1400eb910
mov word [rdi + 0x9cc], ax
shr eax, 0x10
mov word [rdi + 0x9ce], ax
mov al, byte [rsp + 0x60]
mov dword [rdi + 0x9d0], ebx
test al, al
je 0x1400eaa5f
movzx r8d, bx
lea r9, [rsp + 0x60]
movzx r10d, bx
movzx ecx, al
inc r9
movzx edx, al
xor r8w, dx
xor r8w, word [rdi + rcx*4 + 0x4b8]
mov al, byte [r9]
mov word [rdi + 0x9d0], r8w
add dx, word [rdi + rcx*4 + 0x4ba]
add dx, r10w
mov word [rdi + 0x9d2], dx
movzx r10d, dx
test al, al
jne 0x1400ea9d0
jmp 0x1400eaa5f
mov al, byte [rsp + 0x60]
mov word [rdi + 0x9c9], cx
mov byte [rdi + 0x9c8], cl
test al, al
je 0x1400eaa5f
mov r8b, cl
lea r10, [rsp + 0x60]
mov r9b, cl
mov dl, cl
add dl, al
add r8b, al
xor r9b, al
inc r10
mov al, dl
shr dl, 7
add al, al
or dl, al
mov al, byte [r10]
test al, al
jne 0x1400eaa30
mov byte [rdi + 0x9ca], dl
mov byte [rdi + 0x9c9], r9b
mov byte [rdi + 0x9c8], r8b
xor eax, eax
lea rdi, [rsp + 0x60]
mov ecx, 0x200
rep stosb byte [rdi], al
lea rdi, [rbp + 0x160]
mov ecx, 0x400
rep stosb byte [rdi], al
mov al, 1
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.1400f44c0
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400eb8c8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x1400eb90f
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
test cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x1400eb8dd
mov dword [r8], r10d
inc r9d
add r8, 4
cmp r9d, 0x100
jb 0x1400eb8d4
ret

Function at 0x1400eb910
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [0x140175690]
mov r11, r8
mov rbx, rdx
mov r10d, ecx
test r8, r8
je 0x1400eb954
test bl, 7
je 0x1400eb954
movzx ecx, byte [rbx]
inc rbx
movzx eax, r10b
xor rcx, rax
shr r10d, 8
xor r10d, dword [rsi + rcx*4]
sub r11, 1
jne 0x1400eb934
cmp r11, 8
jb 0x1400eb9fa
mov rdi, r11
shr rdi, 3
imul rax, rdi, 0xfffffffffffffff8
add r11, rax
xor r10d, dword [rbx]
mov r9d, dword [rbx + 4]
add rbx, 8
mov eax, r9d
mov edx, r9d
shr eax, 0x10
movzx ecx, al
mov eax, r9d
shr eax, 8
shr rdx, 0x18
mov r8d, dword [rsi + rdx*4]
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr eax, 0x10
movzx ecx, al
mov eax, r10d
shr eax, 8
xor r8d, dword [rsi + rcx*4 + 0x1400]
movzx ecx, al
movzx eax, r9b
xor r8d, dword [rsi + rcx*4 + 0x1800]
xor r8d, dword [rsi + rax*4 + 0xc00]
movzx eax, r10b
mov r10d, r8d
xor r10d, dword [rsi + rax*4 + 0x1c00]
sub rdi, 1
jne 0x1400eb96c
test r11, r11
je 0x1400eba1a
movzx ecx, byte [rbx]
inc rbx
movzx eax, r10b
xor rcx, rax
shr r10d, 8
xor r10d, dword [rsi + rcx*4]
sub r11, 1
jne 0x1400eb9ff
mov rbx, qword [rsp + 8]
mov eax, r10d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400ec1e8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x140
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor edi, edi
mov qword [rsp + 0x20], rcx
mov edx, edi
lea r8, [rsp + 0x30]
mov r9, rcx
lea eax, [rdx*4]
inc edx
mov eax, dword [rax + rcx + 0x28]
bswap eax
mov dword [r8], eax
lea r8, [r8 + 4]
cmp edx, 0x10
jb 0x1400ec22a
lea r11, [rsp + 0x70]
mov ebx, 0x30
lea r10, [rsp + 0x68]
mov ecx, dword [r10 - 0x34]
mov r8d, ecx
mov edx, dword [r10]
mov eax, ecx
ror r8d, 0x12
lea r10, [r10 + 4]
shr ecx, 3
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
ror eax, 0x11
mov ecx, edx
shr edx, 0xa
ror ecx, 0x13
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r10 - 0x3c]
add r8d, dword [r10 - 0x18]
mov dword [r11], r8d
lea r11, [r11 + 4]
sub rbx, 1
jne 0x1400ec254
movups xmm0, xmmword [r9]
lea r12d, [rbx + 0x40]
movups xmm1, xmmword [r9 + 0x10]
movups xmmword [rsp], xmm0
mov ebx, dword [rsp + 8]
mov esi, dword [rsp + 4]
mov r11d, dword [rsp]
mov r9d, dword [rsp + 0xc]
movups xmmword [rsp + 0x10], xmm1
mov r13d, dword [rsp + 0x1c]
mov r14d, dword [rsp + 0x18]
mov r15d, dword [rsp + 0x14]
mov r10d, dword [rsp + 0x10]
mov eax, r10d
mov r8d, r10d
shr eax, 0xb
mov ecx, r10d
shl ecx, 0x1a
mov edx, r11d
shl r8d, 0x15
or r8d, eax
shl edx, 0x13
mov eax, r10d
shr eax, 6
or ecx, eax
mov eax, r10d
xor r8d, ecx
shl eax, 7
mov ecx, r10d
shr ecx, 0x19
or ecx, eax
mov eax, r15d
xor r8d, ecx
and eax, r10d
mov ecx, r10d
not ecx
and ecx, r14d
xor ecx, eax
lea rax, [0x14013e9a0]
add r8d, ecx
mov ecx, r11d
add r8d, dword [rdi + rax]
mov eax, r11d
add r8d, dword [rsp + rdi + 0x30]
lea rdi, [rdi + 4]
shr ecx, 0x16
add r8d, r13d
shr eax, 0xd
mov r13d, r14d
or edx, eax
mov r14d, r15d
mov eax, r11d
mov r15d, r10d
shl eax, 0xa
lea r10d, [r9 + r8]
or ecx, eax
mov r9d, ebx
xor edx, ecx
mov eax, r11d
shr eax, 2
mov ecx, r11d
shl ecx, 0x1e
or ecx, eax
mov eax, esi
xor edx, ecx
and eax, ebx
mov ecx, esi
xor ecx, ebx
mov ebx, esi
and ecx, r11d
mov esi, r11d
xor ecx, eax
add edx, ecx
lea r11d, [rdx + r8]
sub r12, 1
jne 0x1400ec2d8
mov dword [rsp + 0xc], r9d
lea rcx, [rsp]
mov r9, qword [rsp + 0x20]
lea edx, [r12 + 8]
sub rcx, r9
mov dword [rsp + 0x10], r10d
mov dword [rsp], r11d
mov dword [rsp + 8], ebx
mov dword [rsp + 4], esi
mov dword [rsp + 0x18], r14d
mov dword [rsp + 0x14], r15d
mov dword [rsp + 0x1c], r13d
mov eax, dword [r9 + rcx]
add dword [r9], eax
lea r9, [r9 + 4]
sub rdx, 1
jne 0x1400ec3ca
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400ec498
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r8d, dword [rcx + 0x20]
mov edi, 0x38
mov rsi, qword [rcx + 0x20]
and r8d, 0x3f
shl rsi, 3
mov r14, rdx
mov rbx, rcx
mov byte [r8 + rcx + 0x28], 0x80
inc r8d
cmp r8d, edi
je 0x1400ec519
jbe 0x1400ec502
lea edx, [rdi + 8]
cmp r8d, edx
jae 0x1400ec4f7
mov ecx, r8d
sub edx, r8d
add rcx, 0x28
mov r8d, edx
add rcx, rbx
xor edx, edx
call fcn.14012a960
mov rcx, rbx
call fcn.1400ec1e8
xor r8d, r8d
mov ecx, r8d
sub edi, r8d
add rcx, 0x28
mov r8d, edi
add rcx, rbx
xor edx, edx
call fcn.14012a960
mov rax, rsi
mov rcx, rbx
shr rax, 0x20
bswap eax
bswap esi
mov dword [rbx + 0x60], eax
mov dword [rbx + 0x64], esi
call fcn.1400ec1e8
mov eax, dword [rbx]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
bswap eax
mov dword [r14], eax
mov eax, dword [rbx + 4]
bswap eax
mov dword [r14 + 4], eax
mov eax, dword [rbx + 8]
bswap eax
mov dword [r14 + 8], eax
mov eax, dword [rbx + 0xc]
bswap eax
mov dword [r14 + 0xc], eax
mov eax, dword [rbx + 0x10]
bswap eax
mov dword [r14 + 0x10], eax
mov eax, dword [rbx + 0x14]
bswap eax
mov dword [r14 + 0x14], eax
mov eax, dword [rbx + 0x18]
bswap eax
mov dword [r14 + 0x18], eax
mov eax, dword [rbx + 0x1c]
bswap eax
mov dword [r14 + 0x1c], eax
and qword [rbx + 0x20], 0
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret

Function at 0x1400ecff0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x208], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jne 0x1400ed065
xor edi, edi
cmp dword [rcx], edi
jbe 0x1400ed065
lea rax, [rsp + 0x68]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x1400ecf3c]
and dword [rsp + 0x20], 0
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400ed0bc
mov edx, dword [0x140172468]
mov qword [rbx + rdi*8 + 8], rax
inc dword [rbx + 0x208]
test edx, edx
je 0x1400ed05f
mov rcx, qword [rbx + rdi*8 + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc edi
cmp edi, dword [rbx]
jb 0x1400ed014
cmp dword [rbx + 0x20c], 0x40
jb 0x1400ed076
mov rcx, rbx
call fcn.1400ed0f8
mov eax, dword [rbx + 0x610]
add rax, 0x21
add rax, rax
mov qword [rbx + rax*8], rbp
mov eax, dword [rbx + 0x610]
add rax, rax
mov qword [rbx + rax*8 + 0x218], rsi
mov eax, dword [rbx + 0x610]
inc eax
and eax, 0x3f
inc dword [rbx + 0x20c]
mov dword [rbx + 0x610], eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.CreateThread_failed
lea rcx, [0x14016f7e8]
call fcn.1400daa94
mov edx, 2
lea rcx, [0x14016f7e8]
call fcn.1400dab3c
mov dword [rsp + 0x50], edx
lea rcx, [rsp + 0x50]
lea rdx, [0x140162258]
call fcn.1400f7aec
int3
Function at 0x1400eef74
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edi, dword [rcx + 0x18]
mov ebp, 0x38
mov r14, qword [rcx + 0x18]
and edi, 0x3f
shl r14, 3
mov rsi, rdx
mov rbx, rcx
mov byte [rdi + rcx + 0x20], 0x80
inc edi
cmp edi, ebp
je 0x1400ef002
jbe 0x1400eefed
lea edx, [rbp + 8]
cmp edi, edx
jae 0x1400eefd7
sub edx, edi
mov ecx, edi
add rcx, 0x20
mov r8d, edx
add rcx, rbx
xor edx, edx
call fcn.14012a960
xor edi, edi
lea r8, [rbx + 0x20]
mov r9b, 1
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400ed808
sub ebp, edi
mov ecx, edi
add rcx, 0x20
mov r8d, ebp
add rcx, rbx
xor edx, edx
call fcn.14012a960
mov rax, r14
lea r8, [rbx + 0x20]
shr rax, 0x20
lea rdx, [rsp + 0x20]
bswap eax
bswap r14d
mov r9b, 1
mov dword [rbx + 0x58], eax
mov rcx, rbx
mov dword [rbx + 0x5c], r14d
call fcn.1400ed808
mov rdx, rbx
mov ecx, 5
sub rdx, rsi
mov eax, dword [rsi + rdx]
mov dword [rsi], eax
lea rsi, [rsi + 4]
sub rcx, 1
jne 0x1400ef034
and qword [rbx + 0x18], rcx
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400ef08c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14016a040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor eax, eax
xor ecx, ecx
mov sil, dl
cpuid
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], edx
cmp eax, 1
jl 0x1400ef0ed
xor ecx, ecx
mov eax, 1
cpuid
shr ecx, 0x19
and cl, 1
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x2c], edx
jmp 0x1400ef0ef
xor cl, cl
mov rax, rdi
mov byte [rax], cl
sub r9d, 0x80
je 0x1400ef124
sub r9d, 0x40
je 0x1400ef116
cmp r9d, 0x40
jne 0x1400ef147
lea eax, [r9 - 0x20]
mov dword [rdi + 4], 0xe
jmp 0x1400ef130
mov eax, SafeArrayCopy
mov dword [rdi + 4], 0xc
jmp 0x1400ef130
mov eax, 0x10
mov dword [rdi + 4], 0xa
xor ecx, ecx
mov edx, eax
mov al, byte [r8]
inc r8
mov byte [rsp + rcx + 0x20], al
inc rcx
sub rdx, 1
jne 0x1400ef134
mov rcx, qword [rsp + 0x90]
test rcx, rcx
jne 0x1400ef15d
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
jmp 0x1400ef177
mov rdx, rdi
mov ebx, 0x10
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx + 8], al
inc rcx
sub rbx, 1
jne 0x1400ef168
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400ef6e4
test sil, sil
jne 0x1400ef23d
mov r10d, 1
cmp dword [rdi + 4], r10d
jle 0x1400ef23d
lea rbx, [rsp + 0x20]
sub rbx, rdi
lea r9, [rdi + 0x28]
sub rbx, 0x2a
lea r13, [0x140000000]
xor r8d, r8d
lea r11, [r9 + 2]
mov ebp, 4
lea r14, [rbx + r8]
movzx eax, byte [r11 + 1]
lea rdx, [r8 + rax*4]
movzx eax, byte [r11 - 1]
mov dl, byte [rdx + r13 + 0x177a90]
lea rcx, [r8 + rax*4]
movzx eax, byte [r11 - 2]
xor dl, byte [rcx + r13 + 0x178690]
lea rcx, [r8 + rax*4]
movzx eax, byte [r11]
xor dl, byte [rcx + r13 + 0x177690]
lea rcx, [r8 + rax*4]
xor dl, byte [rcx + r13 + 0x179790]
mov byte [r11 + r14], dl
lea r11, [r11 + 4]
sub rbp, 1
jne 0x1400ef1c4
inc r8
cmp r8, 4
jl 0x1400ef1b7
movups xmm0, xmmword [rsp + 0x20]
inc r10d
sub rbx, 0x10
movdqu xmmword [r9], xmm0
add r9, 0x10
cmp r10d, dword [rdi + 4]
jl 0x1400ef1b4
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400f44c0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret