joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bfd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor r10d, r10d
movzx ecx, byte [rcx + 0xc0]
mov r11, r8
mov rdi, rdx
test ecx, ecx
je 0x1400bfd6b
cmp ecx, 1
je 0x1400bfdde
jmp 0x1400bff19
cmp byte [rbx + 0xc1], r10b
jne 0x1400bfdd7
cmp dword [0x140a04560], r10d
je 0x1400bfdc7
mov rax, qword [0x140a04558]
test rax, rax
je 0x1400bfda7
lea rdx, str.Encrypt_ciphers_not_setup
mov ecx, 1
call rax
mov eax, 0xfffffec6
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov ecx, 2
call fcn.14017cf98
mov rcx, rax
lea r8, str.Encrypt_ciphers_not_setup
lea rdx, [0x140998764]
call fcn.1400af550
mov eax, 0xfffffec6
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov byte [rbx + 0xc0], 1
movzx ecx, byte [rbx + 0x2cc]
sub ecx, 1
je 0x1400bfe81
sub ecx, 3
je 0x1400bfe69
cmp ecx, 2
je 0x1400bfe51
cmp dword [0x140a04560], r10d
je 0x1400bfe46
mov rax, qword [0x140a04558]
test rax, rax
je 0x1400bfe26
lea rdx, str.wolfSSL_Encrypt_programming_error
mov ecx, 1
call rax
mov r10d, 0xfffffec6
jmp 0x1400bff19
mov ecx, 2
call fcn.14017cf98
mov rcx, rax
lea r8, str.wolfSSL_Encrypt_programming_error
lea rdx, [0x140998764]
call fcn.1400af550
mov r10d, 0xfffffec6
jmp 0x1400bff19
mov rcx, qword [rbx + 0xb0]
movzx r9d, r9w
call fcn.1400f1340
mov r10d, eax
jmp 0x1400bff19
mov rcx, qword [rbx + 0xa8]
movzx r9d, r9w
call fcn.1400f6b60
mov r10d, eax
jmp 0x1400bff19
mov qword [rsp + 0x38], rsi
movzx esi, r9w
mov r9, qword [rbx + 0xa0]
test r9, r9
je 0x1400bff14
test rdi, rdi
je 0x1400bff14
test r8, r8
je 0x1400bff14
mov qword [rsp + 0x30], rbp
movzx ebp, byte [r9]
mov qword [rsp + 0x40], r14
movzx r14d, byte [r9 + 1]
test esi, esi
je 0x1400bff03
sub rdi, r8
nop
movzx r8d, byte [rbp + r9 + 2]
lea r11, [r11 + 1]
lea eax, [r8 + r14]
movzx r14d, al
lea eax, [rbp + 1]
movzx ecx, byte [r14 + r9 + 2]
mov byte [rbp + r9 + 2], cl
movzx ebp, al
mov byte [r14 + r9 + 2], r8b
lea eax, [r8 + rcx]
movzx ecx, al
movzx eax, byte [rcx + r9 + 2]
xor al, byte [r11 - 1]
mov byte [rdi + r11 - 1], al
add esi, 0xffffffff
jne 0x1400bfec0
mov byte [r9], bpl
mov rbp, qword [rsp + 0x30]
mov byte [r9 + 1], r14b
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov byte [rbx + 0xc0], 0
mov eax, r10d
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c0180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1409c0280]
xor rax, rsp
mov qword [rsp + 0x60], rax
movsxd r15, edx
xor edi, edi
mov qword [rsp + 0x30], rcx
mov r14d, r15d
movsxd r13, r8d
xor bpl, bpl
sub r14d, r13d
mov qword [rsp + 0x38], r9
movzx eax, byte [r15 + rcx - 1]
sub r14d, 0x100
mov ecx, r15d
mov r12, r9
sub ecx, eax
mov ebx, edi
dec ecx
mov eax, r14d
shr eax, 0x1f
dec eax
mov dword [rsp + 0x20], ecx
and r14d, eax
sub ecx, r13d
mov eax, ecx
shr eax, 0x1f
dec eax
and ecx, eax
lea eax, [r13 - 1]
mov edx, eax
mov dword [rsp + 0x24], ecx
and edx, r13d
mov dword [rsp + 0x28], edx
jne 0x1400c0219
mov ebx, r13d
sub ebx, r14d
add ebx, ecx
and ebx, eax
jmp 0x1400c0240
cmp r13d, 0x14
jne 0x1400c0240
mov ebx, ecx
mov eax, 0x66666667
sub ebx, r14d
add ebx, r13d
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ebx, eax
mov r8, r13
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14016ad60
movsxd r11, r14d
mov rcx, r15
cmp r11, r15
jge 0x1400c02ec
mov rax, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov ebp, dword [rsp + 0x20]
mov r9d, r14d
neg r9d
sub rax, rdx
mov qword [rsp + 0x30], rax
nop word [rax + rax]
mov r10, rdi
test r13d, r13d
jle 0x1400c02d6
mov r8d, r14d
lea r12, [rax + r11]
nop
cmp r8d, r15d
jge 0x1400c02ce
mov eax, r8d
lea rdx, [rsp + 0x40]
sub eax, dword [rsp + 0x24]
add rdx, r10
shr eax, 0x1f
mov ecx, ebp
sub ecx, r9d
dec al
sub ecx, r8d
inc r10
sub ecx, r14d
inc r8d
dec ecx
shr ecx, 0x1f
dec cl
and cl, al
and cl, byte [r12 + rdx]
or byte [rdx], cl
cmp r10, r13
jl 0x1400c0290
mov rax, qword [rsp + 0x30]
mov rcx, r15
add r14d, r13d
sub r9d, r13d
add r11, r13
cmp r11, rcx
jl 0x1400c0280
mov r12, qword [rsp + 0x38]
xor bpl, bpl
cmp dword [rsp + 0x28], edi
jne 0x1400c031e
test r13d, r13d
jle 0x1400c0364
lea rax, [r13 - 1]
nop dword [rax + rax]
movsxd rcx, ebx
inc ebx
and rcx, rax
movzx ecx, byte [rsp + rcx + 0x40]
xor cl, byte [rdi + r12]
inc rdi
or bpl, cl
cmp rdi, r13
jl 0x1400c0300
jmp 0x1400c0364
cmp r13d, 0x14
jne 0x1400c0364
test r13d, r13d
jle 0x1400c0364
nop dword [rax]
mov eax, 0x66666667
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
inc ebx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
movzx eax, byte [rsp + rcx + 0x40]
xor al, byte [rdi + r12]
inc rdi
or bpl, al
cmp rdi, r13
jl 0x1400c0330
movzx eax, bpl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140167e90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400c2730
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1409c0280]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov eax, 0x2000
mov rdi, rdx
mov rbx, rcx
test word [rcx + 0x394], ax
je 0x1400c281f
mov rcx, qword [rcx + 0x18]
add rcx, 0xf0
call fcn.1400f1ed0
test eax, eax
jne 0x1400c2953
mov rax, qword [rbx + 0x18]
lea rdx, [rdi + 0x10]
add rax, 0x88
je 0x1400c294e
test rdx, rdx
je 0x1400c294e
movups xmm0, xmmword [rax]
lea rcx, [rbp - 0x39]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp - 0x39], xmm0
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp - 0x29], xmm1
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp - 0x19], xmm0
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rbp - 9], xmm1
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rbp + 7], xmm0
movsd xmm0, qword [rax + 0x60]
movsd qword [rbp + 0x27], xmm0
movaps xmmword [rbp + 0x17], xmm1
call fcn.1400ec230
test eax, eax
jne 0x1400c2953
cmp byte [rbx + 0x2c0], 3
jne 0x1400c2953
cmp byte [rbx + 0x2c1], 3
jb 0x1400c2953
mov rcx, qword [rbx + 0x18]
lea rdx, [rdi + 0x24]
add rcx, 0x158
call fcn.1400ef530
jmp 0x1400c2953
call fcn.1400c2210
test eax, eax
jne 0x1400c2953
mov rax, qword [rbx + 0x18]
add rax, 0x88
je 0x1400c294e
movups xmm0, xmmword [rax]
mov rdx, qword [rbx + 0x10]
lea rcx, [rbp - 0x39]
add rdx, 0x7d
mov r8d, Ordinal_50
movaps xmmword [rbp - 0x39], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp - 0x29], xmm1
movups xmm0, xmmword [rax + 0x20]
movaps xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rax + 0x30]
movaps xmmword [rbp - 9], xmm1
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rax + 0x50]
movaps xmmword [rbp + 0x17], xmm1
movsd xmm0, qword [rax + 0x60]
movsd qword [rbp + 0x27], xmm0
call fcn.1400ebd30
test eax, eax
jne 0x1400c2953
lea r8d, [rax + 0x28]
lea rdx, str.666666666666666666666666666666666666666666666666__
lea rcx, [rbp - 0x39]
call fcn.1400ebd30
test eax, eax
jne 0x1400c2953
lea rdx, [rbp + 0x37]
lea rcx, [rbp - 0x39]
call fcn.1400ec230
test eax, eax
jne 0x1400c2953
mov rax, qword [rbx + 0x48]
lea rcx, [rbp - 0x39]
mov rdx, qword [rbx + 0x10]
mov qword [rbp + 0x27], rax
add rdx, 0x7d
xor eax, eax
mov dword [rbp + 0x13], 0x67452301
mov dword [rbp + 0x17], 0xefcdab89
mov dword [rbp + 0x1b], 0x98badcfe
mov dword [rbp + 0x1f], 0x10325476
lea r8d, [rax + 0x30]
mov dword [rbp + 0x23], 0xc3d2e1f0
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x31], eax
call fcn.1400ebd30
test eax, eax
jne 0x1400c2953
lea r8d, [rax + 0x28]
lea rdx, str.0
lea rcx, [rbp - 0x39]
call fcn.1400ebd30
test eax, eax
jne 0x1400c2953
lea r8d, [rax + 0x14]
lea rdx, [rbp + 0x37]
lea rcx, [rbp - 0x39]
call fcn.1400ebd30
test eax, eax
jne 0x1400c2953
lea rdx, [rdi + 0x10]
lea rcx, [rbp - 0x39]
call fcn.1400ec230
jmp 0x1400c2953
mov eax, 0xffffff53
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140167e90
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400df370
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, r8d
mov r9, rdx
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x1400df463
shr r8d, 3
xor eax, eax
test r8d, r8d
je 0x1400df571
cmp r8d, 8
jb 0x1400df440
lea ecx, [r8 - 1]
lea r11, [r10 + rcx*8]
lea rcx, [rdx + rcx*8]
cmp r10, rcx
ja 0x1400df3ba
cmp r11, rdx
jae 0x1400df440
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
nop word [rax + rax]
movdqu xmm0, xmmword [r10 + rax*8]
lea ecx, [rbx - 2]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rax*8], xmm1
add eax, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
mov ecx, ebx
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
lea ecx, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
cmp eax, r11d
jb 0x1400df3d0
cmp eax, r8d
jae 0x1400df571
sub r9, r10
lea rdx, [r10 + rax*8]
sub r8d, eax
mov ecx, r8d
nop dword [rax]
mov rax, qword [r9 + rdx]
xor qword [rdx], rax
lea rdx, [rdx + 8]
sub rcx, 1
jne 0x1400df450
pop rbx
ret
xor eax, eax
test r8d, r8d
je 0x1400df571
cmp r8d, 8
jb 0x1400df552
lea ecx, [r8 - 1]
lea r11, [rcx + r10]
add rcx, rdx
cmp r10, rcx
ja 0x1400df491
cmp r11, r9
jae 0x1400df552
cmp r8d, 0x40
jb 0x1400df525
mov qword [rsp + 0x10], rdi
mov ebx, r8d
and ebx, 0x3f
mov edi, r8d
sub edi, ebx
mov r11d, reloc.WLDAP32.dll_Ordinal_32
movdqu xmm0, xmmword [rax + r10]
lea ecx, [r11 - 0x10]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + r10], xmm1
add eax, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
mov ecx, r11d
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
lea ecx, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
cmp eax, edi
jb 0x1400df4b1
mov rdi, qword [rsp + 0x10]
cmp ebx, 8
jb 0x1400df54d
mov edx, r8d
and edx, 0xfffffff8
nop dword [rax + rax]
movq xmm0, qword [rax + r10]
movq xmm1, qword [rax + r9]
pxor xmm1, xmm0
movq qword [rax + r10], xmm1
add eax, 8
cmp eax, edx
jb 0x1400df530
cmp eax, r8d
jae 0x1400df571
mov edx, eax
sub r9, r10
add rdx, r10
sub r8d, eax
mov ecx, r8d
movzx eax, byte [rdx + r9]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x1400df560
pop rbx
ret
Function at 0x1400df920
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
mov edi, 0xffffff18
test rcx, rcx
je 0x1400dfa85
test r8, r8
je 0x1400dfa85
cmp edx, 0xf
ja case.0x1400df969.0
movsxd rax, edx
lea rcx, [0x140000000]
mov edx, dword [rcx + rax*4 + 0xdfa9c]
add rdx, rcx
jmp rdx
mov eax, dword [rbx]
xor edi, edi
mov qword [rsp + 0x30], rbp
lea rbp, [rbx + 0xc]
mov byte [rax + rbp], 0x80
mov ecx, dword [rbx]
inc ecx
mov dword [rbx], ecx
cmp ecx, 0x38
jbe 0x1400df9af
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rbp
call fcn.14016ad60
mov rdx, rbp
mov dword [rbx], 0x40
mov rcx, rbx
call fcn.1400f1570
mov ecx, edi
mov dword [rbx], edi
mov r8d, gethostname
xor edx, edx
sub r8d, ecx
add rcx, rbp
call fcn.14016ad60
mov r8d, dword [rbx + 4]
mov rdx, rbp
mov eax, dword [rbx + 8]
mov ecx, r8d
shr ecx, 0x1d
lea ecx, [rcx + rax*8]
mov dword [rbx + 8], ecx
lea eax, [r8*8]
mov dword [rbx + 4], eax
mov rcx, rbx
mov dword [rbp + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rbp + 0x3c], eax
call fcn.1400f1570
movups xmm0, xmmword [rbx + 0x4c]
mov rbp, qword [rsp + 0x30]
mov eax, edi
movups xmmword [rsi], xmm0
mov dword [rbx + 0x4c], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov qword [rbx], rdi
mov dword [rbx + 8], edi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdx, rsi
mov rcx, rbx
call fcn.1400ec230
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rdx, rsi
mov rcx, rbx
call fcn.1400ef3c0
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov edi, 0xffffff53
mov eax, edi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov eax, 0xffffff53
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400dfae0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1409c0280]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor esi, esi
mov dword [rbp + 0x13], 0x67452301
mov rdi, r8
mov qword [rbp + 0x27], rsi
mov r8d, edx
mov dword [rbp + 0x17], 0xefcdab89
mov rdx, rcx
mov dword [rbp + 0x1b], 0x98badcfe
lea rcx, [rbp - 0x39]
mov dword [rbp + 0x1f], 0x10325476
mov qword [rbp - 0x39], rsi
mov dword [rbp - 0x31], esi
call fcn.1400f1d60
mov ebx, eax
test eax, eax
je 0x1400dfb95
cmp dword [0x140a04560], esi
je 0x1400dfc85
mov rax, qword [0x140a04558]
test rax, rax
je 0x1400dfb6e
lea rdx, str.Md5Update_failed
lea ecx, [rsi + 1]
call rax
mov eax, ebx
jmp 0x1400dfc85
mov ecx, 2
call fcn.14017cf98
mov rcx, rax
lea r8, str.Md5Update_failed
lea rdx, [0x140998764]
call fcn.1400af550
mov eax, ebx
jmp 0x1400dfc85
test rdi, rdi
je 0x1400dfc3b
mov eax, dword [rbp - 0x39]
mov byte [rbp + rax - 0x2d], 0x80
mov ecx, dword [rbp - 0x39]
inc ecx
mov dword [rbp - 0x39], ecx
cmp ecx, 0x38
jbe 0x1400dfbe5
mov eax, ecx
mov r8d, 0x40
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.14016ad60
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x39], 0x40
lea rcx, [rbp - 0x39]
call fcn.1400f1570
mov ecx, esi
mov dword [rbp - 0x39], esi
mov eax, ecx
mov r8d, gethostname
sub r8d, ecx
xor edx, edx
lea rcx, [rbp - 0x2d]
add rcx, rax
call fcn.14016ad60
mov r9d, dword [rbp - 0x35]
mov edx, r9d
mov ecx, dword [rbp - 0x31]
shr edx, 0x1d
shl r9d, 3
mov dword [rbp - 0x35], r9d
mov dword [rbp + 0xb], r9d
lea r8d, [rdx + rcx*8]
lea rdx, [rbp - 0x2d]
mov dword [rbp - 0x31], r8d
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], r8d
call fcn.1400f1570
movups xmm0, xmmword [rbp + 0x13]
mov eax, esi
movups xmmword [rdi], xmm0
jmp 0x1400dfc85
cmp dword [0x140a04560], esi
je 0x1400dfc80
mov r8, qword [0x140a04558]
test r8, r8
je 0x1400dfc60
lea rdx, str.Md5Final_failed
mov ecx, 1
call r8
jmp 0x1400dfc80
mov ecx, 2
call fcn.14017cf98
mov rcx, rax
lea r8, str.Md5Final_failed
lea rdx, [0x140998764]
call fcn.1400af550
mov eax, 0xffffff53
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140167e90
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400dfcb0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1409c0280]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x6c], 0x67452301
mov rdi, r8
mov qword [rsp + 0x80], rax
mov r8d, edx
mov dword [rsp + 0x70], 0xefcdab89
mov rdx, rcx
mov dword [rsp + 0x74], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x78], 0x10325476
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.1400ebd30
mov ebx, eax
test eax, eax
je 0x1400dfd5f
cmp dword [0x140a04560], 0
je 0x1400dfdb9
mov rax, qword [0x140a04558]
test rax, rax
je 0x1400dfd4c
lea rdx, str.ShaUpdate_failed
mov ecx, 1
call rax
jmp 0x1400dfdb7
mov ecx, 2
call fcn.14017cf98
lea r8, str.ShaUpdate_failed
jmp 0x1400dfda8
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400ec230
mov ebx, eax
test eax, eax
je 0x1400dfdb9
cmp dword [0x140a04560], 0
je 0x1400dfdb9
mov rax, qword [0x140a04558]
test rax, rax
je 0x1400dfd97
lea rdx, str.ShaFinal_failed
mov ecx, 1
call rax
jmp 0x1400dfdb7
mov ecx, 2
call fcn.14017cf98
lea r8, str.ShaFinal_failed
lea rdx, [0x140998764]
mov rcx, rax
call fcn.1400af550
mov eax, ebx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140167e90
mov rbx, qword [rsp + 0xc8]
add rsp, 0xa0
pop rdi
ret

Function at 0x1400dfde0
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x1409c0280]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov rdi, r8
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x38], rax
mov dword [r11 - 0x30], eax
test rcx, rcx
jne 0x1400dfe62
test edx, edx
je 0x1400dfeb4
mov ebx, 0xffffff53
jmp 0x1400dfe78
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400ee950
mov ebx, eax
test eax, eax
je 0x1400dfeb4
cmp dword [0x140a04560], 0
je 0x1400dff0c
mov rax, qword [0x140a04558]
test rax, rax
je 0x1400dfea1
lea rdx, str.Sha256Update_failed
mov ecx, 1
call rax
jmp 0x1400dff0c
mov ecx, 2
call fcn.14017cf98
lea r8, str.Sha256Update_failed
jmp 0x1400dfefd
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400ef3c0
mov ebx, eax
test eax, eax
je 0x1400dff0e
cmp dword [0x140a04560], 0
je 0x1400dff0e
mov rax, qword [0x140a04558]
test rax, rax
je 0x1400dfeec
lea rdx, str.Sha256Final_failed
mov ecx, 1
call rax
jmp 0x1400dff0c
mov ecx, 2
call fcn.14017cf98
lea r8, str.Sha256Final_failed
lea rdx, [0x140998764]
mov rcx, rax
call fcn.1400af550
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140167e90
mov rbx, qword [rsp + 0xd8]
add rsp, 0xb0
pop rdi
ret
Function at 0x1400ef3c0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400ef51e
test rdx, rdx
je 0x1400ef51e
call fcn.1400eee50
test eax, eax
jne 0x1400ef523
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0x18], ecx
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x1c], ecx
xor eax, eax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f1340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, r9d
mov rdi, r8
shr esi, 4
mov rbp, rdx
mov r14, rcx
test rcx, rcx
je 0x1400f1421
test rdx, rdx
je 0x1400f1421
test r8, r8
je 0x1400f1421
test esi, esi
je 0x1400f141d
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0xf8]
movzx eax, bl
dec esi
or al, dil
test al, 7
jne 0x1400f13af
mov rax, qword [rdi]
xor qword [rbx], rax
mov rax, qword [rdi + 8]
xor qword [rbx + 8], rax
jmp 0x1400f13f3
lea rax, [rdi + 0xf]
lea rcx, [rbx + 0xf]
cmp rbx, rax
ja 0x1400f13e3
cmp rcx, rdi
jb 0x1400f13e3
mov r8, rdi
mov rax, rbx
sub r8, rbx
mov edx, reloc.WS2_32.dll_recv
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400f13d0
jmp 0x1400f13f3
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov r8, rbx
mov rdx, rbx
mov rcx, r14
call fcn.1400ef5f0
movups xmm0, xmmword [rbx]
add rdi, 0x10
movups xmmword [rbp], xmm0
add rbp, 0x10
test esi, esi
jne 0x1400f1393
mov rbx, qword [rsp + 0x30]
xor eax, eax
jmp 0x1400f1426
mov eax, 0xffffff53
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1400f1440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov esi, r9d
mov rbp, r8
mov rbx, rdx
mov r15, rcx
test rcx, rcx
je 0x1400f1558
test rdx, rdx
je 0x1400f1558
test r8, r8
je 0x1400f1558
test sil, 0xf
jne 0x1400f1558
shr esi, 4
test esi, esi
je 0x1400f1548
mov qword [rsp + 0x40], rdi
lea rdi, [rcx + 0xf8]
mov qword [rsp + 0x48], r14
nop word [rax + rax]
movups xmm0, xmmword [rbp]
mov r8, rbx
lea rdx, [r15 + 0x108]
mov rcx, r15
dec esi
movups xmmword [r15 + 0x108], xmm0
call fcn.1400efc30
movzx eax, dil
or al, bl
test al, 7
jne 0x1400f14da
mov rax, qword [rdi]
xor qword [rbx], rax
mov rax, qword [rdi + 8]
xor qword [rbx + 8], rax
jmp 0x1400f1523
lea rax, [rdi + 0xf]
cmp rbx, rax
ja 0x1400f1513
lea rax, [rbx + 0xf]
cmp rax, rdi
jb 0x1400f1513
mov r8, rdi
mov rax, rbx
sub r8, rbx
mov edx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400f1500
jmp 0x1400f1523
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
movups xmm0, xmmword [r15 + 0x108]
add rbx, 0x10
add rbp, 0x10
movups xmmword [rdi], xmm0
test esi, esi
jne 0x1400f14a0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0xffffff53
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret