joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b53d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov rbp, rcx
movzx r10d, byte [rax]
mov ebx, dword [r14]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rsp + 0x28], rax
movzx eax, byte [rdi]
shl eax, 8
mov r12, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r15, r9
lea r9, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov esi, r8d
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rsp + 0x20], r10d
mov byte [rsp + 0x30], r10b
or edx, eax
movzx eax, byte [r9]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rsp + 0x31], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rsp + 0x24], edx
mov byte [rsp + 0x34], dl
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
mov byte [rsp + 0x37], al
test r8d, r8d
je 0x1400b5596
movzx r8d, dl
movzx r9d, r10b
dec esi
test ebx, ebx
jne 0x1400b5533
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.1400b4870
mov r10d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov r9b, byte [rsp + 0x20]
mov r8b, byte [rsp + 0x24]
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x30], r9b
mov byte [rsp + 0x34], r8b
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rsp + 0x37], al
movsxd rax, ebx
inc r12
inc rbp
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rbp - 1]
inc ebx
mov byte [r12 - 1], cl
and ebx, 7
test esi, esi
jne 0x1400b54c7
test r13d, r13d
je 0x1400b5596
mov rax, qword [rsp + 0x28]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r14], ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140103060
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b55c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov eax, r9d
mov r9d, 0x80
mov r11, r8
cmp edx, r9d
mov r10, rcx
mov byte [rcx], 0
cmovg edx, r9d
mov ebx, 0x400
test eax, eax
jle 0x1400b55ee
cmp eax, ebx
cmovg eax, ebx
mov ebx, eax
movsxd rdx, edx
test rdx, rdx
jle 0x1400b5611
sub r11, r10
mov r8, rdx
nop dword [rax]
movzx eax, byte [r11 + rcx]
inc rcx
sub r8, 1
mov byte [rcx - 1], al
jne 0x1400b5600
cmp rdx, r9
movzx ecx, byte [rdx + r10 - 1]
lea r11, [0x1401425e0]
jge 0x1400b564c
mov r8, r10
sub r8, rdx
nop dword [rax]
movzx eax, byte [r8 + rdx]
inc rdx
add eax, ecx
cmp rdx, r9
movzx ecx, al
movzx ecx, byte [rcx + r11]
mov byte [rdx + r10 - 1], cl
jl 0x1400b5630
lea edx, [rbx + 7]
neg ebx
mov eax, 0xff
sar edx, 3
and ebx, 7
sub r9d, edx
movzx ecx, bl
sar eax, cl
movsxd r8, r9d
movsxd r9, edx
mov ecx, eax
movzx eax, byte [r8 + r10]
and rcx, rax
movzx eax, byte [rcx + r11]
mov byte [r8 + r10], al
test r8, r8
je 0x1400b56a9
lea rdx, [r8 + r10]
nop word [rax + rax]
movzx ecx, byte [rdx + r9 - 1]
dec rdx
xor rcx, rax
sub r8, 1
movzx eax, byte [rcx + r11]
mov byte [rdx], al
jne 0x1400b5690
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop word [rax + rax]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
sub r8, 4
shl ecx, 8
sub rdx, 2
or ecx, eax
sub r9, 1
movzx eax, cx
mov dword [r8 + 4], eax
jne 0x1400b56c0
mov rbx, qword [rsp + 8]
ret
Function at 0x1400b56f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, reloc.WS2_32.dll_recv
call fcn.140103e70
sub rsp, rax
movzx eax, byte [rcx + 1]
movzx r8d, byte [rcx]
mov r9, rcx
shl r8d, 8
lea rbx, [0x140142bf0]
xor edi, edi
or r8d, eax
movzx eax, byte [rcx + 2]
mov r11, rdx
shl r8d, 8
lea rsi, [0x1401426e0]
or r8d, eax
movzx eax, byte [rcx + 3]
movzx ecx, byte [rcx + 4]
shl ecx, 8
shl r8d, 8
or r8d, eax
movzx eax, byte [r9 + 5]
or ecx, eax
movzx eax, byte [r9 + 6]
xor r8d, 0xa3b1bac6
shl ecx, 8
mov dword [rsp], r8d
or ecx, eax
movzx eax, byte [r9 + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 9]
xor ecx, 0x56aa3350
mov dword [rsp + 4], ecx
movzx ecx, byte [r9 + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 0xd]
xor ecx, 0x677d9197
mov dword [rsp + 8], ecx
movzx ecx, byte [r9 + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 0xf]
shl ecx, 8
or ecx, eax
xor ecx, 0xb27022dc
sub rbx, rdx
mov dword [rsp + 0xc], ecx
nop word [rax + rax]
lea eax, [rdi + 1]
add r11, 4
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
movsxd r8, eax
lea eax, [rdi + 3]
mov r10d, dword [rsp + r8*4]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
movsxd rcx, eax
lea eax, [rdi + 2]
xor r10d, dword [rsp + rcx*4]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
movsxd rcx, eax
xor r10d, dword [rsp + rcx*4]
xor r10d, dword [rbx + r11 - 4]
mov eax, r10d
shr eax, 0x18
movzx ecx, al
mov eax, r10d
movzx r8d, byte [rcx + rsi]
shr eax, 0x10
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rsi]
or r8d, eax
mov eax, r10d
shr eax, 8
shl r8d, 8
movzx ecx, al
movzx eax, byte [rcx + rsi]
or r8d, eax
movzx eax, r10b
movzx ecx, byte [rax + rsi]
shl r8d, 8
mov eax, edi
cdq
or r8d, ecx
inc edi
and edx, 3
mov ecx, r8d
add eax, edx
and eax, 3
sub eax, edx
rol ecx, 0xd
movsxd rdx, eax
mov eax, r8d
ror eax, 9
xor ecx, eax
xor ecx, r8d
xor dword [rsp + rdx*4], ecx
mov eax, dword [rsp + rdx*4]
mov dword [r11 - 4], eax
cmp edi, 0x20
jne 0x1400b57e0
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
lea eax, [rdi - 0x1f]
add rsp, 0x10
pop rdi
ret
Function at 0x1400b9e70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xd8]
mov rbp, rcx
mov rcx, qword [rsp + 0xc8]
mov ebx, dword [r14]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov r15, r9
mov esi, r8d
movzx r9d, byte [rax]
movzx r8d, byte [rax + 4]
lea rdi, [rax + 1]
mov qword [rsp + 0x48], rax
movzx eax, byte [rdi]
mov qword [rsp + 0x28], rcx
movzx ecx, byte [rdi + 6]
shl eax, 8
xor r13d, r13d
or r9d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12, rdx
mov qword [rsp + 0x40], r14
or r9d, eax
movzx eax, byte [rdi + 2]
mov qword [rsp + 0x30], rdi
shl eax, 0x18
or r9d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rsp + 0x20], r9d
mov byte [rsp + 0x50], r9b
or r8d, eax
movzx eax, byte [rdi + 5]
or ecx, eax
mov eax, r9d
shr eax, 8
shl ecx, 0x10
mov byte [rsp + 0x51], al
or r8d, ecx
mov eax, r9d
shr eax, 0x10
mov dword [rsp + 0x24], r8d
mov byte [rsp + 0x54], r8b
mov byte [rsp + 0x52], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x53], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x55], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x56], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x57], al
test esi, esi
je 0x1400ba073
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x28]
dec esi
test ebx, ebx
jne 0x1400ba002
lea rcx, [rsp + 0x20]
mov r9, rdi
mov r8, r14
mov rdx, r15
call fcn.1400bc540
mov r9d, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
movzx eax, r9b
mov byte [rsp + 0x50], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x51], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x52], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x53], al
movzx eax, r8b
mov byte [rsp + 0x54], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x55], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x56], al
mov eax, r8d
shr eax, 0x18
inc r13d
mov byte [rsp + 0x57], al
movsxd rax, ebx
inc r12
inc rbp
movzx ecx, byte [rsp + rax + 0x50]
xor cl, byte [rbp - 1]
inc ebx
mov byte [r12 - 1], cl
and ebx, 7
test esi, esi
jne 0x1400b9f90
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
test r13d, r13d
je 0x1400ba073
mov rax, qword [rsp + 0x48]
mov byte [rax], r9b
mov eax, r9d
shr eax, 8
mov byte [rdi], al
mov eax, r9d
shr r9d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r9b
mov byte [rdi + 3], r8b
mov eax, r8d
shr eax, 8
mov byte [rdi + 4], al
mov eax, r8d
shr eax, 0x10
shr r8d, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], r8b
mov dword [r14], ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140103060
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400be340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov rbp, rcx
movzx r10d, byte [rax]
mov ebx, dword [r14]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rsp + 0x28], rax
movzx eax, byte [rdi]
shl eax, 8
mov r12, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r15, r9
lea r9, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov esi, r8d
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rsp + 0x20], r10d
mov byte [rsp + 0x30], r10b
or edx, eax
movzx eax, byte [r9]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rsp + 0x31], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rsp + 0x24], edx
mov byte [rsp + 0x34], dl
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
mov byte [rsp + 0x37], al
test r8d, r8d
je 0x1400be50a
movzx r8d, dl
movzx r9d, r10b
dec esi
test ebx, ebx
jne 0x1400be4a7
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.1400ba0a0
mov r10d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov r9b, byte [rsp + 0x20]
mov r8b, byte [rsp + 0x24]
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x30], r9b
mov byte [rsp + 0x34], r8b
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rsp + 0x37], al
movsxd rax, ebx
inc r12
inc rbp
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rbp - 1]
inc ebx
mov byte [r12 - 1], cl
and ebx, 7
test esi, esi
jne 0x1400be437
test r13d, r13d
je 0x1400be50a
mov rax, qword [rsp + 0x28]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r14], ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140103060
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400bf950
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
mov eax, 0xf0
call fcn.140103e70
sub rsp, rax
mov r13, r9
mov rbp, r9
mov rsi, r8
shr r13, 3
mov r12, rdx
mov rdi, rcx
cmp r8, r9
jb 0x1400bfa5f
mov qword [rsp + 0x110], rbx
xor r8d, r8d
test r13, r13
je 0x1400bfa12
nop dword [rax + rax]
movzx eax, byte [r12 + 6]
movzx ecx, byte [r12 + 7]
inc r8
shl rcx, 8
add r12, 8
or rcx, rax
movzx eax, byte [r12 - 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 - 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 - 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 - 6]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 - 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 - 8]
shl rcx, 8
or rcx, rax
xor qword [rdi + r8*8 - 8], rcx
cmp r8, r13
jb 0x1400bf9a0
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, rdi
call fcn.1400bf5a0
lea r8, [rbx + 1]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400bf5a0
add rbx, 2
cmp rbx, 0x18
jb 0x1400bfa20
sub rsi, rbp
cmp rsi, rbp
jae 0x1400bf990
mov rbx, qword [rsp + 0x110]
lea r11, [rsp + 0xf0]
mov rax, rsi
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400c77a0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.140103e70
sub rsp, rax
lea r8d, [rax + 0x40]
xor edx, edx
mov rbx, rcx
call sub.MSVCR90.dll_memset
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400c91a0
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, 0x20
call fcn.140103e70
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call sub.MSVCR90.dll_memset
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400df980
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x2f0
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rbx, qword [rsp + 0x340]
mov r12, rcx
lea rcx, [rsp + 0x110]
mov rdi, r9
mov rbp, r8
mov rsi, rdx
call fcn.140093630
lea rcx, [rsp + 0x110]
mov r8d, 0x20
mov rdx, rbx
call fcn.140095a60
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x1f0]
call fcn.140095220
movzx eax, byte [rsp + 0x20f]
and byte [rsp + 0x1f0], 0xf8
and al, 0x3f
lea rcx, [rsp + 0x110]
or al, 0x40
mov byte [rsp + 0x20f], al
call fcn.140093630
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0x110]
mov r8d, 0x20
call fcn.140095a60
lea rcx, [rsp + 0x110]
mov r8, rbp
mov rdx, rsi
call fcn.140095a60
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x260]
call fcn.140095220
lea rcx, [rsp + 0x260]
call fcn.1400dca70
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x70]
call fcn.1400daff0
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x230]
call fcn.1400d8c20
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400d7d10
lea r8, [rsp + 0x230]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x20]
call fcn.1400d7d10
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.1400d7a70
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x230]
call fcn.1400d7a70
movzx eax, byte [rsp + 0x230]
lea rcx, [rsp + 0x110]
shl al, 7
xor byte [r12 + 0x1f], al
call fcn.140093630
lea rcx, [rsp + 0x110]
mov r8d, 0x20
mov rdx, r12
call fcn.140095a60
lea rcx, [rsp + 0x110]
mov r8d, 0x20
mov rdx, rdi
call fcn.140095a60
lea rcx, [rsp + 0x110]
mov r8, rbp
mov rdx, rsi
call fcn.140095a60
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x2a0]
call fcn.140095220
lea rcx, [rsp + 0x2a0]
call fcn.1400dca70
lea rcx, [r12 + 0x20]
lea r9, [rsp + 0x260]
lea r8, [rsp + 0x1f0]
lea rdx, [rsp + 0x2a0]
call fcn.1400ddab0
lea rcx, [rsp + 0x110]
mov edx, 0xd8
call fcn.140055e30
lea rcx, [rsp + 0x260]
mov edx, 0x40
call fcn.140055e30
lea rcx, [rsp + 0x1f0]
mov edx, 0x40
call fcn.140055e30
mov eax, 1
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140103060
add rsp, 0x2f0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400dfee0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
mov eax, 0x190
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rax, rdx
mov rbx, rcx
lea r8, [rsp + 0x140]
mov rcx, rax
mov edx, 0x20
call fcn.140095b90
movzx eax, byte [rsp + 0x15f]
and byte [rsp + 0x140], 0xf8
and al, 0x3f
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x70]
or al, 0x40
mov byte [rsp + 0x15f], al
call fcn.1400daff0
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x110]
call fcn.1400d8c20
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.1400d7d10
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x48]
call fcn.1400d7d10
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400d7a70
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x110]
call fcn.1400d7a70
movzx eax, byte [rsp + 0x110]
lea rcx, [rsp + 0x140]
shl al, 7
mov edx, 0x40
xor byte [rbx + 0x1f], al
call fcn.140055e30
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140103060
add rsp, 0x190
pop rbx
ret
Function at 0x1400e0030
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x170
call fcn.140103e70
sub rsp, rax
mov rax, qword [0x140172b58]
xor rax, rsp
mov qword [rsp + 0x168], rax
mov rax, qword [rdx]
mov qword [rsp + 0x70], rcx
lea rcx, [rsp + 0x148]
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
mov rax, qword [rdx + 0x18]
lea rdx, [rsp + 0x148]
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x160]
and byte [rsp + 0x148], 0xf8
shr rax, 0x38
lea rcx, [rsp + 0x80]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x167], al
call fcn.1400daff0
mov ecx, dword [rsp + 0xd0]
mov r14d, dword [rsp + 0xb0]
mov r12d, dword [rsp + 0xb4]
mov eax, dword [rsp + 0xa8]
mov r15d, dword [rsp + 0xe0]
mov esi, dword [rsp + 0xb8]
mov r13d, dword [rsp + 0xe4]
mov ebx, dword [rsp + 0xbc]
mov ebp, dword [rsp + 0xe8]
mov r10d, dword [rsp + 0xc0]
mov edi, dword [rsp + 0xec]
mov r11d, dword [rsp + 0xf0]
mov r8d, dword [rsp + 0xc8]
mov r9d, dword [rsp + 0xf4]
mov edx, dword [rsp + 0xcc]
add eax, ecx
mov ecx, dword [rsp + 0xd4]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xac]
add eax, ecx
mov ecx, dword [rsp + 0xc4]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0xd8]
add eax, r14d
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xdc]
add eax, r12d
mov dword [rsp + 0x2c], eax
lea eax, [r15 + rsi]
sub r15d, esi
mov dword [rsp + 0x30], eax
lea eax, [r13 + rbx]
sub r13d, ebx
mov dword [rsp + 0x34], eax
lea eax, [rbp + r10]
sub ebp, r10d
mov dword [rsp + 0x38], eax
lea eax, [rdi + rcx]
sub edi, ecx
mov dword [rsp + 0x3c], eax
lea eax, [r11 + r8]
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x40], eax
lea eax, [r9 + rdx]
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0xd0]
mov dword [rsp + 0x60], ebp
sub eax, dword [rsp + 0xa8]
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0xd4]
sub eax, dword [rsp + 0xac]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0xd8]
sub eax, r14d
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0xdc]
sub eax, r12d
sub r11d, r8d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x54], eax
sub r9d, edx
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x6c], r9d
call fcn.1400d8c20
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.1400d7d10
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x20]
call fcn.1400d7a70
lea rcx, [rsp + 0x148]
mov edx, 0x20
call fcn.140055e30
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140103060
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e4010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.140103e70
sub rsp, rax
add qword [rcx], r8
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx + 0x10]
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
mov r12, rcx
mov ecx, dword [rcx + 0x28]
mov r14, r8
mov r13, rdx
test ecx, ecx
je 0x1400e4139
mov r15d, 8
sub r15d, ecx
lea rcx, [rcx + r12 + 0x38]
cmp r8, r15
jae 0x1400e407e
call sub.MSVCR90.dll_memcpy
add dword [r12 + 0x28], r14d
jmp 0x1400e423e
mov r8, r15
call sub.MSVCR90.dll_memcpy
movzx eax, byte [r12 + 0x3e]
movzx ecx, byte [r12 + 0x3f]
shl rcx, 8
sub r14, r15
add r13, r15
or rcx, rax
movzx eax, byte [r12 + 0x3d]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3c]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3b]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3a]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x39]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x38]
shl rcx, 8
or rcx, rax
xor rbx, rcx
cmp dword [r12 + 0x30], 0
jle 0x1400e4136
mov eax, dword [r12 + 0x30]
nop dword [rax]
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rbx, 0x15
xor rbx, rsi
rol rdi, 0x11
xor rdi, rbp
rol rbp, 0x20
sub rax, 1
jne 0x1400e4100
xor rsi, rcx
mov r15d, r14d
mov rdx, r13
and r15d, 7
movsxd r8, r15d
sub rdx, r8
add rdx, r14
cmp r13, rdx
je 0x1400e4216
mov r9d, dword [r12 + 0x30]
nop word [rax + rax]
movzx eax, byte [r13 + 6]
movzx ecx, byte [r13 + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13 + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13 + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13 + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13 + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13 + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13]
shl rcx, 8
or rcx, rax
xor rbx, rcx
test r9d, r9d
jle 0x1400e4206
mov eax, dword [r12 + 0x30]
nop word [rax + rax]
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rbx, 0x15
xor rbx, rsi
rol rdi, 0x11
xor rdi, rbp
rol rbp, 0x20
sub rax, 1
jne 0x1400e41d0
add r13, 8
xor rsi, rcx
cmp r13, rdx
jne 0x1400e4160
test r15d, r15d
je 0x1400e4225
lea rcx, [r12 + 0x38]
call sub.MSVCR90.dll_memcpy
mov dword [r12 + 0x28], r15d
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], rbp
mov qword [r12 + 0x20], rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret