joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a778
Capabilities:
Create pipe
Create process on windows
Read file on windows

Disassembly:
push rbp
sub rsp, 0x130
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc0], rcx
mov rax, qword [rbp + 0xc0]
mov rcx, rax
call sym.flatten_char_
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xc0]
mov rcx, rax
call sym.free
mov dword [rbp + 0x70], 0x18
mov dword [rbp + 0x80], 1
mov qword [rbp + 0x78], 0
lea rcx, [rbp + 0x70]
lea rdx, [rbp + 0x90]
lea rax, [rbp + 0x98]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreatePipe]
call rax
test eax, eax
sete al
test al, al
je 0x14000a807
mov eax, 0
jmp 0x14000a95c
mov rax, rbp
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp], 0x68
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x58], rax
mov eax, dword [rbp + 0x3c]
or ah, 1
mov dword [rbp + 0x3c], eax
mov rax, qword [rbp + 0xa8]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x48], rdx
mov rdx, rbp
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
je 0x14000a8ad
mov eax, 0
jmp 0x14000a95c
mov rax, qword [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x20]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x98]
lea rdx, [rbp - 0x24]
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0x1000
lea rdx, [0x14005d0a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
je 0x14000a93b
mov eax, dword [rbp - 0x24]
test eax, eax
jne 0x14000a942
mov eax, 0
jmp 0x14000a95c
mov rax, qword [rbp + 0x98]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [0x14005d0a0]
add rsp, 0x130
pop rbp
ret
Function at 0x14000b210
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push rbp
mov eax, 0x1060
call fcn.140040630
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xff0], rcx
mov qword [rbp + 0xfd8], 0
mov dword [rbp + 0xfd4], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
lea rax, str.HTTP_Connection_Example
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0xfc8], rax
cmp qword [rbp + 0xfc8], 0
jne 0x14000b289
mov eax, 0
jmp 0x14000b40a
mov rdx, qword [rbp + 0xff0]
mov rax, qword [rbp + 0xfc8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlA]
call rax
mov qword [rbp + 0xfc0], rax
cmp qword [rbp + 0xfc0], 0
jne 0x14000b387
mov rax, qword [rbp + 0xfc8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov eax, 0
jmp 0x14000b40a
mov edx, dword [rbp + 0xfbc]
mov eax, dword [rbp + 0xfd4]
add eax, edx
add eax, 1
mov edx, eax
mov rax, qword [rbp + 0xfd8]
mov rcx, rax
call sym.realloc
mov qword [rbp + 0xfd8], rax
cmp qword [rbp + 0xfd8], 0
jne 0x14000b355
mov rax, qword [rbp + 0xfc0]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfc8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov eax, 0
jmp 0x14000b40a
mov eax, dword [rbp + 0xfbc]
mov r8d, eax
mov edx, dword [rbp + 0xfd4]
mov rax, qword [rbp + 0xfd8]
lea rcx, [rdx + rax]
lea rax, [rbp - 0x50]
mov rdx, rax
call sym.memcpy
mov eax, dword [rbp + 0xfbc]
add dword [rbp + 0xfd4], eax
lea rcx, [rbp + 0xfbc]
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0xfc0]
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
test eax, eax
je 0x14000b3c0
mov eax, dword [rbp + 0xfbc]
test eax, eax
jne 0x14000b2f2
cmp qword [rbp + 0xfd8], 0
je 0x14000b3dd
mov edx, dword [rbp + 0xfd4]
mov rax, qword [rbp + 0xfd8]
add rax, rdx
mov byte [rax], 0
mov rax, qword [rbp + 0xfc0]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfc8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0xfd8]
add rsp, 0x1060
pop rbp
ret
Function at 0x14000ea00
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
push rbp
pxor xmm0, xmm0
movabs rdx, 0xbb67ae8584caa73b
mov qword [rcx], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 8], rdx
movabs rdx, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x10], rax
mov rbp, rsp
and rsp, 0xfffffffffffffff0
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x18], rdx
movabs rdx, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x20], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x28], rdx
movabs rdx, 0x5be0cd19137e2179
mov qword [rcx + 0x30], rax
xor eax, eax
mov qword [rcx + 0x38], rdx
movups xmmword [rcx + 0x40], xmm0
leave
ret
Function at 0x140010270
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
mov r14, rdx
push r13
mov r13, r9
push r12
mov r12, r8
push rdi
push rsi
mov rsi, rcx
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x260
mov rdi, qword [rbp + 0x30]
lea rbx, [rsp + 0x190]
mov rcx, rbx
call sym.crypto_hash_sha512_init
lea rax, [rdi + 0x20]
mov qword [rsp + 0x20], rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x38]
test eax, eax
jne 0x1400103f8
lea r15, [rsp + 0x30]
mov rdx, rdi
mov r8d, 0x20
mov rcx, r15
lea rdi, [rsp + 0x70]
call sym.crypto_hash_sha512
lea rdx, [rsp + 0x50]
mov r8d, 0x20
mov rcx, rbx
call sym.crypto_hash_sha512_update
mov r8, r13
mov rdx, r12
mov rcx, rbx
call sym.crypto_hash_sha512_update
mov rdx, rdi
mov rcx, rbx
call sym.crypto_hash_sha512_final
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, 0x20
call sym.memmove
mov rcx, rdi
call sym.sc25519_reduce
lea rax, [rsp + 0xf0]
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x20], rax
call sym.ge25519_scalarmult_base
mov rdx, qword [rsp + 0x20]
mov rcx, rsi
call sym.ge25519_p3_tobytes
mov rcx, rbx
call sym.crypto_hash_sha512_init
mov rdx, rsi
mov r8d, 0x40
mov rcx, rbx
call sym.crypto_hash_sha512_update
mov r8, r13
mov rdx, r12
mov rcx, rbx
call sym.crypto_hash_sha512_update
lea rsi, [rsp + 0xb0]
mov rcx, rbx
mov rdx, rsi
call sym.crypto_hash_sha512_final
mov rcx, rsi
call sym.sc25519_reduce
movzx eax, byte [rsp + 0x4f]
mov r9, rdi
mov r8, r15
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
and byte [rsp + 0x30], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [rsp + 0x4f], al
call sym.sc25519_muladd
mov edx, 0x40
mov rcx, r15
call sym.sodium_memzero
mov edx, 0x40
mov rcx, rdi
call sym.sodium_memzero
test r14, r14
je 0x1400103df
mov qword [r14], 0x40
lea rsp, [rbp - 0x38]
xor eax, eax
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r9, str.SigEd25519_no_Ed25519_collisions
mov rcx, rbx
mov r8d, 0x22
mov rdx, r9
lea r15, [rsp + 0x30]
call sym.crypto_hash_sha512_update
mov rdx, rdi
mov rcx, r15
mov r8d, 0x20
call sym.crypto_hash_sha512
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov r8d, 0x20
call sym.crypto_hash_sha512_update
lea rdi, [rsp + 0x70]
mov r8, r13
mov rdx, r12
mov rcx, rbx
call sym.crypto_hash_sha512_update
mov rdx, rdi
mov rcx, rbx
call sym.crypto_hash_sha512_final
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, 0x20
call sym.memmove
mov rcx, rdi
call sym.sc25519_reduce
lea rax, [rsp + 0xf0]
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x20], rax
call sym.ge25519_scalarmult_base
mov rdx, qword [rsp + 0x20]
mov rcx, rsi
call sym.ge25519_p3_tobytes
mov rcx, rbx
call sym.crypto_hash_sha512_init
lea r9, str.SigEd25519_no_Ed25519_collisions
mov r8d, 0x22
mov rcx, rbx
mov rdx, r9
call sym.crypto_hash_sha512_update
jmp 0x140010358
Function at 0x140012070
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov byte [rsp + 0xf], 0
test r8, r8
je 0x1400120be
xor edx, edx
nop word [rax + rax]
mov rax, qword [rsp + 0x10]
add rax, rdx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x18]
add rcx, rdx
add rdx, 1
movzx r9d, byte [rcx]
movzx ecx, byte [rsp + 0xf]
xor eax, r9d
or eax, ecx
mov byte [rsp + 0xf], al
cmp r8, rdx
jne 0x140012090
movzx eax, byte [rsp + 0xf]
add rsp, 0x28
sub eax, 1
shr eax, 0x1f
sub eax, 1
ret

Function at 0x140012270
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x14004e050], rax
cmp rax, 0xf
jbe 0x1400122ad
mov edx, 0x10
lea rcx, [0x14005e160]
call sym.randombytes_buf
xor eax, eax
leave
ret
call sym.sodium_misuse
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400130e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14004e0b4]
test eax, eax
jne 0x1400130f8
mov dword [0x14004e0b4], 1
mov rax, rdx
shr rax, 0x20
jne 0x14001310f
call sym.SystemFunction036
test al, al
je 0x14001310f
add rsp, 0x28
ret
call sym.sodium_misuse
nop word cs:[rax + rax]
nop

Function at 0x140013120
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x38
mov eax, dword [0x14004e0b4]
test eax, eax
jne 0x140013138
mov dword [0x14004e0b4], 1
lea rcx, [rsp + 0x2c]
mov edx, 4
call sym.SystemFunction036
test al, al
je 0x140013154
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
ret
call sym.sodium_misuse
nop
nop
nop
nop
nop
nop
nop
Function at 0x140014640
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
mov rbp, rsp
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
mov rax, qword [rbp + 0x38]
test r8, r8
je 0x1400146fe
mov r10, qword [rbp + 0x30]
movd xmm4, dword [rax + 8]
lea rbx, [rsp + 0x20]
movd xmm0, dword [rax + 0x1c]
movd xmm2, dword [rax + 0xc]
shr r10, 0x20
movd xmm1, dword [rax + 4]
movd xmm3, dword [r9]
movd xmm5, r10d
punpckldq xmm0, xmm4
movd xmm4, dword [r9 + 4]
mov r9, r8
punpckldq xmm2, xmm5
movd xmm5, dword [rax + 0x18]
mov r8, rcx
mov rcx, rbx
punpcklqdq xmm2, xmm0
movdqu xmm0, xmmword [0x140050650]
punpckldq xmm1, xmm4
movd xmm4, dword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm2
movups xmmword [rsp + 0x20], xmm0
movd xmm0, dword [rbp + 0x30]
punpckldq xmm3, xmm4
punpckldq xmm0, xmm5
movd xmm5, dword [rax]
punpcklqdq xmm0, xmm1
movd xmm1, dword [rax + 0x14]
movups xmmword [rsp + 0x40], xmm0
punpckldq xmm1, xmm5
punpcklqdq xmm1, xmm3
movups xmmword [rsp + 0x30], xmm1
call sym.salsa20_encrypt_bytes.part.0
mov edx, 0x40
mov rcx, rbx
call sym.sodium_memzero
mov rbx, qword [rbp - 8]
xor eax, eax
leave
ret

Function at 0x140014710
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
test rdx, rdx
jne 0x140014720
xor eax, eax
ret
push rbp
mov rbp, rsp
push rsi
push rbx
mov rbx, rdx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
mov eax, dword [r9 + 4]
movd xmm2, dword [r9 + 0x10]
movd xmm3, dword [r9]
movd xmm1, dword [r8]
lea rsi, [rsp + 0x20]
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], eax
mov eax, dword [r9 + 8]
movdqu xmm0, xmmword [0x140050650]
punpckldq xmm1, xmm2
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x5c], eax
mov eax, dword [r9 + 0xc]
movups xmmword [rsp + 0x20], xmm0
movd xmm0, dword [r9 + 0x14]
mov dword [rsp + 0x50], eax
mov eax, dword [r9 + 0x18]
punpckldq xmm0, xmm3
mov dword [rsp + 0x44], eax
mov eax, dword [r9 + 0x1c]
punpcklqdq xmm0, xmm1
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x58], eax
mov eax, dword [r8 + 4]
mov r8, rdx
xor edx, edx
mov dword [rsp + 0x4c], eax
call sym.memset
mov r9, rbx
mov rcx, rsi
mov rdx, rax
mov r8, rax
call sym.salsa20_encrypt_bytes.part.0
mov rcx, rsi
mov edx, 0x40
call sym.sodium_memzero
lea rsp, [rbp - 0x10]
xor eax, eax
pop rbx
pop rsi
pop rbp
ret
Function at 0x1400161a0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
mov rbp, rsp
push rbx
and rsp, 0xffffffffffffffe0
sub rsp, 0x60
mov rax, qword [rbp + 0x38]
test r8, r8
je 0x14001625d
mov r10, rdx
mov rdx, qword [rbp + 0x30]
vmovd xmm5, dword [rax + 0xc]
lea rbx, [rsp + 0x20]
vmovd xmm4, dword [rax + 0x1c]
vpinsrd xmm0, xmm4, dword [rax + 8], 1
shr rdx, 0x20
vmovd xmm4, dword [rax + 4]
vpinsrd xmm1, xmm4, dword [r9 + 4], 1
vpinsrd xmm2, xmm5, edx, 1
vmovd xmm5, dword [rbp + 0x30]
vmovd xmm3, dword [r9]
mov rdx, r10
vpunpcklqdq xmm2, xmm2, xmm0
vmovdqu xmm0, xmmword [0x1400506c0]
vpinsrd xmm3, xmm3, dword [rax + 0x10], 1
mov r9, r8
vmovd xmm4, dword [rax + 0x14]
vmovdqu xmmword [rsp + 0x50], xmm2
mov r8, rcx
mov rcx, rbx
vmovdqu xmmword [rsp + 0x20], xmm0
vpinsrd xmm0, xmm5, dword [rax + 0x18], 1
vpunpcklqdq xmm0, xmm0, xmm1
vpinsrd xmm1, xmm4, dword [rax], 1
vpunpcklqdq xmm1, xmm1, xmm3
vinserti128 ymm0, ymm1, xmm0, 1
vmovdqu ymmword [rsp + 0x30], ymm0
vzeroupper
call sym.salsa20_encrypt_bytes.part.0_1
mov edx, 0x40
mov rcx, rbx
call sym.sodium_memzero
mov rbx, qword [rbp - 8]
xor eax, eax
leave
ret

Function at 0x140016270
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
test rdx, rdx
jne 0x140016280
xor eax, eax
ret
push rbp
mov rbp, rsp
push rsi
push rbx
mov rbx, rdx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
mov eax, dword [r9 + 4]
vmovd xmm2, dword [r8]
vmovdqu xmm0, xmmword [0x1400506c0]
vmovd xmm3, dword [r9 + 0x14]
lea rsi, [rsp + 0x20]
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], eax
mov eax, dword [r9 + 8]
vpinsrd xmm1, xmm2, dword [r9 + 0x10], 1
vmovdqu xmmword [rsp + 0x20], xmm0
vpinsrd xmm0, xmm3, dword [r9], 1
mov dword [rsp + 0x5c], eax
mov eax, dword [r9 + 0xc]
vpunpcklqdq xmm0, xmm0, xmm1
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x50], eax
mov eax, dword [r9 + 0x18]
vmovdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x44], eax
mov eax, dword [r9 + 0x1c]
mov dword [rsp + 0x58], eax
mov eax, dword [r8 + 4]
mov r8, rdx
xor edx, edx
mov dword [rsp + 0x4c], eax
call sym.memset
mov r9, rbx
mov rcx, rsi
mov rdx, rax
mov r8, rax
call sym.salsa20_encrypt_bytes.part.0_1
mov rcx, rsi
mov edx, 0x40
call sym.sodium_memzero
lea rsp, [rbp - 0x10]
xor eax, eax
pop rbx
pop rsi
pop rbp
ret
Function at 0x140026de0
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r11, rcx
mov r8d, 0x1f
mov r9d, 1
push rbx
xor eax, eax
lea rbx, [0x140050720]
nop word [rax + rax]
movzx ecx, byte [r11 + r8]
movzx esi, byte [rbx + r8]
mov edx, ecx
sub ecx, esi
xor edx, esi
sar ecx, 8
movzx edx, dl
and ecx, r9d
sub edx, 1
or eax, ecx
sar edx, 8
and r9d, edx
sub r8, 1
jae 0x140026e00
movzx eax, al
pop rbx
pop rsi
ret
Function at 0x1400289c0
Capabilities:
Hash data using sha512

Disassembly:
push rbp
lea eax, [rdx - 1]
mov rbp, rsp
push rdi
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
cmp al, 0x3f
ja 0x140028a68
mov eax, 0x101
lea rdi, [rcx + 0x48]
mov byte [rsp + 0x20], dl
mov r8, rcx
movdqu xmm0, xmmword [0x1400586d0]
mov word [rsp + 0x22], ax
mov eax, ecx
and rdi, 0xfffffffffffffff8
sub eax, edi
mov byte [rsp + 0x21], 0
movups xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [0x1400586e0]
mov dword [rsp + 0x24], 0
movups xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [0x1400586f0]
mov qword [rsp + 0x28], 0
movups xmmword [rcx + 0x30], xmm0
movdqu xmm0, xmmword [0x1400586c0]
mov qword [rcx + 0x40], 0
mov qword [rcx + 0x161], 0
lea ecx, [rax + 0x169]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
pxor xmm0, xmmword [rsp + 0x20]
movups xmmword [r8], xmm0
mov rdi, qword [rbp - 8]
leave
ret
call sym.sodium_misuse
nop dword [rax]

Function at 0x140028cc0
Capabilities:
Encrypt data using rc4 prga
Hash data using sha512

Disassembly:
push rbp
lea eax, [rdx - 1]
mov rbp, rsp
push rdi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0xe0
cmp al, 0x3f
ja 0x140028e4f
lea eax, [r9 - 1]
cmp al, 0x3f
ja 0x140028e4f
test r8, r8
je 0x140028e4f
lea rdi, [rcx + 0x48]
mov byte [rsp + 0x20], dl
mov edx, ecx
mov r10, rcx
movzx eax, word [0x140058700]
and rdi, 0xfffffffffffffff8
movdqu xmm0, xmmword [0x1400586d0]
mov byte [rsp + 0x21], r9b
sub edx, edi
lea rbx, [rsp + 0x60]
movzx r9d, r9b
mov dword [rsp + 0x24], 0
movups xmmword [rcx + 0x10], xmm0
movdqu xmm0, xmmword [0x1400586e0]
mov word [rsp + 0x22], ax
xor eax, eax
movups xmmword [rcx + 0x20], xmm0
movdqu xmm0, xmmword [0x1400586f0]
mov qword [rsp + 0x28], 0
movups xmmword [rcx + 0x30], xmm0
movdqu xmm0, xmmword [0x1400586c0]
mov qword [rcx + 0x40], 0
mov qword [rcx + 0x161], 0
lea ecx, [rdx + 0x169]
shr ecx, 3
rep stosq qword [rdi], rax
mov ecx, 0x10
mov rdi, rbx
rep stosq qword [rdi], rax
mov rcx, rbx
mov rax, r8
pxor xmm0, xmmword [rsp + 0x20]
movups xmmword [r10], xmm0
cmp r9d, 8
jae 0x140028e28
xor edx, edx
test r9b, 4
jne 0x140028e10
test r9b, 2
jne 0x140028df0
and r9d, 1
jne 0x140028de0
mov rdx, rbx
mov rcx, r10
mov r8d, pe_nt_image_headers64
call sym.blake2b_update
mov rcx, rbx
mov edx, pe_nt_image_headers64
call sym.sodium_memzero
lea rsp, [rbp - 0x10]
xor eax, eax
pop rbx
pop rdi
pop rbp
ret
movzx eax, byte [rax + rdx]
mov byte [rcx + rdx], al
jmp 0x140028db5
movzx r8d, word [rax + rdx]
mov word [rcx + rdx], r8w
add rdx, 2
and r9d, 1
je 0x140028db5
jmp 0x140028de0
mov edx, dword [rax]
mov dword [rcx], edx
mov edx, 4
test r9b, 2
je 0x140028daf
jmp 0x140028df0
mov r11d, r9d
xor eax, eax
and r11d, 0xfffffff8
mov edx, eax
add eax, 8
mov rcx, qword [r8 + rdx]
mov qword [rbx + rdx], rcx
cmp eax, r11d
jb 0x140028e31
lea rcx, [rbx + rax]
add rax, r8
jmp 0x140028da1
call sym.sodium_misuse
nop word cs:[rax + rax]
nop
Function at 0x14002ce90
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbp
mov rbp, rsp
push rdi
push rsi
push rbx
mov rbx, rcx
lea rcx, [rdx + 1]
mov rax, rbx
sub rax, rcx
and rsp, 0xfffffffffffffff0
sub rsp, 0x150
cmp rax, 0xe
jbe 0x14002cf82
movdqu xmm2, xmmword [rdx]
movups xmmword [rbx], xmm2
movdqu xmm0, xmmword [rdx + 0x10]
movups xmmword [rbx + 0x10], xmm0
movzx eax, byte [rbx + 0x1f]
and byte [rbx], 0xf8
mov rdx, rbx
lea rdi, [rsp + 0x20]
lea rcx, [rsp + 0xb0]
lea rsi, [rsp + 0x80]
and eax, 0x7f
or eax, 0x40
mov byte [rbx + 0x1f], al
call sym.ge25519_scalarmult_base
lea r8, [rsp + 0xd8]
mov rax, qword [rsp + 0xf8]
mov rcx, rsi
add rax, qword [rsp + 0x120]
lea rdx, [rsp + 0x100]
movdqu xmm0, xmmword [rsp + 0xe8]
movdqu xmm1, xmmword [rsp + 0xd8]
mov qword [rsp + 0x70], rax
paddq xmm0, xmmword [rsp + 0x110]
paddq xmm1, xmmword [rsp + 0x100]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x50], xmm1
call sym.fe25519_sub_1
mov rdx, rsi
mov rcx, rsi
call sym.fe25519_invert
lea rdx, [rsp + 0x50]
mov r8, rsi
mov rcx, rdi
call sym.fe25519_mul_1
mov rdx, rdi
mov rcx, rbx
call sym.fe25519_tobytes
lea rsp, [rbp - 0x18]
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
nop dword [rax]
movzx ecx, byte [rdx + rax]
mov byte [rbx + rax], cl
add rax, 1
cmp rax, 0x20
jne 0x14002cf88
jmp 0x14002cec9
Function at 0x14002e550
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
mov rbp, rsp
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
mov rax, qword [rbp + 0x38]
test r8, r8
je 0x14002e60a
movd xmm4, dword [rax + 0x1c]
movd xmm5, dword [rax + 0x14]
lea rbx, [rsp + 0x20]
movdqu xmm0, xmmword [0x140058780]
movd xmm1, dword [rax + 0x18]
movd xmm2, dword [rbp + 0x30]
movd xmm3, dword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movd xmm0, dword [rax + 0x10]
punpckldq xmm1, xmm4
movd xmm4, dword [r9 + 8]
punpckldq xmm0, xmm5
punpcklqdq xmm0, xmm1
movd xmm1, dword [r9 + 4]
mov r9d, dword [r9]
movups xmmword [rsp + 0x40], xmm0
movd xmm5, r9d
punpckldq xmm1, xmm4
movd xmm4, dword [rax + 0xc]
mov r9, r8
punpckldq xmm2, xmm5
movd xmm5, dword [rax + 4]
mov r8, rcx
mov rcx, rbx
punpcklqdq xmm2, xmm1
movd xmm1, dword [rax]
punpckldq xmm3, xmm4
movups xmmword [rsp + 0x50], xmm2
punpckldq xmm1, xmm5
punpcklqdq xmm1, xmm3
movups xmmword [rsp + 0x30], xmm1
call sym.chacha20_encrypt_bytes.part.0
mov edx, 0x40
mov rcx, rbx
call sym.sodium_memzero
mov rbx, qword [rbp - 8]
xor eax, eax
leave
ret
Function at 0x140030000
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
lea r10, [r8*8]
shl r9, 3
vmovq xmm2, r10
vpinsrq xmm2, xmm2, r9, 1
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
vmovups xmmword [rsp], xmm6
vmovups xmmword [rsp + 0x10], xmm7
mov rax, qword [rbp + 0x30]
vmovdqu xmm0, xmmword [rax + 0x30]
vmovdqu xmm5, xmmword [rax + 0x40]
vmovdqu xmm6, xmmword [rax]
vaesenc xmm7, xmm5, xmmword [rax + 0x50]
vaesenc xmm4, xmm0, xmm5
vmovdqu xmm5, xmmword [rax + 0x20]
vpxor xmm2, xmm2, xmm0
vaesenc xmm1, xmm5, xmm0
vmovdqu xmm5, xmmword [rax + 0x10]
vaesenc xmm0, xmm5, xmmword [rax + 0x20]
vaesenc xmm3, xmm6, xmm5
vmovdqu xmm5, xmmword [rax + 0x50]
vaesenc xmm6, xmm5, xmm6
vaesenc xmm5, xmm4, xmm7
vaesenc xmm4, xmm1, xmm4
vpxor xmm6, xmm6, xmm2
vaesenc xmm1, xmm0, xmm1
vaesenc xmm0, xmm3, xmm0
vaesenc xmm7, xmm7, xmm6
vaesenc xmm3, xmm6, xmm3
vaesenc xmm6, xmm4, xmm5
vpxor xmm7, xmm7, xmm2
vaesenc xmm4, xmm1, xmm4
vaesenc xmm1, xmm0, xmm1
vaesenc xmm5, xmm5, xmm7
vaesenc xmm0, xmm3, xmm0
vaesenc xmm3, xmm7, xmm3
vpxor xmm5, xmm5, xmm2
vaesenc xmm7, xmm4, xmm6
vaesenc xmm4, xmm1, xmm4
vaesenc xmm6, xmm6, xmm5
vaesenc xmm1, xmm0, xmm1
vaesenc xmm0, xmm3, xmm0
vpxor xmm6, xmm6, xmm2
vaesenc xmm3, xmm5, xmm3
vaesenc xmm5, xmm4, xmm7
vaesenc xmm7, xmm7, xmm6
vaesenc xmm4, xmm1, xmm4
vaesenc xmm1, xmm0, xmm1
vpxor xmm7, xmm7, xmm2
vaesenc xmm0, xmm3, xmm0
vaesenc xmm3, xmm6, xmm3
vaesenc xmm6, xmm4, xmm5
vaesenc xmm5, xmm5, xmm7
vaesenc xmm4, xmm1, xmm4
vpxor xmm5, xmm5, xmm2
vaesenc xmm1, xmm0, xmm1
vaesenc xmm0, xmm3, xmm0
vaesenc xmm3, xmm7, xmm3
vaesenc xmm7, xmm4, xmm6
vaesenc xmm6, xmm6, xmm5
vaesenc xmm4, xmm1, xmm4
vpxor xmm6, xmm6, xmm2
vaesenc xmm1, xmm0, xmm1
vmovdqu xmmword [rax + 0x50], xmm7
vaesenc xmm0, xmm3, xmm0
vaesenc xmm3, xmm5, xmm3
vmovdqu xmmword [rax + 0x40], xmm4
vmovdqu xmmword [rax + 0x30], xmm1
vmovdqu xmmword [rax + 0x20], xmm0
vmovdqu xmmword [rax + 0x10], xmm3
vmovdqu xmmword [rax], xmm6
cmp rdx, 0x10
je 0x1400301c0
cmp rdx, 0x20
jne 0x1400301a0
vpxor xmm0, xmm0, xmm3
vpxor xmm0, xmm0, xmm6
vmovdqu xmmword [rcx], xmm0
vmovdqu xmm2, xmmword [rax + 0x50]
vpxor xmm0, xmm2, xmmword [rax + 0x40]
vpxor xmm0, xmm0, xmmword [rax + 0x30]
vmovdqu xmmword [rcx + 0x10], xmm0
vmovups xmm6, xmmword [rsp]
vmovups xmm7, xmmword [rsp + 0x10]
leave
ret
vmovups xmm6, xmmword [rsp]
vmovups xmm7, xmmword [rsp + 0x10]
mov r8, rdx
xor edx, edx
leave
jmp sym.memset
vpxor xmm7, xmm7, xmm4
vpxor xmm1, xmm1, xmm0
vpxor xmm3, xmm3, xmm6
vpxor xmm0, xmm7, xmm1
vpxor xmm0, xmm0, xmm3
vmovdqu xmmword [rcx], xmm0
vmovups xmm6, xmmword [rsp]
vmovups xmm7, xmmword [rsp + 0x10]
leave
ret
Function at 0x140036770
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
mov rbp, rsp
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x60
mov rax, qword [rbp + 0x38]
test r8, r8
je 0x14003682a
movd xmm4, dword [rax + 0x1c]
movd xmm5, dword [rax + 0x14]
lea rbx, [rsp + 0x20]
movdqu xmm0, xmmword [0x1400588e0]
movd xmm1, dword [rax + 0x18]
movd xmm2, dword [rbp + 0x30]
movd xmm3, dword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movd xmm0, dword [rax + 0x10]
punpckldq xmm1, xmm4
movd xmm4, dword [r9 + 8]
punpckldq xmm0, xmm5
punpcklqdq xmm0, xmm1
movd xmm1, dword [r9 + 4]
mov r9d, dword [r9]
movups xmmword [rsp + 0x40], xmm0
movd xmm5, r9d
punpckldq xmm1, xmm4
movd xmm4, dword [rax + 0xc]
mov r9, r8
punpckldq xmm2, xmm5
movd xmm5, dword [rax + 4]
mov r8, rcx
mov rcx, rbx
punpcklqdq xmm2, xmm1
movd xmm1, dword [rax]
punpckldq xmm3, xmm4
movups xmmword [rsp + 0x50], xmm2
punpckldq xmm1, xmm5
punpcklqdq xmm1, xmm3
movups xmmword [rsp + 0x30], xmm1
call sym.chacha20_encrypt_bytes.part.0_1
mov edx, 0x40
mov rcx, rbx
call sym.sodium_memzero
mov rbx, qword [rbp - 8]
xor eax, eax
leave
ret