joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400948d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdi, rbp
mov qword [rsp + 0x10], rdi
xchg rdi, rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x24], 0x8b7024c
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r15
sub rsp, 0x20
movzx eax, byte [rdx + 1]
xchg r13, r13
xchg r15, rsi
mov rsi, r8
xchg rsi, r15
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
xchg rcx, rcx
shl ebx, 4
shl ebx, 2
shl ebx, 1
shl ebx, 1
dec r8d
or ebx, eax
mov rsp, rsp
shl edi, 4
shl edi, 1
shl edi, 2
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 7
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
xchg rdi, rdi
shl ebx, 2
shl ebx, 5
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x40], esi
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 2
shl edi, 6
or edi, eax
movzx eax, byte [rdx + 7]
xchg r11, r11
shl edi, 7
shl edi, 1
or edi, eax
mov rsp, rsp
test r8d, r8d
jle 0x140094a00
mov rdx, qword [rcx + 8]
mov r13, r13
lea r14d, [r8 - 1]
movsxd rax, r8d
shr r14d, 1
inc r14d
mov rsp, rsp
lea rcx, [rax + rax*2]
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
xchg r10, r10
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
xchg rsi, rdx
mov rsi, rdx
xchg rsi, rdx
mov ecx, edi
call fcn.140095114
xchg rbp, rbp
xor ebx, eax
xchg rbp, r13
mov rdx, r13
xchg rbp, r13
mov ecx, ebx
call fcn.140095114
xchg rdi, rdi
xor edi, eax
sub rsi, 0x18
add rbp, 0xffffffffffffffe8
mov rdx, rdx
sub r14, 1
jne 0x1400949c1
lea rax, [r15 + 7]
mov dword [rsp - 0x3c], 0x6f7ab0fd
mov ecx, 0x7435087c
sub ecx, 0x35678c40
add ecx, 0x407d9761
sub ecx, 0x7f4b1399
mov byte [rax - 4], dil
xchg r10, r10
mov byte [rax], bl
dec rax
shr ebx, 4
shr ebx, 2
shr ebx, 1
shr ebx, 1
shr edi, 8
mov dword [rsp - 0x38], 0xa2fba4
sub rcx, 1
jne 0x140094a23
mov rbx, qword [rsp + 0x40]
mov dword [rsp - 0xc], 0x225246f9
mov rbp, qword [rsp + 0x48]
xchg r15, rsi
mov r15, qword [rsp + 0x50]
xchg rsi, r15
nop
add rsp, 0x54d4e1a3
sub rsp, 0x54d4e183
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x28], 0x3c81bfff
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140094a98
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg r12, rsp
mov rax, r12
xchg r12, rsp
mov qword [rax + 8], rbx
mov dword [rsp - 0xc], edi
mov qword [rax + 0x10], rbp
xchg r15, rsi
mov qword [rax + 0x18], r15
xchg rsi, r15
mov qword [rax + 0x20], rdi
push r14
mov rbx, rbx
sub rsp, 0x20
movzx eax, byte [rdx + 1]
mov r14, r8
mov r13, r13
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
shl ebx, 8
mov dword [rsp - 0x2c], 0x735cf653
or ebx, eax
shl edi, 6
shl edi, 1
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 7
shl ebx, 1
or ebx, eax
movzx eax, byte [rdx + 3]
mov dword [rsp - 0x18], edi
shl ebx, 1
shl ebx, 1
shl ebx, 3
shl ebx, 2
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x1c], 0x6cd7bb7e
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 5
shl edi, 2
shl edi, 1
or edi, eax
mov r9, r9
movzx eax, byte [rdx + 7]
shl edi, 4
shl edi, 3
shl edi, 1
or edi, eax
mov eax, dword [rcx + 4]
mov dword [rsp - 0xc], 0x1abaa412
test eax, eax
jle 0x140094b98
mov rsi, qword [rcx + 8]
xchg r13, r13
lea ebp, [rax - 1]
shr ebp, 1
inc ebp
xchg rsi, rdx
mov rsi, rdx
xchg rsi, rdx
mov ecx, edi
call fcn.140095114
xor ebx, eax
mov dword [rsp - 0xc], 0x3ebfb92e
lea rdx, [rsi + 0xc]
mov ecx, ebx
call fcn.140095114
xchg rbx, rbx
xor edi, eax
add rsi, 0x18
sub rbp, 1
mov dword [rsp - 0x10], 0x641f6d41
jne 0x140094b58
lea rax, [r14 + 7]
mov ecx, 0x1d48c193
sub ecx, 0xa8baa3
add ecx, 0x52a26783
xor ecx, 0x6f426e77
mov byte [rax - 4], dil
mov r14, r14
mov byte [rax], bl
dec rax
shr ebx, 7
shr ebx, 1
shr edi, 5
shr edi, 1
shr edi, 1
shr edi, 1
sub rcx, 1
mov dword [rsp - 0x28], edx
jne 0x140094bb3
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg rbx, r10
mov rbp, qword [rsp + 0x38]
mov rcx, rcx
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
sub rsp, 0xffffffffffffffe0
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140094dc8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rdx, rdx
nop
sub rsp, 8
mov qword [rsp], rbp
push rsi
mov qword [rsp], rdi
push r14
xchg r13, r13
lea rbp, [rsp - 0x47]
add rsp, 0x6f383f89
sub rsp, 0x6f384029
movdqa xmm0, xmmword [0x140001e00]
xchg rdx, rdx
xor edi, edi
movdqa xmm1, xmmword [0x140001da0]
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
xchg rsi, rbp
movdqu xmmword [rsi - 0x39], xmm0
xchg rbp, rsi
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
mov edx, edi
mov rbx, rbx
movdqa xmm0, xmmword [0x140001e50]
mov r8d, edi
xchg rbp, r10
movdqu xmmword [r10 - 0x29], xmm1
xchg rbp, r10
movdqa xmm1, xmmword [0x140001e40]
mov rsp, rsp
xchg rbp, r15
movdqu xmmword [r15 - 0x19], xmm0
xchg rbp, r15
xchg rsi, rbp
movdqu xmmword [rsi - 9], xmm1
xchg rbp, rsi
mov ecx, edx
xchg r11, r11
lea r8, [r8 + 4]
mov eax, 0xad1421b
xor eax, 0x2189ea9b
sub eax, 0x1078a8dd
add eax, 0x1facedd2
add eax, 0x2dd26833
inc rdx
rol eax, cl
mov dword [rsp - 0x2c], 0x105098db
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
xchg r9, r9
jb 0x140094e6b
cmp dword [rsi + 4], 8
jne 0x140094f24
lea rdx, [rbp + 0x6d]
xchg r14, r14
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
xchg rbp, rbp
shl cx, 1
shl cx, 2
shl cx, 4
shl cx, 1
or cx, ax
mov dword [rsp - 0x10], 0x1be14946
mov word [rdx], cx
lea rdx, [rdx - 2]
cmp rdi, 4
jl 0x140094ec2
mov r14, r14
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, [rbp + 0x67]
xchg rsi, rdx
mov rcx, rdx
xchg rsi, rdx
call fcn.140094c08
mov dword [rsp - 0x28], 0x4c6d9264
jmp 0x140094feb
cmp dword [rsi], edi
jle 0x140094feb
mov r14d, edi
mov dword [rsp - 0x2c], esi
lea rdx, [rbp + 0x6d]
mov r8d, 0x23fd5cf6
sub r8d, 0x78cd703
xor r8d, 0x61bca2e1
sub r8d, 0x7dcc270e
movzx eax, byte [rbx]
mov r9, r9
movzx ecx, byte [rbx + 1]
sub rbx, 0xfffffffffffffffe
shl ax, 4
shl ax, 4
or cx, ax
mov word [rdx], cx
mov dword [rsp - 0x1c], 0x3b2e4aa4
lea rdx, [rdx - 2]
sub r8, 1
jne 0x140094f52
lea r9, [rbp + 7]
mov dword [rsp - 0xc], 0x27f5846
mov r8d, r14d
lea rdx, [rbp + 0x67]
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.140094c08
xchg rdx, rdx
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
sub r8d, r14d
xchg r10, r10
lea rdx, [rbp + 0x67]
sub r8d, 8
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.140094c08
mov r8, r8
inc edi
nop
add r14d, 0xa669ca8
sub r14d, 0xa669ca0
cmp edi, dword [rsi]
jl 0x140094f33
xchg r14, r14
xor eax, eax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
xchg r8, r8
lea rdi, [rbp + 7]
mov rsi, qword [r11 + 0x30]
lea ecx, [rax + 0x40]
mov r11, r11
rep stosb byte [rdi], al
xchg rsp, r11
mov r11, rsp
xchg r11, rsp
nop
mov r14, qword [rsp]
add rsp, 8
pop rdi
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400950c4
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov rsp, rsp
mov r11d, ecx
test edx, edx
je 0x14009510f
mov dword [rsp - 0x3c], 0x55a75f4b
lea ecx, [r11 + r11]
mov r9d, r10d
xor r9d, r11d
mov r11d, ecx
mov r10, r10
test dl, 1
cmove r9d, r10d
xor r11d, r8d
cmp ecx, 0x100
mov dword [rsp - 0x18], 0x53e4cbba
mov r10d, r9d
cmovb r11d, ecx
shr edx, 1
jne 0x1400950d9
mov r14, r14
mov eax, r10d
ret
Function at 0x1400a0290
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbp, rax
mov rbp, qword [rcx + 0xf8]
xchg rbp, rax
xor r8d, r8d
xchg r9, rdi
mov rdi, rdx
xchg rdi, r9
test rax, rax
mov dword [rsp - 0x14], 0x4edf96b5
je 0x1400a02ff
mov ecx, r8d
mov edx, 0x4fd18587
add edx, 0x1ee6e135
sub edx, 0x2e554319
xor edx, 0x283c760b
rol edx, cl
xor dl, byte [rax]
inc rax
mov dword [rsp - 0x18], ecx
mov byte [r8 + r9], dl
inc r8
cmp r8, 0x20
mov dword [rsp - 0x34], 0x37968d8b
jb 0x1400a02b8
mov al, 0x16
add al, 0x35
sub al, 0x1c
sub al, 0x2e
ret
mov rax, qword [rcx + 0x100]
test rax, rax
xchg rbx, rbx
je 0x1400a0331
movups xmm0, xmmword [rax]
xchg rcx, rdx
movups xmmword [rcx], xmm0
xchg rdx, rcx
movups xmm1, xmmword [rax + 0x10]
xchg rbx, rdx
movups xmmword [rbx + 0x10], xmm1
xchg rdx, rbx
jmp 0x1400a02f6
xorps xmm0, xmm0
xor al, al
xchg rcx, rdx
movups xmmword [rcx], xmm0
xchg rcx, rdx
xchg r13, rdx
movups xmmword [r13 + 0x10], xmm0
xchg rdx, r13
ret
Function at 0x1400afab4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
xchg r14, r14
xchg rbp, rsi
mov qword [rsp + 0x10], rbp
xchg rbp, rsi
mov qword [rsp + 0x18], rdi
mov dword [rsp - 0x28], 0x56256074
push r14
nop
sub rsp, 0x502ac4fb
add rsp, 0x502ac4db
lea rax, [rcx + 8]
xorps xmm0, xmm0
mov qword [rcx], rax
xchg rdx, rdx
xchg rdx, rsi
mov rdx, rsi
xchg rsi, rdx
movups xmmword [rax], xmm0
mov dword [rsp - 0x20], 0x5953247a
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
movups xmmword [rax + 0x10], xmm0
mov dword [rsp - 0x38], 0x474a2d23
xchg r8, rax
movups xmmword [r8 + 0x20], xmm0
xchg r8, rax
mov rdx, qword [rdx + 0x38]
mov qword [rcx + 0x38], rdx
call fcn.140017924
mov dword [rsp - 0x18], esi
xor ebx, ebx
mov r8d, ebx
cmp qword [rdi + 0x38], rbx
xchg rsi, rsi
jbe 0x1400afb6d
xchg rcx, rbx
mov rbx, qword [rsi]
xchg rbx, rcx
movzx edx, word [rcx + r8*2]
mov r14, r14
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [rdi + 0x38]
jb 0x1400afb47
mov rdx, rdx
lea rax, [rdi + 0x48]
xorps xmm0, xmm0
xchg rsp, rax
mov qword [rdi + 0x40], rsp
xchg rsp, rax
lea rcx, [rdi + 0x40]
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rax
xchg r12, rax
movups xmmword [r12 + 0x20], xmm0
xchg r12, rax
mov rdx, qword [rsi + 0x78]
xchg rcx, rdx
mov qword [rdi + 0x78], rcx
xchg rdx, rcx
call fcn.140017924
xchg r15, r8
mov r15, rbx
xchg r8, r15
cmp qword [rdi + 0x78], rbx
jbe 0x1400afbe7
xchg r9, r9
xchg r13, rcx
mov r13, qword [rsi + 0x40]
xchg rcx, r13
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
xchg rcx, rcx
inc r8
cmp r8, qword [rdi + 0x78]
jb 0x1400afbc3
lea r14, [rdi + 0x80]
mov dword [rsp - 0x2c], ecx
xorps xmm0, xmm0
lea rax, [r14 + 8]
mov rcx, r14
mov qword [r14], rax
mov dword [rsp - 0x18], 0x7bced33c
movups xmmword [rax], xmm0
xchg rsp, rax
movups xmmword [rsp + 0x10], xmm0
xchg rsp, rax
xchg rsi, rax
movups xmmword [rsi + 0x20], xmm0
xchg rsi, rax
xchg rdx, r11
mov r11, qword [rsi + 0xb8]
xchg rdx, r11
mov qword [r14 + 0x38], rdx
call fcn.140017924
mov dword [rsp - 0x20], 0x5d95c52
cmp qword [r14 + 0x38], rbx
jbe 0x1400afc70
xchg r15, rcx
mov r15, qword [rsi + 0x80]
xchg r15, rcx
movzx edx, word [rcx + rbx*2]
mov word [rax + rbx*2], dx
xchg r8, r8
inc rbx
cmp rbx, qword [r14 + 0x38]
jb 0x1400afc43
mov dword [rsp - 0xc], 0x21297a52
xchg rdi, rbx
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdi
mov rbx, qword [rsp + 0x40]
xchg rdi, rbx
xchg rbx, rsi
mov rbx, qword [rsp + 0x38]
xchg rbx, rsi
sub rsp, 0xffffffffffffffe0
pop r14
mov r9, r9
ret
Function at 0x1400b6e00
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
xchg r10, rbx
mov qword [r11 + 8], r10
xchg rbx, r10
xchg r12, rsi
mov qword [r11 + 0x18], r12
xchg r12, rsi
xchg rdi, r8
mov qword [r11 + 0x20], r8
xchg r8, rdi
push r14
xchg r11, r11
add rsp, 0xffffffffffffffc0
mov rax, qword [0x1401434c8]
lea rdx, [r11 + 0x10]
not rax
mov r10, r10
mov dword [rsp + 0x58], 0x6b45303f
sub dword [rsp + 0x58], 0x5af9748c
add dword [rsp + 0x58], 0x52160a14
sub dword [rsp + 0x58], 0x6261c5b7
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
movabs rcx, 0x2d6b95a8006e6641
add rcx, 0x1175d0db
add rcx, 0x1430ef89
add rcx, 0x4d2abd70
xor rcx, 0x463961d9
add rax, rcx
movabs rcx, 0x421356f7015c01ce
add rcx, 0x20179ad0
xor rcx, 0x506f2c3
add rcx, 0x184e845
not rax
sub rax, rcx
xchg rbp, rbp
lea rcx, [r11 - 0x28]
rol rax, 2
rol rax, 0xd
rol rax, 2
rol rax, 1
call rax
xchg r8, r8
lea rdi, [rbx + 8]
xorps xmm0, xmm0
xchg r9, rdi
mov qword [rbx], r9
xchg rdi, r9
xor esi, esi
mov dword [rsp - 0x2c], 0x7a5b7243
xchg r15, rdi
movups xmmword [r15], xmm0
xchg r15, rdi
movups xmmword [rdi + 0x10], xmm0
xchg rdi, r15
movups xmmword [r15 + 0x20], xmm0
xchg r15, rdi
test eax, eax
mov rbp, rbp
jne 0x1400b6f14
mov qword [rbx + 0x38], rsi
jmp 0x1400b7036
lea rax, [rsp + 0x20]
xchg rbx, rbx
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
mov rbp, rbp
jne 0x1400b6f20
mov qword [rbx + 0x38], r14
cmp qword [rbx], rdi
mov rbp, rbp
je 0x1400b6f4d
mov rcx, qword [rbx]
call fcn.1400999d0
mov dword [rsp - 0x24], ebx
cmp r14, 0x18
jbe 0x1400b6f7d
lea rcx, [r14 + r14]
call fcn.140099d10
mov r10, r10
mov qword [rbx], rax
test rax, rax
jne 0x1400b6f8d
mov qword [rbx], rdi
xchg rsp, rsp
mov rcx, rsi
jmp 0x1400b6fb3
xchg rdi, r8
mov qword [rbx], r8
xchg r8, rdi
xchg r11, rax
mov r11, rdi
xchg r11, rax
xorps xmm0, xmm0
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
xchg rsi, rax
movups xmmword [rsi + 0x10], xmm0
xchg rsi, rax
xchg r12, rax
movups xmmword [r12 + 0x20], xmm0
xchg r12, rax
xchg rsp, rcx
mov rsp, qword [rbx]
xchg rcx, rsp
mov edx, 0x4c1ddb63
sub edx, 0x8478c70
xor edx, 0x4317f169
xor edx, 0x2e6eed29
cmp qword [rbx + 0x38], rsi
xchg r14, r14
jbe 0x1400b7036
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov dword [rsp - 0xc], 0x37dc195a
mov r9d, 0x56a89be2
xor r9d, 0x31c75287
xor r9d, 0x2da1163f
sub r9d, 0x4acede5b
and ax, r9w
xchg rcx, rcx
ror edx, 5
ror edx, 3
xor ax, word [r8 + rcx]
mov rdx, rdx
inc rsi
mov word [rcx], ax
lea rcx, [rcx + 2]
mov dword [rsp - 0x30], 0x7cc90104
cmp rsi, qword [rbx + 0x38]
jb 0x1400b6fdf
mov rsi, qword [rsp + 0x60]
xchg r12, rax
mov r12, rbx
xchg r12, rax
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
sub rsp, 0xffffffffffffffc0
xchg r15, r15
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x1400dac40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp - 0x28], 0x570174f9
mov qword [rsp + 0x18], rsi
xchg rbx, rdi
mov qword [rsp + 0x20], rbx
xchg rbx, rdi
nop
sub rsp, 8
mov qword [rsp], rbp
mov rbp, rsp
sub rsp, 0x50
mov dword [rsp - 0x3c], ebx
xor esi, esi
mov dword [rbp - 0x30], 0x7b7a194
add dword [rbp - 0x30], 0x24ce6e24
add dword [rbp - 0x30], 0x43ae5dd5
xor dword [rbp - 0x30], 0x70156d69
mov dword [rbp - 0x2c], 0x27d38667
add dword [rbp - 0x2c], 0x1e3e6b9f
sub dword [rbp - 0x2c], 0x41f214bf
sub dword [rbp - 0x2c], 0x3aedcaa
xchg r13, rbx
mov r13, rcx
xchg r13, rbx
mov dword [rbp - 0x28], 0x4bfceff
add dword [rbp - 0x28], 0x3891d54b
xor dword [rbp - 0x28], 0x53b4003a
xor dword [rbp - 0x28], 0x42ef807b
xor dword [rbp - 0x28], 0x2c6a248b
mov dword [rbp - 0x24], 0x6ffa9865
sub dword [rbp - 0x24], 0x6e734497
add dword [rbp - 0x24], 0x25d71eb9
xor dword [rbp - 0x24], 0x61433ace
sub dword [rbp - 0x24], 0x45d347c8
mov dword [rbp - 0x20], 0x494683c0
sub dword [rbp - 0x20], 0x93f0a4a
sub dword [rbp - 0x20], 0x3248a162
xor dword [rbp - 0x20], 0x5973345d
xor dword [rbp - 0x20], 0x54f3ec96
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
mov r8, r8
mov rax, qword [rbp + 0x10]
and cl, 3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x2dca9fd6
add eax, 0x165fa9ac
xor eax, 0x244b3a87
sub eax, 0x31b22052
shr eax, cl
movzx ecx, al
mov rax, qword [rbp + 0x10]
mov dword [rsp - 0x2c], edi
xor cx, dx
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
inc rax
xchg rdx, rdx
xchg rcx, rax
mov qword [rbp + 0x10], rcx
xchg rcx, rax
xchg r11, rax
mov r11, qword [rbp + 0x10]
xchg r11, rax
cmp rax, 0xa
xchg r9, r9
jb 0x1400dad25
xor edx, edx
mov word [rbp - 8], si
lea rcx, [rbp - 0x1c]
mov dword [rsp - 0x10], ecx
call fcn.14008be30
mov r8, rax
mov qword [rbx + 0x200], rax
xchg r15, r15
xor eax, eax
lea rdi, [rbp - 0x1c]
lea ecx, [rax + 0xa]
mov dword [rsp - 0x24], 0x61075376
rep stosb byte [rdi], al
test r8, r8
je 0x1400dae20
mov r15, r15
lea rdx, [rbx + 0x208]
xchg r8, rcx
mov r8, rcx
xchg r8, rcx
call fcn.1400db4bc
mov dword [rsp - 0x10], edx
test al, al
jne 0x1400dae16
xchg rcx, r12
mov r12, qword [rbx + 0x200]
xchg rcx, r12
call fcn.14008e3a0
xchg r13, r13
xor al, al
xchg rbp, rsi
mov qword [rbx + 0x200], rbp
xchg rsi, rbp
jmp 0x1400dae20
mov al, 0x24
xor al, 0x3b
sub al, 0x10
xor al, 0x42
sub al, 0x4c
mov rbx, qword [rsp + 0x68]
xchg rsi, r8
mov r8, qword [rsp + 0x70]
xchg r8, rsi
xchg rdx, rdi
mov rdx, qword [rsp + 0x78]
xchg rdx, rdi
add rsp, 0x50
pop rbp
mov dword [rsp - 0x44], 0x1db2617d
ret
Function at 0x1400db2bc
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 0x10], r14
xchg r14, rbx
push rdi
mov dword [rsp - 0x20], 0x7fb68c73
add rsp, 0x74ac9d85
sub rsp, 0x74ac9ec5
xchg rcx, r8
mov rdi, rcx
xchg rcx, r8
mov rbx, rcx
mov rsi, rsi
mov r8d, 0x2bdbd411
add r8d, 0xa25447
sub r8d, 0x2b8aa98f
xor r8d, 0xf37fc9
lea rcx, [rsp + 0x40]
xor edx, edx
mov dword [rsp - 0x40], esp
call fcn.14009a030
xchg rcx, rax
mov rcx, qword [rbx + 0x238]
xchg rcx, rax
lea r8, [rsp + 0x40]
mov edx, dword [rdi + 0x10]
mov dword [rsp - 0x28], 0x25fbcdee
movabs rcx, 0x7b823c102d318b19
sub rcx, 0x223d5f31
xor rcx, 0x1e9b4a35
xor rcx, 0x2a9d5712
add rcx, 0x709c0dbc
add rax, rcx
mov dword [rsp - 0x40], esp
mov dword [rsp + 0x30], 0x1ed0ea21
add dword [rsp + 0x30], 0x127f6aae
add dword [rsp + 0x30], 0x14800ebb
add dword [rsp + 0x30], 0x13cf0a55
xor dword [rsp + 0x30], 0x599f6ddd
and dword [rsp + 0x28], 0
xchg r11, r11
not rax
and qword [rsp + 0x20], 0
movabs rcx, 0x4ed9571d5e73d921
xor rcx, 0x6020124f
add rcx, 0x2929ce37
xor rcx, 0x4bb9023e
add rcx, 0x326d36ea
sub rax, rcx
mov dword [rsp - 0x3c], esi
mov r9d, 0x690b234
xor r9d, 0x2c6b428e
sub r9d, 0xe5d9bbf
sub r9d, 0x1c9e53fb
mov rcx, qword [rdi + 0x20]
not rax
mov rcx, rcx
rol rax, 3
rol rax, 1
call rax
test eax, eax
xchg r10, r10
jne 0x1400db494
or eax, 0xffffffff
lea rbx, [rsp + 0x40]
cmp byte [rsp + 0x40], 0
mov dword [rsp - 0x2c], ebp
mov dword [rsp + 0x150], eax
je 0x1400db467
xchg rsi, rdx
mov rsi, rbx
xchg rsi, rdx
lea rcx, [rsp + 0x150]
mov r8d, 0x2553a582
add r8d, 0x18b2d4ae
add r8d, 0x122ce996
xor r8d, 0x503363c7
inc rbx
mov rdi, rdi
call fcn.14008efd0
cmp byte [rbx], 0
jne 0x1400db41d
xchg r15, r15
mov eax, dword [rsp + 0x150]
not eax
cmp eax, 0xa2ca6717
je 0x1400db485
mov dword [rsp - 0x30], esi
cmp eax, 0xd7b7e7a8
sete al
jmp 0x1400db496
mov al, 0x49
sub al, 0x1e
sub al, 0xe
xor al, 0xb
sub al, 0x15
jmp 0x1400db496
xor al, al
xchg rcx, rbx
mov rcx, qword [rsp + 0x158]
xchg rbx, rcx
sub rsp, 0xfffffffffffffec0
xchg r9, r9
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret

Function at 0x1400dfa10
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 8], rbx
xchg r10, r10
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0x726be249
sub rsp, 0x726be309
xchg r10, rax
mov r10, r8
xchg r10, rax
xchg rbp, rdx
mov rbx, rbp
xchg rbp, rdx
xchg r8, r11
mov r11, rdx
xchg r11, r8
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
mov edx, 0x4adce78
add edx, 0x3a6faa62
xor edx, 0x7fffc9d7
add edx, 0x202a584
sub edx, 0x42e55671
xchg r13, rax
mov rcx, r13
xchg r13, rax
call fcn.1400e0280
mov dword [rsp - 0x18], ebp
movzx eax, byte [rbx + 0x1f]
lea rcx, [rsp + 0x20]
and byte [rbx], 0xf8
and al, 0x3f
mov r14, r14
or al, 0x40
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
mov byte [rbx + 0x1f], al
call fcn.1400e3890
mov dword [rsp - 0x28], edi
lea rdx, [rsp + 0x20]
xchg rbx, rcx
mov rbx, rdi
xchg rbx, rcx
call fcn.1400e37d0
mov rbx, qword [rsp + 0xd0]
sub rsp, 0xffffffffffffff40
mov dword [rsp - 0x30], ebx
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400f2454
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
neg rsp
sub rsp, 0xffffffffffffffd0
neg rsp
mov dword [rcx + 8], 0x39dc005c
sub dword [rcx + 8], 0x36efb94f
xor dword [rcx + 8], 0x2ec470c
lea r14, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x14000ba68]
mov qword [rcx], rax
mov rbp, rdx
lea rax, [r14 + 8]
mov rbx, rcx
mov qword [r14], rax
xor edi, edi
mov qword [rcx + 0x290], rdi
mov rsi, r8
movups xmmword [rax], xmm0
mov rcx, r14
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [r14 + 0x38], rdx
call fcn.140017924
mov r8d, edi
cmp qword [r14 + 0x38], rdi
jbe 0x1400f24f6
mov rcx, qword [rsi]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [r14 + 0x38]
jb 0x1400f24dc
mov ecx, dword [rsi + 0x40]
mov edx, 0x2d49ff54
sub edx, 0x2ce7f3df
add edx, 0x283022fa
mov qword [rbx + 0x2e0], rdi
bts ecx, 0xe
mov dword [rbx + 0x2d8], ecx
mov r15d, 0x62e6f215
sub r15d, 0x6176bd4a
xor r15d, 0x40812842
mov eax, dword [rsi + 0x54]
and ecx, 0x2000
xor eax, edx
mov dword [rbx + 0x2e8], eax
mov eax, dword [rsi + 0x58]
xor eax, edx
mov dword [rbx + 0x2ec], eax
mov eax, dword [rsi + 0x44]
xor eax, edx
mov dword [rbx + 0x2f0], eax
mov eax, dword [rsi + 0x48]
xor eax, edx
mov dword [rbx + 0x2f4], eax
mov rax, qword [rsi + 0x60]
mov qword [rbx + 0x2f8], rax
mov eax, dword [rsi + 0x4c]
xor eax, r15d
mov dword [rbx + 0x308], eax
mov eax, dword [rsi + 0x50]
xor eax, edx
mov byte [rbx + 0x310], dil
neg ecx
mov dword [rbx + 0x30c], eax
pushf
mov edx, 0x7f2938a9
sub edx, 0x4786e3e9
add edx, 0x1009e5e7
xor edx, 0x47ac3ab7
popf
mov qword [rbx + 0x318], rbp
sbb r14, r14
and r14, 0xffffffffffff0100
sub r14, 0xffffffffffff0001
mov rcx, r14
shl rcx, 4
call fcn.140099900
mov rcx, rax
mov rdx, r14
movaps xmm0, xmmword [0x140148580]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x1400f25d1
mov qword [rbx + 0x300], rax
mov rdx, rdi
mov rax, qword [rsi + 0x68]
inc rdi
mov ecx, dword [rax + rdx]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x20], xmm0
mov ecx, dword [rax + rdx + 4]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x24], xmm0
mov ecx, dword [rax + rdx + 8]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rsi + 0x68]
movss dword [rsp + 0x28], xmm0
mov ecx, dword [rax + rdx + 0xc]
xor ecx, r15d
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x300]
movss dword [rsp + 0x2c], xmm0
movups xmm1, xmmword [rsp + 0x20]
xorps xmm1, xmmword [0x140148580]
movups xmmword [rdx + rax], xmm1
lea rdx, [rdx + 0x10]
cmp rdi, r14
jl 0x1400f25f3
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x50]
call fcn.1400f20fc
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop
add rsp, 0x6267f052
sub rsp, 0x6267f022
pop r15
pop r14
pop rdi
ret