joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f5ab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rcx + 0x28]
mov rax, qword [rcx + 0x58]
mov rbx, rcx
mov rsi, rdx
cmp rdi, rdx
jae 0x5f5c9f
mov rcx, qword [rcx + 0x30]
cmp rcx, rdx
jbe 0x5f5c66
lea r11, [rdi + 1]
mov r10, r11
shl r10, 4
jmp 0x5f5af8
mov rax, qword [rbx + 0x58]
add r11, 1
lea rdx, [rax + r10]
lea rax, [rax + r10 - 0x10]
movzx r9d, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
movzx ecx, byte [rax]
lea ebp, [r8 + r8]
lea edi, [r9 + r9]
sar r9d, 7
sar r8d, 7
or r9d, ebp
sar cl, 7
mov byte [rdx + 0xe], r9b
movzx r9d, byte [rax + 0xd]
and ecx, 0xffffff87
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xd], r8b
movzx r8d, byte [rax + 0xc]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xc], r9b
movzx r9d, byte [rax + 0xb]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xb], r8b
movzx r8d, byte [rax + 0xa]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xa], r9b
movzx r9d, byte [rax + 9]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 9], r8b
movzx r8d, byte [rax + 8]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 8], r9b
movzx r9d, byte [rax + 7]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 7], r8b
movzx r8d, byte [rax + 6]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 6], r9b
movzx r9d, byte [rax + 5]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 5], r8b
movzx r8d, byte [rax + 4]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 4], r9b
movzx r9d, byte [rax + 3]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 3], r8b
movzx r8d, byte [rax + 2]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 2], r9b
movzx r9d, byte [rax + 1]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 1], r8b
movzx r8d, byte [rax]
lea eax, [r8 + r8]
or eax, r9d
xor ecx, edi
add r10, 0x10
mov byte [rdx], al
mov byte [rdx + 0xf], cl
cmp r11, rsi
jne 0x5f5af0
mov rax, qword [rbx + 0x58]
mov qword [rbx + 0x28], r11
shl r11, 4
add rax, r11
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [rdx + 4]
mov r9d, 0x71
lea r8, str.crypto_modes_ocb128.c
sub rdx, rcx
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, rax
mov qword [rbx + 0x30], rdx
shl rdx, 4
call sym.CRYPTO_realloc
test rax, rax
je 0x5f5c5d
mov qword [rbx + 0x58], rax
jmp 0x5f5adc
shl rsi, 4
add rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x5f9e50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r8d, dword [rcx]
mov rdx, qword [rcx + 8]
mov rbx, rcx
cmp r8d, 2
je 0x5f9f10
jg 0x5f9e98
test r8d, r8d
je 0x5f9eb8
cmp r8d, 1
jne 0x5f9ea8
mov rcx, qword [rdx]
call sym.OPENSSL_LH_strhash
mov r8d, dword [rbx]
and eax, 0x3fffffff
shl r8d, 0x1e
or eax, r8d
add rsp, 0x28
pop rbx
pop rsi
ret
cmp r8d, 3
jne 0x5f9ea8
mov eax, dword [rdx + 0x10]
jmp 0x5f9e82
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, dword [rdx + 0x14]
mov r11, qword [rdx + 0x18]
mov eax, ecx
shl eax, 0x14
test ecx, ecx
jle 0x5f9e82
lea esi, [rcx + rcx*2]
xor r9d, r9d
mov ebx, 0xaaaaaaab
nop dword [rax + rax]
mov edx, r9d
movzx r10d, byte [r11]
mov ecx, r9d
add r9d, 3
imul rdx, rbx
add r11, 1
shr rdx, 0x24
lea edx, [rdx + rdx*2]
shl edx, 3
sub ecx, edx
shl r10d, cl
xor eax, r10d
cmp esi, r9d
jne 0x5f9ed8
jmp 0x5f9e82
mov rcx, qword [rdx + 8]
call sym.OPENSSL_LH_strhash
mov r8d, dword [rbx]
jmp 0x5f9e82
Function at 0x60ba10
Capabilities:
Generate random numbers via winapi

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x50
mov edx, 1
mov r12, rcx
call sym.rand_pool_bytes_needed
mov rcx, r12
mov rdx, rax
mov r13, rax
call sym.rand_pool_add_begin
mov rbx, rax
test rax, rax
je 0x60ba90
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x60bb10
xor r8d, r8d
xor r13d, r13d
mov rcx, r12
mov rdx, r13
call sym.rand_pool_add_end
mov rcx, r12
call sym.rand_pool_entropy_available
test rax, rax
je 0x60ba90
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov edx, 1
mov rcx, r12
call sym.rand_pool_bytes_needed
mov rcx, r12
mov rdx, rax
mov r13, rax
call sym.rand_pool_add_begin
mov rbx, rax
test rax, rax
je 0x60bafb
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x48]
mov r9d, 0x16
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x60bb60
xor r8d, r8d
xor r13d, r13d
mov rcx, r12
mov rdx, r13
call sym.rand_pool_add_end
mov rcx, r12
call sym.rand_pool_entropy_available
test rax, rax
jne 0x60ba80
mov rcx, r12
call sym.rand_pool_entropy_available
add rsp, 0x50
pop rbx
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x60bb50
xor r8d, r8d
xor r13d, r13d
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x38]
jmp 0x60ba68
lea r8, [r13*8]
jmp 0x60bb2b
mov rcx, qword [rsp + 0x48]
mov r8, rbx
mov edx, r13d
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x60bba0
lea r8, [r13*8]
mov qword [rsp + 0x38], r8
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8, qword [rsp + 0x38]
jmp 0x60bae3
xor r8d, r8d
xor r13d, r13d
jmp 0x60bb7d
Function at 0x60ff60
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 0x18]
jmp sym.BN_num_bits
Function at 0x6179b0
Capabilities:
Check for software breakpoints

Disassembly:
push r12
sub rsp, 0x30
mov eax, dword [rsp + 0x60]
cmp eax, r9d
jne 0x617a88
movzx r9d, byte [r8]
lea edx, [r9 - 0x6a]
cmp dl, 1
ja 0x617a88
lea rdx, [r8 + 1]
lea r12d, [rax - 2]
cmp r9b, 0x6b
je 0x617a08
movsxd rax, r12d
cmp byte [rdx + rax], 0xcc
jne 0x617ab7
mov r8d, r12d
call sym.memcpy
mov eax, r12d
add rsp, 0x30
pop r12
ret
lea r12d, [rax - 3]
test r12d, r12d
jle 0x617a3b
xor eax, eax
jmp 0x617a26
cmp r8b, 0xbb
jne 0x617a48
add eax, 1
cmp r12d, eax
je 0x617a80
movzx r8d, byte [rdx]
add rdx, 1
cmp r8b, 0xba
jne 0x617a18
sub r12d, eax
test eax, eax
jne 0x6179e2
mov dword [rsp + 0x20], 0x50
jmp 0x617a50
mov dword [rsp + 0x20], 0x48
mov r8d, 0x8a
mov edx, pe_nt_image_headers64
mov ecx, 4
mov r12d, 0xffffffff
lea r9, str.crypto_rsa_rsa_x931.c
call sym.ERR_put_error
mov eax, r12d
add rsp, 0x30
pop r12
ret
xor r12d, r12d
jmp 0x6179e2
mov r8d, 0x89
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x3d
lea r9, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call sym.ERR_put_error
jmp 0x6179f7
mov r8d, 0x8b
mov edx, pe_nt_image_headers64
mov ecx, 4
mov dword [rsp + 0x20], 0x59
lea r9, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call sym.ERR_put_error
jmp 0x6179f7

Function at 0x61b3f0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 1
jmp sym.sha1_block_data_order
Function at 0x61cd90
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
mov r8d, 1
jmp sym.sha256_block_data_order

Function at 0x61d0c0
Capabilities:
Hash data using sha256

Disassembly:
push r13
push r12
push rdi
sub rsp, 0x90
lea rax, [0x009f9400]
movdqu xmm0, xmmword [0x008f6420]
test r8, r8
mov r12, r8
lea r8, [rsp + 0x40]
mov r9, rcx
cmove r12, rax
mov ecx, 9
xor eax, eax
mov rdi, r8
rep stosq qword [rdi], rax
movups xmmword [rsp + 0x20], xmm0
movdqu xmm0, xmmword [0x008f6430]
lea r13, [rsp + 0x20]
movups xmmword [rsp + 0x30], xmm0
mov dword [rdi], 0
mov dword [rsp + 0x8c], 0x20
test rdx, rdx
je 0x61d135
mov r8, rdx
mov rcx, r13
mov rdx, r9
call sym.SHA256_Update.part.0
mov rdx, r13
mov rcx, r12
call sym.SHA256_Final
mov edx, 0x70
mov rcx, r13
call sym.OPENSSL_cleanse
mov rax, r12
add rsp, 0x90
pop rdi
pop r12
pop r13
ret
Function at 0x61f430
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov r8d, 1
jmp sym.sha512_block_data_order
Function at 0x6284d0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [rbx], eax
setne al
movzx eax, al
add rsp, 0x20
pop rbx
ret

Function at 0x6284f0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [r12]
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, r13d
mov r12, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x28
pop r12
pop r13
ret

Function at 0x628530
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
setne al
movzx eax, al
add rsp, 0x28
ret
Function at 0x64ab20
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, r8
call sym.AES_set_encrypt_key
test eax, eax
js 0x64ad34
mov edx, dword [rsi + 0xf0]
mov rcx, rsi
lea r11d, [rdx*4]
test r11d, r11d
jle 0x64abc3
movsxd rax, r11d
mov rdx, rsi
xor r8d, r8d
lea rax, [rsi + rax*4]
nop dword [rax + rax]
mov r9d, dword [rdx]
mov r10d, dword [rax]
add r8d, 4
add rdx, 0x10
sub rax, 0x10
mov dword [rdx - 0x10], r10d
mov r10d, dword [rax + 0x14]
mov dword [rax + 0x10], r9d
mov r9d, dword [rdx - 0xc]
mov dword [rdx - 0xc], r10d
mov r10d, dword [rax + 0x18]
mov dword [rax + 0x14], r9d
mov r9d, dword [rdx - 8]
mov dword [rdx - 8], r10d
mov r10d, dword [rax + 0x1c]
mov dword [rax + 0x18], r9d
mov r9d, dword [rdx - 4]
mov dword [rdx - 4], r10d
mov dword [rax + 0x1c], r9d
mov r9d, r11d
sub r9d, r8d
cmp r8d, r9d
jl 0x64ab68
mov edx, dword [rsi + 0xf0]
mov edi, 1
lea r11, [0x008fc580]
lea rax, [0x008fd180]
lea r10, [0x008fb980]
lea r9, [0x008fc180]
lea r8, [0x008fbd80]
cmp edx, 1
jle 0x64ad32
nop dword [rax]
mov r13d, dword [rcx + 0x10]
mov r12d, dword [rcx + 0x14]
add rcx, 0x10
add edi, 1
mov ebp, dword [rcx + 8]
mov r15d, dword [rcx + 0xc]
mov edx, r13d
movzx r14d, r13b
mov ebx, r13d
shr edx, 0x18
movzx r14d, byte [rax + r14*4]
movzx ebx, bh
movzx edx, byte [rax + rdx*4]
mov edx, dword [r11 + rdx*4]
xor edx, dword [r10 + r14*4]
mov r14d, r13d
shr r14d, 0x10
movzx r13d, byte [rax + rbx*4]
mov ebx, r12d
movzx r14d, r14b
movzx ebx, bh
movzx r14d, byte [rax + r14*4]
xor edx, dword [r9 + r14*4]
xor edx, dword [r8 + r13*4]
movzx r13d, r12b
movd xmm0, edx
mov edx, r12d
movzx r13d, byte [rax + r13*4]
shr edx, 0x18
movzx edx, byte [rax + rdx*4]
mov edx, dword [r11 + rdx*4]
xor edx, dword [r10 + r13*4]
mov r13d, r12d
shr r13d, 0x10
movzx r12d, byte [rax + rbx*4]
mov ebx, ebp
movzx r13d, r13b
movzx r13d, byte [rax + r13*4]
xor edx, dword [r9 + r13*4]
xor edx, dword [r8 + r12*4]
movzx r13d, bpl
mov r12d, edx
mov edx, ebp
movzx r13d, byte [rax + r13*4]
shr edx, 0x18
movd xmm3, r12d
movzx edx, byte [rax + rdx*4]
punpckldq xmm0, xmm3
mov edx, dword [r11 + rdx*4]
xor edx, dword [r10 + r13*4]
mov r13d, ebp
movzx ebp, bh
shr r13d, 0x10
movzx ebp, byte [rax + rbp*4]
mov ebx, r15d
movzx r13d, r13b
shr ebx, 0x18
movzx r13d, byte [rax + r13*4]
xor edx, dword [r9 + r13*4]
movzx r13d, r15b
xor edx, dword [r8 + rbp*4]
mov ebp, ebx
movzx r13d, byte [rax + r13*4]
movzx ebp, byte [rax + rbp*4]
mov ebx, r15d
movd xmm1, edx
shr ebx, 0x10
mov ebp, dword [r11 + rbp*4]
xor ebp, dword [r10 + r13*4]
movzx r13d, bl
mov ebx, r15d
movzx ebx, bh
movzx r13d, byte [rax + r13*4]
movzx ebx, byte [rax + rbx*4]
xor ebp, dword [r9 + r13*4]
xor ebp, dword [r8 + rbx*4]
movd xmm2, ebp
punpckldq xmm1, xmm2
punpcklqdq xmm0, xmm1
movups xmmword [rcx], xmm0
cmp dword [rsi + 0xf0], edi
jg 0x64abf8
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x64dec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x38
test r9, r9
je 0x64df90
movzx r10d, byte [r8]
mov ebx, r10d
and ebx, 0xffffff80
test rdx, rdx
je 0x64dee3
movzx eax, bl
mov dword [rdx], eax
cmp r9, 1
je 0x64dfc8
movzx eax, byte [r8]
test al, al
jne 0x64df58
movzx eax, byte [r8 + 1]
and eax, 0xffffff80
cmp bl, al
je 0x64dff8
lea r11, [r9 - 1]
test rcx, rcx
je 0x64df47
movsx eax, r10b
sub r9, r11
sar r10b, 7
lea rdx, [r11 - 1]
shr eax, 0x1f
add r9, r8
nop dword [rax + rax]
movzx r8d, byte [r9 + rdx]
xor r8d, r10d
movzx r8d, r8b
add eax, r8d
mov byte [rcx + rdx], al
sub rdx, 1
shr eax, 8
cmp rdx, 0xffffffffffffffff
jne 0x64df28
mov rax, r11
add rsp, 0x38
pop rbx
pop rsi
ret
mov r11, r9
cmp al, 0xff
jne 0x64df09
lea rax, [r8 + 1]
lea rsi, [r8 + r9]
xor edx, edx
nop dword [rax]
movzx r11d, byte [rax]
add rax, 1
or edx, r11d
cmp rsi, rax
jne 0x64df70
test edx, edx
jne 0x64def5
mov r11, r9
jmp 0x64df09
mov r8d, 0xde
mov edx, 0xe2
mov ecx, 0xd
mov dword [rsp + 0x20], 0x9a
lea r9, str.crypto_asn1_a_int.c
call sym.ERR_put_error
xor r11d, r11d
mov rax, r11
add rsp, 0x38
pop rbx
pop rsi
ret
mov r11d, 1
test rcx, rcx
je 0x64df47
movzx eax, byte [r8]
mov edx, eax
neg eax
test r10b, r10b
cmovns eax, edx
mov byte [rcx], al
mov rax, r11
add rsp, 0x38
pop rbx
pop rsi
ret
mov r8d, 0xdd
mov edx, 0xe2
mov ecx, 0xd
mov dword [rsp + 0x20], 0xbb
lea r9, str.crypto_asn1_a_int.c
call sym.ERR_put_error
xor r11d, r11d
jmp 0x64df47

Function at 0x64e090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
movsxd r8, dword [rcx]
mov r11, qword [rcx + 8]
mov r10, r8
test r11, r11
je 0x64e0d8
test r8, r8
je 0x64e0d8
mov eax, dword [rcx + 4]
movzx ecx, byte [r11]
and eax, 0x100
jne 0x64e158
cmp rcx, 0x7f
jbe 0x64e148
lea rdi, [r8 + 1]
xor ebx, ebx
mov r10d, edi
mov rsi, rdi
jmp 0x64e0ea
xor esi, esi
mov r10d, 1
xor ebx, ebx
mov edi, 1
xor r8d, r8d
test rdx, rdx
je 0x64e13b
mov r9, qword [rdx]
test r9, r9
je 0x64e13b
mov eax, ebx
sub rsi, r8
mov byte [r9], bl
lea rcx, [r8 - 1]
and eax, 1
add r9, rsi
movzx eax, al
test r8, r8
je 0x64e138
nop dword [rax]
movzx r8d, byte [r11 + rcx]
xor r8d, ebx
movzx r8d, r8b
add eax, r8d
mov byte [r9 + rcx], al
sub rcx, 1
shr eax, 8
cmp rcx, 0xffffffffffffffff
jne 0x64e118
add qword [rdx], rdi
mov eax, r10d
pop rbx
pop rsi
pop rdi
ret
mov rdi, r8
xor ebx, ebx
test eax, eax
je 0x64e0cc
nop dword [rax]
cmp rcx, 0x80
jbe 0x64e178
lea rdi, [r8 + 1]
mov ebx, 0xffffffff
mov r10d, edi
jmp 0x64e0cc
mov rdi, r8
mov ebx, 0xffffffff
jne 0x64e0cc
cmp r8, 1
jbe 0x64e1c8
lea rax, [r11 + 1]
lea r10, [r11 + r8]
xor ecx, ecx
nop word cs:[rax + rax]
movzx r9d, byte [rax]
add rax, 1
or ecx, r9d
cmp r10, rax
jne 0x64e1a0
test ecx, ecx
setne dil
mov ebx, edi
and edi, 1
add rdi, r8
neg ebx
mov r10d, edi
jmp 0x64e0cc
mov edi, 1
xor ebx, ebx
jmp 0x64e0cc
Function at 0x64f900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x10
mov r10d, 8
lea rax, [rsp + 0xf]
nop dword [rax]
mov byte [rax], dl
mov r11, r10
mov edi, edx
sub r10, 1
mov rbx, rdx
shr rdx, 8
mov r9, rax
mov rsi, rax
lea rax, [rax - 1]
jne 0x64f918
mov eax, 8
sub rax, r10
mov rbp, rax
je 0x64f9c0
test dil, dil
jns 0x64f9e0
test r8d, r8d
jne 0x64fa00
mov edx, 9
xor edi, edi
sub rdx, r10
mov r12d, edx
test rcx, rcx
je 0x64f9ce
sub r11, 9
mov eax, edi
mov r8d, 7
mov byte [rcx], dil
and eax, 1
sub r8, r10
lea r10, [rbp + r11]
add rdx, r11
movzx eax, al
add r9, r10
add rcx, rdx
nop dword [rax]
movzx edx, byte [r9 + r8]
xor edx, edi
movzx edx, dl
add eax, edx
mov byte [rcx + r8], al
sub r8, 1
shr eax, 8
cmp r8, 0xffffffffffffffff
jne 0x64f990
mov eax, r12d
add rsp, 0x10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test rcx, rcx
je 0x64f9ef
mov byte [rcx], 0
mov r12d, 1
mov eax, r12d
add rsp, 0x10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test r8d, r8d
jne 0x64fa00
mov rdx, rbp
xor edi, edi
jmp 0x64f95f
mov r12d, 1
jmp 0x64f9ce
cmp dil, 0x80
jbe 0x64fa18
mov edx, 9
mov edi, 0xffffffff
sub rdx, r10
jmp 0x64f95f
mov rdx, rbp
mov edi, 0xffffffff
cmp rbx, 0x80
jne 0x64f95f
cmp rbp, 1
je 0x64f9e5
lea rax, [r9 + 1]
add rsi, rbp
xor edx, edx
nop dword [rax]
movzx r8d, byte [rax]
add rax, 1
or edx, r8d
cmp rsi, rax
jne 0x64fa40
test edx, edx
setne dl
mov edi, edx
and edx, 1
neg edi
add rdx, rbp
jmp 0x64f95f

Function at 0x651340
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, 1
mov r9, rcx
mov ebx, r8d
mov rcx, rdx
test r9, r9
je 0x651370
movsxd r8, r8d
mov edx, 1
mov ebx, ebx
call sym.fwrite
cmp rbx, rax
sete al
movzx eax, al
add rsp, 0x20
pop rbx
ret
Function at 0x65bcb0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r9, r8
mov r8d, 1
call sym.fwrite
add rsp, 0x28
ret

Function at 0x661a10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12d, 1
mov ebx, r12d
mov edi, dword [rsp + 0xc0]
mov qword [rsp + 0xa0], rcx
mov ecx, edi
mov esi, r9d
shl ebx, cl
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0xa8], edx
mov qword [rsp + 0xb0], r8
call sym.bn_wexpand
test rax, rax
je 0x661cb8
cmp edi, 3
jg 0x661b08
mov edx, dword [rsp + 0xa8]
test edx, edx
jle 0x661c90
mov rax, qword [rsp + 0xa0]
movsxd r11, ebx
mov rbp, qword [rsp + 0xb0]
shl r11, 3
mov r10, qword [rax]
mov eax, dword [rsp + 0xa8]
lea r9, [r10 + 8]
sub eax, 1
lea rdi, [r9 + rax*8]
nop dword [rax + rax]
mov rcx, rbp
xor r8d, r8d
xor edx, edx
nop dword [rax + rax]
mov r13d, edx
mov r12, qword [rcx]
add edx, 1
add rcx, 8
xor r13d, esi
lea eax, [r13 - 1]
not r13d
and eax, r13d
shr eax, 0x1f
neg rax
and rax, r12
or r8, rax
cmp ebx, edx
jne 0x661ac0
mov qword [r10], r8
add rbp, r11
mov r10, r9
cmp rdi, r9
je 0x661c90
add r9, 8
jmp 0x661ab0
lea ecx, [rdi - 2]
shl r12d, cl
lea eax, [r12 - 1]
and eax, esi
sar esi, cl
mov dword [rsp + 0x24], eax
mov eax, esi
lea edx, [rsi - 1]
mov r9d, esi
not eax
mov ebp, r9d
xor esi, 1
mov edi, r9d
and eax, edx
sub esi, 1
xor ebp, 3
xor edi, 2
shr eax, 0x1f
sub ebp, 1
sub edi, 1
neg rax
mov qword [rsp + 0x28], rax
mov eax, r9d
xor eax, 0xfffffffe
and esi, eax
mov eax, r9d
xor r9d, 0xfffffffc
xor eax, 0xfffffffd
and r9d, ebp
shr esi, 0x1f
and edi, eax
shr r9d, 0x1f
mov eax, dword [rsp + 0xa8]
neg rsi
shr edi, 0x1f
mov ebp, r9d
neg rdi
neg rbp
test eax, eax
jle 0x661c90
movsxd rbx, ebx
movsxd r14, r12d
lea rax, [rbx*8]
shl r14, 3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rax]
mov eax, dword [rsp + 0xa8]
mov qword [rsp + 0x30], rbx
sub eax, 1
add rbx, 8
lea rax, [rbx + rax*8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rax
mov eax, 2
shl eax, cl
movsxd r13, eax
mov eax, 3
shl eax, cl
shl r13, 3
movsxd r15, eax
shl r15, 3
nop dword [rax]
mov rdx, qword [rsp + 0xb0]
xor ebx, ebx
xor r9d, r9d
nop dword [rax]
lea rcx, [r14 + rdx]
mov rax, qword [rdx]
lea r8, [r15 + rdx]
and rax, qword [rsp + 0x28]
mov r11, qword [rcx]
lea rcx, [r13 + rdx]
add rdx, 8
mov rcx, qword [rcx]
mov r10, qword [r8]
mov r8d, dword [rsp + 0x24]
and r11, rsi
and rcx, rdi
and r10, rbp
xor r8d, r9d
or rcx, r11
add r9d, 1
or rax, rcx
mov ecx, r8d
sub r8d, 1
not ecx
or rax, r10
and r8d, ecx
shr r8d, 0x1f
neg r8
and rax, r8
or rbx, rax
cmp r12d, r9d
jne 0x661bf8
mov rax, qword [rsp + 0x30]
mov qword [rax], rbx
mov rax, qword [rsp + 0x40]
add qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x48], rax
je 0x661c90
add rax, 8
mov qword [rsp + 0x38], rax
jmp 0x661be8
mov rax, qword [rsp + 0xa0]
mov edi, dword [rsp + 0xa8]
mov dword [rax + 8], edi
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x661ca7
Function at 0x663560
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r13, rcx
mov r12, rdx
mov rcx, r8
mov edx, 4
mov rbx, r8
mov rsi, r9
call sym.BN_get_flags
test eax, eax
jne 0x6635aa
mov edx, 4
mov rcx, r12
call sym.BN_get_flags
test eax, eax
je 0x6635e0
mov r9, rsi
mov r8, rbx
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.BN_mod_exp_mont_consttime
mov edx, 4
mov rcx, rsi
call sym.BN_get_flags
test eax, eax
jne 0x6635aa
mov r9, rsi
mov r8, rbx
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.BN_mod_exp_mont.part.0

Function at 0x66a0a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x66a0c0
mov rax, qword [sym.Camellia_encrypt]
mov qword [rsp + 0x30], rax
jmp sym.CRYPTO_cbc128_encrypt
mov rax, qword [sym.Camellia_decrypt]
mov qword [rsp + 0x30], rax
jmp sym.CRYPTO_cbc128_decrypt
Function at 0x66aa10
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 0x28]
jmp sym.CMAC_Final
Function at 0x6830f0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x1b0
lea r12, [rsp + 0xd0]
mov rbx, rcx
mov rcx, rdx
mov edx, 0x20
mov r8, r12
lea rsi, [rsp + 0x40]
lea r13, [rsp + 0x70]
call sym.SHA512
movzx eax, byte [rsp + 0xef]
mov rdx, r12
lea r14, [rsp + 0x110]
mov rcx, r14
and byte [rsp + 0xd0], 0xf8
and eax, 0x3f
or eax, 0x40
mov byte [rsp + 0xef], al
call sym.ge_scalarmult_base_1
lea rdx, [rsp + 0x160]
mov rcx, rsi
call sym.fe_invert_1
mov r8, rsi
mov rdx, r14
mov rcx, r13
call sym.fe_mul_1
lea r14, [rsp + 0xa0]
mov r8, rsi
lea rdx, [rsp + 0x138]
mov rcx, r14
call sym.fe_mul_1
mov rdx, r14
mov rcx, rbx
call sym.fe_tobytes_1
lea rcx, [rsp + 0x20]
mov rdx, r13
call sym.fe_tobytes_1
movzx eax, byte [rsp + 0x20]
mov edx, 0x40
mov rcx, r12
and eax, 1
shl eax, 7
xor byte [rbx + 0x1f], al
call sym.OPENSSL_cleanse
nop
add rsp, 0x1b0
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret

Function at 0x683220
Capabilities:
Encrypt data using curve25519

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x178
movdqu xmm2, xmmword [rdx + 0x10]
movdqu xmm1, xmmword [rdx]
movups xmmword [rsp + 0x30], xmm2
movzx eax, byte [rsp + 0x3f]
mov r12, rcx
lea r14, [rsp + 0x20]
lea rcx, [rsp + 0xd0]
mov rdx, r14
movups xmmword [rsp + 0x20], xmm1
lea rbx, [rsp + 0xa0]
and eax, 0x7f
and byte [rsp + 0x20], 0xf8
lea r13, [rsp + 0x40]
or eax, 0x40
mov byte [rsp + 0x3f], al
call sym.ge_scalarmult_base_1
mov r8d, dword [rsp + 0x118]
movdqu xmm0, xmmword [rsp + 0xf8]
paddd xmm0, xmmword [rsp + 0x120]
mov edx, dword [rsp + 0x140]
movdqu xmm3, xmmword [rsp + 0xf8]
mov ecx, dword [rsp + 0x11c]
movups xmmword [rsp + 0x40], xmm0
lea eax, [rdx + r8]
sub edx, r8d
movdqu xmm0, xmmword [rsp + 0x108]
paddd xmm0, xmmword [rsp + 0x130]
mov dword [rsp + 0x60], eax
movdqu xmm4, xmmword [rsp + 0x108]
mov eax, dword [rsp + 0x144]
mov dword [rsp + 0x90], edx
lea rdx, [rsp + 0x70]
movups xmmword [rsp + 0x50], xmm0
movdqu xmm0, xmmword [rsp + 0x120]
lea r9d, [rax + rcx]
sub eax, ecx
mov rcx, rbx
psubd xmm0, xmm3
mov dword [rsp + 0x64], r9d
movups xmmword [rsp + 0x70], xmm0
movdqu xmm0, xmmword [rsp + 0x130]
mov dword [rsp + 0x94], eax
psubd xmm0, xmm4
movups xmmword [rsp + 0x80], xmm0
call sym.fe_invert_1
mov r8, rbx
mov rdx, r13
mov rcx, r13
call sym.fe_mul_1
mov rdx, r13
mov rcx, r12
call sym.fe_tobytes_1
mov edx, 0x20
mov rcx, r14
call sym.OPENSSL_cleanse
nop
add rsp, 0x178
pop rbx
pop r12
pop r13
pop r14
ret

Function at 0x68cfb0
Capabilities:
Encode data using base64

Disassembly:
mov r10, rcx
mov rcx, rdx
mov rdx, r8
mov r8, r9
lea r9, [r10 + 0x48]
jmp sym.BN_GF2m_mod_mul_arr