joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140150fd0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140150ff9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x140151060
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1401510bf

Function at 0x1401510b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1401510b0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x140151140
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14015119f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140151190
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret
Function at 0x140151220
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14015127a

Function at 0x14015129a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140151270
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x140151330
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14015138a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140151380
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x140153b60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm8, xmm5
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm8, xmm6
pxor xmm6, xmm14
pxor xmm8, xmm7
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesenc xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x140153c80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140153c80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesenclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
aesenclast xmm6, xmm14
aesenclast xmm7, xmm15
repz ret

Function at 0x140153d20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm8, xmm5
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140153dc0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140153dc0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
repz ret
Function at 0x140153e40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140153e80
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140153e80
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret

Function at 0x140154280
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x140154380
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140154380
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret
Function at 0x140154420
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1401544c0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1401544c0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x140154540
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140154580
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140154580
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x140154ff0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.140155060
shl edx, 4
test eax, eax
jne 0x140155056
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x14015501b
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x14016f6e0
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov rbp, rcx
mov rdi, rdx
mov rcx, r8
mov edx, 4
mov rbx, r8
mov rsi, r9
call fcn.140073070
test eax, eax
jne 0x14016f72a
mov edx, 4
mov rcx, rdi
call fcn.140073070
test eax, eax
je 0x14016f760
mov r9, rsi
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x80], r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.14016e810
mov edx, 4
mov rcx, rsi
call fcn.140073070
test eax, eax
jne 0x14016f72a
mov r9, rsi
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x80], r12
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.14016df10
Function at 0x140172190
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
movsxd rax, dword [r9 + 8]
mov r15, rax
mov rdi, rdx
mov edx, eax
mov qword [rsp + 0x30], rax
mov r14, rcx
mov rbx, r8
mov rbp, r9
call fcn.1400730b0
test rax, rax
je 0x14017237b
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x30], 0x10
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rax
ja 0x140172350
mov r10, qword [rdi]
mov rax, qword [r14]
movsxd rdx, r15d
mov rcx, qword [rsp + 0x28]
mov r11, qword [rbx]
test r10, r10
mov qword [rsp + 0x40], rax
mov rax, qword [rbp]
cmove r10, rcx
test r11, r11
mov qword [rsp + 0x48], rax
cmove r11, rcx
test rdx, rdx
je 0x140172380
movsxd r9, dword [rdi + 8]
movsxd rax, dword [rbx + 8]
movsxd rsi, dword [rbx + 0xc]
movsxd r13, dword [rdi + 0xc]
xor ebx, ebx
mov r8, rax
mov rdi, r9
sub rdx, r9
mov rax, r9
lea rbp, [rcx + r9*8]
sub rdi, r8
lea r8, [r9 + 1]
sub r9, rsi
mov r12, rdx
neg rax
xor ecx, ecx
xor edx, edx
sub r8, r13
add r9, 1
nop dword [rax]
mov r13, rax
lea rsi, [rdi + rax]
sar r13, 0x3f
and r13, qword [r10 + rdx*8]
add r13, rbx
setb bl
sar rsi, 0x3f
and rsi, qword [r11 + rcx*8]
add rsi, r13
movzx ebx, bl
mov qword [rbp + rax*8], rsi
lea rsi, [r8 + rax]
adc rbx, 0
shr rsi, 0x3f
add rdx, rsi
lea rsi, [r9 + rax]
add rax, 1
shr rsi, 0x3f
add rcx, rsi
cmp r12, rax
jne 0x140172260
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov r9d, r15d
mov r8, qword [rsp + 0x48]
mov rdx, rdi
mov rcx, rsi
call fcn.14016ad10
mov rdx, rdi
mov rcx, rsi
sub rbx, rax
mov rax, qword [rsp + 0x30]
lea r9, [rdi + rax*8]
nop word [rax + rax]
mov r8, qword [rcx]
mov rax, qword [rdx]
add rdx, 8
add rcx, 8
xor rax, r8
and rax, rbx
xor rax, r8
mov qword [rcx - 8], rax
mov qword [rdx - 8], 0
cmp rdx, r9
jne 0x1401722e0
mov dword [r14 + 8], r15d
mov rdi, qword [rsp + 0x38]
mov dword [r14 + 0x10], 0
cmp qword [rsp + 0x28], rdi
je 0x140172337
mov rcx, qword [rsp + 0x28]
mov r8d, 0x5a
lea rdx, str.crypto_bn_bn_mod.c
call fcn.1400c47e0
mov eax, 1
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movsxd rax, r15d
mov r8d, 0x3c
lea rdx, str.crypto_bn_bn_mod.c
lea rcx, [rax*8]
call fcn.1400c4810
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x1401721e6
xor eax, eax
jmp 0x14017233c
mov rdx, rcx
mov rcx, qword [rsp + 0x40]
mov r8, rax
xor r9d, r9d
call fcn.14016ad10
jmp 0x140172308
Function at 0x140188100
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x14032f2e0]
test eax, eax
je 0x140188120
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rbx, [0x14032f280]
mov r8d, 0x30
mov dword [0x14032f2e0], 1
lea rcx, str.OPENSSL_ia32cap
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0x2e
ja 0x140188200
movzx esi, word [0x14032f280]
xor eax, eax
cmp si, 0x7e
sete al
lea rcx, [rbx + rax*2]
call fcn.140188050
mov rbx, rax
cmp si, 0x7e
je 0x140188218
movzx edx, word [0x14032f280]
mov rdi, qword [str.0_n3_]
cmp dx, 0x3a
je 0x140188270
test dx, dx
je 0x1401881f0
lea rax, [0x14032f280]
jmp 0x1401881ad
movzx edx, word [rax + 2]
add rax, 2
test dx, dx
je 0x1401881f0
cmp dx, 0x3a
jne 0x1401881a0
movzx esi, word [rax + 2]
xor edx, edx
cmp si, 0x7e
sete dl
lea rcx, [rax + rdx*2 + 2]
call fcn.140188050
cmp si, 0x7e
je 0x140188258
mov qword [rdi + 8], rax
mov eax, ebx
shr rbx, 0x20
or ah, 4
mov dword [rdi + 4], ebx
mov dword [rdi], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov qword [rdi + 8], 0
jmp 0x1401881d8
mov rdi, qword [str.0_n3_]
mov rcx, rdi
call fcn.1401424e0
mov rbx, rax
jmp 0x1401881d8
mov rdi, qword [str.0_n3_]
mov rcx, rdi
call fcn.1401424e0
mov rdx, rbx
not rdx
and rax, rdx
test ebx, 0x1000000
je 0x140188290
movabs rbx, 0xedfff7fdffffffff
movzx edx, word [0x14032f280]
and rbx, rax
jmp 0x140188191
movq xmm1, qword [rdi + 8]
movq xmm0, rax
pandn xmm0, xmm1
movq qword [rdi + 8], xmm0
jmp 0x1401881d8
mov rcx, rdi
call fcn.1401424e0
movzx edx, word [0x14032f280]
mov rbx, rax
jmp 0x140188191
movzx edx, word [0x14032f280]
mov rbx, rax
jmp 0x140188191
Function at 0x14019aa10
Capabilities:
Encrypt data using curve25519

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b0
lea rsi, [rsp + 0xd0]
mov rbx, rcx
mov rcx, rdx
mov edx, 0x20
mov r8, rsi
lea rdi, [rsp + 0x40]
lea rbp, [rsp + 0x70]
call fcn.140112800
movzx eax, byte [rsp + 0xef]
mov rdx, rsi
lea r12, [rsp + 0x110]
mov rcx, r12
and byte [rsp + 0xd0], 0xf8
and eax, 0x3f
or eax, 0x40
mov byte [rsp + 0xef], al
call fcn.140196e10
lea rdx, [rsp + 0x160]
mov rcx, rdi
call fcn.140193b30
mov r8, rdi
mov rdx, r12
mov rcx, rbp
call fcn.140192d00
lea r12, [rsp + 0xa0]
mov r8, rdi
lea rdx, [rsp + 0x138]
mov rcx, r12
call fcn.140192d00
mov rdx, r12
mov rcx, rbx
call fcn.140192a70
lea rcx, [rsp + 0x20]
mov rdx, rbp
call fcn.140192a70
movzx eax, byte [rsp + 0x20]
mov edx, 0x40
mov rcx, rsi
shl eax, 7
xor byte [rbx + 0x1f], al
call fcn.1401426f0
nop
add rsp, 0x1b0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14019ab20
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
movdqu xmm4, xmmword [rdx + 0x10]
movdqu xmm3, xmmword [rdx]
movups xmmword [rsp + 0x30], xmm4
movzx eax, byte [rsp + 0x3f]
mov rbx, rcx
lea rdi, [rsp + 0x20]
lea rcx, [rsp + 0xd0]
mov rdx, rdi
movups xmmword [rsp + 0x20], xmm3
lea rbp, [rsp + 0xa0]
and eax, 0x7f
and byte [rsp + 0x20], 0xf8
lea rsi, [rsp + 0x40]
or eax, 0x40
mov byte [rsp + 0x3f], al
call fcn.140196e10
lea rdx, [rsp + 0x70]
mov rcx, rbp
movdqu xmm0, xmmword [rsp + 0xf8]
paddd xmm0, xmmword [rsp + 0x120]
movq xmm2, qword [rsp + 0x118]
movdqu xmm5, xmmword [rsp + 0xf8]
movdqu xmm3, xmmword [rsp + 0x108]
movups xmmword [rsp + 0x40], xmm0
movdqu xmm0, xmmword [rsp + 0x108]
paddd xmm0, xmmword [rsp + 0x130]
movups xmmword [rsp + 0x50], xmm0
movq xmm0, qword [rsp + 0x140]
movdqa xmm1, xmm0
psubd xmm0, xmm2
paddd xmm1, xmm2
movq qword [rsp + 0x90], xmm0
movq qword [rsp + 0x60], xmm1
movdqu xmm1, xmmword [rsp + 0x120]
psubd xmm1, xmm5
movups xmmword [rsp + 0x70], xmm1
movdqu xmm1, xmmword [rsp + 0x130]
psubd xmm1, xmm3
movups xmmword [rsp + 0x80], xmm1
call fcn.140193b30
mov r8, rbp
mov rdx, rsi
mov rcx, rsi
call fcn.140192d00
mov rdx, rsi
mov rcx, rbx
call fcn.140192a70
mov edx, 0x20
mov rcx, rdi
call fcn.1401426f0
nop
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1401dc5a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov qword [rsp + 0x148], rdx
mov r12, rcx
mov qword [rsp + 0x150], r8
test r8, r8
je 0x1401dc7d0
movzx eax, byte [rcx + 0xc]
xor edi, edi
lea rsi, [rsp + 0x70]
mov byte [rsp + 0x3e], al
movzx eax, byte [rcx + 0x14]
mov byte [rsp + 0x3f], al
lea rax, [rcx + 0xc]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rcx + 0x14]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
nop dword [rax]
mov rax, qword [rsp + 0x148]
mov r15, qword [rsp + 0x48]
movq xmm0, qword [rax + rdi]
movzx eax, byte [rsp + 0x3e]
mov rcx, r15
and eax, 0xffffff9f
movd ebp, xmm0
pshufd xmm1, xmm0, 0xe5
movq qword [rsp + 0x68], xmm0
or eax, 0x40
movd ebx, xmm1
movq qword [rsp + 0x60], xmm0
mov byte [r12 + 0xc], al
movzx eax, byte [rsp + 0x3f]
and eax, 0xffffff9f
or eax, 0x20
mov byte [r12 + 0x14], al
call fcn.14018eda0
mov rcx, r15
mov rdx, rsi
call fcn.14018efc0
mov rcx, qword [rsp + 0x40]
mov r8d, 1
mov rdx, rsi
call fcn.14018b490
mov r14, qword [rsp + 0x58]
mov rcx, r14
call fcn.14018eda0
mov rcx, r14
mov rdx, rsi
call fcn.14018efc0
mov rcx, qword [rsp + 0x50]
mov r8d, 1
mov rdx, rsi
call fcn.14018b490
mov r9d, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x60]
mov r8d, dword [rsp + 0x68]
xor r9d, ebx
xor ebx, dword [rsp + 0x64]
xor ecx, ebp
mov edx, r9d
mov r15d, r9d
mov eax, ebx
mov r14d, ecx
shr edx, 0x18
shr r15d, 0x10
mov r13d, ecx
xor r8d, ebp
movzx edx, dl
shr eax, 0x18
movzx r15d, r15b
mov r10d, r8d
shl rdx, 8
mov dword [rsp + 0x20], eax
mov eax, r9d
movzx r9d, r9b
or rdx, r15
movzx eax, ah
shr r14d, 0x18
mov r11d, r8d
shl rdx, 8
movzx r14d, r14b
shr r13d, 0x10
mov ebp, ebx
or rdx, rax
movzx r13d, r13b
movzx eax, ch
shr r10d, 0x10
shl rdx, 8
shr r11d, 0x18
movzx r10d, r10b
mov byte [rsp + 0x3e], cl
or rdx, r9
shr ebp, 0x10
movzx r11d, r11b
mov byte [rsp + 0x3f], r8b
shl rdx, 8
movzx ebp, bpl
movzx ecx, cl
or rdx, r14
shl rdx, 8
or rdx, r13
shl rdx, 8
add rdi, 8
or rdx, rax
movzx eax, byte [rsp + 0x20]
shl rdx, 8
shl rax, 8
or rdx, rcx
or rax, rbp
movzx ebp, bh
movzx ebx, bl
mov qword [rsp + 0x20], rdx
shl rax, 8
or rax, rbp
shl rax, 8
or rax, rbx
mov ebx, r8d
movzx r8d, r8b
shl rax, 8
movzx ebx, bh
or rax, r11
shl rax, 8
or rax, r10
shl rax, 8
or rax, rbx
shl rax, 8
or rax, r8
mov qword [rsp + 0x28], rax
movdqu xmm2, xmmword [rsp + 0x20]
movups xmmword [r12 + 0xc], xmm2
cmp rdi, qword [rsp + 0x150]
jb 0x1401dc610
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1401e7b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rdi, [rdi + 0x64]
sub rsp, 0xe8
mov r9, rsi
lea rsi, [rsp + 0x64]
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
lea r15, [0x1401e7d40]
mov qword [rsi + 0x74], rcx
cmp rdx, rcx
jb 0x1401e7c00
shr rcx, 3
lea r8, [rdi - 0x64]
mov rax, qword [r9]
lea r9, [r9 + 8]
xor rax, qword [r8]
lea r8, [r8 + 8]
sub rdx, 8
mov qword [r8 - 8], rax
sub rcx, 1
jne 0x1401e7bc6
mov qword [rsi + 0x64], r9
mov qword [rsi + 0x6c], rdx
call fcn.1401e7800
mov r9, qword [rsi + 0x64]
mov rdx, qword [rsi + 0x6c]
mov rcx, qword [rsi + 0x74]
jmp 0x1401e7bb9
mov rax, rdx
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret