joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2265f966200
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, edx
mov eax, 0xaaaaaaab
mul edx
mov rbp, rcx
mov rcx, qword [0x2265f97ab68]
shr edx, 1
lea edi, [rdx*4 + 5]
test rcx, rcx
je 0x2265f96634b
lea r8d, [rdi + 1]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r9, rax
test rax, rax
je 0x2265f96634b
xor r11d, r11d
xor edx, edx
test ebx, ebx
je 0x2265f96633d
lea esi, [rdi - 4]
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp edx, esi
jae 0x2265f96633d
xor r10d, r10d
xor r8d, r8d
mov cl, byte [r11 + rbp]
mov byte [rsp + r8 + 0x48], cl
cmp r11d, ebx
jae 0x2265f96628a
inc r10d
jmp 0x2265f966290
mov byte [rsp + r8 + 0x48], 0
inc r11d
inc r8
cmp r8, 3
jl 0x2265f966277
test r10d, r10d
je 0x2265f966334
movzx ecx, byte [rsp + 0x48]
movzx eax, byte [rsp + 0x48]
and ecx, 3
movzx r8d, byte [rsp + 0x49]
shr rax, 2
shl ecx, 4
mov al, byte [rax + r14]
mov byte [rsp + 0x50], al
mov eax, r8d
shr rax, 4
or rcx, rax
mov al, byte [rcx + r14]
mov byte [rsp + 0x51], al
cmp r10d, 1
jle 0x2265f966312
movzx eax, byte [rsp + 0x4a]
and r8d, 0xf
shr rax, 6
shl r8d, 2
mov ecx, r8d
or rcx, rax
mov al, byte [rcx + r14]
mov byte [rsp + 0x52], al
cmp r10d, 2
jle 0x2265f966317
movzx eax, byte [rsp + 0x4a]
and eax, 0x3f
mov cl, byte [rax + r14]
jmp 0x2265f966319
mov byte [rsp + 0x52], 0x3d
mov cl, 0x3d
mov byte [rsp + 0x53], cl
xor r8d, r8d
mov al, byte [rsp + r8 + 0x50]
inc r8
mov byte [rdx + r9], al
inc edx
cmp r8, 4
jl 0x2265f966320
cmp r11d, ebx
jb 0x2265f966269
cmp edx, edi
jae 0x2265f966346
mov byte [rdx + r9], 0
mov rax, r9
jmp 0x2265f96634d
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x2265f966bc4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
movsxd rsi, edx
mov rdi, rcx
lea rax, str.business.doc
xor r9d, r9d
inc rax
inc r9d
cmp byte [rax], 0
jne 0x2265f966be6
mov eax, 0xf
mov byte [rsp + 0x2f], 0
cmp r9d, eax
cmova r9d, eax
xor ecx, ecx
test r9d, r9d
je 0x2265f966c1d
lea rdx, [rsp + 0x20]
lea eax, [rcx + 0x41]
inc ecx
mov byte [rdx], al
inc rdx
cmp ecx, r9d
jb 0x2265f966c0e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9b, byte [rbx + 0x100]
mov r11, rsi
mov r10b, byte [rbx + 0x101]
test esi, esi
jle 0x2265f966c6e
inc r9b
movzx r8d, r9b
mov dl, byte [r8 + rbx]
add r10b, dl
movzx ecx, r10b
mov al, byte [rcx + rbx]
mov byte [r8 + rbx], al
mov byte [rcx + rbx], dl
add dl, byte [r8 + rbx]
movzx eax, dl
mov cl, byte [rax + rbx]
xor byte [rdi], cl
inc rdi
sub r11, 1
jne 0x2265f966c3d
mov rsi, qword [rsp + 0x48]
mov byte [rbx + 0x100], r9b
mov byte [rbx + 0x101], r10b
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x2265f966da0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r8, rcx
lea r9, [rsp]
add rcx, 0x1d
mov r10d, 0x10
sub r9, r8
movzx eax, byte [rcx]
movzx edx, byte [rcx - 1]
lea rcx, [rcx + 4]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 2]
shl edx, 8
or edx, eax
mov dword [r9 + rcx - 0x21], edx
sub r10, 1
jne 0x2265f966dd3
lea rcx, [rsp + 8]
lea edx, [r10 + 0x40]
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
ror eax, 0x1f
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x2265f966e09
mov r15d, dword [r8]
lea esi, [rdx + 0x14]
mov r12d, dword [r8 + 4]
mov r14d, r15d
mov r13d, dword [r8 + 8]
mov r10d, r12d
mov ebx, dword [r8 + 0xc]
mov r9d, r13d
mov edi, dword [r8 + 0x10]
xor ebp, ebp
mov eax, r9d
lea r11d, [rdi + 0x5a827999]
and eax, r10d
mov ecx, r10d
not ecx
mov edx, r14d
and ecx, ebx
ror edx, 0x1b
or ecx, eax
mov edi, ebx
mov ebx, r9d
add edx, ecx
add edx, dword [rsp + rbp*4]
mov r9d, r10d
shr r10d, 2
add r11d, edx
shl r9d, 0x1e
inc rbp
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rbp, rsi
jl 0x2265f966e45
mov ebp, 0x28
ror r11d, 0x1b
add edi, 0x6ed9eba1
add r11d, dword [rsp + rsi*4]
mov ecx, ebx
xor ecx, r9d
add r11d, edi
xor ecx, r10d
mov edi, ebx
mov ebx, r9d
add r11d, ecx
mov r9d, r10d
inc rsi
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rsi, rbp
jl 0x2265f966e8f
mov edx, 0x3c
mov ecx, r9d
ror r11d, 0x1b
or ecx, r10d
mov eax, r9d
and ecx, ebx
and eax, r10d
add edi, 0x8f1bbcdc
or ecx, eax
add ecx, dword [rsp + rbp*4]
add r11d, edi
add r11d, ecx
mov edi, ebx
mov ebx, r9d
inc rbp
mov r9d, r10d
shr r10d, 2
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rbp, rdx
jl 0x2265f966ed1
mov eax, dword [rsp + rdx*4]
add edi, 0xca62c1d6
ror r11d, 0x1b
mov ecx, ebx
xor ecx, r9d
add r11d, edi
xor ecx, r10d
mov edi, ebx
mov ebx, r9d
add eax, ecx
mov r9d, r10d
add r11d, eax
shr r10d, 2
inc rdx
shl r9d, 0x1e
or r9d, r10d
mov r10d, r14d
mov r14d, r11d
cmp rdx, 0x50
jl 0x2265f966f15
add dword [r8 + 0xc], ebx
lea eax, [r15 + r11]
add dword [r8 + 0x10], edi
lea r11, [rsp + 0x140]
and dword [r8 + 0x5c], 0
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r8], eax
lea eax, [r12 + r10]
mov dword [r8 + 4], eax
lea eax, [r9 + r13]
mov dword [r8 + 8], eax
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x2265f966f9c
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
xor ebx, ebx
mov dword [rbp - 0x29], 0x67452301
mov r14, r8
mov qword [rbp - 0x15], rbx
mov rsi, rcx
mov qword [rbp + 0x33], rbx
mov edx, ebx
mov dword [rbp - 0x25], 0xefcdab89
lea edi, [rbx + 0xe]
mov dword [rbp - 0x21], 0x98badcfe
lea r15d, [rbx + 1]
mov dword [rbp - 0x1d], 0x10325476
mov dword [rbp - 0x19], 0xc3d2e1f0
mov eax, ebx
mov dword [rbp + 0x3b], ebx
dec edi
test eax, eax
jne 0x2265f967104
mov al, byte [rsi]
movsxd rcx, edx
mov byte [rbp + rcx - 0xd], al
mov edx, dword [rbp + 0x33]
mov eax, dword [rbp + 0x3b]
inc edx
add dword [rbp - 0x15], 8
mov dword [rbp + 0x33], edx
jne 0x2265f96702b
add dword [rbp - 0x11], r15d
cmove eax, r15d
mov dword [rbp + 0x3b], eax
cmp edx, 0x40
jne 0x2265f96703f
lea rcx, [rbp - 0x29]
call fcn.2265f966da0
mov eax, dword [rbp + 0x3b]
mov edx, dword [rbp + 0x33]
add rsi, r15
test edi, edi
jne 0x2265f966ffc
test eax, eax
jne 0x2265f967104
cmp dword [rbp + 0x37], ebx
jne 0x2265f967104
movsxd rax, edx
mov byte [rbp + rax - 0xd], 0x80
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp edx, 0x37
jle 0x2265f9670b6
jmp 0x2265f96707e
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x40
jl 0x2265f96706f
lea rcx, [rbp - 0x29]
call fcn.2265f966da0
mov eax, dword [rbp + 0x33]
jmp 0x2265f9670a0
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x38
jl 0x2265f967091
jmp 0x2265f9670bb
cdqe
mov byte [rbp + rax - 0xd], bl
mov eax, dword [rbp + 0x33]
add eax, r15d
mov dword [rbp + 0x33], eax
cmp eax, 0x38
jl 0x2265f9670a7
mov ecx, dword [rbp - 0x11]
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x2b], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x2c], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x2d], al
mov byte [rbp + 0x2e], cl
mov ecx, dword [rbp - 0x15]
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x2f], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x30], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x32], cl
lea rcx, [rbp - 0x29]
mov byte [rbp + 0x31], al
call fcn.2265f966da0
mov dword [rbp + 0x37], r15d
lea r8, [rbp - 0x27]
mov al, byte [r8 + 1]
lea edx, [rbx*4]
lea ecx, [rdx + 1]
mov byte [rdx + r14], al
mov al, byte [r8]
add ebx, r15d
mov byte [rcx + r14], al
lea ecx, [rdx + 2]
mov al, byte [r8 - 1]
lea r8, [r8 + 4]
mov byte [rcx + r14], al
lea ecx, [rdx + 3]
mov al, byte [r8 - 6]
mov byte [rcx + r14], al
cmp ebx, 5
jb 0x2265f967108
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x2265f969628
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea r9d, [r8 - 0x21524111]
mov r10, rdx
add r9d, edx
mov rbx, rcx
mov r11d, r9d
mov edi, r9d
cmp rdx, 0xc
jbe 0x2265f969742
lea r8, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r8
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add r10, rax
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
movzx r8d, byte [rbx + 4]
movzx edx, byte [rbx + 8]
add r8d, r11d
shl ecx, 8
add edx, r9d
add ecx, eax
movzx eax, byte [rbx + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
add r8d, ecx
movzx ecx, byte [rbx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [rbx + 3]
shl ecx, 8
mov r9d, edx
add ecx, eax
ror r9d, 0x1c
movzx eax, byte [rbx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbx]
shl ecx, 8
add rbx, 0xc
add ecx, eax
sub ecx, edx
add edx, r8d
add ecx, edi
xor r9d, ecx
sub r8d, r9d
mov eax, r9d
add r9d, edx
ror eax, 0x1a
xor eax, r8d
sub edx, eax
mov ecx, eax
add eax, r9d
ror ecx, 0x18
xor ecx, edx
sub r9d, ecx
mov edi, ecx
add ecx, eax
ror edi, 0x10
xor edi, r9d
sub eax, edi
mov r11d, edi
ror r11d, 0xd
add edi, ecx
xor r11d, eax
sub ecx, r11d
mov r9d, r11d
ror r9d, 0x1c
add r11d, edi
xor r9d, ecx
sub rsi, 1
jne 0x2265f969679
cmp r10, 6
ja 0x2265f969786
je 0x2265f9697e3
test r10, r10
je 0x2265f969868
sub r10, 1
je 0x2265f96980f
sub r10, 1
je 0x2265f969806
sub r10, 1
je 0x2265f9697fd
sub r10, 1
je 0x2265f9697f4
cmp r10, 1
je 0x2265f9697ed
jmp 0x2265f969814
sub r10, 7
je 0x2265f9697d9
sub r10, 1
je 0x2265f9697cf
sub r10, 1
je 0x2265f9697c8
sub r10, 1
je 0x2265f9697be
sub r10, 1
je 0x2265f9697b4
cmp r10, 1
jne 0x2265f969814
movzx eax, byte [rbx + 0xb]
shl eax, 0x18
add r9d, eax
movzx eax, byte [rbx + 0xa]
shl eax, 0x10
add r9d, eax
movzx eax, byte [rbx + 9]
shl eax, 8
add r9d, eax
movzx eax, byte [rbx + 8]
add r9d, eax
movzx eax, byte [rbx + 7]
shl eax, 0x18
add r11d, eax
movzx eax, byte [rbx + 6]
shl eax, 0x10
add r11d, eax
movzx eax, byte [rbx + 5]
shl eax, 8
add r11d, eax
movzx eax, byte [rbx + 4]
add r11d, eax
movzx eax, byte [rbx + 3]
shl eax, 0x18
add edi, eax
movzx eax, byte [rbx + 2]
shl eax, 0x10
add edi, eax
movzx eax, byte [rbx + 1]
shl eax, 8
add edi, eax
movzx eax, byte [rbx]
add edi, eax
xor r9d, r11d
mov eax, r11d
ror eax, 0x12
sub r9d, eax
mov eax, r9d
mov edx, r9d
ror eax, 0x15
xor edx, edi
sub edx, eax
xor r11d, edx
mov eax, edx
ror eax, 7
sub r11d, eax
xor r9d, r11d
mov eax, r11d
ror eax, 0x10
sub r9d, eax
mov eax, r9d
mov ecx, r9d
ror eax, 0x1c
xor ecx, edx
sub ecx, eax
xor r11d, ecx
mov eax, ecx
ror eax, 0x12
sub r11d, eax
mov eax, r11d
xor r9d, r11d
ror eax, 8
sub r9d, eax
mov rbx, qword [rsp + 8]
mov eax, r9d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x2265f96abe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
je 0x2265f96abf1
jmp 0x2265f96abe9
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x3c]
add rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0xc], 0
je 0x2265f96ac5f
xor eax, eax
test eax, eax
je 0x2265f96ac4f
jmp 0x2265f96ac47
mov rax, qword [rsp + 0x30]
add rax, 0x14
mov qword [rsp + 0x30], rax
jmp 0x2265f96ac3c
xor eax, eax
test eax, eax
je 0x2265f96ac67
jmp 0x2265f96ac5f
mov eax, dword [0x2265f979fd8]
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [str.p_t7a]
call fcn.2265f95ca44
test eax, eax
je 0x2265f96ad34
xor eax, eax
test eax, eax
je 0x2265f96ac91
jmp 0x2265f96ac89
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov eax, dword [0x2265f979fd8]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x2265f979fe8]
call qword [rax + 0x1f8]
test eax, eax
jne 0x2265f96acd9
xor eax, eax
test eax, eax
je 0x2265f96acd2
jmp 0x2265f96acca
mov eax, 0xffffffff
jmp 0x2265f96ad3e
mov eax, dword [0x2265f979fd8]
mov r8d, eax
mov rdx, qword [str.p_t7a]
mov rcx, qword [rsp + 0x28]
call fcn.2265f95c93c
mov eax, dword [0x2265f979fd8]
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x2265f979fe8]
call qword [rax + 0x1f8]
test eax, eax
jne 0x2265f96ad2a
xor eax, eax
test eax, eax
je 0x2265f96ad23
jmp 0x2265f96ad1b
mov eax, 0xffffffff
jmp 0x2265f96ad3e
xor eax, eax
test eax, eax
je 0x2265f96ad32
jmp 0x2265f96ad2a
jmp 0x2265f96ad3c
xor eax, eax
test eax, eax
je 0x2265f96ad3c
jmp 0x2265f96ad34
xor eax, eax
add rsp, 0x58
ret
Function at 0x2265f96b878
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, 1
mov dword [rdx], ecx
mov dword [rdx + 0x9c0], r8d
movsxd rcx, r8d
mov eax, dword [rdx + rcx*4 - 4]
shr eax, 0x1e
xor eax, dword [rdx + rcx*4 - 4]
imul eax, eax, 0x6c078965
add eax, r8d
mov dword [rdx + rcx*4], eax
mov r8d, dword [rdx + 0x9c0]
inc r8d
mov dword [rdx + 0x9c0], r8d
cmp r8d, 0x270
jl 0x2265f96b887
ret

Function at 0x2265f96b8bc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, dword [rcx + 0x9c0]
mov r8, rcx
cmp r9d, 0x270
jl 0x2265f96b982
xor r9d, r9d
lea rbx, [0x2265f977040]
mov r10d, r9d
mov r11d, 0x7fffffff
mov edx, 0xe3
mov ecx, dword [r8 + r10*4]
xor ecx, dword [r8 + r10*4 + 4]
and ecx, r11d
xor ecx, dword [r8 + r10*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + r10*4 + 0x634]
mov dword [r8 + r10*4], ecx
inc r10
cmp r10, rdx
jl 0x2265f96b8f0
mov ecx, dword [r8 + rdx*4]
xor ecx, dword [r8 + rdx*4 + 4]
and ecx, r11d
xor ecx, dword [r8 + rdx*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + rdx*4 - 0x38c]
mov dword [r8 + rdx*4], ecx
inc rdx
cmp rdx, 0x26f
jl 0x2265f96b91e
mov eax, dword [r8 + 0x9bc]
mov edx, eax
xor edx, dword [r8]
and edx, r11d
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
mov ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + 0x630]
xor ecx, edx
mov dword [r8 + 0x9bc], ecx
mov dword [r8 + 0x9c0], r9d
mov rbx, qword [rsp + 8]
movsxd rax, r9d
mov ecx, dword [r8 + rax*4]
lea eax, [r9 + 1]
mov dword [r8 + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x2265f96e990
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x2265f971cc0]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret
Function at 0x1f5030
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
je 0x1f5040
jne 0x1f5040
sub rsp, 0x28
mov rax, qword [rdx]
cmp dword [rax + 0x8c], 0
je 0x1f50eb
mov rsi, qword [rdx + 8]
mov edi, dword [rax + 0x88]
cmp dword [rdi + rsi + 0x18], 0
je 0x1f5088
jne 0x1f5088
je 0x491351b6
add r12, rsi
add rbx, rsi
je 0x1f50eb
cmp dword [rsi + rdi + 0x14], 0
je 0x1f50eb
mov r15, r8
mov r13, rcx
mov ebx, dword [rsi + rdi + 0x20]
mov r12d, dword [rsi + rdi + 0x24]
je 0x1f5069
jne 0x1f5069
je 0x74e2afeb
and eax, 0x44e92375
mov esi, dword [rcx + rax]
Function at 0x202790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x2027c0
mov eax, dword [rax + 0x20]
mov dword [rdi + 0x38], eax
mov rcx, rbx
mov rdx, rsi
call r15
mov rcx, rdi
jmp 0x202870
xor r14d, r14d
xor edx, edx
jmp 0x2028ff
mov rax, qword [rcx]
jmp 0x20280b
push r15
je 0x2028f6
jne 0x2028f6
add byte [rax], al
add byte [rax], al
nop word cs:[rax + rax]
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
jmp 0x2028de
mov rcx, rbp
jmp 0x2028b1
mov r15, qword [sym.imp.itmkl_beo_UteNpt2HgazewrUmZvtjloS]
je 0x2027d2
jne 0x2027d2
jmp 0xffffffffff21b34d
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x202796
call qword [rax + 8]
je 0x202914
jne 0x202914
jmp 0x20d508
jmp 0x2028cc
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 8]
test eax, eax
je 0x20287d
jne 0x20287d
por mm3, qword [rdx - 0x17]
je 0x2027ed
jne 0x2027ed
je 0xffffffff842fd62d
jmp 0x202821
sub rsp, 0x28
mov rdi, rcx
je 0x20290b
jmp 0x202932
push rdi
push rbp
push rbx
jmp 0x202845
je 0x202920
mov rax, qword [rcx]
jmp 0x2027ad
call fcn.00203060
jmp 0x20295e
jmp 0xd8ac90
je 0x20293b
je 0x20294f
jne 0x20294f
je 0xffffffff8da43819
je 0x202925
add byte [rax], al
add byte [rax - 0x75], cl
outsd dx, dword [rsi]
adc byte [rdi], cl
test ch, cl
add byte [rax], al
add byte [rdi], cl
test edi, eax
add byte [rax], al
add byte [rax - 0x7b], cl
leave
mov rbp, qword [rdi + 0x10]
je 0x20296f
jne 0x20296f
test rcx, rcx
jmp 0x20285e
call qword [rax + 0x18]
lea edx, [rax + 1]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x20]
mov rcx, qword [rdi + 0x10]
jmp 0x2027bb
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [rax + 0x30]
test rax, rax
je 0x20293b
mov rcx, qword [rdi + 0x10]
je 0x202801
jne 0x202801
push r14
push rsi
jmp 0x202857
je 0x202842
jne 0x202842
mov rcx, qword [rcx + 0x10]
je 0x2028a8
jne 0x2028a8
jmp 0x10be99d
test eax, eax
jmp 0x202918
jne 0x2027e0
jmp 0x20293b
xor r14d, r14d
jmp 0x20293b
je 0x202935
jne 0x202935
jmp 0x20287c
jne 0x20290b
jmp 0x21e77a
mov r14d, 1
mov eax, r14d
jmp 0x202942
je 0x20281b
jne 0x20281b
jmp 0x387fb69b
lea rbx, [rdi + 0x38]
lea rsi, [rdi + 0x3c]
jmp 0x2027f5
cmp eax, 1
je 0x202892
jne 0x202892
je 0x65b4bb
mov rax, qword [rbp]
jmp 0x202838
invalid
add al, ah
dec dword [rbp + 0x29]
imul r9, rbx, 0xa2c13
Function at 0x218de0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, [rdx + 0x10]
cmp r8d, 0x100
cmovne rax, rdx
lea r8, str.expand_32_byte_kexpand_16_byte_k
lea r9, [0x0022fbe0]
cmove r9, r8
mov edx, dword [rax]
mov dword [rcx + 0x20], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x24], edx
mov edx, dword [rax + 8]
mov dword [rcx + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x2c], eax
mov dword [rcx], 0x61707865
mov rax, qword [r9 + 4]
mov qword [rcx + 4], rax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0xc], eax
ret
Function at 0x21ee90
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x21ef1b
mov qword [rcx + 0x48], 0
mov qword [rcx], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
mov eax, 1
ret
Function at 0x21f940
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
mov edx, 0x20
mov rcx, r8
mov r8, rsi
call fcn.0021f6b0
and byte [rsi], 0xf8
mov al, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.0021c300
mov rcx, rdi
mov rdx, rbx
call fcn.0021c280
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
Function at 0x21f9a0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov qword [rsp + 0x28], rcx
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
mov byte [rsp + rax + 0x30], cl
add rax, 1
cmp rax, 0x20
jne 0x21f9c0
and byte [rsp + 0x30], 0xf8
mov al, byte [rsp + 0x4f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x4f], al
lea rbp, [rsp + 0x140]
mov rcx, rbp
call fcn.00219700
lea rbx, [rsp + 0x170]
mov rcx, rbx
call fcn.00219390
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.002193b0
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0021b630
mov rcx, rbx
mov rdx, rbx
call fcn.00219990
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
call fcn.0021a130
lea rcx, [rsp + 0x80]
call fcn.00219390
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.00219370
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.002196e0
lea r14, [rsp + 0xe0]
mov rcx, r14
call fcn.00219390
mov r13d, 0xfe
xor r15d, r15d
nop word cs:[rax + rax]
nop
mov ebp, r15d
mov eax, r13d
shr rax, 3
movzx r15d, byte [rsp + rax + 0x30]
mov ecx, r13d
and cl, 7
shr r15d, cl
and r15d, 1
xor ebp, r15d
lea rsi, [rsp + 0x80]
mov rcx, rsi
lea r12, [rsp + 0x50]
mov rdx, r12
mov r8d, ebp
call fcn.00219540
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
call fcn.00219540
lea rbp, [rsp + 0xb0]
mov rcx, rbp
mov rdx, r12
mov r8, r14
call fcn.0021b630
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.0021b630
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.002193b0
mov rcx, rdi
mov rdx, r12
mov r8, r14
call fcn.002193b0
mov rcx, r14
mov rdx, rbp
mov r8, rsi
call fcn.0021a130
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
call fcn.0021a130
mov rcx, rbp
mov rdx, rbx
call fcn.00219c20
mov rcx, rbx
mov rdx, rsi
call fcn.00219c20
mov rcx, r12
mov rdx, r14
mov r8, rdi
call fcn.002193b0
mov rcx, rdi
mov rdx, r14
mov r8, rdi
call fcn.0021b630
mov rcx, rsi
mov rdx, rbx
mov r8, rbp
call fcn.0021a130
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0021b630
mov rcx, rdi
mov rdx, rdi
call fcn.00219c20
mov rcx, r14
mov rdx, rbx
call fcn.0021ac70
mov rcx, r12
mov rdx, r12
call fcn.00219c20
mov rcx, rbp
mov rdx, rbp
mov r8, r14
call fcn.002193b0
mov rcx, r14
lea rdx, [rsp + 0x140]
mov r8, rdi
call fcn.0021a130
mov rcx, rdi
mov rdx, rbx
mov r8, rbp
call fcn.0021a130
add r13d, 0xffffffff
cmp r13d, 0xffffffff
jne 0x21fa90
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov r8d, r15d
call fcn.00219540
lea rdi, [rsp + 0x110]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
mov r8d, r15d
call fcn.00219540
mov rcx, rdi
mov rdx, rdi
call fcn.00219990
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.0021a130
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call fcn.0021a9a0
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret