joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c02ed
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
endbr64
lea rsp, [rsp - 0x58]
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
mov eax, dword [rcx + 0xf0]
movdqu xmm6, xmmword [r8]
movdqa xmm9, xmmword [0x004c3ee0]
movdqa xmm7, xmmword [0x004c3ec0]
shl eax, 4
mov r10d, 0x10
lea r11, [rcx]
movdqu xmm3, xmmword [r9]
movdqa xmm2, xmm6
lea rcx, [rcx + rax + 0x20]
pshufb xmm6, xmm7
sub r10, rax
jmp 0x4c0370
movups xmm0, xmmword [r11]
mov rax, r10
movups xmm8, xmmword [rdi]
xorps xmm2, xmm0
movups xmm1, xmmword [r11 + 0x10]
xorps xmm0, xmm8
xorps xmm3, xmm0
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4c038f
aesenc xmm2, xmm1
aesenc xmm3, xmm1
paddq xmm6, xmm9
dec rdx
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
lea rdi, [rdi + 0x10]
xorps xmm8, xmm2
movdqa xmm2, xmm6
movups xmmword [rsi], xmm8
pshufb xmm2, xmm7
lea rsi, [rsi + 0x10]
jne 0x4c0370
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
movups xmmword [r9], xmm3
pxor xmm3, xmm3
pxor xmm8, xmm8
pxor xmm6, xmm6
movaps xmm6, xmmword [rsp]
movaps xmmword [rsp], xmm0
movaps xmm7, xmmword [rsp + 0x10]
movaps xmmword [rsp + 0x10], xmm0
movaps xmm8, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
movaps xmm9, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
lea rsp, [rsp + 0x58]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x4c044d
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
endbr64
lea rsp, [rsp - 0x58]
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
mov eax, dword [rcx + 0xf0]
movups xmm6, xmmword [r8]
movdqu xmm3, xmmword [r9]
movdqa xmm9, xmmword [0x004c3ee0]
movdqa xmm7, xmmword [0x004c3ec0]
movaps xmm2, xmm6
mov r10d, eax
mov r11, rcx
pshufb xmm6, xmm7
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec eax
movups xmm1, xmmword [rcx]
lea rcx, [rcx + 0x10]
jne 0x4c04bd
aesenclast xmm2, xmm1
shl r10d, 4
mov eax, 0x10
movups xmm8, xmmword [rdi]
paddq xmm6, xmm9
lea rdi, [rdi + 0x10]
sub rax, r10
lea rcx, [r11 + r10 + 0x20]
mov r10, rax
jmp 0x4c0500
xorps xmm8, xmm2
movdqa xmm2, xmm6
movups xmmword [rsi], xmm8
lea rsi, [rsi + 0x10]
pshufb xmm2, xmm7
sub rdx, 1
je 0x4c0590
movups xmm0, xmmword [r11]
mov rax, r10
movups xmm1, xmmword [r11 + 0x10]
xorps xmm8, xmm0
xorps xmm2, xmm0
xorps xmm3, xmm8
movups xmm0, xmmword [r11 + 0x20]
jmp 0x4c0540
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4c0540
movups xmm8, xmmword [rdi]
paddq xmm6, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
lea rdi, [rdi + 0x10]
jmp 0x4c0500
mov eax, dword [r11 + 0xf0]
movups xmm0, xmmword [r11]
movups xmm1, xmmword [r11 + 0x10]
xorps xmm8, xmm0
lea r11, [r11 + 0x20]
xorps xmm3, xmm8
aesenc xmm3, xmm1
dec eax
movups xmm1, xmmword [r11]
lea r11, [r11 + 0x10]
jne 0x4c05ac
aesenclast xmm3, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
movups xmmword [r9], xmm3
pxor xmm3, xmm3
pxor xmm8, xmm8
pxor xmm6, xmm6
movaps xmm6, xmmword [rsp]
movaps xmmword [rsp], xmm0
movaps xmm7, xmmword [rsp + 0x10]
movaps xmmword [rsp + 0x10], xmm0
movaps xmm8, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
movaps xmm9, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
lea rsp, [rsp + 0x58]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x4c2440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm8, xmm5
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm8, xmm6
pxor xmm6, xmm14
pxor xmm8, xmm7
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesenc xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x4c2560
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4c2560
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesenclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
aesenclast xmm6, xmm14
aesenclast xmm7, xmm15
repz ret

Function at 0x4c2600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm8, xmm2
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm8, xmm3
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm8, xmm4
pxor xmm4, xmm12
pxor xmm8, xmm5
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x4c26a0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4c26a0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm10
aesenclast xmm3, xmm11
aesenclast xmm4, xmm12
aesenclast xmm5, xmm13
repz ret
Function at 0x4c2720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x4c2760
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4c2760
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret
Function at 0x4c2b60
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x4c2c60
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4c2c60
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret

Function at 0x4c2d00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x4c2da0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4c2da0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret
Function at 0x4c2e20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x4c2e60
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4c2e60
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x4c38d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call sym.aesni_set_encrypt_key
shl edx, 4
test eax, eax
jne 0x4c3936
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x4c38fb
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x4c5400
Capabilities:
Encode data using xor

Disassembly:
lea r11, [0x004c7180]
movdqu xmm7, xmmword [rcx]
lea rcx, [rcx + 0x10]
movdqa xmm0, xmmword [r11]
movdqa xmm1, xmmword [r11 + 0x10]
movdqa xmm2, xmmword [r11 + 0x20]
movdqa xmm3, xmmword [r11 + 0x30]
movdqa xmm4, xmmword [r11 + 0x40]
pcmpeqd xmm5, xmm5
movdqu xmm6, xmmword [rcx]
movdqa xmmword [rax], xmm7
lea rax, [rax + 0x10]
dec r10d
jmp 0x4c5450
pshufb xmm6, xmm4
movdqa xmm8, xmm0
movdqa xmm9, xmm1
pand xmm8, xmm6
pand xmm9, xmm6
movdqa xmm10, xmm2
pcmpeqb xmm8, xmm0
psllq xmm0, 4
movdqa xmm11, xmm3
pcmpeqb xmm9, xmm1
psllq xmm1, 4
pand xmm10, xmm6
pand xmm11, xmm6
movdqa xmm12, xmm0
pcmpeqb xmm10, xmm2
psllq xmm2, 4
movdqa xmm13, xmm1
pcmpeqb xmm11, xmm3
psllq xmm3, 4
movdqa xmm14, xmm2
movdqa xmm15, xmm3
pxor xmm8, xmm5
pxor xmm9, xmm5
pand xmm12, xmm6
pand xmm13, xmm6
movdqa xmmword [rax], xmm8
pcmpeqb xmm12, xmm0
psrlq xmm0, 4
movdqa xmmword [rax + 0x10], xmm9
pcmpeqb xmm13, xmm1
psrlq xmm1, 4
lea rcx, [rcx + 0x10]
pand xmm14, xmm6
pand xmm15, xmm6
movdqa xmmword [rax + 0x20], xmm10
pcmpeqb xmm14, xmm2
psrlq xmm2, 4
movdqa xmmword [rax + 0x30], xmm11
pcmpeqb xmm15, xmm3
psrlq xmm3, 4
movdqu xmm6, xmmword [rcx]
pxor xmm13, xmm5
pxor xmm14, xmm5
movdqa xmmword [rax + 0x40], xmm12
movdqa xmmword [rax + 0x50], xmm13
movdqa xmmword [rax + 0x60], xmm14
movdqa xmmword [rax + 0x70], xmm15
lea rax, [rax + 0x80]
dec r10d
jne 0x4c5450
movdqa xmm7, xmmword [r11 + 0x50]
repz ret
Function at 0x4c7d6d
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
endbr64
xchg rdx, rcx
sub rcx, 0x10
jb 0x4c7ea4
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm6, xmmword [r8]
sub rsi, rdi
call sym._vpaes_preheat
cmp r9d, 0
je 0x4c7e30
jmp 0x4c7e00
movdqu xmm0, xmmword [rdi]
pxor xmm0, xmm6
call sym._vpaes_encrypt_core
movdqa xmm6, xmm0
movdqu xmmword [rsi + rdi], xmm0
lea rdi, [rdi + 0x10]
sub rcx, 0x10
jae 0x4c7e00
jmp 0x4c7e54
movdqu xmm0, xmmword [rdi]
movdqa xmm7, xmm0
call sym._vpaes_decrypt_core
pxor xmm0, xmm6
movdqa xmm6, xmm7
movdqu xmmword [rsi + rdi], xmm0
lea rdi, [rdi + 0x10]
sub rcx, 0x10
jae 0x4c7e30
movdqu xmmword [r8], xmm6
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x4ca0d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r10, rcx
test r9, r9
je 0x4ca1a0
movzx r11d, byte [r8]
mov ebx, r11d
and ebx, 0xffffff80
test rdx, rdx
je 0x4ca0f7
movzx eax, bl
mov dword [rdx], eax
cmp r9, 1
je 0x4ca1e0
movzx eax, byte [r8]
test al, al
jne 0x4ca168
movzx eax, byte [r8 + 1]
and eax, 0xffffff80
cmp bl, al
je 0x4ca210
lea r12, [r9 - 1]
test r10, r10
je 0x4ca15a
movsx eax, r11b
sub r9, r12
sar r11b, 7
lea rdx, [r12 - 1]
shr eax, 0x1f
add r8, r9
nop dword [rax + rax]
movzx ecx, byte [r8 + rdx]
xor ecx, r11d
movzx ecx, cl
add eax, ecx
mov byte [r10 + rdx], al
shr eax, 8
sub rdx, 1
jae 0x4ca140
mov rax, r12
add rsp, 0x28
pop rbx
pop r12
ret
mov r12, r9
cmp al, 0xff
jne 0x4ca11d
mov eax, 1
xor edx, edx
nop word cs:[rax + rax]
movzx ecx, byte [r8 + rax]
add rax, 1
or edx, ecx
cmp r9, rax
ja 0x4ca180
test edx, edx
jne 0x4ca109
mov r12, r9
jmp 0x4ca11d
call sym.ERR_new
lea r8, str.c2i_ibuf
mov edx, 0xa0
xor r12d, r12d
lea rcx, str..._openssl_3.1.1_crypto_asn1_a_int.c
call sym.ERR_set_debug
xor r8d, r8d
mov edx, 0xde
mov ecx, 0xd
call sym.ERR_set_error
mov rax, r12
add rsp, 0x28
pop rbx
pop r12
ret
mov r12d, 1
test r10, r10
je 0x4ca15a
movzx eax, byte [r8]
mov edx, eax
neg eax
test r11b, r11b
cmovns eax, edx
mov byte [r10], al
mov rax, r12
add rsp, 0x28
pop rbx
pop r12
ret
call sym.ERR_new
lea r8, str.c2i_ibuf
mov edx, 0xc1
xor r12d, r12d
lea rcx, str..._openssl_3.1.1_crypto_asn1_a_int.c
call sym.ERR_set_debug
xor r8d, r8d
mov edx, 0xdd
mov ecx, 0xd
call sym.ERR_set_error
jmp 0x4ca15a

Function at 0x4ca2b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r12
push rsi
push rbx
movsxd rbx, dword [rcx]
mov r9, qword [rcx + 8]
mov r12, rbx
mov r11, rdx
test r9, r9
je 0x4ca300
test rbx, rbx
je 0x4ca300
mov eax, dword [rcx + 4]
movzx edx, byte [r9]
and eax, 0x100
jne 0x4ca368
cmp rdx, 0x7f
jbe 0x4ca388
lea rsi, [rbx + 1]
xor r10d, r10d
mov r12d, esi
mov r8, rsi
jmp 0x4ca313
xor r8d, r8d
mov r12d, 1
xor r10d, r10d
xor ebx, ebx
mov esi, 1
test r11, r11
je 0x4ca35d
mov rcx, qword [r11]
test rcx, rcx
je 0x4ca35d
mov byte [rcx], r10b
test rbx, rbx
je 0x4ca35a
mov eax, r10d
sub r8, rbx
lea rdx, [rbx - 1]
and eax, 1
add r8, rcx
movzx eax, al
nop dword [rax + rax]
movzx ecx, byte [r9 + rdx]
xor ecx, r10d
movzx ecx, cl
add eax, ecx
mov byte [r8 + rdx], al
shr eax, 8
sub rdx, 1
jae 0x4ca340
add qword [r11], rsi
mov eax, r12d
pop rbx
pop rsi
pop r12
ret
cmp rdx, 0x80
jbe 0x4ca3a0
lea rsi, [rbx + 1]
mov r10d, 0xffffffff
mov r12d, esi
jmp 0x4ca2f1
mov rsi, rbx
test eax, eax
jne 0x4ca368
xor r10d, r10d
jmp 0x4ca2f1
mov rsi, rbx
mov r10d, 0xffffffff
jne 0x4ca2f1
cmp rbx, 1
je 0x4ca38f
lea rax, [r9 + 1]
lea r8, [r9 + rbx]
xor edx, edx
nop
movzx ecx, byte [rax]
add rax, 1
or edx, ecx
cmp rax, r8
jne 0x4ca3c0
test edx, edx
setne sil
mov r10d, esi
and esi, 1
add rsi, rbx
neg r10d
mov r12d, esi
jmp 0x4ca2f1
Function at 0x4cbd00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x18
mov r9d, 8
mov rsi, rcx
lea rax, [rsp + 0xf]
nop dword [rax]
mov byte [rax], dl
mov r10, r9
mov rcx, rax
sub r9, 1
mov r11, rdx
mov rbx, rax
sub rax, 1
shr rdx, 8
jne 0x4cbd18
mov eax, 8
sub rax, r9
mov rdx, rax
je 0x4cbda8
test r11b, r11b
jns 0x4cbdc0
test r8d, r8d
jne 0x4cbdd0
mov eax, 9
sub rax, r9
mov rdx, rax
xor eax, eax
mov r11d, edx
test rsi, rsi
je 0x4cbdb6
mov ecx, 7
lea rdx, [rdx + r10 - 8]
mov byte [rsi], r8b
sub rcx, r9
add rsi, rdx
lea r9, [rsp + r10]
nop dword [rax + rax]
movzx edx, byte [r9 + rcx + 7]
xor edx, r8d
movzx edx, dl
add eax, edx
mov byte [rsi + rcx - 1], al
shr eax, 8
sub rcx, 1
jae 0x4cbd80
mov eax, r11d
add rsp, 0x18
pop rbx
pop rsi
ret
test rsi, rsi
je 0x4cbdb0
mov byte [rsi], 0
mov r11d, 1
mov eax, r11d
add rsp, 0x18
pop rbx
pop rsi
ret
test r8d, r8d
jne 0x4cbdd0
xor eax, eax
xor r8d, r8d
jmp 0x4cbd5c
cmp r11, 0x80
jbe 0x4cbdf4
mov eax, 9
mov r8d, 0xffffffff
sub rax, r9
mov rdx, rax
mov eax, 1
jmp 0x4cbd5c
mov eax, 1
mov r8d, 0xffffffff
jne 0x4cbd5c
cmp rdx, 1
je 0x4cbdc5
add rcx, 1
add rbx, rdx
xor eax, eax
nop dword [rax]
movzx r8d, byte [rcx]
add rcx, 1
or eax, r8d
cmp rcx, rbx
jne 0x4cbe18
test eax, eax
setne cl
mov r8d, ecx
movzx eax, cl
movzx ecx, cl
neg r8d
add rdx, rcx
jmp 0x4cbd5c

Function at 0x4ccde0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, 1
mov r9, rcx
mov ebx, r8d
mov rcx, rdx
test r9, r9
je 0x4cce10
movsxd r8, r8d
mov edx, 1
mov ebx, ebx
call sym.fwrite
cmp rbx, rax
sete al
movzx eax, al
add rsp, 0x20
pop rbx
ret
Function at 0x4d8f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, rcx
mov rcx, rdx
mov rax, qword [r8]
mov r8d, dword [r9 + 0x20]
mov edx, dword [rax]
test edx, edx
jne 0x4d8f39
test r8b, 1
jne 0x4d8f53
and r8d, 2
je 0x4d8f4e
xor r8d, r8d
test edx, edx
jns 0x4d8f4e
neg edx
mov r8d, 1
jmp sym.ossl_i2c_uint64_int
mov eax, 0xffffffff
ret

Function at 0x4d8f60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov r8, rcx
mov rcx, rdx
mov rax, qword [r8]
mov r8d, dword [r9 + 0x20]
mov rdx, qword [rax]
test rdx, rdx
jne 0x4d8f7b
test r8b, 1
jne 0x4d8f97
and r8d, 2
je 0x4d8f92
xor r8d, r8d
test rdx, rdx
jns 0x4d8f92
neg rdx
mov r8d, 1
jmp sym.ossl_i2c_uint64_int
mov eax, 0xffffffff
ret

Function at 0x4d96c0
Capabilities:
Get thread local storage value

Disassembly:
lea rcx, [0x00829584]
jmp sym.CRYPTO_THREAD_get_local
Function at 0x4db640
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x00795420]
lea rsi, [0x00795420]
mov r11d, 0x48
mov qword [rcx], rax
mov rax, qword [0x00796460]
lea rdi, [rcx + 8]
mov rbp, rcx
and rdi, 0xfffffffffffffff8
lea rbx, [rbp + 0x48]
mov r10, rbp
mov qword [rcx + 0x1040], rax
mov rax, rcx
sub rax, rdi
sub rsi, rax
add eax, 0x1048
shr eax, 3
cmp edx, 0x48
mov ecx, eax
cmovle r11d, edx
mov rax, r8
rep movsq qword [rdi], qword [rsi]
movsxd r11, r11d
add r11, r8
nop dword [rax]
lea rcx, [rax + 1]
movzx eax, byte [rax]
cmp r11, rcx
cmovbe rcx, r8
shl eax, 8
movzx edx, byte [rcx]
lea r9, [rcx + 1]
or edx, eax
cmp r11, r9
cmovbe r9, r8
mov eax, edx
shl eax, 8
movzx edx, byte [r9]
lea rcx, [r9 + 1]
or edx, eax
cmp r11, rcx
cmovbe rcx, r8
shl edx, 8
lea rax, [rcx + 1]
movzx ecx, byte [rcx]
or edx, ecx
cmp r11, rax
cmovbe rax, r8
xor dword [r10], edx
add r10, 4
cmp rbx, r10
jne 0x4db6a8
mov qword [rsp + 0x28], 0
mov rdi, rbp
lea rsi, [rsp + 0x28]
nop
mov rdx, rbp
mov rcx, rsi
add rdi, 8
call sym.BF_encrypt
mov rax, qword [rsp + 0x28]
mov qword [rdi - 8], rax
cmp rbx, rdi
jne 0x4db710
lea rdi, [rbp + 0x1048]
nop dword [rax]
mov rdx, rbp
mov rcx, rsi
add rbx, 8
call sym.BF_encrypt
mov rax, qword [rsp + 0x28]
mov qword [rbx - 8], rax
cmp rbx, rdi
jne 0x4db738
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x4dbc70
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r9, r8
mov r8d, 1
call sym.fwrite
add rsp, 0x28
ret
Function at 0x4e2040
Capabilities:
Initialize winsock library

Disassembly:
push r13
push r12
push rdi
push rbx
sub rsp, 0x48
mov r12d, dword [0x00829738]
mov qword [rsp + 0x30], 0
mov rbx, rcx
mov r13, rdx
test r12d, r12d
je 0x4e2100
lea rax, [rsp + 0x30]
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov dword [rsp + 0x20], 1
call sym.BIO_lookup
mov r12d, eax
test eax, eax
je 0x4e21a0
mov rcx, qword [rsp + 0x30]
call sym.BIO_ADDRINFO_family
cmp eax, 2
je 0x4e21c8
call sym.ERR_new
lea r8, str.BIO_get_host_ip
mov edx, 0x3a
xor r12d, r12d
lea rcx, [0x00796c40]
call sym.ERR_set_debug
xor r8d, r8d
mov edx, 0x6b
mov ecx, 0x20
call sym.ERR_set_error
mov rcx, qword [rsp + 0x30]
call sym.BIO_ADDRINFO_free
mov eax, r12d
add rsp, 0x48
pop rbx
pop rdi
pop r12
pop r13
ret
lea rdx, [0x008295a0]
xor eax, eax
mov ecx, 0x33
mov dword [0x00829738], 1
mov rdi, rdx
rep stosq qword [rdi], rax
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4e2069
call sym.ERR_new
lea r8, str.BIO_sock_init
mov edx, 0x94
lea rcx, [0x00796c40]
call sym.ERR_set_debug
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.calling_wsastartup__
mov ecx, 2
mov edx, eax
call sym.ERR_set_error
call sym.ERR_new
lea r8, str.BIO_sock_init
mov edx, 0x96
lea rcx, [0x00796c40]
call sym.ERR_set_debug
xor r8d, r8d
mov edx, 0x7a
mov ecx, 0x20
call sym.ERR_set_error
jmp 0x4e21b4
mov r8, rbx
lea rdx, [0x00796c7c]
mov ecx, 2
call sym.ERR_add_error_data
mov eax, r12d
add rsp, 0x48
pop rbx
pop rdi
pop r12
pop r13
ret
mov rcx, qword [rsp + 0x30]
lea rbx, [rsp + 0x38]
call sym.BIO_ADDRINFO_address
mov r8, rbx
xor edx, edx
mov rcx, rax
call sym.BIO_ADDR_rawaddress
mov r12d, eax
test eax, eax
je 0x4e20de
xor r12d, r12d
cmp qword [rsp + 0x38], 4
jne 0x4e20de
mov rcx, qword [rsp + 0x30]
call sym.BIO_ADDRINFO_address
mov r8, rbx
mov rdx, r13
mov rcx, rax
call sym.BIO_ADDR_rawaddress
mov r12d, eax
jmp 0x4e20de