joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b0630
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg r9, rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x4f38e3e2
add eax, 0x24b4f530
sub eax, 0x4858bcf8
add eax, 0x1078fae9
xor eax, 0xf60d20d
sub eax, 0x336eb15e
call fcn.1401fd640
sub rsp, rax
mov ebx, edx
mov edi, ecx
call fcn.1401fe170
mov dword [rsp + 0x24], eax
mov r9d, 0x3e09baa
xor r9d, 0x74f981d9
sub r9d, 0xb61f04f
sub r9d, 0x2df7469d
add r9d, 0x3177e6ea
sub r9d, 0x62fbf8eb
xor r9d, 0x4501f6e7
sub r9d, 0x53bf283
sub r9d, 0x43fe34dd
mov dword [rsp + 0x13a4], 0x12b23c9e
add dword [rsp + 0x13a4], 0x67a924d9
sub dword [rsp + 0x13a4], 0x5d0760d3
add dword [rsp + 0x13a4], 0x45085ef
add dword [rsp + 0x13a4], 0x1e781741
add dword [rsp + 0x13a4], 0x2f1b78fc
xor dword [rsp + 0x13a4], 0x90c7e92f
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0x1a
shr r8d, 2
shr r8d, 1
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401b0709
mov ebp, 0x3f8a3ea9
xor ebp, 0x2370cfd8
xor ebp, 0x36260ca3
xor ebp, 0x3c77ec2
xor ebp, 0x69f163aa
sub ebp, 0x39c34792
add ebp, 0x67392124
xor ebp, 0xee60ba4c
mov dword [rsp + 0x20], 0x647f189d
sub dword [rsp + 0x20], 0x511b8776
add dword [rsp + 0x20], 0x251c6320
xor dword [rsp + 0x20], 0x4721357
add dword [rsp + 0x20], 0x2e53d63f
sub dword [rsp + 0x20], 0x22aa17b3
xor dword [rsp + 0x20], 0x487f3123
xor dword [rsp + 0x20], 0xfc896cf
cmp edi, ebp
lea rax, [rsp + 0x20]
xchg r11, rax
mov qword [rsp + 0x13d0], r11
xchg r11, rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401b07f7
call fcn.1401b0a70
mov ecx, eax
jmp 0x1401b084f
inc edi
mov ebx, edi
call fcn.1401b0a70
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401b0847
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401b0847
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401b0a70
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401b082c
shr rcx, 4
shr rcx, 0x1c
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
mov rbx, qword [r11 + 0x10]
lea eax, [rdx + rbp]
xchg r14, rbp
mov r14, qword [r11 + 0x18]
xchg r14, rbp
lea ecx, [rdx - 0x80000000]
mov rsi, qword [r11 + 0x28]
cmovae eax, ecx
mov rsp, r11
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0a70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x63441529
add r9d, 0x154e4936
xor r9d, 0x4a172db8
sub r9d, 0x2d04633
add r9d, 0x3f421ea8
sub r9d, 0x690eca15
sub r9d, 0x5e87fd7
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b0b03
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b0abe
mov ecx, dword [r10]
jmp 0x1401b0c48
cmp ecx, 0x4e0
jb 0x1401b0c48
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x5989b3f7
sub ebx, 0x4d16e8b1
add ebx, 0x2d20c005
xor ebx, 0x319148d8
add ebx, 0x2b6664bb
xor ebx, 0x1caeca6b
sub ebx, 0x2fc7e142
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0b46
lea r11, [r10 + 0xd50]
mov ebx, 0x5a32355c
xor ebx, 0x7c8cf6dd
xor ebx, 0x333b254f
add ebx, 0x29bf7525
xor ebx, 0x7a29cfff
xor ebx, 0x70604d72
add ebx, 0x3d6e68f2
sub ebx, 0x6847ad53
sub ebx, 0xa339391
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0bca
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 3
shr ecx, 1
shr ecx, 2
shr ecx, 3
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 4
shl eax, 3
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 3
shl eax, 9
shl eax, 1
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 8
shr eax, 9
shr eax, 1
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa

Function at 0x14022c8a0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1406bd5dd
push 0xffffffffcbee8039
call fcn.1404c4979
out 0xd5, eax
or al, 0xf9
out 0x74, al
cdq
xchg esp, eax
mov ebx, dword [rdi]
cwd
xchg esp, eax
inc dword [rdi + riz*8]
cdq
inc byte [rsi]
sub byte [rdx + 0x76eae02c], al
or byte gs:[rdi + rbp*4 + 0x2408cf51], dl
fnsave dword [rbx]
test eax, 0xfbd99495
mov dl, byte [rbp - 0x5ad91c6c]
or byte [rsp + rdx*2], r15b
cld
invalid
Function at 0x140231b50
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
movzx r14d, r9b
mov r15, r8
mov rsi, rdx
mov rdi, rcx
test r9b, r9b
jne 0x140231b9a
call fcn.140231220
test al, al
je 0x140231ed4
call fcn.140229910
mov rbp, rax
xor ebx, ebx
cmp qword [rax + 0x10], rbx
jne 0x140231bcd
lea ecx, [rbx + 0x10]
call fcn.14023be5c
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140231bc6
mov rcx, rax
call fcn.14022de10
jmp 0x140231bc9
mov rax, rbx
mov qword [rbp + 0x10], rax
mov r12d, 0x40
mov r8, r12
lea rdx, [rsp + 0x30]
mov rcx, qword [rbp + 0x10]
call fcn.14022e800
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x20]
lea r8, [rsp + 0xc0]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14022c570
mov r11, qword [rsp + 0x20]
mov byte [rsp + r11 + 0xc0], 0
mov dword [rsp + 0x84], ebx
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x88], 0x67452301
mov dword [rsp + 0x8c], 0xefcdab89
mov dword [rsp + 0x90], 0x98badcfe
mov dword [rsp + 0x94], 0x10325476
invalid
test byte [rax + rbx*4], ah
add byte [rax], al

Function at 0x14063a45a
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140928f87
syscall
ret
Function at 0x1400012f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0xb0
xor r15d, r15d
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov r14d, r15d
xor eax, eax
lock cmpxchg qword [0x1400035e0], rbx
je 0x140001359
cmp rax, rbx
jne 0x14000134c
mov edi, 1
mov r14d, edi
jmp 0x14000135e
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001330
mov edi, 1
mov eax, dword [0x1400035e8]
cmp eax, edi
jne 0x140001376
mov esi, 0x1f
mov ecx, esi
call fcn.140093000
jmp 0x1400013e7
mov eax, dword [0x1400035e8]
test eax, eax
jne 0x1400013dc
mov dword [0x1400035e8], edi
lea r12, [0x1400021b0]
lea rbx, [0x140002198]
mov qword [rsp + 0x30], rbx
mov eax, r15d
mov dword [rsp + 0x24], eax
cmp rbx, r12
jae 0x1400013ce
test eax, eax
jne 0x1400013d2
mov rsi, qword [rbx]
test rsi, rsi
je 0x1400013c3
mov rcx, rsi
mov rax, qword [0x140002170]
call rax
call rsi
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x1400013a0
test eax, eax
je 0x1400013e2
mov eax, 0xff
jmp 0x140001543
mov dword [0x140003024], edi
mov esi, 0x1f
mov eax, dword [0x1400035e8]
cmp eax, edi
jne 0x14000140e
lea rdx, [0x140002190]
lea rcx, [0x140002180]
call sub.msvcrt.dll__initterm
mov dword [0x1400035e8], 2
test r14d, r14d
jne 0x14000141d
mov rax, r15
xchg qword [0x1400035e0], rax
cmp qword [0x1400035f0], r15
je 0x140001454
lea rcx, [0x1400035f0]
call fcn.140001750
test eax, eax
je 0x140001454
mov rbx, qword [0x1400035f0]
mov rcx, rbx
mov rax, qword [0x140002170]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rdx, qword [rax]
test rdx, rdx
jne 0x14000146d
mov eax, 0xff
jmp 0x140001543
mov qword [rsp + 0x28], rdx
mov ecx, dword [rsp + 0x20]
cmp word [rdx], 0x20
ja 0x1400014f4
cmp word [rdx], r15w
je 0x140001486
test ecx, ecx
jne 0x1400014f4
movzx eax, word [rdx]
sub ax, di
cmp ax, si
ja 0x14000149c
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140001486
mov ecx, dword [rsp + 0x7c]
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
and cl, dil
cmovne r9d, eax
mov r8, rdx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001010
mov dword [0x140003020], eax
cmp dword [0x140003040], r15d
jne 0x1400014dd
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003024], r15d
jne 0x1400014f2
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003020]
jmp 0x140001543
cmp word [rdx], 0x22
jne 0x140001508
mov eax, r15d
test ecx, ecx
sete al
mov ecx, eax
mov dword [rsp + 0x20], eax
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140001476
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
sub rsp, 0x28
call fcn.1400017e4
add rsp, 0x28
jmp 0x1400012f0
Function at 0x877c00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x14a8
call fcn.008a7180
sub rsp, rax
movaps xmmword [rsp + 0x1490], xmm15
movaps xmmword [rsp + 0x1480], xmm14
movaps xmmword [rsp + 0x1470], xmm13
movaps xmmword [rsp + 0x1460], xmm12
movaps xmmword [rsp + 0x1450], xmm11
movaps xmmword [rsp + 0x1440], xmm10
movaps xmmword [rsp + 0x1430], xmm9
movdqa xmmword [rsp + 0x1420], xmm8
movaps xmmword [rsp + 0x1410], xmm7
movaps xmmword [rsp + 0x1400], xmm6
movdqa xmm9, xmmword [0x008af5e0]
xor eax, eax
movdqa xmm12, xmmword [0x008af5f0]
pxor xmm2, xmm2
movdqa xmm4, xmmword [0x008af610]
movdqa xmm6, xmmword [0x008af630]
movdqa xmm13, xmmword [0x008af670]
movdqa xmm14, xmmword [0x008af680]
movdqa xmm15, xmmword [0x008af690]
movdqa xmm7, xmmword [0x008af6a0]
movdqa xmm10, xmmword [0x008af6b0]
movdqa xmm11, xmmword [0x008af6c0]
nop dword [rax + rax]
Function at 0x880140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub cl, byte [rdi]
test byte [rsi + rcx*2 + 0x75], dh
jmp 0x168985c
test byte [rsi + 0xf000002], dh
test dword [rax + 2], esi
add byte [rax], al
add byte [rax - 0x3f7bc3fc], cl
mov rax, qword [rcx + 0x10]
mov edx, dword [rcx + 0x3c]
jmp 0x88020a
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 8], 0x5b41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xa], 0x5a41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xc], 0x5941
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xe], 0x5841
je 0x8802b4
jne 0x8802b4
jmp 0x1f6eb52
ret
mov qword [rcx + 0x10], rdx
jmp 0x880385
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 6], 0x5c41
jmp 0x88014e
cmp edx, 0x8664
je 0x8802d1
cmp edx, 0x14c
jne 0x88018b
je 0x88026b
jne 0x88026b
jmp 0x888bbe
jne 0x8802c6
add byte [rax], al
add byte [rax], al
jmp 0x880193
jne 0x880342
je 0x10d18d3d
mov r9, qword [rcx + 0x10]
lea rdx, [r9 + 1]
mov qword [rcx + 0x10], rdx
je 0x880303
jne 0x880303
jmp 0x8802f4
je 0x880285
jne 0x880285
add byte [rax], al
add byte [rax], al
mov rdx, qword [rcx + 8]
mov byte [rdx + r8], 0x58
mov qword [rcx + 0x10], r9
jmp 0x88018b
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x11], 0x5e
mov rdx, qword [rcx + 8]
je 0x88028c
jne 0x88028c
je 0x2984706
mov byte [rax + rdx + 2], 0x5d
pop rbp
je 0x880342
jmp 0x8801e5
mov byte [rax + rdx + 4], 0x5a
mov rdx, qword [rcx + 8]
lea r8, [rax + 6]
je 0x8802c6
jmp 0x8801d7
mov byte [rax + rdx + 3], 0x5b
mov rdx, qword [rcx + 8]
jmp 0x88024b
mov rdx, qword [rcx + 8]
mov byte [rdx + rax], 0x5f
mov rdx, qword [rcx + 8]
mov byte [rax + rdx + 1], 0x5e
mov rdx, qword [rcx + 8]
je 0x88023c
jne 0x88023c
jmp 0x872972
jmp 0x8801b0
jne 0x8802f4
mov byte [r9 + rdx + 0x12], 0x5d
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x13], 0x5b
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x14], 0x5a
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x15], 0x59
jmp 0x8802dd
je 0x8d98e00
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x10], 0x5f
jmp 0x880228
jne 0x880317
jmp 0x5984790
mov byte [rax + rdx + 5], 0x59
lea r9, [rax + 7]
jmp 0x8802e5
mov r8, qword [rcx + 8]
lea rdx, [rax + 1]
jmp 0x880339
lea r8, [r9 + 0x16]
add r9, 0x17
je 0x880212
jne 0x880212
jmp 0x8802b2
jmp 0x8801a0
je 0x880317
jmp 0x8802c3
mov byte [r8 + r9], 0x8b
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
je 0x880383
jne 0x880383
jmp 0x880317
mov qword [rcx + 0x10], rdx
mov byte [r8 + r9], 0xe5
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
lea rdx, [r9 + 1]
jmp 0x88035d
lea rdx, [r9 + 1]
jmp 0x8802f9
mov qword [rcx + 0x10], rdx
je 0x88036d
jne 0x88036d
jmp 0x8d98e8e
mov rdx, qword [rcx + 8]
je 0x88025f
jne 0x88025f
je 0x871641
inc dword [rax]
add byte [rax], al
add byte [rdi], cl
test byte [rsi - 2], bh
invalid
je 0x8801e1
jne 0x8801e1
add byte [rax], al
add byte [rax], al
mov byte [r8 + rax], 0x48
mov r8, qword [rcx + 8]
je 0x8801ed
jne 0x8801ed
jmp 0xffffffffc6cbae72
jmp 0x88032f
mov byte [r8 + r9], 0x5d
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov word [r8 + r9], 0x5f41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 2], 0x5e41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 4], 0x5d41
je 0x8802f4
jmp 0x88028a
invalid
Function at 0x88a860
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
jmp 0x88aab8
mov edi, edx
jmp 0x88ab91
je 0x88aabe
jne 0x88aabe
je 0x53de0218
push rsi
push rdi
push rbp
push rbx
jmp 0x88abba
sub rsp, 0xa8
jmp 0x88a9b8

Function at 0x898c50
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, [rdx + 0x10]
cmp r8d, 0x100
cmovne rax, rdx
lea r8, str.expand_32_byte_kexpand_16_byte_k
lea r9, [0x008afbe0]
cmove r9, r8
mov edx, dword [rax]
mov dword [rcx + 0x20], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x24], edx
mov edx, dword [rax + 8]
mov dword [rcx + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x2c], eax
mov dword [rcx], 0x61707865
mov rax, qword [r9 + 4]
mov qword [rcx + 4], rax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0xc], eax
ret

Function at 0x898d90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [rdx]
mov dword [rsp + 0xc], eax
mov eax, dword [rdx + 4]
mov dword [rsp + 0x10], eax
mov eax, dword [rdx + 8]
mov dword [rsp + 0x14], eax
mov r12d, dword [rdx + 0xc]
mov r13d, dword [rdx + 0x10]
mov r14d, dword [rdx + 0x14]
mov r15d, dword [rdx + 0x18]
mov r10d, dword [rdx + 0x1c]
mov edi, dword [rdx + 0x20]
mov r11d, dword [rdx + 0x24]
mov ebx, dword [rdx + 0x28]
mov ebp, dword [rdx + 0x2c]
mov ecx, dword [rdx + 0x30]
mov eax, dword [rdx + 0x34]
mov r9d, dword [rdx + 0x38]
mov r8d, dword [rdx + 0x3c]
mov dword [rsp + 0x4c], 0xfffffff8
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x3c], ecx
mov edx, ecx
mov dword [rsp + 0x38], ebp
mov dword [rsp + 8], ebp
mov dword [rsp + 0x34], ebx
mov dword [rsp], ebx
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x2c], edi
mov ebp, edi
mov dword [rsp + 0x28], r10d
mov edi, r10d
mov dword [rsp + 0x24], r15d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
mov dword [rsp + 0x1c], r13d
mov dword [rsp + 0x18], r12d
mov r14d, r12d
mov r12d, dword [rsp + 0x14]
mov r10d, dword [rsp + 0x10]
mov ecx, dword [rsp + 0xc]
nop

Function at 0x89ed00
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x89ed8b
mov qword [rcx + 0x48], 0
mov qword [rcx], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x40], rax
xor eax, eax
ret
mov eax, 1
ret
Function at 0x89f7b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
mov edx, 0x20
mov rcx, r8
mov r8, rsi
call fcn.0089f520
and byte [rsi], 0xf8
mov al, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.0089c170
mov rcx, rdi
mov rdx, rbx
call fcn.0089c0f0
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret
Function at 0x89f810
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov qword [rsp + 0x28], rcx
xor eax, eax
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
mov byte [rsp + rax + 0x30], cl
add rax, 1
cmp rax, 0x20
jne 0x89f830
and byte [rsp + 0x30], 0xf8
mov al, byte [rsp + 0x4f]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0x4f], al
lea rbp, [rsp + 0x140]
mov rcx, rbp
call fcn.00899570
lea rbx, [rsp + 0x170]
mov rcx, rbx
call fcn.00899200
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.00899220
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0089b4a0
mov rcx, rbx
mov rdx, rbx
call fcn.00899800
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
call fcn.00899fa0
lea rcx, [rsp + 0x80]
call fcn.00899200
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.008991e0
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.00899550
lea r14, [rsp + 0xe0]
mov rcx, r14
call fcn.00899200
mov r13d, 0xfe
xor r15d, r15d
nop word cs:[rax + rax]
nop
mov ebp, r15d
mov eax, r13d
shr rax, 3
movzx r15d, byte [rsp + rax + 0x30]
mov ecx, r13d
and cl, 7
shr r15d, cl
and r15d, 1
xor ebp, r15d
lea rsi, [rsp + 0x80]
mov rcx, rsi
lea r12, [rsp + 0x50]
mov rdx, r12
mov r8d, ebp
call fcn.008993b0
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
call fcn.008993b0
lea rbp, [rsp + 0xb0]
mov rcx, rbp
mov rdx, r12
mov r8, r14
call fcn.0089b4a0
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call fcn.0089b4a0
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.00899220
mov rcx, rdi
mov rdx, r12
mov r8, r14
call fcn.00899220
mov rcx, r14
mov rdx, rbp
mov r8, rsi
call fcn.00899fa0
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
call fcn.00899fa0
mov rcx, rbp
mov rdx, rbx
call fcn.00899a90
mov rcx, rbx
mov rdx, rsi
call fcn.00899a90
mov rcx, r12
mov rdx, r14
mov r8, rdi
call fcn.00899220
mov rcx, rdi
mov rdx, r14
mov r8, rdi
call fcn.0089b4a0
mov rcx, rsi
mov rdx, rbx
mov r8, rbp
call fcn.00899fa0
mov rcx, rbx
mov rdx, rbx
mov r8, rbp
call fcn.0089b4a0
mov rcx, rdi
mov rdx, rdi
call fcn.00899a90
mov rcx, r14
mov rdx, rbx
call fcn.0089aae0
mov rcx, r12
mov rdx, r12
call fcn.00899a90
mov rcx, rbp
mov rdx, rbp
mov r8, r14
call fcn.00899220
mov rcx, r14
lea rdx, [rsp + 0x140]
mov r8, rdi
call fcn.00899fa0
mov rcx, rdi
mov rdx, rbx
mov r8, rbp
call fcn.00899fa0
add r13d, 0xffffffff
cmp r13d, 0xffffffff
jne 0x89f900
lea rsi, [rsp + 0x80]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov r8d, r15d
call fcn.008993b0
lea rdi, [rsp + 0x110]
lea rdx, [rsp + 0xe0]
mov rcx, rdi
mov r8d, r15d
call fcn.008993b0
mov rcx, rdi
mov rdx, rdi
call fcn.00899800
mov rcx, rsi
mov rdx, rsi
mov r8, rdi
call fcn.00899fa0
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call fcn.0089a810
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret