joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008f910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x140145084], 0
jne 0x14008fa1a
mov dword [rsp - 0x1c], ebx
xor edx, edx
lea r8, [0x140145080]
nop word [rax + rax]
mov ecx, edx
mov dword [rsp - 0x24], 0x7ec7d8d4
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
mov dword [rsp - 0x44], 0x5e3e3be3
shr eax, 1
neg ecx
and ecx, 0xedb88320
xchg rsp, rsp
inc edx
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x3c], ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x34], ebx
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x20], esp
and ecx, 1
neg ecx
and ecx, 0xedb88320
xchg r11, r11
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x40], edx
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov r12, r12
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
mov r10, r10
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [rsp - 0x40], esi
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x20], 0x52004e5a
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
xchg rdx, rdx
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov r13, r13
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [rsp - 0x3c], edx
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x2c], 0x7376ee66
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14008f934
ret
Function at 0x140094da4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp - 0xc], 0x7012d8fd
xchg r8, rbp
mov qword [rsp + 0x10], r8
xchg rbp, r8
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x20
mov dword [rsp - 0x18], esi
movzx eax, byte [rdx + 1]
xchg r8, r12
mov r15, r12
xchg r8, r12
movzx ebx, byte [rdx]
movzx edi, byte [rdx + 4]
mov r8d, dword [rcx + 4]
mov dword [rsp - 0x34], edx
shl ebx, 2
shl ebx, 3
shl ebx, 1
shl ebx, 1
shl ebx, 1
dec r8d
xchg rcx, rcx
or ebx, eax
shl edi, 7
shl edi, 1
movzx eax, byte [rdx + 2]
shl ebx, 8
or ebx, eax
mov r8, r8
movzx eax, byte [rdx + 3]
shl ebx, 2
shl ebx, 2
shl ebx, 4
or ebx, eax
movzx eax, byte [rdx + 5]
mov r13, r13
or edi, eax
movzx eax, byte [rdx + 6]
shl edi, 2
shl edi, 4
shl edi, 1
shl edi, 1
or edi, eax
xchg r13, r13
movzx eax, byte [rdx + 7]
shl edi, 4
shl edi, 4
or edi, eax
test r8d, r8d
xchg rbp, rbp
jle 0x140094eee
mov rdx, qword [rcx + 8]
lea r14d, [r8 - 1]
mov rcx, rcx
movsxd rax, r8d
shr r14d, 1
inc r14d
lea rcx, [rax + rax*2]
mov r9, r9
lea eax, [r8 - 1]
lea rsi, [rdx + rcx*4]
movsxd rcx, eax
xchg rdi, rdi
lea rax, [rcx + rcx*2]
lea rbp, [rdx + rax*4]
xchg rsi, rdi
mov rdx, rdi
xchg rsi, rdi
mov ecx, edi
call fcn.1400955f8
mov rcx, rcx
xor ebx, eax
xchg rbp, rdi
mov rdx, rdi
xchg rdi, rbp
mov ecx, ebx
call fcn.1400955f8
mov dword [rsp - 0x3c], 0x1da7737a
xor edi, eax
nop
add rsi, 0x21d2012c
sub rsi, 0x21d20144
add rbp, 0xffffffffffffffe8
sub r14, 1
mov dword [rsp - 0x2c], 0xabb6ce5
jne 0x140094e9a
lea rax, [r15 + 7]
mov ecx, 0x77e5bbab
xor ecx, 0x721a6e08
add ecx, 0x251ce6ac
sub ecx, 0x2b1cbc4b
mov byte [rax - 4], dil
mov byte [rax], bl
dec rax
mov dword [rsp - 0x28], ebp
shr ebx, 5
shr ebx, 3
shr edi, 7
shr edi, 1
sub rcx, 1
mov dword [rsp - 0x44], ebx
jne 0x140094f09
mov rbx, qword [rsp + 0x40]
xchg rsi, rbp
mov rsi, qword [rsp + 0x48]
xchg rsi, rbp
mov rsi, qword [rsp + 0x50]
sub rsp, 0xffffffffffffffe0
xchg r11, r11
pop r15
pop r14
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140094f5c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rsp, rax
mov rsp, rax
xchg rsp, rax
xchg rbx, r11
mov qword [rax + 8], r11
xchg r11, rbx
xchg rbp, r8
mov qword [rax + 0x10], r8
xchg r8, rbp
mov qword [rax + 0x18], rsi
xchg rbp, rdi
mov qword [rax + 0x20], rbp
xchg rdi, rbp
nop
mov qword [rsp - 8], r14
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffe0
neg rsp
movzx eax, byte [rdx + 1]
xchg r10, r14
mov r10, r8
xchg r14, r10
movzx ebx, byte [rdx]
xchg rsi, rsi
movzx edi, byte [rdx + 4]
shl ebx, 6
shl ebx, 1
shl ebx, 1
or ebx, eax
mov dword [rsp - 0x30], 0x7ad05e92
shl edi, 5
shl edi, 2
shl edi, 1
movzx eax, byte [rdx + 2]
mov dword [rsp - 0x14], ebp
shl ebx, 7
shl ebx, 1
or ebx, eax
mov r10, r10
movzx eax, byte [rdx + 3]
shl ebx, 1
shl ebx, 2
shl ebx, 3
shl ebx, 1
shl ebx, 1
or ebx, eax
xchg rbp, rbp
movzx eax, byte [rdx + 5]
or edi, eax
movzx eax, byte [rdx + 6]
xchg rsp, rsp
shl edi, 5
shl edi, 1
shl edi, 1
shl edi, 1
or edi, eax
movzx eax, byte [rdx + 7]
mov dword [rsp - 0x10], 0x1feb1521
shl edi, 7
shl edi, 1
or edi, eax
xchg rsp, rsp
mov eax, dword [rcx + 4]
test eax, eax
jle 0x140095080
xchg rsp, rsp
xchg rsi, r15
mov r15, qword [rcx + 8]
xchg rsi, r15
lea ebp, [rax - 1]
mov dword [rsp - 0x38], 0x22999828
shr ebp, 1
inc ebp
xchg rsi, rdx
mov rsi, rdx
xchg rsi, rdx
mov ecx, edi
call fcn.1400955f8
mov dword [rsp - 0x34], 0x79900fb
xor ebx, eax
lea rdx, [rsi + 0xc]
mov ecx, ebx
xchg r12, r12
call fcn.1400955f8
xor edi, eax
add rsi, 0x18
sub rbp, 1
xchg r14, r14
jne 0x140095045
lea rax, [r14 + 7]
mov ecx, 0x31030fe9
add ecx, 0x2fa51e35
sub ecx, 0x2afab663
sub ecx, 0x35ad77b7
mov byte [rax - 4], dil
mov r14, r14
mov byte [rax], bl
dec rax
shr ebx, 7
shr ebx, 1
shr edi, 6
shr edi, 1
shr edi, 1
sub rcx, 1
xchg rcx, rcx
jne 0x14009509b
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov r13, r13
xchg rsi, rdi
mov rdi, qword [rsp + 0x40]
xchg rsi, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
xchg r11, r11
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400952b8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
xchg rdi, rbx
mov qword [rsp + 0x10], rdi
xchg rbx, rdi
xchg r11, rsi
mov qword [rsp + 0x18], r11
xchg r11, rsi
push rbp
mov dword [rsp - 0x44], 0x2b167c97
push rdi
push r14
lea rbp, [rsp - 0x47]
xchg r10, r10
sub rsp, 0xa0
movdqa xmm0, xmmword [0x140001df0]
xor edi, edi
mov dword [rsp - 0x24], 0x5f30361b
movdqa xmm1, xmmword [0x140001dd0]
xchg r8, rbx
mov r8, rdx
xchg r8, rbx
xchg rbp, rdi
movdqu xmmword [rdi - 0x39], xmm0
xchg rbp, rdi
xchg rcx, rbx
mov rsi, rbx
xchg rcx, rbx
mov edx, edi
mov dword [rsp - 0x38], esi
movdqa xmm0, xmmword [0x140001dc0]
mov r8d, edi
movdqu xmmword [rbp - 0x29], xmm1
mov rsi, rsi
movdqa xmm1, xmmword [0x140001db0]
xchg r15, rbp
movdqu xmmword [r15 - 0x19], xmm0
xchg r15, rbp
xchg r9, rbp
movdqu xmmword [r9 - 9], xmm1
xchg r9, rbp
mov ecx, edx
lea r8, [r8 + 4]
xchg r11, r11
mov eax, 0x46f63137
sub eax, 0x3881e0b9
add eax, 0x558ab18b
sub eax, 0x32a9b875
add eax, 0x29fd053d
inc rdx
rol eax, cl
mov dword [rsp - 0x14], esp
xor eax, dword [rbp + r8 - 0x3d]
mov dword [rbp + r8 + 3], eax
cmp rdx, 0x10
jb 0x140095359
mov dword [rsp - 0x34], 0x37b8fbe0
cmp dword [rsi + 4], 8
jne 0x140095402
lea rdx, [rbp + 0x6d]
mov dword [rsp - 0x18], 0x4dc4736a
movzx ecx, byte [rbx + rdi*2]
movzx eax, byte [rbx + rdi*2 + 1]
inc rdi
shl cx, 3
shl cx, 1
shl cx, 4
or cx, ax
mov word [rdx], cx
lea rdx, [rdx - 2]
mov r13, r13
cmp rdi, 4
jl 0x1400953b6
lea r9, [rbp + 7]
xor r8d, r8d
xchg rbp, rbp
lea rdx, [rbp + 0x67]
mov rcx, rsi
call fcn.1400950f0
xchg rdi, rdi
jmp 0x1400954c4
cmp dword [rsi], edi
jle 0x1400954c4
xchg rdx, rdx
mov r14d, edi
lea rdx, [rbp + 0x6d]
mov r8d, 0x6eaf2f06
add r8d, 0xa1243ba
add r8d, 0x40b8dce
sub r8d, 0x7ccd008a
movzx eax, byte [rbx]
xchg r8, r8
movzx ecx, byte [rbx + 1]
add rbx, 2
shl ax, 5
shl ax, 1
shl ax, 2
or cx, ax
mov word [rdx], cx
mov rdi, rdi
lea rdx, [rdx - 2]
sub r8, 1
jne 0x14009542f
xchg r13, r13
lea r9, [rbp + 7]
mov r8d, r14d
lea rdx, [rbp + 0x67]
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call fcn.1400950f0
mov r8d, dword [rsi + 4]
lea r9, [rbp + 0x27]
mov dword [rsp - 0x28], 0x74257f62
sub r8d, r14d
lea rdx, [rbp + 0x67]
nop
sub r8d, 0x72f98be1
add r8d, 0x72f98bd9
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call fcn.1400950f0
mov dword [rsp - 0x34], edi
inc edi
add r14d, 8
cmp edi, dword [rsi]
jl 0x140095410
mov r13, r13
xor eax, eax
lea r11, [rsp + 0xa0]
xchg rbx, rsi
mov rsi, qword [r11 + 0x28]
xchg rbx, rsi
lea rdi, [rbp + 7]
mov rsi, qword [r11 + 0x30]
mov dword [rsp - 0x20], 0x29145b2c
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
xchg rbx, rsp
mov rbx, r11
xchg rsp, rbx
pop r14
xchg rdi, rdi
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rbp
mov dword [rsp - 0x1c], ecx
ret
Function at 0x1400955a8
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov r11d, ecx
test edx, edx
mov r12, r12
je 0x1400955f0
lea ecx, [r11 + r11]
mov r9d, r10d
xor r9d, r11d
mov dword [rsp - 0x34], 0x2d44e95d
mov r11d, ecx
test dl, 1
cmove r9d, r10d
xchg r8, r8
xor r11d, r8d
cmp ecx, 0x100
mov r10d, r9d
cmovb r11d, ecx
mov dword [rsp - 0x44], 0x4e708b4e
shr edx, 1
jne 0x1400955b5
mov eax, r10d
mov r8, r8
ret
Function at 0x1400a0874
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0xf8]
mov dword [rsp - 0x3c], 0x1ee60526
xor r8d, r8d
xchg rdx, r9
mov rdx, r9
xchg rdx, r9
test rax, rax
mov dword [rsp - 0x24], edx
je 0x1400a08dd
mov ecx, r8d
mov edx, 0x646cedf2
sub edx, 0x4e48f1ad
add edx, 0x10cfdcdc
add edx, 0x345e75b0
rol edx, cl
xor dl, byte [rax]
mov rdi, rdi
inc rax
mov byte [r8 + r9], dl
inc r8
mov rdi, rdi
cmp r8, 0x20
jb 0x1400a089c
mov al, 0x55
sub al, 0x46
add al, 0x11
sub al, 0x1f
ret
xchg rbx, rax
mov rbx, qword [rcx + 0x100]
xchg rbx, rax
test rax, rax
je 0x1400a0918
movups xmm0, xmmword [rax]
mov rbx, rbx
xchg r15, rdx
movups xmmword [r15], xmm0
xchg r15, rdx
movups xmm1, xmmword [rax + 0x10]
mov r11, r11
xchg rdx, rsp
movups xmmword [rsp + 0x10], xmm1
xchg rdx, rsp
jmp 0x1400a08d4
xorps xmm0, xmm0
xor al, al
mov r11, r11
xchg rdx, r11
movups xmmword [r11], xmm0
xchg r11, rdx
xchg r13, rdx
movups xmmword [r13 + 0x10], xmm0
xchg r13, rdx
ret
Function at 0x1400b7454
Capabilities:
Encode data using xor

Disassembly:
xchg rsp, rbp
mov r11, rbp
xchg rsp, rbp
xchg rsp, rbx
mov qword [r11 + 8], rsp
xchg rsp, rbx
xchg rsi, r13
mov qword [r11 + 0x18], r13
xchg rsi, r13
mov qword [r11 + 0x20], rdi
push r14
mov dword [rsp - 0x24], 0x6069b906
add rsp, 0xffffffffffffffc0
mov rdx, qword [0x1401444c8]
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
movabs rcx, 0xb7e4b05a6ffd5a14
xor rcx, 0x5c9d240
xor rcx, 0x34686890
xor rcx, 0x2ff810e9
add rcx, 0x7fffffff
sub rcx, 0x419cbc6f
mov dword [rsp + 0x58], 0x726ec279
xor dword [rsp + 0x58], 0x1bd1a3b1
sub dword [rsp + 0x58], 0x1a41b0f6
xor dword [rsp + 0x58], 0x4f7db0c2
add rdx, rcx
movabs rax, 0x3155689129f86453
xor rax, 0x18d70319
xor rax, 0x535e164a
sub rax, 0x571465f2
not rdx
xchg r11, r11
lea rcx, [r11 - 0x28]
sub rdx, rax
movabs rax, 0xd4e227c061075f57
add rax, 0x5d6f4ae
sub rax, 0x90d9ceb
xor rax, 0x449333c3
ror rdx, 4
ror rdx, 0x24
ror rdx, 0xc
ror rdx, 1
ror rdx, 2
ror rdx, 2
ror rdx, 1
ror rdx, 1
add rax, rdx
lea rdx, [r11 + 0x10]
call rax
xchg rsp, rsp
lea rdi, [rbx + 8]
xorps xmm0, xmm0
xchg rdi, rdx
mov qword [rbx], rdx
xchg rdi, rdx
xor esi, esi
xchg rcx, rdi
movups xmmword [rcx], xmm0
xchg rdi, rcx
movups xmmword [rdi + 0x10], xmm0
xchg r12, r12
movups xmmword [rdi + 0x20], xmm0
test eax, eax
jne 0x1400b758b
xchg rbp, rbp
mov qword [rbx + 0x38], rsi
jmp 0x1400b76c9
lea rax, [rsp + 0x20]
mov dword [rsp - 0xc], ebp
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
mov rbp, rbp
jne 0x1400b7598
xchg rsp, r14
mov qword [rbx + 0x38], rsp
xchg r14, rsp
cmp qword [rbx], rdi
je 0x1400b75d5
mov r11, r11
xchg r9, rcx
mov r9, qword [rbx]
xchg r9, rcx
call fcn.140099eb0
mov dword [rsp - 0x3c], 0x3d216bec
cmp r14, 0x18
jbe 0x1400b7616
lea rcx, [r14 + r14]
xchg rdi, rdi
call fcn.14009a150
xchg r9, rax
mov qword [rbx], r9
xchg r9, rax
test rax, rax
mov dword [rsp - 0x1c], esi
jne 0x1400b7626
xchg rdi, rdx
mov qword [rbx], rdx
xchg rdx, rdi
xchg rsi, rbx
mov rcx, rbx
xchg rsi, rbx
jmp 0x1400b7649
xchg rdi, rcx
mov qword [rbx], rcx
xchg rdi, rcx
xchg r8, rax
mov r8, rdi
xchg r8, rax
xorps xmm0, xmm0
mov r11, r11
xchg r8, rax
movups xmmword [r8], xmm0
xchg r8, rax
xchg r13, rax
movups xmmword [r13 + 0x10], xmm0
xchg r13, rax
xchg r15, rax
movups xmmword [r15 + 0x20], xmm0
xchg r15, rax
mov rcx, qword [rbx]
mov edx, 0x2b66b483
xor edx, 0x609c076f
xor edx, 0x6702966f
sub edx, 0x29274264
add edx, 0x66d87cf2
cmp qword [rbx + 0x38], rsi
jbe 0x1400b76c9
mov dword [rsp - 0x14], edi
lea r8, [rsp + 0x20]
sub r8, rcx
movzx eax, dx
mov rcx, rcx
mov r9d, 0x35d7b12
add r9d, 0x2b035f19
sub r9d, 0x29bffd98
sub r9d, 0x4a0db94
and ax, r9w
ror edx, 4
ror edx, 1
ror edx, 3
xor ax, word [r8 + rcx]
xchg rdi, rdi
inc rsi
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
mov dword [rsp - 0x10], esp
jb 0x1400b767c
mov rsi, qword [rsp + 0x60]
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
xchg rbx, r12
mov r12, qword [rsp + 0x50]
xchg rbx, r12
xchg rcx, rdi
mov rcx, qword [rsp + 0x68]
xchg rcx, rdi
sub rsp, 0xffffffffffffffc0
mov dword [rsp - 0x3c], ebp
nop
add rsp, 8
mov r14, qword [rsp - 8]
ret
Function at 0x1400c99cc
Capabilities:
Enumerate pe sections

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x3c], ebx
xchg rbp, rsi
mov qword [rsp + 0x18], rbp
xchg rbp, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
push 0x2904674
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
mov dword [rsp - 0x44], 0x5406ae3c
nop
mov qword [rsp - 8], r15
sub rsp, 8
nop
sub rsp, 0x2855e3e6
add rsp, 0x2855e3c6
movzx esi, word [rdx + 0x14]
xchg rcx, rcx
lea rbx, [rdx + 0x18]
movzx eax, word [rdx + 6]
xchg r11, rcx
mov r13, r11
xchg r11, rcx
add rbx, rsi
mov dword [rsp - 0x14], edx
mov ecx, 0x43503c99
add ecx, 0xa55e2d8
sub ecx, 0x4a96c477
add ecx, 0x751a14dc
sub ecx, 0x78296fd5
xchg rsp, r9
mov r15, rsp
xchg rsp, r9
xchg r12, rdi
mov rdi, r8
xchg rdi, r12
xchg rbx, rdi
mov rbx, rdx
xchg rbx, rdi
cmp cx, ax
mov dword [rsp - 0x34], 0x4576166c
jae 0x1400c9aea
lea rbp, [rdx + 0x40]
add rbp, rsi
mov dword [rsp - 0x28], ebp
sub ax, cx
movzx r14d, ax
xchg rdx, rsi
mov rsi, rbp
xchg rsi, rdx
xchg r13, rcx
mov r13, rcx
xchg r13, rcx
call fcn.1400ca7e0
test al, al
mov dword [rsp - 0x34], 0x4d37f11d
xchg rdi, rbp
mov rcx, rdi
xchg rdi, rbp
cmove rcx, rbx
sub rbp, 0xffffffffffffffd8
mov r10, r10
mov rbx, rcx
sub r14, 1
jne 0x1400c9aa5
mov rcx, rcx
mov eax, dword [rsi + rdi + 0x24]
mov rdx, rbx
xchg rdx, rdi
mov rcx, rdx
xchg rdi, rdx
mov dword [r12], eax
mov r15, r15
call fcn.1400869f0
add eax, dword [rbx + 0xc]
mov rbx, qword [rsp + 0x50]
xchg r10, rbp
mov r10, qword [rsp + 0x58]
xchg rbp, r10
xchg r13, rsi
mov r13, qword [rsp + 0x60]
xchg rsi, r13
mov dword [r15], eax
mov dword [rsp - 0x38], esi
neg rsp
add rsp, 0xffffffffffffffe0
neg rsp
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
mov r13, qword [rsp - 8]
pop r12
xchg r15, r15
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400daa3c
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 0x10], r9
xchg r9, rbx
mov qword [rsp + 0x18], rsi
xchg rdi, r13
mov qword [rsp + 0x20], r13
xchg rdi, r13
push rbp
xchg rcx, rsp
mov rbp, rcx
xchg rsp, rcx
nop
sub rsp, 0x55b6b21f
add rsp, 0x55b6b1cf
xor esi, esi
mov dword [rbp - 0x30], 0x7005725b
xor dword [rbp - 0x30], 0x4a789869
add dword [rbp - 0x30], 0x1737716c
add dword [rbp - 0x30], 0x1f7a927e
sub dword [rbp - 0x30], 0x711cedd6
mov dword [rbp - 0x2c], 0x2b01b720
add dword [rbp - 0x2c], 0x2bfb70bb
sub dword [rbp - 0x2c], 0x2aadabcc
sub dword [rbp - 0x2c], 0x2c1a7b74
xchg rcx, rbp
mov rbx, rbp
xchg rbp, rcx
mov dword [rbp - 0x28], 0x2a93382
add dword [rbp - 0x28], 0x7499fd35
sub dword [rbp - 0x28], 0x201d8d71
sub dword [rbp - 0x28], 0x56d3a324
mov dword [rbp - 0x24], 0x5ff03b0c
sub dword [rbp - 0x24], 0x4064feee
sub dword [rbp - 0x24], 0xfece294
sub dword [rbp - 0x24], 0xf905903
mov dword [rbp - 0x20], 0x77447aa4
xor dword [rbp - 0x20], 0x27291ed3
xor dword [rbp - 0x20], 0x561ab78a
xor dword [rbp - 0x20], 0x73a57db0
xor dword [rbp - 0x20], 0x75deae30
mov qword [rbp + 0x10], rsi
xchg r10, r10
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
and cl, 3
mov dword [rsp - 0x2c], 0x28b3cbc3
shl cl, 2
shl cl, 1
movzx edx, word [rbp + rax*2 - 0x30]
mov eax, 0x6d5c3ed9
xor eax, 0x2e6687a3
add eax, 0x3754fedd
sub eax, 0x136ebade
add eax, 0x3886298
shr eax, cl
mov rdx, rdx
movzx ecx, al
mov rax, qword [rbp + 0x10]
xor cx, dx
mov rdx, rdx
mov word [rbp + rax*2 - 0x1c], cx
mov rax, qword [rbp + 0x10]
inc rax
mov qword [rbp + 0x10], rax
mov dword [rsp - 0x34], 0x181afcab
xchg rdi, rax
mov rdi, qword [rbp + 0x10]
xchg rdi, rax
cmp rax, 0xa
xchg rdi, rdi
jb 0x1400dab20
xor edx, edx
mov word [rbp - 8], si
xchg rbp, rbp
lea rcx, [rbp - 0x1c]
call fcn.14008c3d0
xchg r8, rax
mov rax, r8
xchg r8, rax
mov qword [rbx + 0x200], rax
xor eax, eax
lea rdi, [rbp - 0x1c]
mov dword [rsp - 0x3c], 0x74e50b4a
lea ecx, [rax + 0xa]
rep stosb byte [rdi], al
test r8, r8
xchg rdx, rdx
je 0x1400dac1e
lea rdx, [rbx + 0x208]
xchg r11, rcx
mov r11, r8
xchg rcx, r11
call fcn.1400db31c
test al, al
mov dword [rsp - 0x3c], 0x2612b9ff
jne 0x1400dac16
mov rcx, qword [rbx + 0x200]
call fcn.14008e900
xor al, al
xchg r14, r14
mov qword [rbx + 0x200], rsi
jmp 0x1400dac1e
mov al, 0x49
add al, 0x2f
sub al, 0x65
sub al, 0x12
mov rbx, qword [rsp + 0x68]
xchg r10, r10
xchg rsi, rdx
mov rdx, qword [rsp + 0x70]
xchg rsi, rdx
xchg rdi, rsi
mov rsi, qword [rsp + 0x78]
xchg rsi, rdi
nop
sub rsp, 0x72e542c0
add rsp, 0x72e54310
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400db104
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
xchg rbx, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x1eb19c5b
add rsp, 0x1eb19b1b
xchg rcx, rdi
mov rcx, r8
xchg rdi, rcx
xchg rbx, r8
mov r8, rcx
xchg rbx, r8
mov r8d, 0x47d94d7a
xor r8d, 0x2938094a
sub r8d, 0x3c1d4796
sub r8d, 0x58bc4d3
sub r8d, 0x2d3836c7
lea rcx, [rsp + 0x40]
mov rdx, rdx
xor edx, edx
call fcn.14009a470
mov rax, qword [rbx + 0x238]
lea r8, [rsp + 0x40]
mov dword [rsp - 0x44], ebx
mov edx, dword [rdi + 0x10]
movabs rcx, 0x6e38e68584b3bde
sub rcx, 0x1aa9c214
sub rcx, 0x16dd46d9
xor rcx, 0x6061f4ff
ror rax, 3
ror rax, 3
mov r9d, 0x3e2f88d2
add r9d, 0xaeb07b6
add r9d, 0x1a032b1c
xor r9d, 0x631dbaa4
sub rax, rcx
mov dword [rsp + 0x30], 0x27f37697
xor dword [rsp + 0x30], 0x4de3f418
sub dword [rsp + 0x30], 0x304d1869
xor dword [rsp + 0x30], 0x26737f6e
sub dword [rsp + 0x30], 0x1fb01546
and dword [rsp + 0x28], 0
movabs rcx, 0x7ef714643bf0cd6
xor rcx, 0x60326d55
add rcx, 0x463d8fb
add rcx, 0x7980767
add rcx, 0x7fffffff
add rcx, 0x1ec6335a
and qword [rsp + 0x20], 0
ror rax, 3
ror rax, 0x16
ror rax, 0x10
xor rax, rcx
mov dword [rsp - 0x20], edi
mov rcx, qword [rdi + 0x20]
ror rax, 7
ror rax, 2
ror rax, 8
ror rax, 2
not rax
call rax
xchg rsp, rsp
test eax, eax
jne 0x1400db2f6
or eax, 0xffffffff
lea rbx, [rsp + 0x40]
xchg r15, r15
cmp byte [rsp + 0x40], 0
mov dword [rsp + 0x150], eax
je 0x1400db2bf
mov rdx, rbx
xchg r10, r10
lea rcx, [rsp + 0x150]
mov r8d, 0x2261659b
xor r8d, 0x11e8fa04
add r8d, 0x403afd7
xor r8d, 0x378d4f77
inc rbx
mov dword [rsp - 0x20], esp
call fcn.14008f5a0
cmp byte [rbx], 0
jne 0x1400db276
mov dword [rsp - 0x14], esi
mov eax, dword [rsp + 0x150]
not eax
cmp eax, 0xa2ca6717
mov dword [rsp - 0x24], 0x560a193a
je 0x1400db2e9
cmp eax, 0xd7b7e7a8
sete al
mov dword [rsp - 0x40], 0x7e533cf7
jmp 0x1400db2f8
mov al, 0x44
add al, 0x2e
sub al, 0x4f
xor al, 0x22
jmp 0x1400db2f8
xor al, al
mov rbx, qword [rsp + 0x158]
mov dword [rsp - 0xc], ecx
add rsp, 0x681538d2
sub rsp, 0x68153792
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x1400df730
Capabilities:
Encrypt data using curve25519

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbp, rbx
push rdi
sub rsp, 0x6e1e1c2d
add rsp, 0x6e1e1b6d
mov rax, r8
mov r14, r14
mov rbx, rdx
xchg rsp, rdx
mov r8, rsp
xchg rdx, rsp
xchg rcx, r12
mov rdi, r12
xchg r12, rcx
mov edx, 0x58b10c59
sub edx, 0x1b5491a7
sub edx, 0xf5aa370
xor edx, 0x72390a1b
sub edx, 0x5c38dd39
mov rcx, rax
call fcn.1400dffb0
movzx eax, byte [rbx + 0x1f]
mov dword [rsp - 0x1c], 0x5dff1f9c
lea rcx, [rsp + 0x20]
and byte [rbx], 0xf8
and al, 0x3f
or al, 0x40
mov dword [rsp - 0x2c], edx
xchg rdx, rdi
mov rdi, rbx
xchg rdi, rdx
mov byte [rbx + 0x1f], al
call fcn.1400e3600
lea rdx, [rsp + 0x20]
mov r9, r9
xchg rcx, r12
mov r12, rdi
xchg rcx, r12
call fcn.1400e3530
xchg r12, rbx
mov r12, qword [rsp + 0xd0]
xchg rbx, r12
add rsp, 0xc0
xchg rbx, rbx
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400f4090
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x6ad1b3d7
sub r10d, 0x484f52f7
xor r10d, 0x3f030bfd
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r9d, r9d
add r8d, r8d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x42bf1a64
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
mov al, byte [rdx]
cvtdq2ps xmm2, xmm2
test al, al
je 0x1400f4126
mov r10, qword [rcx + 0x300]
movzx eax, al
inc rdx
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x140149620]
mov al, byte [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test al, al
jne 0x1400f40ea
mov eax, r9d
ret

Function at 0x1400f421c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x2e8]
mov r10d, 0x450628f4
sub r10d, 0x4137894a
xor r10d, 0x1e4ff4b7
mov r8d, dword [rcx + 0x2f4]
xor eax, r10d
xor r8d, r10d
xor r11d, r11d
add r8d, r8d
mov r9d, r11d
movd xmm2, eax
mov eax, dword [rcx + 0x308]
xor eax, 0x42bf1a64
mov dword [rsp + 8], eax
movss xmm3, dword [rsp + 8]
movzx eax, word [rdx]
cvtdq2ps xmm2, xmm2
test ax, ax
je 0x1400f42c5
mov r10, qword [rcx + 0x300]
movzx eax, ax
nop
sub rdx, 0x4a04748
add rdx, 0x4a0474a
add rax, rax
movups xmm0, xmmword [r10 + rax*8]
xorps xmm0, xmmword [0x140149620]
movzx eax, word [rdx]
movaps xmm1, xmm0
shufps xmm1, xmm0, 0xaa
subss xmm1, xmm0
mulss xmm1, xmm2
addss xmm1, xmm3
cvttss2si ecx, xmm1
sub ecx, r8d
add r9d, ecx
test ax, ax
jne 0x1400f427b
mov eax, r9d
ret

Function at 0x1400f42cc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xa0
xor ebx, ebx
mov rdi, rcx
mov qword [rax + 8], rbx
cmp qword [rcx + 0x2f8], rbx
je 0x1400f4365
mov edx, dword [rcx + 0x2ec]
mov ecx, 0x40789ba
add ecx, 0x6c5e9541
sub ecx, 0x8b9d404
sub ecx, 0x4a2adfda
mov eax, dword [rdi + 0x2e8]
xor edx, ecx
xor eax, ecx
lea rcx, [rbx - 1]
imul edx, eax
lea eax, [rbx + 4]
movsxd rsi, edx
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.140099d50
test rsi, rsi
jle 0x1400f4382
mov rcx, qword [rdi + 0x2f8]
mov edx, dword [rcx + rbx*4]
xor edx, 0x75b15a6d
mov dword [rax + rbx*4], edx
inc rbx
cmp rbx, rsi
jl 0x1400f4341
jmp 0x1400f4382
lea rdx, [rsp + 0xb0]
call fcn.1400f44e8
test al, al
je 0x1400f43cd
mov rax, qword [rsp + 0xb0]
lea rcx, [0x14000bb80]
mov qword [rsp + 0x98], 0x4129b3e9
xor qword [rsp + 0x98], 0x5f6b7f93
sub qword [rsp + 0x98], 0x1e42cc62
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rcx, qword [rdi + 0x318]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rax
call fcn.1400f3398
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret