joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d9260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm8, xmm2
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesenc xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1401d92a0
aesenc xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1401d92a0
aesenc xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesenclast xmm2, xmm7
repz ret

Function at 0x1401d96a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
movdqa xmm14, xmm10
pxor xmm10, xmm15
movdqu xmm15, xmmword [rbx + r14]
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm14, xmm13
pxor xmm5, xmm13
pxor xmm15, xmm14
pxor xmm6, xmm14
pxor xmm7, xmm15
movups xmm0, xmmword [r11 + 0x20]
lea r12, [r8 + 1]
lea r13, [r8 + 3]
lea r14, [r8 + 5]
add r8, 6
pxor xmm10, xmm9
bsf r12, r12
bsf r13, r13
bsf r14, r14
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
pxor xmm11, xmm9
pxor xmm12, xmm9
aesdec xmm6, xmm1
pxor xmm13, xmm9
pxor xmm14, xmm9
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm15, xmm9
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [r11 + 0x40]
shl r12, 4
shl r13, 4
jmp 0x1401d97a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1401d97a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [r11 + 0x10]
shl r14, 4
aesdeclast xmm2, xmm10
movdqu xmm10, xmmword [rbx]
mov rax, r10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
aesdeclast xmm6, xmm14
aesdeclast xmm7, xmm15
repz ret
Function at 0x1401d9840
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1401d98e0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1401d98e0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x1401d9960
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1401d99a0
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1401d99a0
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x1401da410
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.1401da480
shl edx, 4
test eax, eax
jne 0x1401da476
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x1401da43b
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x1401dbf40
Capabilities:
Encode data using xor

Disassembly:
lea r11, [0x1401ddcc0]
movdqu xmm7, xmmword [rcx]
lea rcx, [rcx + 0x10]
movdqa xmm0, xmmword [r11]
movdqa xmm1, xmmword [r11 + 0x10]
movdqa xmm2, xmmword [r11 + 0x20]
movdqa xmm3, xmmword [r11 + 0x30]
movdqa xmm4, xmmword [r11 + 0x40]
pcmpeqd xmm5, xmm5
movdqu xmm6, xmmword [rcx]
movdqa xmmword [rax], xmm7
lea rax, [rax + 0x10]
dec r10d
jmp 0x1401dbf90
pshufb xmm6, xmm4
movdqa xmm8, xmm0
movdqa xmm9, xmm1
pand xmm8, xmm6
pand xmm9, xmm6
movdqa xmm10, xmm2
pcmpeqb xmm8, xmm0
psllq xmm0, 4
movdqa xmm11, xmm3
pcmpeqb xmm9, xmm1
psllq xmm1, 4
pand xmm10, xmm6
pand xmm11, xmm6
movdqa xmm12, xmm0
pcmpeqb xmm10, xmm2
psllq xmm2, 4
movdqa xmm13, xmm1
pcmpeqb xmm11, xmm3
psllq xmm3, 4
movdqa xmm14, xmm2
movdqa xmm15, xmm3
pxor xmm8, xmm5
pxor xmm9, xmm5
pand xmm12, xmm6
pand xmm13, xmm6
movdqa xmmword [rax], xmm8
pcmpeqb xmm12, xmm0
psrlq xmm0, 4
movdqa xmmword [rax + 0x10], xmm9
pcmpeqb xmm13, xmm1
psrlq xmm1, 4
lea rcx, [rcx + 0x10]
pand xmm14, xmm6
pand xmm15, xmm6
movdqa xmmword [rax + 0x20], xmm10
pcmpeqb xmm14, xmm2
psrlq xmm2, 4
movdqa xmmword [rax + 0x30], xmm11
pcmpeqb xmm15, xmm3
psrlq xmm3, 4
movdqu xmm6, xmmword [rcx]
pxor xmm13, xmm5
pxor xmm14, xmm5
movdqa xmmword [rax + 0x40], xmm12
movdqa xmmword [rax + 0x50], xmm13
movdqa xmmword [rax + 0x60], xmm14
movdqa xmmword [rax + 0x70], xmm15
lea rax, [rax + 0x80]
dec r10d
jne 0x1401dbf90
movdqa xmm7, xmmword [r11 + 0x50]
repz ret
Function at 0x1401e1d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
sub rsp, 0x28
test r9, r9
je 0x1401e1e10
movzx r10d, byte [r8]
mov ebx, r10d
and ebx, 0xffffff80
test rdx, rdx
je 0x1401e1d63
movzx eax, bl
mov dword [rdx], eax
cmp r9, 1
je 0x1401e1e50
movzx eax, byte [r8]
test al, al
jne 0x1401e1dd8
movzx eax, byte [r8 + 1]
and eax, 0xffffff80
cmp bl, al
je 0x1401e1e80
lea r11, [r9 - 1]
test rcx, rcx
je 0x1401e1dc7
movsx eax, r10b
sub r9, r11
sar r10b, 7
lea rdx, [r11 - 1]
shr eax, 0x1f
add r9, r8
nop dword [rax + rax]
movzx r8d, byte [r9 + rdx]
xor r8d, r10d
movzx r8d, r8b
add eax, r8d
mov byte [rcx + rdx], al
sub rdx, 1
shr eax, 8
cmp rdx, 0xffffffffffffffff
jne 0x1401e1da8
mov rax, r11
add rsp, 0x28
pop rbx
pop rsi
ret
mov r11, r9
cmp al, 0xff
jne 0x1401e1d89
lea rax, [r8 + 1]
lea rsi, [r8 + r9]
xor edx, edx
nop dword [rax]
movzx r11d, byte [rax]
add rax, 1
or edx, r11d
cmp rsi, rax
jne 0x1401e1df0
test edx, edx
jne 0x1401e1d75
mov r11, r9
jmp 0x1401e1d89
call fcn.1400bf100
lea r8, str.c2i_ibuf
mov edx, 0xa0
lea rcx, str.crypto_asn1_a_int.c
call fcn.1400bf220
xor r8d, r8d
mov edx, 0xde
mov ecx, 0xd
call fcn.1400bf330
xor r11d, r11d
mov rax, r11
add rsp, 0x28
pop rbx
pop rsi
ret
mov r11d, 1
test rcx, rcx
je 0x1401e1dc7
movzx eax, byte [r8]
mov edx, eax
neg eax
test r10b, r10b
cmovns eax, edx
mov byte [rcx], al
mov rax, r11
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.1400bf100
lea r8, str.c2i_ibuf
mov edx, 0xc1
lea rcx, str.crypto_asn1_a_int.c
call fcn.1400bf220
xor r8d, r8d
mov edx, 0xdd
mov ecx, 0xd
call fcn.1400bf330
xor r11d, r11d
jmp 0x1401e1dc7

Function at 0x1401e1f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
movsxd r8, dword [rcx]
mov r11, qword [rcx + 8]
mov r10, r8
test r11, r11
je 0x1401e1f68
test r8, r8
je 0x1401e1f68
mov eax, dword [rcx + 4]
movzx ecx, byte [r11]
and eax, 0x100
jne 0x1401e1fe8
cmp rcx, 0x7f
jbe 0x1401e1fd8
lea rsi, [r8 + 1]
xor ebx, ebx
mov r10d, esi
mov rdi, rsi
jmp 0x1401e1f7a
xor edi, edi
mov r10d, 1
xor ebx, ebx
mov esi, 1
xor r8d, r8d
test rdx, rdx
je 0x1401e1fcb
mov r9, qword [rdx]
test r9, r9
je 0x1401e1fcb
mov byte [r9], bl
test r8, r8
je 0x1401e1fc8
mov eax, ebx
sub rdi, r8
lea rcx, [r8 - 1]
and eax, 1
add r9, rdi
movzx eax, al
nop dword [rax]
movzx r8d, byte [r11 + rcx]
xor r8d, ebx
movzx r8d, r8b
add eax, r8d
mov byte [r9 + rcx], al
sub rcx, 1
shr eax, 8
cmp rcx, 0xffffffffffffffff
jne 0x1401e1fa8
add qword [rdx], rsi
mov eax, r10d
pop rbx
pop rsi
pop rdi
ret
mov rsi, r8
xor ebx, ebx
test eax, eax
je 0x1401e1f5c
nop dword [rax]
cmp rcx, 0x80
jbe 0x1401e2008
lea rsi, [r8 + 1]
mov ebx, 0xffffffff
mov r10d, esi
jmp 0x1401e1f5c
mov rsi, r8
mov ebx, 0xffffffff
jne 0x1401e1f5c
cmp r8, 1
jbe 0x1401e2058
lea rax, [r11 + 1]
lea r10, [r11 + r8]
xor ecx, ecx
nop word cs:[rax + rax]
movzx r9d, byte [rax]
add rax, 1
or ecx, r9d
cmp rax, r10
jne 0x1401e2030
test ecx, ecx
setne sil
mov ebx, esi
and esi, 1
add rsi, r8
neg ebx
mov r10d, esi
jmp 0x1401e1f5c
mov esi, 1
xor ebx, ebx
jmp 0x1401e1f5c
Function at 0x1401f9e40
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x1405d8ac0]
lea rsi, [0x1405d8ac0]
mov r11d, 0x48
mov qword [rcx], rax
mov rax, qword [0x1405d9b00]
lea rdi, [rcx + 8]
mov rbp, rcx
and rdi, 0xfffffffffffffff8
mov r10, rbp
mov qword [rcx + 0x1040], rax
mov rax, rcx
sub rax, rdi
sub rsi, rax
add eax, 0x1048
shr eax, 3
cmp edx, 0x48
cmovle r11d, edx
mov ecx, eax
mov rax, r8
rep movsq qword [rdi], qword [rsi]
lea rdi, [rbp + 0x48]
movsxd r11, r11d
add r11, r8
nop dword [rax]
lea rcx, [rax + 1]
movzx eax, byte [rax]
cmp r11, rcx
cmovbe rcx, r8
shl eax, 8
movzx edx, byte [rcx]
lea r9, [rcx + 1]
or edx, eax
cmp r11, r9
cmovbe r9, r8
mov eax, edx
shl eax, 8
movzx edx, byte [r9]
lea rcx, [r9 + 1]
or edx, eax
cmp r11, rcx
cmovbe rcx, r8
shl edx, 8
lea rax, [rcx + 1]
movzx ecx, byte [rcx]
or edx, ecx
cmp r11, rax
cmovbe rax, r8
xor dword [r10], edx
add r10, 4
cmp rdi, r10
jne 0x1401f9ea8
mov qword [rsp + 0x28], 0
mov rbx, rbp
lea rsi, [rsp + 0x28]
nop
mov rdx, rbp
mov rcx, rsi
add rbx, 8
call fcn.1401f9090
mov eax, dword [rsp + 0x28]
mov dword [rbx - 8], eax
mov eax, dword [rsp + 0x2c]
mov dword [rbx - 4], eax
cmp rbx, rdi
jne 0x1401f9f10
lea rdi, [rbp + 0x1048]
nop dword [rax]
mov rdx, rbp
mov rcx, rsi
add rbx, 8
call fcn.1401f9090
mov eax, dword [rsp + 0x28]
mov dword [rbx - 8], eax
mov eax, dword [rsp + 0x2c]
mov dword [rbx - 4], eax
cmp rdi, rbx
jne 0x1401f9f40
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1401fc720
Capabilities:
Check if file exists

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x38
mov r12, rdx
mov rsi, rcx
call fcn.140281480
mov edx, 0x62
mov rcx, r12
mov r13, rax
call sub.msvcrt.dll_strchr
cmp rax, 1
sbb ebx, ebx
and ebx, 0x10
add ebx, 1
test r13, r13
je 0x1401fc7a0
lea rcx, [0x1405da660]
call fcn.1400a3700
mov r12, rax
test rax, rax
je 0x1401fc830
xor edx, edx
mov rcx, rax
call fcn.1400a3aa0
mov r9, r13
mov r8d, ebx
mov edx, 0x6a
mov rcx, r12
call fcn.1400a5de0
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret
call fcn.1400bf100
lea r8, str.BIO_new_file
mov edx, 0x43
lea rcx, str.crypto_bio_bss_file.c
call fcn.1400bf220
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x20], r12
mov r9, rsi
lea r8, [0x1405da536]
mov edx, eax
mov ecx, 2
call fcn.1400bf330
mov rbx, qword [sym.imp.msvcrt.dll__errno]
call rbx
cmp dword [rax], 2
je 0x1401fc7f3
call rbx
cmp dword [rax], 6
jne 0x1401fc840
call fcn.1400bf100
lea r8, str.BIO_new_file
mov edx, 0x4b
xor r12d, r12d
lea rcx, str.crypto_bio_bss_file.c
call fcn.1400bf220
xor r8d, r8d
mov edx, pe_nt_image_headers64
mov ecx, 0x20
call fcn.1400bf330
jmp 0x1401fc78b
mov rcx, r13
call sub.msvcrt.dll_fclose
jmp 0x1401fc78b
call fcn.1400bf100
lea r8, str.BIO_new_file
mov edx, 0x4d
xor r12d, r12d
lea rcx, str.crypto_bio_bss_file.c
call fcn.1400bf220
xor r8d, r8d
mov edx, 0x80002
mov ecx, 0x20
call fcn.1400bf330
jmp 0x1401fc78b
Function at 0x1401ffdc0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12d, 1
mov ebx, r12d
mov edi, dword [rsp + 0xc0]
mov qword [rsp + 0xa0], rcx
mov ecx, edi
mov esi, r9d
shl ebx, cl
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0xa8], edx
mov qword [rsp + 0xb0], r8
call fcn.1400ad590
test rax, rax
je 0x140200068
cmp edi, 3
jg 0x1401ffeb8
mov edx, dword [rsp + 0xa8]
test edx, edx
jle 0x140200040
mov rax, qword [rsp + 0xa0]
movsxd r11, ebx
mov rbp, qword [rsp + 0xb0]
shl r11, 3
mov r10, qword [rax]
mov eax, dword [rsp + 0xa8]
lea r9, [r10 + 8]
sub eax, 1
lea rdi, [r9 + rax*8]
nop dword [rax + rax]
mov rcx, rbp
xor r8d, r8d
xor edx, edx
nop dword [rax + rax]
mov r13d, edx
mov r12, qword [rcx]
add edx, 1
add rcx, 8
xor r13d, esi
lea eax, [r13 - 1]
not r13d
and eax, r13d
shr eax, 0x1f
neg rax
and rax, r12
or r8, rax
cmp ebx, edx
jne 0x1401ffe70
mov qword [r10], r8
add rbp, r11
mov r10, r9
cmp rdi, r9
je 0x140200040
add r9, 8
jmp 0x1401ffe60
lea ecx, [rdi - 2]
shl r12d, cl
lea eax, [r12 - 1]
and eax, esi
sar esi, cl
mov dword [rsp + 0x24], eax
mov eax, esi
lea edx, [rsi - 1]
mov r9d, esi
not eax
mov ebp, r9d
xor esi, 1
mov edi, r9d
and eax, edx
sub esi, 1
xor ebp, 3
xor edi, 2
shr eax, 0x1f
sub ebp, 1
sub edi, 1
neg rax
mov qword [rsp + 0x28], rax
mov eax, r9d
xor eax, 0xfffffffe
and esi, eax
mov eax, r9d
xor r9d, 0xfffffffc
xor eax, 0xfffffffd
and r9d, ebp
shr esi, 0x1f
and edi, eax
shr r9d, 0x1f
mov eax, dword [rsp + 0xa8]
neg rsi
shr edi, 0x1f
mov ebp, r9d
neg rdi
neg rbp
test eax, eax
jle 0x140200040
movsxd rbx, ebx
movsxd r14, r12d
lea rax, [rbx*8]
shl r14, 3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rax]
mov eax, dword [rsp + 0xa8]
mov qword [rsp + 0x30], rbx
sub eax, 1
add rbx, 8
lea rax, [rbx + rax*8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rax
mov eax, 2
shl eax, cl
movsxd r13, eax
mov eax, 3
shl eax, cl
shl r13, 3
movsxd r15, eax
shl r15, 3
nop dword [rax]
mov rdx, qword [rsp + 0xb0]
xor ebx, ebx
xor r9d, r9d
nop dword [rax]
lea rcx, [r14 + rdx]
mov rax, qword [rdx]
lea r8, [r15 + rdx]
and rax, qword [rsp + 0x28]
mov r11, qword [rcx]
lea rcx, [r13 + rdx]
add rdx, 8
mov rcx, qword [rcx]
mov r10, qword [r8]
mov r8d, dword [rsp + 0x24]
and r11, rsi
and rcx, rdi
and r10, rbp
xor r8d, r9d
or rcx, r11
add r9d, 1
or rax, rcx
mov ecx, r8d
sub r8d, 1
not ecx
or rax, r10
and r8d, ecx
shr r8d, 0x1f
neg r8
and rax, r8
or rbx, rax
cmp r12d, r9d
jne 0x1401fffa8
mov rax, qword [rsp + 0x30]
mov qword [rax], rbx
mov rax, qword [rsp + 0x40]
add qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x48], rax
je 0x140200040
add rax, 8
mov qword [rsp + 0x38], rax
jmp 0x1401fff98
mov rax, qword [rsp + 0xa0]
mov edi, dword [rsp + 0xa8]
mov dword [rax + 8], edi
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x140200057
Function at 0x1402041a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
movsxd rax, dword [r9 + 8]
mov rsi, rax
mov rdi, rdx
mov edx, eax
mov qword [rsp + 0x120], rcx
mov rbx, r8
mov qword [rsp + 0x28], rax
mov rbp, r9
call fcn.1400ad590
test rax, rax
je 0x1402043a8
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x28], 0x10
mov qword [rsp + 0x30], rax
mov r12, rax
ja 0x140204378
mov rax, qword [rbp]
mov r10, qword [rdi]
movsxd rcx, esi
mov r11, qword [rbx]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x120]
test r10, r10
cmove r10, r12
test r11, r11
mov rax, qword [rax]
cmove r11, r12
mov qword [rsp + 0x40], rax
test rcx, rcx
je 0x1402043b0
movsxd r9, dword [rdi + 8]
movsxd rax, dword [rdi + 0xc]
xor r8d, r8d
movsxd rbp, dword [rbx + 8]
movsxd r15, dword [rbx + 0xc]
xor ebx, ebx
mov qword [rsp + 0x48], rax
mov rax, r9
sub rcx, r9
mov rdx, r9
lea rdi, [r9 + 1]
lea r13, [r12 + r9*8]
sub rax, rbp
sub r9, r15
mov r14, rcx
neg rdx
xor ecx, ecx
mov rbp, rax
sub rdi, qword [rsp + 0x48]
add r9, 1
nop word [rax + rax]
mov rax, qword [r10 + rcx*8]
mov r15, rdx
sar r15, 0x3f
and rax, r15
add rax, rbx
mov r15, rax
lea rax, [rbp + rdx]
setb bl
sar rax, 0x3f
and rax, qword [r11 + r8*8]
movzx ebx, bl
add rax, r15
mov qword [r13 + rdx*8], rax
lea rax, [rdi + rdx]
adc rbx, 0
shr rax, 0x3f
add rcx, rax
lea rax, [r9 + rdx]
add rdx, 1
shr rax, 0x3f
add r8, rax
cmp r14, rdx
jne 0x140204280
mov rdi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov r9d, esi
mov rdx, r12
mov rcx, rdi
call fcn.1401fd7a0
mov rdx, r12
mov rcx, rdi
sub rbx, rax
mov rax, qword [rsp + 0x28]
lea r9, [r12 + rax*8]
nop dword [rax]
mov r8, qword [rcx]
mov rax, qword [rdx]
add rdx, 8
add rcx, 8
xor rax, r8
and rax, rbx
xor rax, r8
mov qword [rcx - 8], rax
mov qword [rdx - 8], 0
cmp r9, rdx
jne 0x140204300
mov rax, qword [rsp + 0x120]
mov r13d, 1
mov dword [rax + 8], esi
mov dword [rax + 0x10], 0
cmp r12, qword [rsp + 0x30]
je 0x14020435c
mov r8d, 0x61
lea rdx, str.crypto_bn_bn_mod.c
mov rcx, r12
call fcn.140095b40
mov eax, r13d
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movsxd rax, esi
mov r8d, 0x41
lea rdx, str.crypto_bn_bn_mod.c
lea rcx, [rax*8]
call fcn.140095a80
mov r12, rax
test rax, rax
jne 0x1402041f9
nop dword [rax]
xor r13d, r13d
jmp 0x14020435c
mov r8, qword [rsp + 0x38]
mov rcx, rax
xor r9d, r9d
mov rdx, r12
call fcn.1401fd7a0
jmp 0x140204328
Function at 0x140236f60
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x1c0
xor r13d, r13d
mov rbx, rdx
mov r14, r8
lea rdx, str.SHA512
mov r8, r9
call fcn.1402693f0
mov r12, rax
test rax, rax
je 0x140237080
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rcx, r14
mov edx, 0x20
mov qword [rsp + 0x28], 0
lea r15, [rsp + 0xe0]
mov r8, r15
call fcn.140268b40
mov rcx, r12
mov r13d, eax
call fcn.140269450
test r13d, r13d
je 0x140237098
movzx eax, byte [rsp + 0xff]
lea r14, [rsp + 0x120]
lea r12, [rsp + 0x50]
mov rdx, r15
mov rcx, r14
lea r13, [rsp + 0x80]
and byte [rsp + 0xe0], 0xf8
and eax, 0x3f
or eax, 0x40
mov byte [rsp + 0xff], al
call fcn.140232a60
lea rdx, [rsp + 0x170]
mov rcx, r12
call fcn.14022f820
mov rdx, r14
mov rcx, r13
mov r8, r12
call fcn.14022eb10
lea r14, [rsp + 0xb0]
mov r8, r12
lea rdx, [rsp + 0x148]
mov rcx, r14
call fcn.14022eb10
mov rdx, r14
mov rcx, rbx
call fcn.14022e880
mov rdx, r13
lea rcx, [rsp + 0x30]
mov r13d, 1
call fcn.14022e880
movzx eax, byte [rsp + 0x30]
mov edx, 0x40
mov rcx, r15
and eax, 1
shl eax, 7
xor byte [rbx + 0x1f], al
call fcn.140098720
mov eax, r13d
add rsp, 0x1c0
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 0x40
mov rcx, r15
call fcn.140098720
jmp 0x140237080

Function at 0x1402370f0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x178
movdqu xmm2, xmmword [rdx + 0x10]
movdqu xmm1, xmmword [rdx]
movups xmmword [rsp + 0x30], xmm2
movzx eax, byte [rsp + 0x3f]
mov r12, rcx
lea r14, [rsp + 0x20]
lea rcx, [rsp + 0xd0]
mov rdx, r14
movups xmmword [rsp + 0x20], xmm1
lea rbx, [rsp + 0xa0]
and eax, 0x7f
and byte [rsp + 0x20], 0xf8
lea r13, [rsp + 0x40]
or eax, 0x40
mov byte [rsp + 0x3f], al
call fcn.140232a60
mov r8d, dword [rsp + 0x118]
movdqu xmm0, xmmword [rsp + 0xf8]
paddd xmm0, xmmword [rsp + 0x120]
mov edx, dword [rsp + 0x140]
movdqu xmm3, xmmword [rsp + 0xf8]
mov ecx, dword [rsp + 0x11c]
movups xmmword [rsp + 0x40], xmm0
lea eax, [rdx + r8]
sub edx, r8d
movdqu xmm0, xmmword [rsp + 0x108]
paddd xmm0, xmmword [rsp + 0x130]
mov dword [rsp + 0x60], eax
movdqu xmm4, xmmword [rsp + 0x108]
mov eax, dword [rsp + 0x144]
mov dword [rsp + 0x90], edx
lea rdx, [rsp + 0x70]
movups xmmword [rsp + 0x50], xmm0
movdqu xmm0, xmmword [rsp + 0x120]
lea r9d, [rax + rcx]
sub eax, ecx
mov rcx, rbx
psubd xmm0, xmm3
mov dword [rsp + 0x64], r9d
movups xmmword [rsp + 0x70], xmm0
movdqu xmm0, xmmword [rsp + 0x130]
mov dword [rsp + 0x94], eax
psubd xmm0, xmm4
movups xmmword [rsp + 0x80], xmm0
call fcn.14022f820
mov r8, rbx
mov rdx, r13
mov rcx, r13
call fcn.14022eb10
mov rdx, r13
mov rcx, r12
call fcn.14022e880
mov edx, 0x20
mov rcx, r14
call fcn.140098720
nop
add rsp, 0x178
pop rbx
pop r12
pop r13
pop r14
ret
Function at 0x14034c1f0
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 0x28]
jmp fcn.1400abf50
Function at 0x140350b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rdi, [rdi + 0x64]
sub rsp, 0xe8
mov r9, rsi
lea rsi, [rsp + 0x64]
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
lea r15, [0x140350d40]
mov qword [rsi + 0x74], rcx
cmp rdx, rcx
jb 0x140350c00
shr rcx, 3
lea r8, [rdi - 0x64]
mov rax, qword [r9]
lea r9, [r9 + 8]
xor rax, qword [r8]
lea r8, [r8 + 8]
sub rdx, 8
mov qword [r8 - 8], rax
sub rcx, 1
jne 0x140350bc6
mov qword [rsi + 0x64], r9
mov qword [rsi + 0x6c], rdx
call fcn.140350800
mov r9, qword [rsi + 0x64]
mov rdx, qword [rsi + 0x6c]
mov rcx, qword [rsi + 0x74]
jmp 0x140350bb9
mov rax, rdx
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x140356350
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x28]
add qword [rcx], r8
mov rdi, qword [rcx + 8]
mov rsi, qword [rcx + 0x10]
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
mov r12, rcx
mov r13, rdx
mov r14, r8
test eax, eax
je 0x1403563fa
mov r15d, 8
lea rcx, [rcx + rax + 0x38]
sub r15d, eax
cmp r8, r15
jb 0x1403564ca
mov r8, r15
sub r14, r15
add r13, r15
call sub.msvcrt.dll_memcpy
mov rcx, qword [r12 + 0x38]
mov edx, dword [r12 + 0x30]
xor rbx, rcx
test edx, edx
je 0x1403563f7
xor eax, eax
nop dword [rax + rax]
add rdi, rsi
add rbp, rbx
rol rsi, 0xd
add eax, 1
rol rbx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rbx, rbp
add rbp, rsi
rol rsi, 0x11
add rdi, rbx
rol rbx, 0x15
xor rsi, rbp
xor rbx, rdi
rol rbp, 0x20
cmp eax, edx
jne 0x1403563c0
xor rdi, rcx
mov r9d, r14d
and r14, 0xfffffffffffffff8
lea r8, [r13 + r14]
and r9d, 7
cmp r13, r8
je 0x14035646b
mov ecx, dword [r12 + 0x30]
nop dword [rax]
mov rdx, qword [r13]
xor rbx, rdx
test ecx, ecx
je 0x14035645f
xor eax, eax
nop dword [rax]
add rdi, rsi
add rbp, rbx
rol rsi, 0xd
add eax, 1
rol rbx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rbx, rbp
add rbp, rsi
rol rsi, 0x11
add rdi, rbx
rol rbx, 0x15
xor rsi, rbp
xor rbx, rdi
rol rbp, 0x20
cmp ecx, eax
jne 0x140356428
add r13, 8
xor rdi, rdx
cmp r8, r13
jne 0x140356418
test r9d, r9d
jne 0x1403564ae
movq xmm0, rdi
movq xmm1, rsi
movq xmm2, rbx
mov dword [r12 + 0x28], r9d
punpcklqdq xmm0, xmm1
movups xmmword [r12 + 8], xmm0
movq xmm0, rbp
punpcklqdq xmm0, xmm2
movups xmmword [r12 + 0x18], xmm0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r10, [r12 + 0x38]
xor eax, eax
mov edx, eax
add eax, 1
movzx ecx, byte [r8 + rdx]
mov byte [r10 + rdx], cl
cmp eax, r9d
jb 0x1403564b5
jmp 0x140356470
call sub.msvcrt.dll_memcpy
add dword [r12 + 0x28], r14d
jmp 0x14035649d

Function at 0x140359210
Capabilities:
Create thread

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r8d, 0x27
lea rdx, str.crypto_thread_arch_thread_win.c
mov rbx, rcx
mov ecx, 8
call fcn.140095c70
mov r12, rax
test rax, rax
je 0x140359280
mov qword [rsp + 0x28], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
lea r8, [0x140359170]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [r12], rax
test rax, rax
je 0x140359280
mov eax, 1
mov qword [rbx + 0x20], r12
add rsp, 0x38
pop rbx
pop r12
ret
mov r8d, 0x34
mov qword [rbx + 0x20], 0
lea rdx, str.crypto_thread_arch_thread_win.c
mov rcx, r12
call fcn.140095b40
xor eax, eax
add rsp, 0x38
pop rbx
pop r12
ret