joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140221710
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x80]
and eax, 0x3f
mov rbx, rcx
lea ecx, [rax + 1]
mov rsi, rdx
mov byte [rbx + rax], pe_nt_image_headers64
mov eax, ecx
lea rdi, [rbx + 0x40]
add rax, rbx
cmp ecx, 0x20
jbe 0x140221810
mov edx, 0x40
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x140221898
mov ecx, edx
mov qword [rax], 0
mov qword [rax + rcx - 8], 0
lea rcx, [rax + 8]
and rcx, 0xfffffffffffffff8
sub rax, rcx
add edx, eax
and edx, 0xfffffff8
cmp edx, 8
jb 0x14022178c
and edx, 0xfffffff8
xor eax, eax
mov r8d, eax
add eax, 8
mov qword [rcx + r8], r9
cmp eax, edx
jb 0x14022177e
vpxor xmm0, xmm0, xmm0
mov rdx, rdi
mov rcx, rbx
call sym.whirlpool_round
vmovdqu xmmword [rbx], xmm0
vmovdqu xmmword [rbx + 0x10], xmm0
mov rax, qword [rbx + 0x80]
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rbx + 0x20], xmm0
mov rdx, rax
shr rdx, 0x3d
bswap rdx
mov qword [rbx + 0x30], rdx
shl rax, 3
bswap rax
mov qword [rbx + 0x38], rax
mov rdx, rdi
mov rcx, rbx
call sym.whirlpool_round
lea rdx, [rbx + 0x48]
mov rax, rsi
sub rax, rdx
cmp rax, 0x10
jbe 0x1402218c0
vmovdqu ymm1, ymmword [rbx + 0x40]
vmovdqu ymmword [rsi], ymm1
vmovdqu ymm0, ymmword [rbx + 0x60]
vmovdqu ymmword [rsi + 0x20], ymm0
vzeroupper
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x20
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x140221868
mov ecx, edx
mov qword [rax], 0
mov qword [rax + rcx - 8], 0
lea rcx, [rax + 8]
and rcx, 0xfffffffffffffff8
sub rax, rcx
add edx, eax
and edx, 0xfffffff8
cmp edx, 8
jb 0x1402217a4
and edx, 0xfffffff8
xor eax, eax
mov r8d, eax
add eax, 8
mov qword [rcx + r8], r9
cmp eax, edx
jb 0x14022184f
jmp 0x1402217a4
test dl, 4
jne 0x140221907
test edx, edx
je 0x1402217a4
mov byte [rax], 0
test dl, 2
je 0x1402217a4
xor ecx, ecx
mov word [rax + rdx - 2], cx
jmp 0x1402217a4
test dl, 4
jne 0x14022191a
test edx, edx
je 0x14022178c
mov byte [rax], 0
test dl, 2
je 0x14022178c
xor r8d, r8d
mov word [rax + rdx - 2], r8w
jmp 0x14022178c
mov rax, qword [rbx + 0x40]
mov qword [rsi], rax
mov rax, qword [rbx + 0x48]
mov qword [rsi + 8], rax
mov rax, qword [rbx + 0x50]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x58]
mov qword [rsi + 0x18], rax
mov rax, qword [rbx + 0x60]
mov qword [rsi + 0x20], rax
mov rax, qword [rbx + 0x68]
mov qword [rsi + 0x28], rax
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x30], rax
mov rax, qword [rbx + 0x78]
mov qword [rsi + 0x38], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x1402217a4
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x14022178c
Function at 0x140221930
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x80]
and eax, 0x3f
mov rbx, rcx
lea ecx, [rax + 1]
mov rsi, rdx
mov byte [rbx + rax], pe_nt_image_headers64
mov eax, ecx
lea rdi, [rbx + 0x40]
add rax, rbx
cmp ecx, 0x20
jbe 0x140221a30
mov edx, 0x40
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x140221ab8
mov ecx, edx
mov qword [rax], 0
mov qword [rax + rcx - 8], 0
lea rcx, [rax + 8]
and rcx, 0xfffffffffffffff8
sub rax, rcx
add edx, eax
and edx, 0xfffffff8
cmp edx, 8
jb 0x1402219ac
and edx, 0xfffffff8
xor eax, eax
mov r8d, eax
add eax, 8
mov qword [rcx + r8], r9
cmp eax, edx
jb 0x14022199e
vpxor xmm0, xmm0, xmm0
mov rdx, rdi
mov rcx, rbx
call sym.whirlpool0_round
vmovdqu xmmword [rbx], xmm0
vmovdqu xmmword [rbx + 0x10], xmm0
mov rax, qword [rbx + 0x80]
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rbx + 0x20], xmm0
mov rdx, rax
shr rdx, 0x3d
bswap rdx
mov qword [rbx + 0x30], rdx
shl rax, 3
bswap rax
mov qword [rbx + 0x38], rax
mov rdx, rdi
mov rcx, rbx
call sym.whirlpool0_round
lea rdx, [rbx + 0x48]
mov rax, rsi
sub rax, rdx
cmp rax, 0x10
jbe 0x140221ae0
vmovdqu ymm1, ymmword [rbx + 0x40]
vmovdqu ymmword [rsi], ymm1
vmovdqu ymm0, ymmword [rbx + 0x60]
vmovdqu ymmword [rsi + 0x20], ymm0
vzeroupper
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x20
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x140221a88
mov ecx, edx
mov qword [rax], 0
mov qword [rax + rcx - 8], 0
lea rcx, [rax + 8]
and rcx, 0xfffffffffffffff8
sub rax, rcx
add edx, eax
and edx, 0xfffffff8
cmp edx, 8
jb 0x1402219c4
and edx, 0xfffffff8
xor eax, eax
mov r8d, eax
add eax, 8
mov qword [rcx + r8], r9
cmp eax, edx
jb 0x140221a6f
jmp 0x1402219c4
test dl, 4
jne 0x140221b27
test edx, edx
je 0x1402219c4
mov byte [rax], 0
test dl, 2
je 0x1402219c4
xor ecx, ecx
mov word [rax + rdx - 2], cx
jmp 0x1402219c4
test dl, 4
jne 0x140221b3a
test edx, edx
je 0x1402219ac
mov byte [rax], 0
test dl, 2
je 0x1402219ac
xor r8d, r8d
mov word [rax + rdx - 2], r8w
jmp 0x1402219ac
mov rax, qword [rbx + 0x40]
mov qword [rsi], rax
mov rax, qword [rbx + 0x48]
mov qword [rsi + 8], rax
mov rax, qword [rbx + 0x50]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x58]
mov qword [rsi + 0x18], rax
mov rax, qword [rbx + 0x60]
mov qword [rsi + 0x20], rax
mov rax, qword [rbx + 0x68]
mov qword [rsi + 0x28], rax
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x30], rax
mov rax, qword [rbx + 0x78]
mov qword [rsi + 0x38], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x1402219c4
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x1402219ac
Function at 0x140221b50
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x80]
and eax, 0x3f
mov rbx, rcx
lea ecx, [rax + 1]
mov rsi, rdx
mov byte [rbx + rax], pe_nt_image_headers64
mov eax, ecx
lea rdi, [rbx + 0x40]
add rax, rbx
cmp ecx, 0x20
jbe 0x140221c50
mov edx, 0x40
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x140221cd8
mov ecx, edx
mov qword [rax], 0
mov qword [rax + rcx - 8], 0
lea rcx, [rax + 8]
and rcx, 0xfffffffffffffff8
sub rax, rcx
add edx, eax
and edx, 0xfffffff8
cmp edx, 8
jb 0x140221bcc
and edx, 0xfffffff8
xor eax, eax
mov r8d, eax
add eax, 8
mov qword [rcx + r8], r9
cmp eax, edx
jb 0x140221bbe
vpxor xmm0, xmm0, xmm0
mov rdx, rdi
mov rcx, rbx
call sym.whirlpool1_round
vmovdqu xmmword [rbx], xmm0
vmovdqu xmmword [rbx + 0x10], xmm0
mov rax, qword [rbx + 0x80]
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rbx + 0x20], xmm0
mov rdx, rax
shr rdx, 0x3d
bswap rdx
mov qword [rbx + 0x30], rdx
shl rax, 3
bswap rax
mov qword [rbx + 0x38], rax
mov rdx, rdi
mov rcx, rbx
call sym.whirlpool1_round
lea rdx, [rbx + 0x48]
mov rax, rsi
sub rax, rdx
cmp rax, 0x10
jbe 0x140221d00
vmovdqu ymm1, ymmword [rbx + 0x40]
vmovdqu ymmword [rsi], ymm1
vmovdqu ymm0, ymmword [rbx + 0x60]
vmovdqu ymmword [rsi + 0x20], ymm0
vzeroupper
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x20
xor r9d, r9d
sub edx, ecx
cmp edx, 8
jb 0x140221ca8
mov ecx, edx
mov qword [rax], 0
mov qword [rax + rcx - 8], 0
lea rcx, [rax + 8]
and rcx, 0xfffffffffffffff8
sub rax, rcx
add edx, eax
and edx, 0xfffffff8
cmp edx, 8
jb 0x140221be4
and edx, 0xfffffff8
xor eax, eax
mov r8d, eax
add eax, 8
mov qword [rcx + r8], r9
cmp eax, edx
jb 0x140221c8f
jmp 0x140221be4
test dl, 4
jne 0x140221d47
test edx, edx
je 0x140221be4
mov byte [rax], 0
test dl, 2
je 0x140221be4
xor ecx, ecx
mov word [rax + rdx - 2], cx
jmp 0x140221be4
test dl, 4
jne 0x140221d5a
test edx, edx
je 0x140221bcc
mov byte [rax], 0
test dl, 2
je 0x140221bcc
xor r8d, r8d
mov word [rax + rdx - 2], r8w
jmp 0x140221bcc
mov rax, qword [rbx + 0x40]
mov qword [rsi], rax
mov rax, qword [rbx + 0x48]
mov qword [rsi + 8], rax
mov rax, qword [rbx + 0x50]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x58]
mov qword [rsi + 0x18], rax
mov rax, qword [rbx + 0x60]
mov qword [rsi + 0x20], rax
mov rax, qword [rbx + 0x68]
mov qword [rsi + 0x28], rax
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x30], rax
mov rax, qword [rbx + 0x78]
mov qword [rsi + 0x38], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x140221be4
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x140221bcc
Function at 0x1402563f0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
lea rbx, [0x14030c8e0]
lea rdi, [rbx + 0x18]
mov r10, rcx
lea rsi, [rcx + 0x5fe]
nop dword [rax + rax]
movzx r11d, word [rbx]
mov r9, rsi
xor r8d, r8d
nop word [rax + rax]
movzx eax, word [r9]
mov ecx, r8d
sub r9, 2
and ecx, 0xf
mov edx, eax
imul eax, eax, 0xaaab
shr eax, 0x19
lea eax, [rax + rax*2]
shl eax, 8
sub edx, eax
mov eax, r11d
movzx edx, dx
shl eax, cl
add ax, word [r10 + rdx*2]
xor word [r10 + r8*2], ax
add r8, 1
cmp r8, 0x300
jne 0x140256420
add rbx, 2
cmp rdi, rbx
jne 0x140256410
pop rbx
pop rsi
pop rdi
ret
Function at 0x1402680d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rdi, r8
mov r13, rcx
mov rsi, rdx
mov r12, r8
shl rdi, 7
mov r14, rcx
lea rbp, [rsp + 0x30]
lea r15, [rcx + rdi - 0x40]
mov rax, rdi
shr rax, 6
vmovdqu xmm2, xmmword [r15]
vmovdqu xmm3, xmmword [r15 + 0x10]
vmovdqu xmm4, xmmword [r15 + 0x20]
vmovdqu xmm5, xmmword [r15 + 0x30]
mov qword [rsp + 0x28], rax
shl rax, 6
vmovdqu xmmword [rsp + 0x30], xmm2
mov rbx, rax
vmovdqu xmmword [rsp + 0x40], xmm3
vmovdqu ymm1, ymmword [rsp + 0x30]
add rbx, rcx
vmovdqu xmmword [rsp + 0x50], xmm4
vmovdqu xmmword [rsp + 0x60], xmm5
vmovdqu ymm0, ymmword [rsp + 0x50]
nop
vpxor ymm0, ymm0, ymmword [r14 + 0x20]
mov rdx, rsi
mov rcx, rbp
add r14, 0x40
vpxor ymm1, ymm1, ymmword [r14 - 0x40]
vmovdqu ymmword [rsp + 0x50], ymm0
vmovdqu ymmword [rsp + 0x30], ymm1
call sym.pwxform
vmovdqu ymm1, ymmword [rsp + 0x30]
vmovdqu ymm0, ymmword [rsp + 0x50]
vmovdqu ymmword [r14 - 0x40], ymm1
vmovdqu ymmword [r14 - 0x20], ymm0
cmp rbx, r14
jne 0x140268150
mov edx, dword [rsi + 4]
mov rcx, r15
add r12, r12
add rdi, r13
call sym.salsa20
cmp qword [rsp + 0x28], r12
jae 0x140268223
nop dword [rax]
mov eax, dword [rbx - 0x40]
xor dword [rbx], eax
mov rcx, rbx
mov eax, dword [rbx - 0x3c]
xor dword [rbx + 4], eax
mov eax, dword [rbx - 0x38]
xor dword [rbx + 8], eax
mov eax, dword [rbx - 0x34]
xor dword [rbx + 0xc], eax
mov eax, dword [rbx - 0x30]
xor dword [rbx + 0x10], eax
mov eax, dword [rbx - 0x2c]
xor dword [rbx + 0x14], eax
mov eax, dword [rbx - 0x28]
xor dword [rbx + 0x18], eax
mov eax, dword [rbx - 0x24]
xor dword [rbx + 0x1c], eax
mov eax, dword [rbx - 0x20]
xor dword [rbx + 0x20], eax
mov eax, dword [rbx - 0x1c]
xor dword [rbx + 0x24], eax
mov eax, dword [rbx - 0x18]
xor dword [rbx + 0x28], eax
mov eax, dword [rbx - 0x14]
xor dword [rbx + 0x2c], eax
mov eax, dword [rbx - 0x10]
xor dword [rbx + 0x30], eax
mov eax, dword [rbx - 0xc]
xor dword [rbx + 0x34], eax
mov eax, dword [rbx - 8]
xor dword [rbx + 0x38], eax
mov eax, dword [rbx - 4]
xor dword [rbx + 0x3c], eax
add rbx, 0x40
mov edx, dword [rsi + 4]
call sym.salsa20
cmp rdi, rbx
jne 0x1402681b0
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1402685d0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
vmovdqu xmm5, xmmword [rcx + 0x50]
vmovdqu xmm4, xmmword [rcx + 0x40]
vmovdqu xmm1, xmmword [rcx + 0x60]
vmovdqu xmmword [rsp + 0x30], xmm5
mov rsi, rdx
lea rbp, [rcx + 0x40]
mov rbx, rcx
vmovdqu xmm5, xmmword [rbp + 0x30]
vmovdqu xmmword [rsp + 0x20], xmm4
vmovdqu xmm4, xmmword [rbp + 0x20]
lea r12, [rcx + 0x80]
vmovdqu ymm0, ymmword [rsp + 0x20]
lea rdi, [rsp + 0x20]
vmovdqu xmmword [rsp + 0x50], xmm5
mov edx, dword [rsp + 0x5c]
vmovq xmm2, qword [rsp + 0x50]
mov eax, dword [rsp + 0x58]
vmovdqu xmmword [rsp + 0x40], xmm4
nop dword [rax]
vpxor ymm0, ymm0, ymmword [rbx]
vpxor xmm1, xmm1, xmmword [rbx + 0x20]
mov rcx, rdi
add rbx, 0x40
xor edx, dword [rbx - 4]
xor eax, dword [rbx - 8]
vmovdqu ymmword [rsp + 0x20], ymm0
vmovq xmm0, qword [rbx - 0x10]
mov dword [rsp + 0x5c], edx
mov rdx, rsi
vpxor xmm0, xmm0, xmm2
mov dword [rsp + 0x58], eax
vmovdqu xmmword [rsp + 0x40], xmm1
vmovq qword [rsp + 0x50], xmm0
call sym.pwxform
vmovdqu ymm0, ymmword [rsp + 0x20]
mov eax, dword [rsp + 0x58]
vmovdqu ymm3, ymmword [rsp + 0x40]
vmovdqu xmm1, xmmword [rsp + 0x40]
vmovdqu ymmword [rbx - 0x40], ymm0
vmovq xmm2, qword [rsp + 0x50]
mov edx, dword [rsp + 0x5c]
vmovdqu ymmword [rbx - 0x20], ymm3
cmp rbx, r12
jne 0x140268638
mov edx, dword [rsi + 4]
mov rcx, rbp
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.salsa20
Function at 0x14026a0b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rdi, r8
mov r13, rcx
mov rsi, rdx
mov r12, r8
shl rdi, 7
mov r14, rcx
lea rbp, [rsp + 0x30]
lea r15, [rcx + rdi - 0x40]
mov rax, rdi
shr rax, 6
vmovdqu xmm2, xmmword [r15]
vmovdqu xmm3, xmmword [r15 + 0x10]
vmovdqu xmm4, xmmword [r15 + 0x20]
vmovdqu xmm5, xmmword [r15 + 0x30]
mov qword [rsp + 0x28], rax
shl rax, 6
vmovdqu xmmword [rsp + 0x30], xmm2
mov rbx, rax
vmovdqu xmmword [rsp + 0x40], xmm3
vmovdqu ymm1, ymmword [rsp + 0x30]
add rbx, rcx
vmovdqu xmmword [rsp + 0x50], xmm4
vmovdqu xmmword [rsp + 0x60], xmm5
vmovdqu ymm0, ymmword [rsp + 0x50]
nop
vpxor ymm0, ymm0, ymmword [r14 + 0x20]
mov rdx, rsi
mov rcx, rbp
add r14, 0x40
vpxor ymm1, ymm1, ymmword [r14 - 0x40]
vmovdqu ymmword [rsp + 0x50], ymm0
vmovdqu ymmword [rsp + 0x30], ymm1
call sym.pwxform_1
vmovdqu ymm1, ymmword [rsp + 0x30]
vmovdqu ymm0, ymmword [rsp + 0x50]
vmovdqu ymmword [r14 - 0x40], ymm1
vmovdqu ymmword [r14 - 0x20], ymm0
cmp rbx, r14
jne 0x14026a130
mov edx, dword [rsi + 4]
mov rcx, r15
add r12, r12
add rdi, r13
call sym.salsa20_1
cmp qword [rsp + 0x28], r12
jae 0x14026a203
nop dword [rax]
mov eax, dword [rbx - 0x40]
xor dword [rbx], eax
mov rcx, rbx
mov eax, dword [rbx - 0x3c]
xor dword [rbx + 4], eax
mov eax, dword [rbx - 0x38]
xor dword [rbx + 8], eax
mov eax, dword [rbx - 0x34]
xor dword [rbx + 0xc], eax
mov eax, dword [rbx - 0x30]
xor dword [rbx + 0x10], eax
mov eax, dword [rbx - 0x2c]
xor dword [rbx + 0x14], eax
mov eax, dword [rbx - 0x28]
xor dword [rbx + 0x18], eax
mov eax, dword [rbx - 0x24]
xor dword [rbx + 0x1c], eax
mov eax, dword [rbx - 0x20]
xor dword [rbx + 0x20], eax
mov eax, dword [rbx - 0x1c]
xor dword [rbx + 0x24], eax
mov eax, dword [rbx - 0x18]
xor dword [rbx + 0x28], eax
mov eax, dword [rbx - 0x14]
xor dword [rbx + 0x2c], eax
mov eax, dword [rbx - 0x10]
xor dword [rbx + 0x30], eax
mov eax, dword [rbx - 0xc]
xor dword [rbx + 0x34], eax
mov eax, dword [rbx - 8]
xor dword [rbx + 0x38], eax
mov eax, dword [rbx - 4]
xor dword [rbx + 0x3c], eax
add rbx, 0x40
mov edx, dword [rsi + 4]
call sym.salsa20_1
cmp rdi, rbx
jne 0x14026a190
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14026a5b0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
vmovdqu xmm5, xmmword [rcx + 0x50]
vmovdqu xmm4, xmmword [rcx + 0x40]
vmovdqu xmm1, xmmword [rcx + 0x60]
vmovdqu xmmword [rsp + 0x30], xmm5
mov rsi, rdx
lea rbp, [rcx + 0x40]
mov rbx, rcx
vmovdqu xmm5, xmmword [rbp + 0x30]
vmovdqu xmmword [rsp + 0x20], xmm4
vmovdqu xmm4, xmmword [rbp + 0x20]
lea r12, [rcx + 0x80]
vmovdqu ymm0, ymmword [rsp + 0x20]
lea rdi, [rsp + 0x20]
vmovdqu xmmword [rsp + 0x50], xmm5
mov edx, dword [rsp + 0x5c]
vmovq xmm2, qword [rsp + 0x50]
mov eax, dword [rsp + 0x58]
vmovdqu xmmword [rsp + 0x40], xmm4
nop dword [rax]
vpxor ymm0, ymm0, ymmword [rbx]
vpxor xmm1, xmm1, xmmword [rbx + 0x20]
mov rcx, rdi
add rbx, 0x40
xor edx, dword [rbx - 4]
xor eax, dword [rbx - 8]
vmovdqu ymmword [rsp + 0x20], ymm0
vmovq xmm0, qword [rbx - 0x10]
mov dword [rsp + 0x5c], edx
mov rdx, rsi
vpxor xmm0, xmm0, xmm2
mov dword [rsp + 0x58], eax
vmovdqu xmmword [rsp + 0x40], xmm1
vmovq qword [rsp + 0x50], xmm0
call sym.pwxform_1
vmovdqu ymm0, ymmword [rsp + 0x20]
mov eax, dword [rsp + 0x58]
vmovdqu ymm3, ymmword [rsp + 0x40]
vmovdqu xmm1, xmmword [rsp + 0x40]
vmovdqu ymmword [rbx - 0x40], ymm0
vmovq xmm2, qword [rsp + 0x50]
mov edx, dword [rsp + 0x5c]
vmovdqu ymmword [rbx - 0x20], ymm3
cmp rbx, r12
jne 0x14026a618
mov edx, dword [rsi + 4]
mov rcx, rbp
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.salsa20_1
Function at 0x14026b224
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
xor rcx, rcx
mov ecx, edx
shr ecx, 6
mov rax, 0x40
movdqa xmm0, xmmword [rdi]
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm4, xmmword [rsi]
movdqa xmm5, xmmword [rsi + 0x10]
movdqa xmm8, xmmword [rsi + 0x20]
movdqa xmm9, xmmword [rsi + 0x30]
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm8
pxor xmm3, xmm9
movdqa xmmword [rdi], xmm0
movdqa xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi + 0x20], xmm2
movdqa xmmword [rdi + 0x30], xmm3
add rdi, rax
add rsi, rax
dec ecx
jne 0x14026b242
mov rdi, r10
mov rsi, r11
ret

Function at 0x14026b2a0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
xor rcx, rcx
mov ecx, esi
shr ecx, 1
movdqa xmm0, xmmword [rdi]
movdqa xmm12, xmm0
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm13, xmm1
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm14, xmm2
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm15, xmm3
movdqa xmm4, xmm1
paddd xmm4, xmm0
movdqa xmm5, xmm4
pslld xmm4, 7
psrld xmm5, 0x19
pxor xmm3, xmm4
movdqa xmm4, xmm0
pxor xmm3, xmm5
paddd xmm4, xmm3
movdqa xmm5, xmm4
pslld xmm4, 9
psrld xmm5, 0x17
pxor xmm2, xmm4
movdqa xmm4, xmm3
pxor xmm2, xmm5
pshufd xmm3, xmm3, 0x93
paddd xmm4, xmm2
movdqa xmm5, xmm4
pslld xmm4, 0xd
psrld xmm5, 0x13
pxor xmm1, xmm4
movdqa xmm4, xmm2
pxor xmm1, xmm5
pshufd xmm2, xmm2, 0x4e
paddd xmm4, xmm1
movdqa xmm5, xmm4
pslld xmm4, 0x12
psrld xmm5, 0xe
pxor xmm0, xmm4
movdqa xmm4, xmm3
pxor xmm0, xmm5
pshufd xmm1, xmm1, 0x39
paddd xmm4, xmm0
movdqa xmm5, xmm4
pslld xmm4, 7
psrld xmm5, 0x19
pxor xmm1, xmm4
movdqa xmm4, xmm0
pxor xmm1, xmm5
paddd xmm4, xmm1
movdqa xmm5, xmm4
pslld xmm4, 9
psrld xmm5, 0x17
pxor xmm2, xmm4
movdqa xmm4, xmm1
pxor xmm2, xmm5
pshufd xmm1, xmm1, 0x93
paddd xmm4, xmm2
movdqa xmm5, xmm4
pslld xmm4, 0xd
psrld xmm5, 0x13
pxor xmm3, xmm4
movdqa xmm4, xmm2
pxor xmm3, xmm5
pshufd xmm2, xmm2, 0x4e
paddd xmm4, xmm3
movdqa xmm5, xmm4
pslld xmm4, 0x12
psrld xmm5, 0xe
pxor xmm0, xmm4
pshufd xmm3, xmm3, 0x39
pxor xmm0, xmm5
dec ecx
jne 0x14026b2da
paddd xmm0, xmm12
movdqa xmmword [rdi], xmm0
paddd xmm1, xmm13
movdqa xmmword [rdi + 0x10], xmm1
paddd xmm2, xmm14
movdqa xmmword [rdi + 0x20], xmm2
paddd xmm3, xmm15
movdqa xmmword [rdi + 0x30], xmm3
mov rdi, r10
mov rsi, r11
ret
Function at 0x14026b48c
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
xor rcx, rcx
mov ecx, esi
shr ecx, 1
movdqa xmm0, xmmword [rdi]
movdqa xmm12, xmm0
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm13, xmm1
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm14, xmm2
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm15, xmm3
paddd xmm0, xmm1
pxor xmm3, xmm0
pshuflw xmm3, xmm3, 0xb1
pshufhw xmm3, xmm3, 0xb1
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm3
pslld xmm3, 8
psrld xmm4, 0x18
pxor xmm3, xmm4
pshufd xmm0, xmm0, 0x93
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x39
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
pshuflw xmm3, xmm3, 0xb1
pshufhw xmm3, xmm3, 0xb1
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm3
pslld xmm3, 8
psrld xmm4, 0x18
pxor xmm3, xmm4
pshufd xmm0, xmm0, 0x39
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x93
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
dec ecx
jne 0x14026b4c6
paddd xmm0, xmm12
movdqa xmmword [rdi], xmm0
paddd xmm1, xmm13
movdqa xmmword [rdi + 0x10], xmm1
paddd xmm2, xmm14
movdqa xmmword [rdi + 0x20], xmm2
paddd xmm3, xmm15
movdqa xmmword [rdi + 0x30], xmm3
mov rdi, r10
mov rsi, r11
ret

Function at 0x14026c020
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r9, r8
mov r8d, 1
call sym.fwrite
cmp rax, 1
setne al
movzx eax, al
neg eax
add rsp, 0x28
ret
Function at 0x14026dac0
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rdx
movsx rdx, byte [rdx]
mov r8, rcx
test rdx, rdx
je 0x14026db7a
mov rcx, rbp
mov esi, 0x1505
nop dword [rax + rax]
mov rax, rsi
add rcx, 1
shl rax, 5
add rax, rsi
lea rsi, [rax + rdx]
movsx rdx, byte [rcx]
test rdx, rdx
jne 0x14026dae8
mov rcx, qword [r8 + 0x10]
lea rdi, [0x14030cdc0]
mov rax, rsi
xor edx, edx
add r8, 0x18
div qword [rdi + rcx*8]
mov rdi, qword [r8 - 0x10]
shl rdx, 4
add rdi, rdx
mov rbx, qword [rdi]
cmp rbx, r8
jne 0x14026db3a
jmp 0x14026db70
cmp rbx, qword [rdi + 8]
je 0x14026db60
mov rbx, qword [rbx + 8]
cmp qword [rbx - 8], rsi
jne 0x14026db30
lea rcx, [rbx + 0x20]
mov rdx, rbp
call sym.strcmp
test eax, eax
jne 0x14026db30
mov rax, qword [rbx + 0x10]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
cmp rbx, qword [rdi + 8]
jne 0x14026db3a
jmp 0x14026db54
mov esi, 0x1505
jmp 0x14026db03

Function at 0x14026db90
Capabilities:
Hash data using djb2

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, rdx
movsx rdx, byte [rdx]
mov rbp, rcx
test rdx, rdx
je 0x14026dd12
mov rcx, rdi
mov esi, 0x1505
nop dword [rax + rax]
mov rax, rsi
add rcx, 1
shl rax, 5
add rax, rsi
lea rsi, [rax + rdx]
movsx rdx, byte [rcx]
test rdx, rdx
jne 0x14026dbc0
mov rcx, qword [rbp + 0x10]
lea rbx, [0x14030cdc0]
mov rax, rsi
xor edx, edx
lea r14, [rbp + 0x18]
div qword [rbx + rcx*8]
shl rdx, 4
add rdx, qword [rbp + 8]
mov r13, qword [rdx]
mov r12, rdx
cmp r13, r14
je 0x14026dcc0
mov rcx, qword [r13 - 8]
mov rbx, r13
jmp 0x14026dc2b
cmp rbx, qword [r12 + 8]
je 0x14026dcb0
mov rbx, qword [rbx + 8]
mov rcx, qword [rbx - 8]
cmp rsi, rcx
jne 0x14026dc18
lea rcx, [rbx + 0x20]
mov rdx, rdi
lea r15, [rbx - 8]
call sym.strcmp
test eax, eax
jne 0x14026dc18
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
mov r8, qword [r12 + 8]
cmp rbx, r13
je 0x14026dcd8
cmp rbx, r8
je 0x14026dcf0
mov qword [rcx + 8], rdx
mov qword [rdx], rcx
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14026dc86
mov rdx, qword [rcx + 8]
cmp rdx, 0xffffffffffffffff
je 0x14026dc86
sub rdx, 1
mov qword [rcx + 8], rdx
je 0x14026dd00
mov rcx, r15
mov dword [rsp + 0x2c], eax
call sym.jsonp_free
sub qword [rbp], 1
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 0xffffffff
jmp 0x14026dc9b
mov eax, 0xffffffff
cmp r13, qword [rdx + 8]
je 0x14026dc9b
mov rbx, r13
jmp 0x14026dc2b
cmp rbx, r8
je 0x14026dd1c
mov qword [r12], rdx
jmp 0x14026dc62
mov qword [r12 + 8], rcx
jmp 0x14026dc62
mov dword [rsp + 0x2c], eax
call sym.json_delete
mov eax, dword [rsp + 0x2c]
jmp 0x14026dc86
mov esi, 0x1505
jmp 0x14026dbdb
vmovq xmm1, r14
vpunpcklqdq xmm0, xmm1, xmm1
vmovdqu xmmword [r12], xmm0
jmp 0x14026dc62