joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140095f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r11, qword [0x1403ec5f8]
mov rsi, rdx
xor r11, rcx
mov r10, r8
mov r8, qword [rsp + 0x60]
test r9, r9
not r11
movq xmm1, rcx
cmovne rsi, r9
punpcklqdq xmm1, xmm1
xor r9d, r9d
mov rbx, rdx
mov rdi, rcx
movq xmm2, r11
punpcklqdq xmm2, xmm2
cmp r8, 8
jb 0x140095fb7
mov rbp, rsi
mov r14, rdx
sub rbp, r10
sub r14, r10
mov r15d, 8
mov rax, r10
sub r15, r10
mov rdx, qword [rax + rbp]
lea rax, [rax + 8]
and rdx, r11
mov rcx, rdi
and rcx, qword [rax - 8]
add r9, 8
or rdx, rcx
lea rcx, [r15 + rax]
mov qword [r14 + rax - 8], rdx
cmp rcx, r8
jbe 0x140095f90
mov rcx, r8
sub rcx, r9
cmp r9, r8
jae 0x14009617f
cmp rcx, 8
jb 0x140096147
lea rdx, [r8 - 1]
lea rax, [r8 - 1]
add rdx, rbx
add rax, rsi
lea rbp, [r9 + rbx]
lea r14, [rsi + r9]
cmp rbp, rax
ja 0x140095ff4
cmp rdx, r14
jae 0x140096147
lea rax, [r8 - 1]
add rax, r10
lea r15, [r9 + r10]
cmp rbp, rax
ja 0x14009600d
cmp rdx, r15
jae 0x140096147
and ecx, 7
mov qword [rsp + 0x40], r12
mov rdx, r8
sub rdx, rcx
andps xmm1, xmmword [0x140103d50]
mov rcx, r10
andps xmm2, xmmword [0x140103d50]
add r14, 2
packuswb xmm1, xmm1
sub rcx, rsi
packuswb xmm2, xmm2
mov r15, rbx
packuswb xmm1, xmm1
sub r15, rsi
packuswb xmm2, xmm2
packuswb xmm1, xmm1
packuswb xmm2, xmm2
movdqa xmmword [rsp + 0x10], xmm1
movzx r12d, word [rsp + 0x10]
movdqa xmmword [rsp], xmm2
movzx ebp, word [rsp]
nop word [rax + rax]
movzx eax, word [r14 + rcx - 2]
lea r14, [r14 + 8]
movd xmm0, r12d
add r9, 8
movd xmm2, eax
movzx eax, word [r14 - 0xa]
andps xmm2, xmm0
movd xmm0, ebp
movd xmm1, eax
andps xmm1, xmm0
orps xmm2, xmm1
movd xmm1, ebp
movd eax, xmm2
movd xmm2, r12d
mov word [r15 + r14 - 0xa], ax
movzx eax, word [r14 + rcx - 8]
movd xmm0, eax
movzx eax, word [r14 - 8]
andps xmm2, xmm0
movd xmm0, eax
andps xmm1, xmm0
movd xmm0, r12d
orps xmm2, xmm1
movd eax, xmm2
mov word [r15 + r14 - 8], ax
movzx eax, word [r14 + rcx - 6]
movd xmm2, eax
movzx eax, word [r14 - 6]
andps xmm2, xmm0
movd xmm0, ebp
movd xmm1, eax
andps xmm1, xmm0
movd xmm0, r12d
orps xmm2, xmm1
movd eax, xmm2
mov word [r15 + r14 - 6], ax
movzx eax, word [r14 + rcx - 4]
movd xmm2, eax
movzx eax, word [r14 - 4]
andps xmm2, xmm0
movd xmm0, ebp
movd xmm1, eax
andps xmm1, xmm0
orps xmm2, xmm1
movd eax, xmm2
mov word [r15 + r14 - 4], ax
cmp r9, rdx
jb 0x140096070
mov r12, qword [rsp + 0x40]
cmp r9, r8
jae 0x14009617f
sub r10, rsi
lea rdx, [rsi + r9]
sub rbx, rsi
sub r8, r9
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx + r10]
lea rdx, [rdx + 1]
and cl, dil
movzx eax, r11b
and al, byte [rdx - 1]
or cl, al
mov byte [rbx + rdx - 1], cl
sub r8, 1
jne 0x140096160
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400961a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, qword [rsp + 0x70]
mov rbx, r9
mov rbp, r8
mov r14, rdx
mov r15, rcx
cmp r9, rdi
ja 0x14009622b
mov qword [rsp + 0x50], rsi
mov rsi, qword [rsp + 0x78]
mov rax, qword [0x1403ec5f8]
lea r8, [rbx + r14]
mov rdx, qword [0x1403ec5f8]
xor rax, rbx
xor rdx, rbp
mov qword [rsp + 0x20], rsi
xor rdx, rax
xor r9d, r9d
mov rax, qword [0x1403ec5f8]
xor rax, rdx
mov rdx, r15
mov rcx, rax
neg rax
shr rcx, 1
neg rcx
or rcx, rax
shr rcx, 0x3f
dec rcx
call fcn.140095f20
inc rbx
cmp rbx, rdi
jbe 0x1400961d3
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140096240
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14009635b
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov qword [rsp + 0x10], rbp
xor ebx, ebx
mov qword [rsp + 0x18], r14
lea rbp, [rdx - 1]
mov r14, rdx
mov rdi, rdx
sub r14, r8
mov rsi, rcx
mov r9, qword [0x1403ec5f8]
mov r8, qword [0x1403ec5f8]
xor r9, rbx
mov rax, qword [0x1403ec5f8]
xor r8, r14
mov rcx, r8
xor rcx, r9
sub r9, r8
shr rcx, 0x3f
xor rcx, rax
mov rax, qword [0x1403ec5f8]
mov rdx, rcx
neg rcx
shr rdx, 1
neg rdx
or rdx, rcx
mov rcx, qword [0x1403ec5f8]
shr rdx, 0x3f
neg rdx
xor rax, rdx
and rdx, r8
not rax
and r9, rax
or r9, rdx
shr r9, 0x3f
xor rcx, r9
mov rax, rcx
neg rcx
shr rax, 1
neg rax
or rax, rcx
shr rax, 0x3f
neg rax
test rbp, rbp
je 0x14009632f
mov r10, rsi
mov r11, rbp
nop word [rax + rax]
movzx edx, byte [r10]
movzx ecx, byte [r10 + 1]
lea r10, [r10 + 1]
mov r8, qword [0x1403ec5f8]
xor r8, rax
not r8b
and r8b, cl
movzx ecx, al
and cl, dl
or r8b, cl
mov byte [r10 - 1], r8b
sub r11, 1
jne 0x140096300
movzx ecx, byte [rsi + rdi - 1]
inc rbx
and al, cl
mov byte [rsi + rdi - 1], al
cmp rbx, rdi
jb 0x140096270
mov r14, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
pop rdi
ret

Function at 0x140097a80
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x1401045f0]
mov r14, rdx
mov rcx, rbx
test rsi, rsi
je 0x140097ade
cmp qword [0x1401045f0], 0
je 0x140097ade
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x140097ad1
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.1400f9a90
test eax, eax
je 0x140097af9
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x140097ab8
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
test rbx, rbx
je 0x140097ade
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
xor eax, eax
jmp 0x140097ae3
Function at 0x140097b10
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x1401043c0]
mov r14, r8
mov r15, rdx
mov rcx, rbx
test rsi, rsi
je 0x140097b76
cmp qword [0x1401043c0], 0
je 0x140097b76
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x140097b69
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.1400f9a90
test eax, eax
je 0x140097b96
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x140097b50
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
test rbx, rbx
je 0x140097b76
mov eax, dword [rbx + 0x20]
mov dword [r15], eax
mov eax, dword [rbx + 0x24]
mov dword [r14], eax
xor eax, eax
jmp 0x140097b7b
Function at 0x1400a3dd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0x40
mov rsi, rcx
mov rbp, r9
lea rcx, [rsp + 0x20]
mov r15, r8
mov rdi, rdx
call fcn.14009ed60
lea rcx, [rsp + 0x30]
call fcn.14009ed60
xor edx, edx
lea rcx, [rsi + 0x68]
call fcn.14009ec90
cmp eax, 1
je 0x1400a3e1c
mov eax, 0xffffb080
jmp 0x1400a3f69
xor edx, edx
mov qword [rsp + 0x60], r12
mov rcx, rdi
call fcn.14009ec90
mov rbx, qword [rsp + 0x88]
lea rcx, [rsp + 0x20]
test eax, eax
mov rdx, rdi
sete al
mov byte [rbx], al
call fcn.14009b820
mov r12d, eax
test eax, eax
jne 0x1400a3f4d
mov r8, rdi
lea rdx, [rsi + 0x68]
lea rcx, [rsp + 0x30]
call fcn.1400a2140
mov r12d, eax
test eax, eax
jne 0x1400a3f4d
movzx r8d, byte [rbx]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400a19a0
mov r12d, eax
test eax, eax
jne 0x1400a3f4d
lea r8, [rbp + 1]
xor edx, edx
mov rcx, r15
call fcn.1400f8fb0
xor esi, esi
test rbp, rbp
je 0x1400a3eee
mov qword [rsp + 0x68], r14
movzx r14d, byte [rsp + 0x80]
nop
xor ebx, ebx
test r14, r14
je 0x1400a3ee1
mov rdi, rsi
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.14009ec90
mov rcx, rbx
add rdi, rbp
shl al, cl
inc rbx
or byte [rsi + r15], al
cmp rbx, r14
jb 0x1400a3ec0
inc rsi
cmp rsi, rbp
jb 0x1400a3eb0
mov r14, qword [rsp + 0x68]
xor r11b, r11b
cmp rbp, 1
jb 0x1400a3f4d
inc r15
nop word [rax + rax]
movzx edx, byte [r15 - 1]
mov r10d, 1
movzx r9d, byte [r15]
lea r15, [r15 + 1]
xor r9b, r11b
mov ecx, edx
and r11b, byte [r15 - 1]
movzx eax, r9b
and al, 1
sub r10b, al
movzx eax, r10b
imul ecx, eax
shl r10b, 7
or r10b, dl
mov byte [r15 - 2], r10b
movzx eax, cl
xor cl, r9b
and al, r9b
mov byte [r15 - 1], cl
or r11b, al
sub rbp, 1
jne 0x1400a3f00
lea rcx, [rsp + 0x30]
call fcn.14009e090
lea rcx, [rsp + 0x20]
call fcn.14009e090
mov eax, r12d
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
Function at 0x1400abe10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r10, rdx
mov qword [rsp + 0x30], r8
movzx edx, r9b
xor esi, esi
bts edx, 0x19
mov ebp, r9d
mov rdi, r8
mov r14, rcx
cmp edx, 0x2000003
je 0x1400abf07
cmp edx, 0x2000004
je 0x1400abf07
cmp edx, 0x2000005
je 0x1400abf07
cmp edx, 0x2000008
je 0x1400abf07
cmp edx, 0x2000009
je 0x1400abf07
cmp edx, 0x200000a
je 0x1400abf00
cmp edx, 0x200000b
je 0x1400abf00
cmp edx, 0x200000c
je 0x1400abf00
cmp edx, 0x200000d
je 0x1400abf00
cmp edx, 0x2000010
je 0x1400abef9
cmp edx, 0x2000011
je 0x1400abef2
cmp edx, 0x2000012
je 0x1400abeeb
cmp edx, 0x2000013
mov dword [r14], r9d
mov ebx, 0x40
mov eax, esi
cmove eax, ebx
mov ecx, 0x48
mov ebx, esi
cmove ebx, ecx
cmp rbx, rax
jae 0x1400abf0e
mov eax, 0xffffff7a
jmp 0x1400ac090
mov ebx, 0x68
jmp 0x1400abf0c
mov ebx, 0x88
jmp 0x1400abf0c
mov ebx, 0x90
jmp 0x1400abf0c
mov ebx, 0x80
jmp 0x1400abf0c
mov ebx, 0x40
mov dword [rcx], ebp
cmp r8, rbx
jbe 0x1400abf46
lea rax, [rsp + 0x30]
mov rdx, r10
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
mov ecx, ebp
mov qword [rsp + 0x20], 0x90
call fcn.14008f740
mov edi, eax
test eax, eax
jne 0x1400ac07f
mov rdi, qword [rsp + 0x30]
jmp 0x1400abf58
test r8, r8
je 0x1400abf58
mov rdx, r10
lea rcx, [rsp + 0x40]
call fcn.1400f9370
mov qword [rsp + 0xe8], r15
mov rax, rsi
test rdi, rdi
je 0x1400abfed
cmp rdi, 0x40
jb 0x1400abfd6
movdqa xmm2, xmmword [str.6666666666666666server]
mov rcx, rdi
and rcx, 0xffffffffffffffc0
movdqu xmm0, xmmword [rsp + rax + 0x40]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rsp + rax + 0x40], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x50]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rsp + rax + 0x50], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x60]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rsp + rax + 0x60], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x70]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rsp + rax + 0x70], xmm1
add rax, 0x40
cmp rax, rcx
jb 0x1400abf81
cmp rax, rdi
jae 0x1400abfed
nop dword [rax + rax]
xor byte [rsp + rax + 0x40], 0x36
inc rax
cmp rax, rdi
jb 0x1400abfe0
mov r15, rbx
lea rcx, [rsp + 0x40]
sub r15, rdi
add rcx, rdi
mov r8, r15
mov edx, 0x36
call fcn.1400f8fb0
test rdi, rdi
je 0x1400ac03c
lea rax, [rsp + 0x40]
mov rdx, r14
sub rdx, rax
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
add rcx, rsi
inc rsi
movzx eax, byte [rcx]
xor al, 0x6a
mov byte [rcx + rdx + 0xf0], al
cmp rsi, rdi
jb 0x1400ac020
lea rcx, [r14 + 0xf0]
mov r8, r15
add rcx, rdi
mov edx, 0x5c
call fcn.1400f8fb0
mov edx, ebp
lea rcx, [r14 + 8]
call fcn.14008f9e0
mov r15, qword [rsp + 0xe8]
mov edi, eax
test eax, eax
jne 0x1400ac07f
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [r14 + 8]
call fcn.14008fa90
mov edi, eax
mov edx, 0x90
lea rcx, [rsp + 0x40]
call fcn.140092fb0
mov eax, edi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400c86e0
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b6ed0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
cmp edx, 1
jbe 0x1400b6edb
mov eax, 0xffffff8b
ret
xor eax, eax
movabs r8, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
test edx, edx
mov qword [rcx + 8], rax
movabs rax, 0x6a09e667f3bcc908
cmovne rax, r8
movabs r8, 0x629a292a367cd507
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
cmovne rax, r8
movabs r8, 0x9159015a3070dd17
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
cmovne rax, r8
movabs r8, 0x152fecd8f70e5939
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
cmovne rax, r8
movabs r8, 0x67332667ffc00b31
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
cmovne rax, r8
movabs r8, 0x8eb44a8768581511
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
cmovne rax, r8
movabs r8, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
cmovne rax, r8
movabs r8, 0x47b5481dbefa4fa4
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
cmovne rax, r8
mov qword [rcx + 0x48], rax
xor eax, eax
mov dword [rcx + 0xd0], edx
ret

Function at 0x1400b7ab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp r8, 8
jb 0x1400b7bd1
mov r9d, dword [rcx + 0xc8]
mov r8d, 8
mov eax, r9d
and eax, 7
sub r8d, eax
je 0x1400b7b62
test r8d, r8d
jle 0x1400b7b3c
mov eax, r8d
sub rdi, rax
nop word [rax + rax]
mov eax, r9d
dec r8d
shr rax, 3
and r9d, 7
shl r9d, 3
lea rdx, [rbx + rax*8]
movzx eax, byte [rsi]
movzx ecx, r9b
shl rax, cl
inc rsi
xor qword [rdx], rax
mov r9d, dword [rbx + 0xc8]
inc r9d
mov dword [rbx + 0xc8], r9d
test r8d, r8d
jg 0x1400b7b00
movzx ecx, word [rbx + 0xce]
xor edx, edx
mov eax, r9d
div ecx
mov dword [rbx + 0xc8], edx
test edx, edx
jne 0x1400b7b5c
mov rcx, rbx
call fcn.1400b70e0
cmp rdi, 8
jb 0x1400b7bd1
mov qword [rsp + 0x30], rbp
mov rbp, rdi
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
nop word [rax + rax]
mov ecx, dword [rbx + 0xc8]
mov rdx, qword [rsi]
mov eax, ecx
shr rax, 3
and ecx, 7
shl ecx, 3
add rsi, 8
shl rdx, cl
xor qword [rbx + rax*8], rdx
xor edx, edx
mov eax, dword [rbx + 0xc8]
movzx ecx, word [rbx + 0xce]
add eax, 8
div ecx
mov dword [rbx + 0xc8], edx
test edx, edx
jne 0x1400b7bc6
mov rcx, rbx
call fcn.1400b70e0
sub rbp, 1
jne 0x1400b7b80
mov rbp, qword [rsp + 0x30]
test rdi, rdi
je 0x1400b7c31
nop word [rax + rax]
mov ecx, dword [rbx + 0xc8]
lea rsi, [rsi + 1]
mov eax, ecx
dec rdi
shr rax, 3
and ecx, 7
lea rdx, [rbx + rax*8]
shl ecx, 3
movzx eax, byte [rsi - 1]
shl rax, cl
xor qword [rdx], rax
xor edx, edx
mov eax, dword [rbx + 0xc8]
movzx ecx, word [rbx + 0xce]
inc eax
div ecx
mov dword [rbx + 0xc8], edx
test edx, edx
jne 0x1400b7c2c
mov rcx, rbx
call fcn.1400b70e0
test rdi, rdi
jne 0x1400b7be0
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b80e0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
xor eax, eax
ret
Function at 0x1400bbbd0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov rdi, r8
mov rsi, rdx
call fcn.140093770
test rax, rax
jne 0x1400bbc07
mov eax, 0xffffbf80
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, rbx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140093010
Function at 0x1400bbd40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, rcx
lea rax, [rdx - 0xb]
mov r15, r9
mov r13, r9
xor ebx, ebx
mov rbp, rdx
cmp r9, rax
mov r9, qword [0x1403ec5f8]
cmova r15, rax
movzx eax, byte [rcx]
xor r9, rax
movzx eax, byte [rcx + 1]
mov rcx, qword [0x1403ec5f8]
xor rcx, rax
mov rax, qword [0x1403ec5f8]
xor rax, rcx
mov rcx, qword [0x1403ec5f8]
mov r10, qword [0x1403ec5f8]
xor rcx, rax
xor rcx, 2
mov rax, r9
shr rax, 1
mov r11, rcx
shr r11, 1
neg rax
neg r11
neg rcx
or r11, rcx
neg r9
or rax, r9
shr r11, 0x3f
shr rax, 0x3f
neg r11
neg rax
or r11, rax
mov eax, 2
cmp rax, rdx
jae 0x1400bbe3f
nop dword [rax]
movzx ecx, byte [r14 + rax]
inc rax
mov rdx, qword [0x1403ec5f8]
xor rdx, rcx
mov rcx, qword [0x1403ec5f8]
xor rdx, rcx
mov rcx, qword [0x1403ec5f8]
xor rcx, rdx
mov rdx, rcx
neg rcx
shr rdx, 1
neg rdx
or rdx, rcx
shr rdx, 0x3f
dec rdx
or r10, rdx
mov ecx, r10d
not ecx
and ecx, 1
add rbx, rcx
cmp rax, rbp
jb 0x1400bbdf0
mov r9, qword [0x1403ec5f8]
mov esi, ebp
mov r8, qword [0x1403ec5f8]
xor r9, rbx
mov rax, qword [0x1403ec5f8]
xor r8, 8
sub esi, ebx
mov rcx, r8
xor rcx, r9
sub esi, 3
shr rcx, 0x3f
sub r9, r8
xor rcx, rax
not r10
mov rax, qword [0x1403ec5f8]
mov rdx, rcx
neg rcx
shr rdx, 1
neg rdx
or rdx, rcx
shr rdx, 0x3f
neg rdx
xor rax, rdx
and rdx, r8
not rax
and r9, rax
mov rax, qword [0x1403ec5f8]
or r9, rdx
shr r9, 0x3f
xor rax, r9
mov rcx, rax
neg rax
shr rcx, 1
neg rcx
or rcx, rax
mov rax, qword [0x1403ec5f8]
mov r9, qword [0x1403ec5f8]
mov r8, qword [0x1403ec5f8]
xor r9, r15
shr rcx, 0x3f
neg rcx
or rcx, r10
or r11, rcx
xor rax, r11
not eax
and esi, eax
mov eax, r11d
and eax, r15d
or esi, eax
mov rax, qword [0x1403ec5f8]
xor r8, rsi
mov rcx, r8
xor rcx, r9
sub r9, r8
shr rcx, 0x3f
xor rcx, rax
mov rax, qword [0x1403ec5f8]
mov rdx, rcx
neg rcx
shr rdx, 1
neg rdx
or rdx, rcx
shr rdx, 0x3f
neg rdx
xor rax, rdx
and rdx, r8
not rax
and r9, rax
mov rax, qword [0x1403ec5f8]
mov r12, qword [0x1403ec5f8]
or r9, rdx
shr r9, 0x3f
xor rax, r9
mov rdi, rax
neg rax
shr rdi, 1
neg rdi
or rdi, rax
shr rdi, 0x3f
neg rdi
xor r12, r11
not r12d
mov ebx, edi
and r12d, edi
lea rdx, [r14 + 0xb]
mov eax, r11d
lea r8, [rbp - 0xb]
and r12d, 0x4400
and eax, 0x4100
or r12d, eax
mov rcx, rdi
or rcx, r11
neg r12d
call fcn.140096360
mov rax, qword [0x1403ec5f8]
sub r14, r15
xor rdi, rax
mov r8, r15
not edi
mov eax, r15d
and rbx, rax
and rdi, rsi
or rdi, rbx
mov rdx, r15
lea rbx, [r14 + rbp]
sub r8, rdi
mov rcx, rbx
call fcn.140096240
test r13, r13
je 0x1400bbfe5
mov rcx, qword [rsp + 0x60]
mov r8, r15
mov rdx, rbx
call fcn.1400f9370
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rdi
jmp 0x1400bbfed
mov rax, qword [rsp + 0x70]
mov qword [rax], rdi
mov rbx, qword [rsp + 0x50]
mov eax, r12d
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400be910
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0xa8
mov rax, qword [0x140160140]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov edi, dword [rbp + 0x7f]
mov rbx, rcx
lea rcx, [rbp - 0x59]
mov r13, r9
mov r12, r8
mov r14, rdx
call fcn.140093830
mov ecx, edi
call fcn.140093770
mov rdi, rax
test rax, rax
jne 0x1400be965
mov eax, 0xffffbf80
jmp 0x1400beb07
lea rcx, [rbp - 0x59]
mov qword [rsp + 0xe8], rsi
call fcn.140093830
xor r8d, r8d
lea rcx, [rbp - 0x59]
mov rdx, rdi
call fcn.140093840
mov esi, eax
test eax, eax
jne 0x1400beae6
mov rcx, rdi
call fcn.140093490
mov dword [rbp - 0x61], esi
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
test r14, r14
je 0x1400beae6
mov qword [rsp + 0xa0], r15
movzx r15d, al
cmp r14, r15
lea rcx, [rbp - 0x59]
mov rdi, r14
cmovae rdi, r15
call fcn.140093ae0
mov esi, eax
test eax, eax
jne 0x1400beade
mov r8, r13
lea rcx, [rbp - 0x59]
mov rdx, r12
call fcn.140093bf0
mov esi, eax
test eax, eax
jne 0x1400beade
mov r8d, 4
lea rdx, [rbp - 0x61]
lea rcx, [rbp - 0x59]
call fcn.140093bf0
mov esi, eax
test eax, eax
jne 0x1400beade
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x59]
call fcn.1400932e0
mov esi, eax
test eax, eax
jne 0x1400beade
xor ecx, ecx
test rdi, rdi
je 0x1400bead2
cmp rdi, 0x40
jb 0x1400beac0
lea rdx, [rdi - 1]
add rdx, rbx
lea rax, [rbp + rdi - 0x32]
cmp rbx, rax
ja 0x1400bea5b
lea rax, [rbp - 0x31]
cmp rdx, rax
jae 0x1400beac0
mov rax, rdi
and rax, 0xffffffffffffffc0
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbp + rcx - 0x31]
xorps xmm1, xmm0
movdqu xmmword [rbx], xmm1
movdqu xmm0, xmmword [rbx + 0x10]
movdqu xmm1, xmmword [rbp + rcx - 0x21]
xorps xmm1, xmm0
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmm0, xmmword [rbx + 0x20]
movdqu xmm1, xmmword [rbp + rcx - 0x11]
xorps xmm1, xmm0
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm0, xmmword [rbx + 0x30]
movdqu xmm1, xmmword [rbp + rcx - 1]
add rcx, 0x40
xorps xmm1, xmm0
movdqu xmmword [rbx + 0x30], xmm1
add rbx, 0x40
cmp rcx, rax
jb 0x1400bea62
cmp rcx, rdi
jae 0x1400bead2
nop
movzx eax, byte [rbp + rcx - 0x31]
inc rcx
xor byte [rbx], al
inc rbx
cmp rcx, rdi
jb 0x1400beac0
inc byte [rbp - 0x5e]
sub r14, rdi
jne 0x1400be9c2
mov r15, qword [rsp + 0xa0]
mov edx, 0x40
lea rcx, [rbp - 0x31]
call fcn.140092fb0
lea rcx, [rbp - 0x59]
call fcn.1400933a0
mov eax, esi
mov rsi, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1400c86e0
add rsp, 0xa8
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400bfd20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [rdx]
aeskeygenassist xmm0, xmm1, 1
pshufd xmm3, xmm0, 0xff
xorps xmm3, xmm1
movups xmmword [rcx], xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x10], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x20], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x30], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x40], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x50], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x60], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
movdqa xmm3, xmm2
xorps xmm0, xmm1
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x70], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x80], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x90], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm1, xmm3
xorps xmm1, xmm0
pslldq xmm3, 4
xorps xmm1, xmm3
movdqu xmmword [rcx + 0xa0], xmm1
ret