joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028ff0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x1400df040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rax, qword [rcx]
mov r14, r9
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + 0x20]
test al, al
jne 0x140029030
mov rcx, rdi
call fcn.14000dd30
mov rbx, qword [rdi + 0x48]
mov rcx, qword [rdi + 0x40]
mov rax, rbx
mov r15, qword [rdi + 0x58]
sub rax, rcx
sub rax, r15
cmp r14, rax
jb 0x140029229
mov rdx, r15
xor r15d, r15d
nop dword [rax]
nop dword [rax + rax]
sub rbx, rdx
mov qword [rsp + 0x50], rbp
sub rbx, rcx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rbx
lea r8, [rdx + rcx]
movaps xmm0, xmmword [rsp + 0x50]
mov r10, rbx
mov qword [rsp + 0x70], r8
mov rax, rsi
mov qword [rsp + 0x78], rbx
mov r9, rbp
mov qword [rsp + 0x68], rbx
mov rdx, rbx
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x30], xmm1
cmp rbx, 0x20
jb 0x1400291c6
nop
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r10, qword [rsp + 0x28]
add r10, 0xffffffffffffffe0
mov rax, qword [rdx + 8]
movups xmm1, xmmword [r8]
mov qword [rsp + 0x88], r10
movups xmm3, xmmword [r8 + 0x10]
movups xmmword [rsp + 0xb0], xmm1
xor qword [rsp + 0xb8], rax
mov rax, qword [rdx + 0x18]
movq rcx, xmm1
xor rcx, qword [rdx]
mov qword [rsp + 0xb0], rcx
movq rcx, xmm3
xor rcx, qword [rdx + 0x10]
movups xmm0, xmmword [rsp + 0xb0]
movups xmmword [rsp + 0xc0], xmm3
xor qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0xc0]
add rcx, 0xffffffffffffffe0
lea r9, [rax + 0x20]
movups xmmword [rax], xmm0
mov qword [rsp + 0x98], rcx
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe0
mov qword [rsp + 0x80], r9
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0xa8], rcx
movups xmmword [rax + 0x10], xmm1
lea rax, [r8 + 0x20]
mov qword [rsp + 0x90], rax
lea r8, [rdx + 0x20]
movaps xmm0, xmmword [rsp + 0x90]
mov qword [rsp + 0xa0], r8
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x40], xmm0
cmp r10, 0x20
jae 0x1400290c0
mov rdx, r10
test r10, r10
je 0x1400291e6
sub r8, rax
sub r9, rax
movzx ecx, byte [r8 + rax]
xor cl, byte [rax]
mov byte [r9 + rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400291d1
mov rcx, qword [rdi + 0x40]
mov rdx, qword [rdi + 0x48]
mov r9, qword [rdi + 8]
sub rdx, rcx
mov r8, qword [rdi + 0x28]
shr rdx, 6
call fcn.140028960
sub r14, rbx
mov qword [rdi + 0x58], r15
mov rcx, qword [rdi + 0x40]
add rsi, rbx
add rbp, rbx
mov rdx, r15
mov rbx, qword [rdi + 0x48]
mov rax, rbx
sub rax, rcx
cmp r14, rax
jae 0x140029060
lea r8, [r15 + rcx]
mov r9, r14
mov rcx, rbp
mov rdx, rsi
call fcn.14002a0e0
add qword [rdi + 0x58], r14
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140092a00
add rsp, 0xe8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002a0e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
mov rax, qword [0x1400df040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x10], rcx
mov r10, rcx
mov qword [rsp + 0x18], r9
mov rcx, r9
movaps xmm0, xmmword [rsp + 0x10]
mov qword [rsp], rdx
mov qword [rsp + 8], r9
movaps xmm1, xmmword [rsp]
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], r9
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmmword [rsp], xmm1
cmp r9, 0x20
jb 0x14002a21f
nop word [rax + rax]
mov r8, qword [rsp + 0x10]
mov rdx, qword [rsp]
mov r9, qword [rsp + 0x38]
add r9, 0xffffffffffffffe0
mov rax, qword [r8 + 8]
movups xmm1, xmmword [rdx]
mov qword [rsp + 0x28], r9
movups xmm3, xmmword [rdx + 0x10]
add rdx, 0x20
movups xmmword [rsp + 0x60], xmm1
xor qword [rsp + 0x68], rax
mov rax, qword [r8 + 0x18]
movq rcx, xmm1
xor rcx, qword [r8]
mov qword [rsp + 0x60], rcx
movq rcx, xmm3
xor rcx, qword [r8 + 0x10]
add r8, 0x20
movups xmm0, xmmword [rsp + 0x60]
mov qword [rsp + 0x40], rdx
movups xmmword [rsp + 0x70], xmm3
xor qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rcx
movups xmm1, xmmword [rsp + 0x70]
mov qword [rsp + 0x50], r8
movups xmmword [rax], xmm0
lea r10, [rax + 0x20]
movups xmmword [rax + 0x10], xmm1
mov rax, qword [rsp + 8]
add rax, 0xffffffffffffffe0
mov qword [rsp + 0x20], r10
movaps xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x18]
add rax, 0xffffffffffffffe0
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movdqa xmmword [rsp], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x10], xmm0
cmp r9, 0x20
jae 0x14002a150
mov rcx, r9
test r9, r9
je 0x14002a245
sub r8, rdx
sub r10, rdx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [r10 + rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x14002a230
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140092a00
add rsp, 0x98
ret
Function at 0x14002a260
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x1400df040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rax, qword [rcx]
mov r15, r9
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
call qword [rax + 0x20]
test al, al
jne 0x14002a2a0
mov rcx, rdi
call fcn.14000dd30
mov rbx, qword [rdi + 0x40]
mov rcx, qword [rdi + 0x38]
mov rax, rbx
mov r14, qword [rdi + 0x50]
sub rax, rcx
sub rax, r14
cmp r15, rax
jb 0x14002a4a7
mov rdx, r14
xor r14d, r14d
nop dword [rax]
nop dword [rax + rax]
sub rbx, rdx
mov qword [rsp + 0x50], rbp
sub rbx, rcx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rbx
lea r8, [rdx + rcx]
movaps xmm0, xmmword [rsp + 0x50]
mov r10, rbx
mov qword [rsp + 0x70], r8
mov rax, rsi
mov qword [rsp + 0x78], rbx
mov r9, rbp
mov qword [rsp + 0x68], rbx
mov rdx, rbx
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x30], xmm1
cmp rbx, 0x20
jb 0x14002a436
nop
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r10, qword [rsp + 0x28]
add r10, 0xffffffffffffffe0
mov rax, qword [rdx + 8]
movups xmm1, xmmword [r8]
mov qword [rsp + 0x88], r10
movups xmm3, xmmword [r8 + 0x10]
movups xmmword [rsp + 0xb0], xmm1
xor qword [rsp + 0xb8], rax
mov rax, qword [rdx + 0x18]
movq rcx, xmm1
xor rcx, qword [rdx]
mov qword [rsp + 0xb0], rcx
movq rcx, xmm3
xor rcx, qword [rdx + 0x10]
movups xmm0, xmmword [rsp + 0xb0]
movups xmmword [rsp + 0xc0], xmm3
xor qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0xc0]
add rcx, 0xffffffffffffffe0
lea r9, [rax + 0x20]
movups xmmword [rax], xmm0
mov qword [rsp + 0x98], rcx
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe0
mov qword [rsp + 0x80], r9
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0xa8], rcx
movups xmmword [rax + 0x10], xmm1
lea rax, [r8 + 0x20]
mov qword [rsp + 0x90], rax
lea r8, [rdx + 0x20]
movaps xmm0, xmmword [rsp + 0x90]
mov qword [rsp + 0xa0], r8
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x40], xmm0
cmp r10, 0x20
jae 0x14002a330
mov rdx, r10
test r10, r10
je 0x14002a456
sub r8, rax
sub r9, rax
movzx ecx, byte [r8 + rax]
xor cl, byte [rax]
mov byte [r9 + rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14002a441
mov rdx, qword [rdi + 0x20]
mov r8d, 0x14
mov rcx, qword [rdi + 0x38]
call fcn.14002a960
mov rax, qword [rdi + 0x20]
mov rdx, r14
inc dword [rax + 0x20]
mov eax, r14d
mov rcx, qword [rdi + 0x20]
cmp dword [rcx + 0x20], eax
sete al
sub r15, rbx
add dword [rcx + 0x24], eax
add rsi, rbx
mov qword [rdi + 0x50], r14
add rbp, rbx
mov rbx, qword [rdi + 0x40]
mov rcx, qword [rdi + 0x38]
mov rax, rbx
sub rax, rcx
cmp r15, rax
jae 0x14002a2d0
lea r8, [r14 + rcx]
mov r9, r15
mov rcx, rbp
mov rdx, rsi
call fcn.14002a0e0
add qword [rdi + 0x50], r15
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140092a00
add rsp, 0xe8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002a5a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov eax, dword [rdx + 0x34]
mov r8d, dword [rdx]
mov r14d, dword [rdx + 4]
mov r15d, dword [rdx + 8]
mov r12d, dword [rdx + 0xc]
mov ebp, dword [rdx + 0x10]
mov r9d, dword [rdx + 0x14]
mov r10d, dword [rdx + 0x18]
mov r11d, dword [rdx + 0x1c]
mov ebx, dword [rdx + 0x20]
mov edi, dword [rdx + 0x24]
mov esi, dword [rdx + 0x28]
mov r13d, dword [rdx + 0x2c]
mov ecx, dword [rdx + 0x30]
mov dword [rsp + 0x68], eax
mov eax, dword [rdx + 0x38]
mov edx, dword [rdx + 0x3c]
mov dword [rsp + 0x70], eax
mov qword [rsp + 8], 0xa
nop dword [rax]
lea eax, [rcx + r8]
ror eax, 0x19
xor ebp, eax
lea eax, [r8 + rbp]
ror eax, 0x17
xor ebx, eax
lea eax, [rbx + rbp]
ror eax, 0x13
xor ecx, eax
lea eax, [rcx + rbx]
ror eax, 0xe
xor r8d, eax
lea eax, [r9 + r14]
ror eax, 0x19
xor edi, eax
lea eax, [rdi + r9]
ror eax, 0x17
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, edi
ror eax, 0x13
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
ror eax, 0xe
xor r9d, eax
lea eax, [rsi + r10]
ror eax, 0x19
xor dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x70]
add eax, esi
ror eax, 0x17
xor r15d, eax
mov eax, dword [rsp + 0x70]
add eax, r15d
ror eax, 0x13
xor r10d, eax
lea eax, [r10 + r15]
ror eax, 0xe
xor esi, eax
lea eax, [rdx + r13]
ror eax, 0x19
xor r12d, eax
lea eax, [rdx + r12]
ror eax, 0x17
xor r11d, eax
lea eax, [r11 + r12]
ror eax, 0x13
xor r13d, eax
lea eax, [r11 + r13]
ror eax, 0xe
xor edx, eax
lea eax, [r12 + r8]
ror eax, 0x19
xor r14d, eax
mov dword [rsp], r14d
lea eax, [r14 + r8]
ror eax, 0x17
xor r15d, eax
lea eax, [r15 + r14]
ror eax, 0x13
xor r12d, eax
lea eax, [r12 + r15]
ror eax, 0xe
xor r8d, eax
lea eax, [r9 + rbp]
ror eax, 0x19
xor r10d, eax
lea eax, [r10 + r9]
ror eax, 0x17
xor r11d, eax
lea eax, [r11 + r10]
ror eax, 0x13
xor ebp, eax
lea eax, [r11 + rbp]
ror eax, 0xe
xor r9d, eax
lea eax, [rsi + rdi]
ror eax, 0x19
xor r13d, eax
lea eax, [rsi + r13]
mov r14d, dword [rsp + 0x70]
ror eax, 0x17
xor ebx, eax
lea eax, [rbx + r13]
ror eax, 0x13
xor edi, eax
lea eax, [rdi + rbx]
ror eax, 0xe
xor esi, eax
mov eax, dword [rsp + 0x70]
add eax, edx
ror eax, 0x19
xor ecx, eax
lea eax, [rdx + rcx]
ror eax, 0x17
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, ecx
ror eax, 0x13
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
mov dword [rsp + 0x70], r14d
mov r14d, dword [rsp]
ror eax, 0xe
xor edx, eax
sub qword [rsp + 8], 1
jne 0x14002a600
mov rcx, qword [rsp + 0x60]
mov dword [rcx], r8d
mov dword [rcx + 4], r9d
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], edx
mov dword [rcx + 0x10], r10d
mov dword [rcx + 0x14], r11d
mov dword [rcx + 0x18], ebx
mov dword [rcx + 0x1c], edi
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002d520
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xe8
mov rax, qword [0x1400df040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rax, qword [rcx]
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call qword [rax + 0x20]
test al, al
jne 0x14002d55c
mov rcx, rbx
call fcn.14000dd30
mov r9, qword [rbx + 0x38]
mov rdx, qword [rbx + 0x30]
mov rax, r9
mov rcx, qword [rbx + 0x48]
sub rax, rdx
sub rax, rcx
cmp rbp, rax
jb 0x14002d74c
nop word [rax + rax]
sub r9, rcx
mov qword [rsp + 0x50], rsi
sub r9, rdx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r9
lea r8, [rcx + rdx]
movaps xmm0, xmmword [rsp + 0x50]
mov rax, rdi
mov qword [rsp + 0x70], r8
mov r10, rsi
mov qword [rsp + 0x78], r9
mov rdx, r9
mov qword [rsp + 0x68], r9
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x30], xmm1
cmp r9, 0x20
jb 0x14002d6e6
nop dword [rax]
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x28]
add r9, 0xffffffffffffffe0
mov rax, qword [rdx + 8]
movups xmm1, xmmword [r8]
mov qword [rsp + 0x88], r9
movups xmm3, xmmword [r8 + 0x10]
movups xmmword [rsp + 0xb0], xmm1
xor qword [rsp + 0xb8], rax
mov rax, qword [rdx + 0x18]
movq rcx, xmm1
xor rcx, qword [rdx]
mov qword [rsp + 0xb0], rcx
movq rcx, xmm3
xor rcx, qword [rdx + 0x10]
movups xmm0, xmmword [rsp + 0xb0]
movups xmmword [rsp + 0xc0], xmm3
xor qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0xc0], rcx
mov rcx, qword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0xc0]
add rcx, 0xffffffffffffffe0
lea r10, [rax + 0x20]
movups xmmword [rax], xmm0
mov qword [rsp + 0x98], rcx
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe0
mov qword [rsp + 0x80], r10
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0xa8], rcx
movups xmmword [rax + 0x10], xmm1
lea rax, [r8 + 0x20]
mov qword [rsp + 0x90], rax
lea r8, [rdx + 0x20]
movaps xmm0, xmmword [rsp + 0x90]
mov qword [rsp + 0xa0], r8
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x40], xmm0
cmp r9, 0x20
jae 0x14002d5e0
mov rdx, r9
test r9, r9
je 0x14002d706
sub r8, rax
sub r10, rax
movzx ecx, byte [rax + r8]
xor cl, byte [rax]
mov byte [rax + r10], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14002d6f1
mov r8, qword [rbx + 0x38]
mov rcx, rbx
mov rax, qword [rbx + 0x30]
sub rax, r8
sub r8, qword [rbx + 0x30]
sub r8, qword [rbx + 0x48]
add rax, qword [rbx + 0x48]
add rdi, r8
add rsi, r8
add rbp, rax
call fcn.14002d7b0
mov r9, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x48]
mov rax, r9
mov rdx, qword [rbx + 0x30]
sub rax, rcx
sub rax, rdx
cmp rbp, rax
jae 0x14002d580
lea r8, [rcx + rdx]
mov r9, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.14002a0e0
add qword [rbx + 0x48], rbp
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140092a00
add rsp, 0xe8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002d920
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov rdi, rcx
mov edx, 0x100
add rcx, 0x18
call fcn.140007370
mov edx, 0x100
lea rcx, [rdi + 0x30]
call fcn.140007370
xor ebx, ebx
mov word [rdi + 0x10], 0
mov qword [rdi + 0x48], rbx
mov eax, ebx
nop dword [rax + rax]
mov rcx, qword [rdi + 0x18]
mov byte [rax + rcx], al
inc rax
cmp rax, 0x100
jne 0x14002d970
mov rbp, qword [r15]
mov r11, rbx
mov r15, qword [r15 + 8]
mov r10, rbx
nop
mov r8, qword [rdi + 0x18]
xor edx, edx
mov rax, r10
div r15
movzx r9d, byte [r8 + r10]
movzx ecx, byte [rdx + rbp]
add rcx, r11
add rcx, r9
movzx r11d, cl
movzx eax, byte [r8 + r11]
mov byte [r8 + r10], al
inc r10
mov byte [r8 + r11], r9b
cmp r10, 0x100
jne 0x14002d990
mov rcx, rdi
call fcn.14002d7b0
mov rcx, qword [rdi + 0x38]
sub rcx, qword [rdi + 0x30]
mov rax, qword [rdi + 8]
add rbx, rcx
cmp rbx, rax
jbe 0x14002d9c8
mov rbx, qword [rsp + 0x40]
xor edx, edx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
div rcx
add qword [rdi + 0x48], rdx
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140030390
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r8d, dword [rcx]
mov r9d, 2
mov edx, dword [rcx + 4]
mov eax, dword [rcx + 8]
mov dword [rsp], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 4], eax
mov eax, r8d
xor eax, dword [rcx + 0x10]
mov dword [rsp + 8], eax
mov eax, edx
xor eax, r8d
mov dword [rsp + 0x1c], edx
xor eax, dword [rcx + 0x14]
mov dword [rsp + 0xc], eax
mov eax, edx
xor eax, dword [rcx + 0x18]
mov dword [rsp + 0x10], eax
mov eax, r8d
xor eax, dword [rcx + 0x1c]
mov dword [rsp + 0x14], eax
mov eax, edx
xor eax, r8d
mov edx, r9d
lea r8, [rsp]
mov dword [rsp + 0x18], eax
mov rax, rcx
sub r8, rcx
movdqu xmm1, xmmword [rax + r8]
lea rax, [rax + 0x10]
movdqa xmm2, xmm1
movdqa xmm0, xmm1
psrld xmm2, 0x10
pslld xmm0, 0x10
orps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x10]
xorps xmm2, xmm0
xorps xmm2, xmm1
movdqu xmmword [rax - 0x10], xmm2
sub rdx, 1
jne 0x1400303f0
mov edx, dword [rcx]
mov eax, dword [rcx + 4]
mov dword [rsp], eax
mov eax, dword [rcx + 8]
mov dword [rsp + 4], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 8], eax
mov eax, edx
xor eax, dword [rcx + 0x10]
mov dword [rsp + 0xc], eax
mov eax, edx
xor eax, dword [rcx + 0x14]
mov dword [rsp + 0x10], eax
mov eax, dword [rcx + 0x18]
mov dword [rsp + 0x14], eax
mov eax, edx
xor eax, dword [rcx + 0x1c]
mov dword [rsp + 0x18], eax
lea rax, [rsp]
sub rax, rcx
mov dword [rsp + 0x1c], edx
nop dword [rax + rax]
movdqu xmm3, xmmword [rcx]
movdqu xmm1, xmmword [rcx + rax]
lea rcx, [rcx + 0x10]
movdqa xmm0, xmm1
xorps xmm0, xmm3
movdqa xmm2, xmm0
pslld xmm0, 8
psrld xmm2, 0x18
orps xmm2, xmm0
movdqa xmm0, xmm3
pslld xmm0, 0x10
xorps xmm2, xmm1
movdqa xmm1, xmm3
psrld xmm1, 0x10
orps xmm1, xmm0
movdqa xmm0, xmm3
pslld xmm0, 0x18
xorps xmm2, xmm1
psrld xmm3, 8
orps xmm0, xmm3
xorps xmm2, xmm0
movdqu xmmword [rcx - 0x10], xmm2
sub r9, 1
jne 0x140030470
add rsp, 0x28
ret
Function at 0x140030cf0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call qword [rax + 0x20]
test al, al
jne 0x140030d22
mov rcx, rbx
call fcn.14000dd30
lea r9, [rbx + 8]
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x140031810
Function at 0x140033380
Capabilities:
Encrypt data using blowfish

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov edx, 0x12
add rcx, 0x20
call fcn.140029be0
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140033412
mov r8d, 0x48
lea rdx, [0x14009cb00]
call sub.VCRUNTIME140.dll_memmove
mov edx, 0x400
lea rcx, [rdi + 8]
call fcn.140029be0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140033412
mov r8d, 0x1000
lea rdx, [0x14009cb50]
call sub.VCRUNTIME140.dll_memmove
mov r8, qword [rsi + 8]
xor r9d, r9d
mov rdx, qword [rsi]
mov rcx, rdi
mov qword [rsp + 0x20], 0
call fcn.140032cb0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea r9, str.build_include_public_botan_mem_ops.h
mov dword [rsp + 0x20], 0x93
lea r8, str.copy_mem
lea rdx, str.If_n___0_then_args_are_not_null
lea rcx, str.n___0_implies_in___nullptr__out___nullptr
call fcn.14000e220
int3
Function at 0x1400382d0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r10d, dword [rcx]
lea rsi, [r8 + 0x78]
mov r11d, dword [rdx]
lea r14, [0x1400a0200]
mov rbx, rdx
mov rdi, rcx
mov ebp, 8
nop dword [rax]
nop word [rax + rax]
mov edx, r11d
mov r9d, r11d
xor edx, dword [rsi + 4]
mov eax, edx
ror r9d, 4
xor r9d, dword [rsi]
shr eax, 8
and eax, 0x3f
add eax, 0x140
movzx eax, byte [rax + r14]
imul r8d, eax, 0x841018
mov eax, r9d
shr eax, 8
and eax, 0x3f
add eax, 0x100
and r8d, 0x20404010
movzx eax, byte [rax + r14]
imul ecx, eax, 0x912140
mov eax, edx
shr eax, 0x10
and eax, 0x3f
add eax, 0xc0
and ecx, 0x42080100
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x60221
mov eax, edx
shr eax, 0x18
and edx, 0x3f
and eax, 0x3f
add edx, 0x1c0
add eax, 0x40
and ecx, 0x802081
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x2012020
mov eax, r9d
shr eax, 0x10
and eax, 0x3f
sub eax, 0xffffff80
and ecx, 0x80108020
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x901048
mov eax, r9d
shr rax, 0x18
and r9d, 0x3f
and eax, 0x3f
add r9d, 0x180
and ecx, 0x8020208
movzx eax, byte [rax + r14]
xor r8d, ecx
imul ecx, eax, 0x41106
movzx eax, byte [rdx + r14]
and ecx, 0x1010404
xor r8d, ecx
imul ecx, eax, 0x212240
movzx eax, byte [r9 + r14]
and ecx, 0x10041040
xor r8d, ecx
imul ecx, eax, 0x120202
and ecx, 0x4200802
xor r8d, ecx
xor r10d, r8d
mov edx, r10d
mov r9d, r10d
xor edx, dword [rsi - 4]
mov eax, edx
ror r9d, 4
xor r9d, dword [rsi - 8]
shr eax, 8
and eax, 0x3f
add eax, 0x140
movzx eax, byte [rax + r14]
imul r8d, eax, 0x841018
mov eax, r9d
shr eax, 8
and eax, 0x3f
and r8d, 0x20404010
add eax, 0x100
movzx eax, byte [rax + r14]
imul ecx, eax, 0x912140
lea rsi, [rsi - 0x10]
mov eax, edx
shr eax, 0x10
and eax, 0x3f
add eax, 0xc0
and ecx, 0x42080100
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x60221
mov eax, edx
shr eax, 0x18
and edx, 0x3f
and eax, 0x3f
add edx, 0x1c0
add eax, 0x40
and ecx, 0x802081
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x2012020
mov eax, r9d
shr eax, 0x10
and eax, 0x3f
sub eax, 0xffffff80
and ecx, 0x80108020
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x901048
mov eax, r9d
shr rax, 0x18
and r9d, 0x3f
and eax, 0x3f
add r9d, 0x180
and ecx, 0x8020208
movzx eax, byte [rax + r14]
xor r8d, ecx
imul ecx, eax, 0x41106
movzx eax, byte [rdx + r14]
and ecx, 0x1010404
xor r8d, ecx
imul ecx, eax, 0x212240
movzx eax, byte [r9 + r14]
and ecx, 0x10041040
xor r8d, ecx
imul ecx, eax, 0x120202
and ecx, 0x4200802
xor r8d, ecx
xor r11d, r8d
sub rbp, 1
jne 0x140038310
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov dword [rdi], r10d
mov rdi, qword [rsp + 0x28]
mov dword [rbx], r11d
mov rbx, qword [rsp + 0x10]
pop r14
ret