joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49bb40
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp edx, 3
je 0x49bb50
ret
jmp method.boost.on_thread_exit__

Function at 0x49bc60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, rcx
mov qword [rsp + 0x90], rcx
movzx ecx, word [rcx + 0x42]
mov rsi, rdx
mov qword [rsp + 0xa0], r8
mov r15, qword [rax + rcx*8 + 0x48]
movzx r14d, word [r15 + 0xc]
movzx edx, word [r15 + 0xa]
sub r14d, 0x10
mov eax, edx
mov edi, r14d
shr ax, 1
shr edi, 1
xor eax, 1
mov dword [rsp + 0x2c], edi
lea r13d, [rdi - 1]
mov rdi, qword [rsp + 0x90]
and eax, 1
mov r14d, eax
mov r11, qword [rdi + 0x30]
mov rdi, qword [r11 + 0x10]
lea r11, [sym.mdb_cmp_cint]
cmp rdi, r11
je 0x49be68
and dx, 0x20
jne 0x49bde0
lea rbp, [rsp + 0x30]
cmp eax, r13d
jle 0x49bd61
xor eax, eax
xor r12d, r12d
xor ebx, ebx
nop dword [rax + rax]
cmp qword [rsp + 0xa0], 0
je 0x49bd23
mov r9d, dword [rsp + 0x2c]
test eax, eax
mov rsi, qword [rsp + 0xa0]
sete r8b
xor eax, eax
test r9d, r9d
setne al
and eax, r8d
mov dword [rsi], eax
mov rax, qword [rsp + 0x90]
cmp ebx, dword [rsp + 0x2c]
mov word [rax + rcx*2 + 0x148], dx
mov eax, 0
cmovae r12, rax
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r14d, [rbx + 1]
cmp r13d, r14d
jl 0x49bda2
lea ebx, [r14 + r13]
mov rdx, rbp
mov rcx, rsi
sar ebx, 1
mov eax, ebx
movzx r12d, word [r15 + rax*2 + 0x10]
add r12, r15
movzx eax, word [r12 + 6]
mov qword [rsp + 0x30], rax
lea rax, [r12 + 8]
mov qword [rsp + 0x38], rax
call rdi
test eax, eax
je 0x49be50
jg 0x49bd58
lea r13d, [rbx - 1]
cmp r13d, r14d
jge 0x49bd61
mov rsi, qword [rsp + 0x90]
movzx ecx, word [rsi + 0x42]
test eax, eax
jle 0x49be9f
add ebx, 1
mov edx, ebx
test byte [r15 + 0xa], 0x20
jne 0x49bcf8
mov r8d, ebx
movzx r12d, word [r15 + r8*2 + 0x10]
add r12, r15
jmp 0x49bcf8
mov rdx, qword [rsp + 0x90]
movzx r12d, word [r15 + 0x10]
mov rdx, qword [rdx + 0x28]
add r12, r15
mov edx, dword [rdx]
mov qword [rsp + 0x30], rdx
cmp eax, r13d
jg 0x49be94
lea rbp, [rsp + 0x30]
jmp 0x49be1e
lea r14d, [rbx + 1]
cmp r14d, r13d
jg 0x49bda2
mov rdx, qword [rsp + 0x30]
lea ebx, [r13 + r14]
mov rcx, rsi
sar ebx, 1
movsxd rax, ebx
imul rax, rdx
mov rdx, rbp
lea rax, [r15 + rax + 0x10]
mov qword [rsp + 0x38], rax
call rdi
test eax, eax
je 0x49be50
jg 0x49be10
lea r13d, [rbx - 1]
jmp 0x49be14
mov rsi, qword [rsp + 0x90]
mov edx, ebx
movzx ecx, word [rsi + 0x42]
jmp 0x49bcf8
test dl, 1
je 0x49bcd8
movzx r11d, word [r15 + 0x12]
lea rdi, [sym.mdb_cmp_long]
cmp word [r15 + r11 + 6], 8
lea r11, [sym.mdb_cmp_int]
cmovne rdi, r11
jmp 0x49bcd8
xor edx, edx
xor eax, eax
xor ebx, ebx
jmp 0x49bcf8
mov edx, ebx
jmp 0x49bcf8
Function at 0x49bf40
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbx, qword [rcx + 0x48]
mov r14, qword [rcx + 0x20]
mov rax, qword [rbx]
mov esi, edx
mov qword [rsp + 0xc0], rcx
mov r13d, eax
mov r12d, edx
mov dword [rsp + 0xc8], edx
add esi, 1
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rax
test byte [r14 + 0x1a], 8
jne 0x49c118
cmp eax, esi
jl 0x49c1a8
movsxd rax, edx
mov ebp, dword [r14 + 0x1c]
lea r15, [rsp + 0x50]
mov rdi, rax
mov qword [rsp + 0x48], rax
shl rdi, 4
add rdi, rbx
mov rbx, rdi
jmp 0x49c027
mov rcx, qword [rbx + 0x10]
mov r8d, eax
mov r9d, ebp
and r8d, 0xffffffef
mov word [rdx + 0xa], r8w
imul rcx, r9
mov r8d, ebp
test al, 4
je 0x49bfde
mov r8d, dword [rdx + 0xc]
imul r8d, r9d
mov qword [r15], 0
xor r9d, r9d
mov qword [r15 + 8], 0
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], 0
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x20], r15
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49c198
add esi, 1
add rbx, 0x10
cmp r13d, esi
jl 0x49c050
mov rdx, qword [rbx + 0x18]
movzx eax, word [rdx + 0xa]
test ax, 0xc000
je 0x49bfb8
and ax, 0x7fff
add esi, 1
add rbx, 0x10
mov word [rdx + 0xa], ax
mov qword [rbx], 0
cmp r13d, esi
jge 0x49c027
mov edx, dword [rsp + 0xc8]
mov rax, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
not edx
add eax, edx
add rax, qword [rsp + 0x48]
shl rax, 4
lea rbx, [rsi + rax + 0x10]
jmp 0x49c08c
cmp dword [rcx + 0xc], 1
je 0x49c09d
call sym.free
add rdi, 0x10
cmp rdi, rbx
je 0x49c0b7
cmp qword [rdi + 0x10], 0
mov rcx, qword [rdi + 0x18]
je 0x49c0f0
test byte [rcx + 0xa], 4
jne 0x49c078
mov rax, qword [r14 + 0xc8]
add rdi, 0x10
mov qword [rcx], rax
mov qword [r14 + 0xc8], rcx
cmp rdi, rbx
jne 0x49c08c
mov eax, dword [rsp + 0x40]
mov rsi, qword [rsp + 0xc0]
sub eax, r12d
mov edi, r12d
add dword [rsi + 0x80], eax
mov rax, qword [rsp + 0x38]
mov qword [rax], rdi
xor eax, eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea eax, [r12 + 1]
movdqu xmm0, xmmword [rdi + 0x10]
mov rdx, qword [rcx]
mov r12, rax
shl rax, 4
add rax, rsi
movups xmmword [rax], xmm0
mov qword [rax], rdx
jmp 0x49c083
mov rdi, qword [rsp + 0x40]
cmp edi, esi
jl 0x49c1a8
mov eax, r12d
movsxd rcx, edx
mov rsi, qword [rsp + 0x38]
not eax
mov rdx, rcx
add eax, edi
shl rdx, 4
mov r9, rsi
add rax, rcx
add rdx, rsi
shl rax, 4
lea r8, [rsi + rax + 0x10]
jmp 0x49c164
and eax, 0xffffffef
mov word [rcx + 0xa], ax
add rdx, 0x10
cmp r8, rdx
je 0x49c0b7
mov rcx, qword [rdx + 0x18]
movzx eax, word [rcx + 0xa]
test ax, 0xc000
je 0x49c150
and ax, 0x7fff
movdqu xmm1, xmmword [rdx + 0x10]
mov word [rcx + 0xa], ax
lea eax, [r12 + 1]
mov r12, rax
shl rax, 4
movups xmmword [r9 + rax], xmm1
jmp 0x49c157
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x49c0d9
mov eax, r12d
jmp 0x49c0bb
Function at 0x49c410
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp edx, 3
je 0x49c428
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov eax, dword [0x00a2f600]
test eax, eax
jle 0x49c41c
mov rsi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
lea rdi, [0x00a2f620]
nop word [rax + rax]
mov ecx, dword [rdi + rbx*4]
call rsi
test rax, rax
je 0x49c459
mov dword [rax + 8], 0
add rbx, 1
cmp dword [0x00a2f600], ebx
jg 0x49c448
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x49dd60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
test rcx, rcx
je 0x49dd74
mov eax, dword [rcx + 0x7c]
and eax, 0x20001
cmp eax, 0x20001
je 0x49dd80
mov eax, 0x16
ret
jmp sym.mdb_txn_renew0
Function at 0x4c9b50
Capabilities:
Encode data using xor

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rdi, rcx
mov rsi, rdx
lea rcx, [rsp + 0x40]
mov rbx, r8
mov rdx, rdi
call method.cryptonote.get_block_hashing_blob_abi:cxx11__cryptonote::block_const_
movzx ecx, byte [rdi]
cmp cl, 4
jbe 0x4c9c48
cmp cl, 7
ja 0x4c9ba8
cmp cl, 5
je 0x4c9d7e
cmp cl, 6
mov edx, 0x40000
mov eax, 0x20000
mov r9d, 1
cmove rdx, rax
jmp 0x4c9c50
cmp cl, 8
je 0x4c9cc0
mov rax, qword [rdi + 8]
cmp cl, 9
je 0x4c9d08
movsx ecx, byte [rdi + 0x10]
movsx r8d, byte [rdi + 0x11]
mov edx, 1
movzx r9d, cl
mov byte [rsp + 0x3d], cl
movzx ecx, r8b
mov byte [rsp + 0x3e], r8b
movsx r8d, byte [rdi + 0x12]
shl ecx, 8
shl r9d, 0x10
or r9d, ecx
movzx ecx, r8b
mov byte [rsp + 0x3f], r8b
or ecx, r9d
cmove ecx, edx
xor edx, edx
mov ecx, ecx
div rcx
test rbx, rbx
je 0x4c9c21
nop word [rax + rax]
mov r8, rdx
xor rdx, rbx
and r8, rbx
mov rbx, r8
add rbx, rbx
jne 0x4c9c10
and edx, 0x7fff
mov r9d, 2
mov rax, rdx
xor rax, 0x40000
test rdx, rdx
mov edx, 0x40000
cmovne edx, eax
jmp 0x4c9c75
mov edx, 0x80000
xor r9d, r9d
mov eax, 1
nop dword [rax]
mov rcx, rax
and rcx, rbx
xor rbx, rax
mov rax, rcx
add rax, rax
jne 0x4c9c58
and ebx, 0x3ff
xor rbx, rdx
lea edx, [rbx + rbx]
mov dword [rsp + 0x28], edx
mov rcx, qword [rsp + 0x40]
mov r8, rsi
mov dword [rsp + 0x20], 0
mov rdx, qword [rsp + 0x48]
call sym.cn_slow_hash
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
cmp rcx, rax
je 0x4c9ca7
call sym.operator_delete_void_
mov eax, 1
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
ret
mov rax, rbx
mov edx, 1
nop dword [rax + rax]
mov rcx, rdx
and rcx, rax
xor rax, rdx
mov rdx, rcx
add rdx, rdx
jne 0x4c9cd0
and eax, 0x3ff
xor rax, 0x40000
cmp rbx, 0x2d5ff
jbe 0x4c9d60
mov edx, eax
mov r9d, 2
jmp 0x4c9c75
xor edx, edx
div rbx
mov eax, 1
nop word [rax + rax]
mov rcx, rax
and rax, rbx
mov r8, rbx
xor rbx, rcx
add rax, rax
jne 0x4c9d18
cmp rcx, r8
je 0x4c9d41
nop
mov r8, rdx
xor rdx, rbx
and r8, rbx
mov rbx, r8
add rbx, rbx
jne 0x4c9d30
and edx, 0xfff
je 0x4c9d6e
or edx, 0x40000
mov r9d, 2
jmp 0x4c9c75
lea edx, [rax + rax]
mov r9d, 2
jmp 0x4c9c75
mov edx, 0x40000
mov r9d, 2
jmp 0x4c9c75
mov edx, 0x80000
mov r9d, 1
jmp 0x4c9c50
Function at 0x4df9c0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x90
mov rax, qword [rcx]
mov rbx, rdx
mov rdx, r8
mov r8, r9
lea r9, [rsp + 0x20]
call qword [rax + 0xd0]
mov r12d, eax
test al, al
jne 0x4dfa00
mov eax, r12d
add rsp, 0x90
pop rbx
pop rsi
pop r12
ret
movdqu xmm0, xmmword [rsp + 0x20]
movdqu xmm1, xmmword [rsp + 0x30]
lea rsi, [rsp + 0x40]
mov edx, 0x21
lea rcx, [rsp + 0x60]
mov r8, rsi
mov byte [rsp + 0x80], 0x8d
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm1
call sym.cn_fast_hash
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [rsi + rdx]
xor byte [rbx + rdx], cl
add rdx, 1
cmp rdx, 8
jne 0x4dfa40
mov eax, r12d
add rsp, 0x90
pop rbx
pop rsi
pop r12
ret

Function at 0x4f6120
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
mov rbx, rcx
shl r8d, 8
movzx ecx, dl
lea r9, [rsp + 0x20]
or r8d, ecx
mov rdx, r9
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rbx + 4], eax
add rsp, 0x1c0
pop rbx
ret

Function at 0x4f6a60
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push r14
mov eax, 0xfd0
push r13
push r12
push rsi
push rbx
call fcn.006e6b70
sub rsp, rax
mov rsi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword [rdx + 8]
lea r9d, [rax + 1]
mov rbx, r8
lea r14, [rsp + 0x30]
mov r12, rcx
mov dword [rsp + 0x28], 0x3e8
mov qword [rsp + 0x20], r14
mov ecx, 0xfde9
mov r8, qword [rdx]
xor edx, edx
call rsi
mov rax, qword [rbx + 8]
lea r13, [rsp + 0x800]
xor edx, edx
mov dword [rsp + 0x28], 0x3e8
mov ecx, 0xfde9
mov qword [rsp + 0x20], r13
lea r9d, [rax + 1]
mov r8, qword [rbx]
call rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4f6aed
and eax, 0xfffffffe
mov rcx, r13
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov r8d, 1
mov rdx, r13
mov rcx, r14
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x4f6b30
call method.std::_V2.system_category__
mov dword [r12], ebx
mov qword [r12 + 8], rax
mov rax, r12
add rsp, 0xfd0
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x4f6b05
Function at 0x4fcdc0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x48
mov r12, rcx
lea rcx, str.LANG
call sym.getenv
mov r13, rax
test rax, rax
je 0x4fcf00
cmp byte [rax], 0
je 0x4fcf00
lea rsi, [r12 + 0x10]
mov rcx, r13
lea rbx, [rsp + 0x30]
mov qword [r12], rsi
call sym.strlen
xor r9d, r9d
mov rdx, r13
mov rcx, r12
lea r8, [r13 + rax]
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
xor r8d, r8d
mov r9d, 1
mov rcx, r12
lea rdx, [0x008a32af]
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.find_char_const__unsigned_long_long__unsigned_long_long__const
mov rcx, qword [r12 + 8]
mov rdx, qword [r12]
lea r10, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
cmp rax, rcx
cmova rax, rcx
xor r9d, r9d
mov rcx, r10
lea r8, [rdx + rax]
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
mov rax, qword [rsp + 0x20]
mov rcx, qword [r12]
mov r8, qword [rsp + 0x28]
cmp rax, rbx
je 0x4fcf60
mov rdx, qword [rsp + 0x30]
cmp rcx, rsi
je 0x4fcf38
mov r9, qword [r12 + 0x10]
mov qword [r12], rax
mov qword [r12 + 8], r8
mov qword [r12 + 0x10], rdx
test rcx, rcx
je 0x4fcf46
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], 0
mov byte [rcx], 0
mov rcx, qword [rsp + 0x20]
cmp rcx, rbx
je 0x4fcebe
call sym.operator_delete_void_
mov rbx, qword [r12]
mov r13, qword [r12 + 8]
mov rsi, qword [sym.imp.msvcrt.dll_tolower]
add r13, rbx
cmp r13, rbx
je 0x4fcef1
nop word cs:[rax + rax]
movsx ecx, byte [rbx]
add rbx, 1
call rsi
mov byte [rbx - 1], al
cmp r13, rbx
jne 0x4fcee0
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop r12
pop r13
ret
lea rcx, str.LC_ALL
call sym.getenv
mov r13, rax
test rax, rax
jne 0x4fcf20
lea r13, [0x008a32a0]
jmp 0x4fcdee
cmp byte [rax], 0
jne 0x4fcdee
lea r13, [0x008a32a0]
jmp 0x4fcdee
mov qword [r12], rax
mov qword [r12 + 8], r8
mov qword [r12 + 0x10], rdx
mov qword [rsp + 0x20], rbx
lea rbx, [rsp + 0x30]
mov rcx, rbx
jmp 0x4fcea3
test r8, r8
je 0x4fcf7c
cmp r8, 1
je 0x4fcf90
mov rdx, rbx
call sym.memcpy
mov r8, qword [rsp + 0x28]
mov rcx, qword [r12]
mov qword [r12 + 8], r8
mov byte [rcx + r8], 0
mov rcx, qword [rsp + 0x20]
jmp 0x4fcea3
movzx eax, byte [rsp + 0x30]
mov byte [rcx], al
mov r8, qword [rsp + 0x28]
mov rcx, qword [r12]
jmp 0x4fcf7c
Function at 0x5133d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, rcx
mov eax, edx
test edx, edx
jle 0x5135db
sub eax, 1
mov rdx, qword [rcx]
mov r14d, 1
lea r12, [rcx + 0x28]
lea r13, [0x009186e8]
lea rsi, [rsp + 0x20]
mov r10d, 0xcccccccd
lea rax, [r13 + rax*8]
lea rbp, [0x00918680]
mov qword [rsp + 8], rax
lea rax, [rcx + 8]
lea rdi, [0x00918620]
mov qword [rsp + 0x10], rax
lea rax, [rcx + 0xc8]
mov qword [rsp + 0x18], rax
nop dword [rax]
mov r8, qword [rsp + 0x10]
mov r9, rsi
mov r11, rbx
mov rcx, rdx
mov rax, qword [r8 + 0x20]
xor rax, qword [r8 + 0x48]
add r9, 8
xor rax, qword [r8 + 0x70]
xor rax, qword [r8 + 0x98]
xor rax, rcx
mov qword [r9 - 8], rax
cmp r12, r8
je 0x513480
mov rcx, qword [r8]
add r8, 8
jmp 0x51344e
mov r8, qword [rsp + 0x18]
xor r9d, r9d
lea ecx, [r9 + 4]
mov rax, rcx
imul rcx, r10
shr rcx, 0x22
lea ecx, [rcx + rcx*4]
sub eax, ecx
lea ecx, [r9 + 1]
mov r9, rcx
imul rcx, r10
cdqe
mov r15d, r9d
shr rcx, 0x22
lea ecx, [rcx + rcx*4]
sub r15d, ecx
movsxd rcx, r15d
mov rcx, qword [rsp + rcx*8 + 0x20]
rol rcx, 1
xor rcx, qword [rsp + rax*8 + 0x20]
lea rax, [r8 - 0xc8]
xor rdx, rcx
mov qword [rax], rdx
add rax, 0x28
cmp r8, rax
je 0x5134ef
mov rdx, qword [rax]
add rax, 0x28
xor rdx, rcx
mov qword [rax - 0x28], rdx
cmp r8, rax
jne 0x5134dc
add r8, 8
cmp r9d, 5
je 0x513508
mov rdx, qword [r8 - 0xc8]
jmp 0x513488
mov rdx, qword [rbx + 8]
xor eax, eax
mov r8d, 0xa
mov ecx, 1
jmp 0x51352b
mov ecx, dword [rbp + rax]
movsxd r8, dword [rdi + rax]
mov rdx, r9
lea r8, [rbx + r8*8]
rol rdx, cl
add rax, 4
mov r9, qword [r8]
mov qword [r8], rdx
cmp rax, 0x60
jne 0x513520
mov qword [rsp + 0x20], r9
xor r15d, r15d
xor eax, eax
mov rdx, qword [r11 + rax]
mov qword [rsi + rax], rdx
add rax, 8
cmp rax, 0x28
jne 0x51354c
mov r8, r11
xor edx, edx
lea ecx, [rdx + 1]
mov eax, edx
mov rdx, rcx
imul rcx, r10
mov r9d, edx
shr rcx, 0x22
lea ecx, [rcx + rcx*4]
sub r9d, ecx
movsxd rcx, r9d
lea r9d, [rax + 2]
mov rax, r9
imul r9, r10
mov rcx, qword [rsp + rcx*8 + 0x20]
not rcx
shr r9, 0x22
lea r9d, [r9 + r9*4]
sub eax, r9d
cdqe
and rcx, qword [rsp + rax*8 + 0x20]
xor qword [r8], rcx
add r8, 8
cmp edx, 5
jne 0x513563
add r15d, 5
add r11, 0x28
cmp r15d, 0x19
jne 0x51354a
mov rdx, qword [rbx]
xor rdx, r14
mov qword [rbx], rdx
cmp qword [rsp + 8], r13
je 0x5135db
mov r14, qword [r13]
add r13, 8
jmp 0x513440
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x513810
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0xc8
jmp sym.keccak
Function at 0x513850
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [rcx + 0x150]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, 0x80000000
jne 0x513a84
movabs rdx, 0xf0f0f0f0f0f0f0f1
lea rcx, [rbp + r8]
mov rax, rcx
mul rdx
shr rdx, 7
mov rax, rdx
shl rax, 4
add rax, rdx
shl rax, 3
sub rcx, rax
mov qword [rbx + 0x150], rcx
test rbp, rbp
jne 0x513984
mov rbp, rsi
and ebp, 7
cmp rdi, 0x87
jbe 0x513908
nop
mov rcx, rsi
test rbp, rbp
jne 0x513920
xor eax, eax
nop word [rax + rax]
mov rdx, qword [rcx + rax]
xor qword [rbx + rax], rdx
add rax, 8
cmp rax, 0x88
jne 0x5138d0
mov edx, 0x18
mov rcx, rbx
sub rdi, 0x88
add rsi, 0x88
call sym.keccakf
cmp rdi, 0x87
ja 0x5138c0
test rdi, rdi
jne 0x5139f0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movdqu xmm0, xmmword [rsi]
lea rcx, [rbx + 0xc8]
movups xmmword [rbx + 0xc8], xmm0
movdqu xmm1, xmmword [rsi + 0x10]
movups xmmword [rcx + 0x10], xmm1
movdqu xmm2, xmmword [rsi + 0x20]
movups xmmword [rcx + 0x20], xmm2
movdqu xmm3, xmmword [rsi + 0x30]
movups xmmword [rcx + 0x30], xmm3
movdqu xmm4, xmmword [rsi + 0x40]
movups xmmword [rcx + 0x40], xmm4
movdqu xmm5, xmmword [rsi + 0x50]
movups xmmword [rcx + 0x50], xmm5
movdqu xmm0, xmmword [rsi + 0x60]
movups xmmword [rcx + 0x60], xmm0
movdqu xmm1, xmmword [rsi + 0x70]
movups xmmword [rcx + 0x70], xmm1
mov rax, qword [rsi + 0x80]
mov qword [rcx + 0x80], rax
jmp 0x5138c8
mov r12d, 0x88
lea rcx, [rbx + rbp + 0xc8]
mov rdx, rsi
sub r12, rbp
cmp r8, r12
mov r8, r12
cmovbe r8, rdi
call sym.memcpy
mov rax, rbx
lea rcx, [rbx + 0x88]
cmp rdi, r12
jb 0x513911
nop word [rax + rax]
mov rdx, qword [rax + 0xc8]
xor qword [rax], rdx
add rax, 8
cmp rcx, rax
jne 0x5139c0
mov edx, 0x18
mov rcx, rbx
add rsi, r12
call sym.keccakf
lea rdi, [rbp + rdi - 0x88]
jmp 0x5138b0
lea rdx, [rbx + 0xc8]
mov eax, edi
cmp edi, 8
jae 0x513a30
and edi, 4
jne 0x513a6f
test eax, eax
je 0x513911
movzx ecx, byte [rsi]
mov byte [rbx + 0xc8], cl
test al, 2
je 0x513911
movzx ecx, word [rsi + rax - 2]
mov word [rdx + rax - 2], cx
jmp 0x513911
mov rax, qword [rsi]
add rbx, 0xd0
mov qword [rbx - 8], rax
mov eax, edi
and rbx, 0xfffffffffffffff8
mov rcx, qword [rsi + rax - 8]
mov qword [rdx + rax - 8], rcx
mov rax, rdx
sub rax, rbx
sub rsi, rax
add eax, edi
mov rdi, rbx
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov ecx, dword [rsi]
mov dword [rbx + 0xc8], ecx
mov ecx, dword [rsi + rax - 4]
mov dword [rdx + rax - 4], ecx
jmp 0x513911
call sym.local_abort.constprop.0
nop
nop word [rax + rax]
Function at 0x513a90
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdx, qword [rcx + 0x150]
mov rbx, rcx
mov rax, rdx
and eax, 0x80000000
je 0x513ad8
test rsi, rsi
je 0x513aca
movdqu xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea r9, [rcx + 0xc8]
mov ecx, 0x88
sub rcx, rdx
lea r8, [r9 + rdx]
cmp rcx, 8
jae 0x513b68
test cl, 4
jne 0x513b92
test rcx, rcx
je 0x513b13
mov byte [r8], 0
test cl, 2
jne 0x513bae
mov rdx, qword [rbx + 0x150]
or byte [r9 + rdx], 1
mov rax, rbx
lea rcx, [rbx + 0x88]
or byte [rbx + 0x14f], 0x80
nop dword [rax]
mov rdx, qword [rax + 0xc8]
xor qword [rax], rdx
add rax, 8
cmp rax, rcx
jne 0x513b30
mov edx, 0x18
mov rcx, rbx
call sym.keccakf
mov eax, 0x80000000
mov qword [rbx + 0x150], rax
jmp 0x513aae
lea rdi, [r8 + 8]
mov qword [r8], 0
mov qword [r8 + rcx - 8], 0
and rdi, 0xfffffffffffffff8
sub r8, rdi
add rcx, r8
shr rcx, 3
rep stosq qword [rdi], rax
jmp 0x513b0c
mov dword [r8], 0
mov dword [r8 + rcx - 4], 0
mov rdx, qword [rbx + 0x150]
jmp 0x513b13
xor eax, eax
mov word [r8 + rcx - 2], ax
mov rdx, qword [rbx + 0x150]
jmp 0x513b13
Function at 0x517770
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
test rcx, rcx
je 0x51797e
mov rax, qword [rcx]
test rax, rax
je 0x51795a
mov rdx, qword [rax]
shr rdx, 2
mov qword [rax + 0x28], rdx
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x28]
add rax, 7
mov qword [rdx + 0x20], rax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
shl rax, 4
mov qword [rdx + 0x10], rax
mov rsi, qword [rcx]
mov edx, 1
mov rcx, qword [rsi + 0x10]
call sym.calloc
mov qword [rsi + 0x18], rax
mov rax, qword [rbx]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x51796c
mov r8, qword [rax]
mov rdx, qword [rax + 8]
lea rdi, [rsp + 0x2c]
lea rbp, [0x0091a780]
lea rsi, [rsp + 0x28]
lea r12, [0x0091a880]
call sym.memcpy
mov r9, qword [rbx]
mov rax, qword [r9 + 0x20]
mov r10, qword [r9 + 0x28]
shl rax, 2
mov r8, r10
cmp r10, rax
jae 0x517910
nop dword [rax]
mov rax, qword [r9 + 0x18]
lea r11, [r10*4]
xor edx, edx
mov r13d, dword [rax + r11 - 4]
mov rax, r10
div r8
mov dword [rsp + 0x28], r13d
mov ecx, r13d
test rdx, rdx
je 0x5178b0
cmp rdx, 4
jne 0x51785e
cmp r8, 6
ja 0x517920
xor eax, eax
mov rdx, qword [r9 + 0x18]
mov r13, r10
sub r13, qword [r9 + 0x28]
lea r8, [rdx + rax]
lea rdx, [rdx + r13*4]
xor cl, byte [rdx + rax]
add rax, 1
mov byte [r8 + r11], cl
cmp rax, 4
je 0x517890
mov r9, qword [rbx]
movzx ecx, byte [rax + rsi]
jmp 0x517860
mov r9, qword [rbx]
add r10, 1
mov rax, qword [r9 + 0x20]
shl rax, 2
cmp rax, r10
jbe 0x517910
mov r8, qword [r9 + 0x28]
jmp 0x517828
movzx edx, word [rsp + 0x29]
mov rcx, rsi
mov word [rdi], dx
movzx edx, byte [rsp + 0x2b]
mov byte [rdi + 2], dl
mov byte [rsp + 0x2f], r13b
mov edx, dword [rsp + 0x2c]
mov dword [rsp + 0x28], edx
movzx edx, byte [rcx]
add rcx, 1
mov r8, rdx
and edx, 0xf0
and r8d, 0xf
add rdx, rbp
movzx edx, byte [rdx + r8]
mov byte [rcx - 1], dl
cmp rdi, rcx
jne 0x5178d0
movzx ecx, byte [r12 + rax - 1]
xor cl, byte [rsp + 0x28]
mov byte [rsp + 0x28], cl
jmp 0x51785e
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rax, [rsp + 0x28]
mov rdx, rcx
and ecx, 0xf0
add rax, 1
and edx, 0xf
add rcx, rbp
movzx edx, byte [rcx + rdx]
mov byte [rax - 1], dl
cmp rdi, rax
je 0x517950
movzx ecx, byte [rax]
jmp 0x517925
movzx ecx, byte [rsp + 0x28]
jmp 0x51785e
mov eax, 7
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, 8
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, 2
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x518a30
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
test rcx, rcx
je 0x518aca
test rdx, rdx
je 0x518ad6
mov rcx, rdx
lea r9, [rdx + 0x10]
lea r8, [0x0091a780]
nop dword [rax]
movzx eax, byte [rcx]
add rcx, 1
mov rdx, rax
and eax, 0xf0
and edx, 0xf
add rax, r8
movzx eax, byte [rax + rdx]
mov byte [rcx - 1], al
cmp r9, rcx
jne 0x518a60
mov rcx, rbx
call sym.oaes_shift_rows
call sym.oaes_mix_cols
lea rcx, [rbx + 4]
call sym.oaes_mix_cols
lea rcx, [rbx + 8]
call sym.oaes_mix_cols
lea rcx, [rbx + 0xc]
call sym.oaes_mix_cols
xor eax, eax
nop dword [rax + rax]
movzx edx, byte [rsi + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x518ab0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, 2
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, 3
jmp 0x518ac3