joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8e7510
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, r8d
movzx r8d, r8b
cmp al, 0x18
je 0x8e7530
cmp al, 0x20
je 0x8e7550
cmp al, 0x10
je 0x8e7540
jmp 0x916e80
mov r9d, 0x10c
mov word [rcx], r9w
jmp 0x916e80
mov r10d, 0xa
mov word [rcx], r10w
jmp 0x916e80
mov eax, 0x20e
mov word [rcx], ax
jmp 0x916e80
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rax, rcx
mov r9, rdx
cmp r8b, 0x18
je 0x916ec0
cmp r8b, 0x20
je 0x916ff0
cmp r8b, 0x10
je 0x916fe0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rcx], 0xc
mov r14d, 0xd0
movzx edi, r8b
xor edx, edx
nop
movzx ecx, byte [r9 + rdx]
mov byte [rax + rdx + 8], cl
add rdx, 1
cmp edi, edx
jg 0x916ed0
movzx r9d, r8b
mov r13d, 1
lea r8, [rax + 8]
lea rcx, [rax + r9]
lea rbp, [0x0242fe60]
lea r15, [0x0242fd20]
cmp r9, r14
jb 0x916f90
jmp 0x916eac
movabs rax, 0xa0a0a0a0a0a0a0a1
movsxd r12, r13d
add r13d, 1
mul r12
shr rdx, 5
lea rax, [rdx + rdx*2]
mov rdx, rax
shl rdx, 4
add rax, rdx
sub r12, rax
movzx eax, sil
movzx esi, byte [rbp + r11]
movzx r11d, byte [rbp + r10]
movzx edx, byte [r15 + r12]
movzx r10d, byte [rbp + rbx]
movzx ebx, byte [rbp + rax]
xor ebx, edx
xor bl, byte [r8]
add r9, 4
add rcx, 4
add r8, 4
mov byte [rcx + 4], bl
movzx eax, byte [r8 - 3]
xor eax, esi
mov byte [rcx + 5], al
xor r11b, byte [r8 - 2]
mov byte [rcx + 6], r11b
xor r10b, byte [r8 - 1]
mov byte [rcx + 7], r10b
cmp r9, r14
jae 0x916eac
mov eax, r9d
movzx ebx, byte [rcx + 4]
movzx esi, byte [rcx + 5]
cdq
movzx r11d, byte [rcx + 6]
movzx r10d, byte [rcx + 7]
idiv edi
test edx, edx
je 0x916f10
cmp edx, 0x10
jne 0x916f5b
cmp edi, 0x20
jne 0x916f5b
movzx eax, sil
movzx ebx, byte [rbp + rbx]
movzx r11d, byte [rbp + r11]
movzx esi, byte [rbp + rax]
movzx r10d, byte [rbp + r10]
jmp 0x916f5b
mov byte [rcx], 0xa
mov r14d, 0xb0
jmp 0x916ec9
mov byte [rcx], 0xe
mov r14d, 0xf0
jmp 0x916ec9

Function at 0x8e7600
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov edi, dword [rsp + 0x80]
mov rax, qword [r8]
mov rbp, rdx
mov rbx, rcx
mov rdx, qword [r8 + 8]
mov rsi, r9
test edi, edi
je 0x8e5fc6
shl rdi, 4
lea r12, [rsp + 0x20]
add rdi, rcx
nop dword [rax]
xor rdx, qword [rsi + 8]
xor rax, qword [rsi]
mov r8, r12
mov rcx, r12
mov qword [rsp + 0x28], rdx
mov rdx, rbp
add rbx, 0x10
add rsi, 0x10
mov qword [rsp + 0x20], rax
call fcn.00916710
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov qword [rbx - 0x10], rax
mov qword [rbx - 8], rdx
cmp rdi, rbx
jne 0x8e5f88
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
jmp 0x8e5f50
Function at 0x8e7610
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov ebp, dword [rsp + 0xb0]
mov rdi, qword [r8]
mov r15, qword [r8 + 8]
mov rbx, rcx
mov r12, rdx
mov rsi, r9
test ebp, ebp
je 0x8e61cb
shl rbp, 4
lea r14, [rsp + 0x20]
lea r13, [rsp + 0x30]
add rbp, rcx
nop dword [rax]
mov rax, qword [rsi]
mov r8, r14
mov rdx, r12
mov rcx, r13
add rbx, 0x10
add rsi, 0x10
mov qword [rsp + 0x20], rax
mov rax, qword [rsi - 8]
mov qword [rsp + 0x28], rax
call fcn.00916ab0
mov rax, qword [rsp + 0x38]
xor rdi, qword [rsp + 0x30]
mov qword [rbx - 0x10], rdi
mov rdi, qword [rsp + 0x20]
xor rax, r15
mov r15, qword [rsp + 0x28]
mov qword [rbx - 8], rax
cmp rbp, rbx
jne 0x8e6180
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x8e6140

Function at 0x8e7780
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [r8]
mov r13d, dword [rsp + 0xb0]
shr r13d, 4
mov qword [rsp + 0x20], rax
mov rax, qword [r8 + 8]
mov rbx, rcx
mov r15, rdx
mov r12, r9
mov qword [rsp + 0x28], rax
je 0x8e60e0
mov r13d, r13d
mov rsi, r9
lea r14, [rsp + 0x20]
mov rbp, r13
lea r13, [rsp + 0x30]
shl rbp, 4
lea rdi, [rcx + rbp]
nop word [rax + rax]
mov r8, r14
mov rdx, r15
mov rcx, r13
add rbx, 0x10
call fcn.00916710
mov rax, qword [rsp + 0x30]
xor rax, qword [rsi]
add rsi, 0x10
mov qword [rbx - 0x10], rax
mov rax, qword [rsp + 0x38]
xor rax, qword [rsi - 8]
add dword [rsp + 0x20], 1
mov qword [rbx - 8], rax
cmp rbx, rdi
jne 0x8e6040
add r12, rbp
mov ebp, dword [rsp + 0xb0]
and ebp, 0xf
jne 0x8e60a0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r13, [rsp + 0x30]
lea r8, [rsp + 0x20]
mov rdx, r15
mov ebp, ebp
mov rcx, r13
call fcn.00916710
xor eax, eax
nop dword [rax]
movzx edx, byte [r13 + rax]
xor dl, byte [r12 + rax]
mov byte [rdi + rax], dl
add rax, 1
cmp rax, rbp
jne 0x8e60c0
jmp 0x8e6088
mov rdi, rcx
jmp 0x8e607c
jmp 0x8e5fe0
Function at 0x8e7790
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rax, qword [r9]
mov r14d, dword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov ebp, dword [rsp + 0xb0]
lea r13d, [r14 - 1]
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x30]
mov rbx, rcx
mov r12, rdx
mov rax, qword [r9 + 8]
mov rdx, r8
mov rcx, rdi
mov r8, rdi
mov qword [rsp + 0x38], rax
call fcn.00916710
test r14d, r14d
je 0x8e624e
nop dword [rax + rax]
mov rcx, rdi
call fcn.00917000
sub r13d, 1
jae 0x8e6240
test ebp, ebp
je 0x8e62ba
shl rbp, 4
lea r13, [rsp + 0x20]
add rbp, rbx
nop
mov rax, qword [rsi]
xor rax, qword [rsp + 0x30]
mov rcx, r13
mov r8, r13
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rax, qword [rsi + 8]
add rbx, 0x10
xor rax, qword [rsp + 0x38]
add rsi, 0x10
mov qword [rsp + 0x28], rax
call fcn.00916710
mov rax, qword [rsp + 0x20]
xor rax, qword [rsp + 0x30]
mov rcx, rdi
mov qword [rbx - 0x10], rax
mov rax, qword [rsp + 0x28]
xor rax, qword [rsp + 0x38]
mov qword [rbx - 8], rax
call fcn.00917000
cmp rbp, rbx
jne 0x8e6260
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
jmp 0x8e61e0

Function at 0x8e77a0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rax, qword [r9]
mov r14d, dword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa8]
mov ebp, dword [rsp + 0xb0]
lea r13d, [r14 - 1]
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x30]
mov rbx, rcx
mov r12, rdx
mov rax, qword [r9 + 8]
mov rdx, r8
mov rcx, rdi
mov r8, rdi
mov qword [rsp + 0x38], rax
call fcn.00916710
test r14d, r14d
je 0x8e633e
nop dword [rax + rax]
mov rcx, rdi
call fcn.00917000
sub r13d, 1
jae 0x8e6330
test ebp, ebp
je 0x8e63aa
shl rbp, 4
lea r13, [rsp + 0x20]
add rbp, rbx
nop
mov rax, qword [rsi]
xor rax, qword [rsp + 0x30]
mov rcx, r13
mov r8, r13
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rax, qword [rsi + 8]
add rbx, 0x10
xor rax, qword [rsp + 0x38]
add rsi, 0x10
mov qword [rsp + 0x28], rax
call fcn.00916ab0
mov rax, qword [rsp + 0x20]
xor rax, qword [rsp + 0x30]
mov rcx, rdi
mov qword [rbx - 0x10], rax
mov rax, qword [rsp + 0x28]
xor rax, qword [rsp + 0x38]
mov qword [rbx - 8], rax
call fcn.00917000
cmp rbp, rbx
jne 0x8e6350
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
jmp 0x8e62d0
Function at 0x8e77d0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
mov eax, dword [rdx + 0x44]
mov edi, dword [rsp + 0xb0]
mov r12, rdx
mov edx, dword [rdx + 0x40]
mov r14, rcx
mov r13, r8
mov rbx, r9
test edx, edx
je 0x8e7040
cmp edi, eax
je 0x8e70b6
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov rdx, qword [r12 + 0x30]
mov esi, dword [r12 + 0x48]
lea r8, [r12 + 0x20]
mov ecx, dword [r12 + 0x4c]
mov qword [r12 + 0x20], rdx
mov rdx, qword [r12 + 0x38]
mov qword [r12 + 0x28], rdx
lea edx, [rsi - 2]
shr edx, 1
lea edx, [rcx + rdx*8 - 1]
mov byte [r12 + 0x20], dl
lea rdx, [r12 + 0x2f]
test eax, eax
je 0x8e708b
nop word [rax + rax]
mov byte [rdx], al
sub rdx, 1
shr eax, 8
jne 0x8e7080
mov rdx, r13
mov rcx, r12
call fcn.00916710
mov rax, qword [r12]
mov qword [r12 + 0x10], rax
mov rax, qword [r12 + 8]
mov qword [r12 + 0x18], rax
mov eax, dword [r12 + 0x44]
cmp edi, eax
jne 0x8e7032
mov rax, qword [r12 + 0x30]
mov dword [rsp + 0x20], edi
mov r9, rbx
mov rdx, r13
lea r8, [rsp + 0x40]
mov rcx, r14
mov qword [rsp + 0x40], rax
mov rax, qword [r12 + 0x38]
mov qword [rsp + 0x48], rax
movzx eax, byte [r12 + 0x4c]
mov byte [rsp + 0x4f], 1
sub eax, 1
mov byte [rsp + 0x40], al
call fcn.008e63c0
cmp edi, 0xf
jbe 0x8e7200
lea esi, [rdi - 0x10]
shr esi, 4
add esi, 1
shl rsi, 4
add rsi, rbx
nop dword [rax]
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
mov r8, r12
mov rcx, r12
xor qword [r12], rdx
add rbx, 0x10
mov rdx, r13
xor qword [r12 + 8], rax
call fcn.00916710
cmp rbx, rsi
jne 0x8e7110
and edi, 0xf
test edi, edi
je 0x8e7032
lea rcx, [rsp + 0x30]
mov rax, rsi
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov r8, rcx
cmp edi, 8
jae 0x8e71d0
xor edx, edx
test dil, 4
je 0x8e7176
mov edx, dword [rax]
mov dword [r8], edx
mov edx, 4
test dil, 2
je 0x8e7189
movzx ecx, word [rax + rdx]
mov word [r8 + rdx], cx
add rdx, 2
and edi, 1
je 0x8e7196
movzx eax, byte [rax + rdx]
mov byte [r8 + rdx], al
mov rax, qword [rsp + 0x30]
xor qword [r12], rax
mov r8, r12
mov rdx, r13
mov rax, qword [rsp + 0x38]
xor qword [r12 + 8], rax
mov rcx, r12
call fcn.00916710
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov r9d, edi
xor eax, eax
and r9d, 0xfffffff8
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, r9d
jb 0x8e71d9
lea r8, [rcx + rax]
add rax, rsi
jmp 0x8e7164
mov rsi, rbx
jmp 0x8e713a
jmp 0x8e7000
Function at 0x8e7840
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov qword [rcx], 0
mov rbx, rcx
mov rsi, r8
mov r12d, r9d
mov qword [rcx + 0x130], 0
lea r14, [rsp + 0x20]
lea r13, [rbx + 0x10]
mov qword [rcx + 0x138], 0
mov r8, r14
mov qword [rcx + 8], 0
mov qword [rcx + 0x110], 0
mov qword [rcx + 0x118], 0
mov rcx, r14
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call fcn.00916710
mov rdx, r14
mov rcx, r13
call fcn.00917030
cmp r12d, 0xc
je 0x8e79b8
lea r14, [rbx + 0x110]
lea edi, [r12*8]
cmp r12d, 0xf
jbe 0x8e79e8
lea ebp, [r12 - 0x10]
shr ebp, 4
add ebp, 1
shl rbp, 4
add rbp, rsi
nop dword [rax + rax]
mov rax, qword [rsi]
xor qword [rbx + 0x110], rax
mov rdx, r13
mov rcx, r14
mov rax, qword [rsi + 8]
xor qword [rbx + 0x118], rax
add rsi, 0x10
call fcn.00917120
cmp rsi, rbp
jne 0x8e7900
and r12d, 0xf
test r12d, r12d
jne 0x8e7988
test edi, edi
je 0x8e794c
lea rax, [rbx + 0x11f]
nop dword [rax]
xor byte [rax], dil
sub rax, 1
shr edi, 8
jne 0x8e7940
mov rdx, r13
mov rcx, r14
call fcn.00917120
mov rax, qword [rbx + 0x110]
mov qword [rbx + 0x120], rax
mov rax, qword [rbx + 0x118]
mov qword [rbx + 0x128], rax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor eax, eax
nop word [rax + rax]
movzx edx, byte [rbp + rax]
xor byte [rbx + rax + 0x110], dl
add rax, 1
cmp r12, rax
jne 0x8e7990
mov rdx, r13
mov rcx, r14
call fcn.00917120
jmp 0x8e7932
xor eax, eax
nop word [rax + rax]
movzx edx, byte [rsi + rax]
mov byte [rbx + rax + 0x110], dl
add rax, 1
cmp rax, 0xc
jne 0x8e79c0
mov byte [rbx + 0x11f], 1
jmp 0x8e7957
mov rbp, rsi
jmp 0x8e792d

Function at 0x8e79f0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov eax, r8d
mov r12, rcx
add qword [rcx + 0x130], rax
mov rbx, rdx
mov rdi, rax
cmp eax, 0xf
jbe 0x8e7b20
lea esi, [rax - 0x10]
lea rbp, [rcx + 0x10]
shr esi, 4
add esi, 1
shl rsi, 4
add rsi, rdx
nop word [rax + rax]
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
mov rcx, r12
add rbx, 0x10
xor qword [r12], rdx
mov rdx, rbp
xor qword [r12 + 8], rax
call fcn.00917120
cmp rbx, rsi
jne 0x8e7a30
and edi, 0xf
test edi, edi
je 0x8e7ae0
lea rcx, [rsp + 0x20]
mov rax, rsi
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov r8, rcx
cmp edi, 8
jae 0x8e7af0
xor edx, edx
test dil, 4
je 0x8e7a93
mov edx, dword [rax]
mov dword [r8], edx
mov edx, 4
test dil, 2
je 0x8e7aa6
movzx ecx, word [rax + rdx]
mov word [r8 + rdx], cx
add rdx, 2
and edi, 1
je 0x8e7ab3
movzx eax, byte [rax + rdx]
mov byte [r8 + rdx], al
mov rax, qword [rsp + 0x20]
xor qword [r12], rax
lea rdx, [r12 + 0x10]
mov rcx, r12
mov rax, qword [rsp + 0x28]
xor qword [r12 + 8], rax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.00917120
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r9d, edi
xor eax, eax
and r9d, 0xfffffff8
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, r9d
jb 0x8e7af9
lea r8, [rcx + rax]
add rax, rsi
jmp 0x8e7a81
mov rsi, rdx
jmp 0x8e7a57
Function at 0x8e7bd0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rbx
mov ebx, dword [rsp + 0x48]
mov esi, dword [rsp + 0x38]
lea eax, [rbx - 2]
mov r11, rdx
mov qword [rcx], 0
mov edx, dword [rsp + 0x40]
mov r10, rcx
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 0
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x28], 0
mov qword [rcx + 0x30], 0
mov qword [rcx + 0x38], 0
mov qword [rcx + 0x40], 0
mov qword [rcx + 0x48], 0
cmp eax, 2
ja 0x8e7d10
cmp edx, 0x10
ja 0x8e7d10
mov eax, 0x15550
bt rax, rdx
jae 0x8e7d10
mov eax, esi
lea ecx, [rbx*8]
shr rax, cl
test rax, rax
jne 0x8e7d10
mov eax, 0xf
mov dword [r10 + 0x48], edx
lea rdx, [r10 + 0x31]
sub eax, ebx
mov dword [r10 + 0x4c], ebx
cmp eax, r9d
mov dword [r10 + 0x44], esi
cmovbe r9d, eax
cmp r9d, 8
jae 0x8e7d18
test r9b, 4
jne 0x8e7d68
test r9d, r9d
je 0x8e7cb5
movzx eax, byte [r8]
mov byte [r10 + 0x31], al
test r9b, 2
jne 0x8e7d80
mov rdx, qword [r10 + 0x30]
mov esi, dword [r10 + 0x48]
lea r8, [r10 + 0x20]
mov ecx, dword [r10 + 0x4c]
mov eax, dword [r10 + 0x44]
mov qword [r10 + 0x20], rdx
mov rdx, qword [r10 + 0x38]
mov qword [r10 + 0x28], rdx
lea edx, [rsi - 2]
shr edx, 1
lea edx, [rcx + rdx*8 + 0x3f]
mov byte [r10 + 0x20], dl
lea rdx, [r10 + 0x2f]
test eax, eax
je 0x8e7cfb
nop word [rax + rax]
mov byte [rdx], al
sub rdx, 1
shr eax, 8
jne 0x8e7cf0
mov rdx, r11
mov rcx, r10
pop rbx
pop rsi
jmp fcn.00916710
pop rbx
pop rsi
ret
mov rax, qword [r8]
mov qword [r10 + 0x31], rax
mov eax, r9d
mov rcx, qword [r8 + rax - 8]
mov qword [rdx + rax - 8], rcx
lea rcx, [r10 + 0x39]
and rcx, 0xfffffffffffffff8
sub rdx, rcx
add r9d, edx
sub r8, rdx
and r9d, 0xfffffff8
cmp r9d, 8
jb 0x8e7cb5
and r9d, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rbx, qword [r8 + rdx]
mov qword [rcx + rdx], rbx
cmp eax, r9d
jb 0x8e7d51
jmp 0x8e7cb5
mov eax, dword [r8]
mov dword [r10 + 0x31], eax
mov eax, r9d
mov ecx, dword [r8 + rax - 4]
mov dword [rdx + rax - 4], ecx
jmp 0x8e7cb5
mov eax, r9d
movzx ecx, word [r8 + rax - 2]
mov word [rdx + rax - 2], cx
jmp 0x8e7cb5
Function at 0x8e8f60
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov rax, qword [rsp + 0x28]
cmp edx, 0x20
je 0x8e8fe0
mov dword [rcx], 0x61707865
mov dword [rcx + 0x14], 0x3120646e
mov dword [rcx + 0x28], 0x79622d36
mov dword [rcx + 0x3c], 0x6b206574
mov edx, dword [r8]
mov dword [rcx + 4], edx
mov edx, dword [r8 + 4]
mov dword [rcx + 8], edx
mov edx, dword [r8 + 8]
mov dword [rcx + 0xc], edx
mov edx, dword [r8 + 0xc]
mov dword [rcx + 0x10], edx
mov edx, dword [r8]
mov dword [rcx + 0x2c], edx
mov edx, dword [r8 + 4]
mov dword [rcx + 0x30], edx
mov edx, dword [r8 + 8]
mov dword [rcx + 0x34], edx
mov edx, dword [r8 + 0xc]
mov dword [rcx + 0x24], 0
mov dword [rcx + 0x38], edx
cmp r9d, 8
je 0x8e9020
cmp r9d, 0xc
jne 0x8e8fdf
mov edx, dword [rax]
mov dword [rcx + 0x18], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x1c], edx
mov eax, dword [rax + 8]
mov dword [rcx + 0x20], eax
ret
mov dword [rcx], 0x61707865
add r8, 0x10
mov dword [rcx + 0x14], 0x3320646e
mov dword [rcx + 0x28], 0x79622d32
mov dword [rcx + 0x3c], 0x6b206574
mov edx, dword [r8 - 0x10]
mov dword [rcx + 4], edx
mov edx, dword [r8 - 0xc]
mov dword [rcx + 8], edx
mov edx, dword [r8 - 8]
mov dword [rcx + 0xc], edx
mov edx, dword [r8 - 4]
mov dword [rcx + 0x10], edx
jmp 0x8e8fa0
mov edx, dword [rax]
mov dword [rcx + 0x18], edx
mov eax, dword [rax + 4]
mov dword [rcx + 0x20], 0
mov dword [rcx + 0x1c], eax
ret

Function at 0x8e9040
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push r12
push rdi
xor eax, eax
mov r11, qword [rsp + 0x40]
lea rdi, [rcx + 8]
mov r10, rcx
mov r12d, edx
mov edx, dword [rsp + 0x38]
and rdi, 0xfffffffffffffff8
mov qword [rcx], 0
mov qword [rcx + 0x80], 0
sub rcx, rdi
add ecx, 0x88
shr ecx, 3
rep stosq qword [rdi], rax
mov byte [r10 + 0x82], r12b
cmp r8d, 0x20
je 0x8e9110
mov dword [r10], 0x61707865
mov dword [r10 + 0x14], 0x3120646e
mov dword [r10 + 0x28], 0x79622d36
mov dword [r10 + 0x3c], 0x6b206574
mov eax, dword [r9]
mov dword [r10 + 4], eax
mov eax, dword [r9 + 4]
mov dword [r10 + 8], eax
mov eax, dword [r9 + 8]
mov dword [r10 + 0xc], eax
mov eax, dword [r9 + 0xc]
mov dword [r10 + 0x10], eax
mov eax, dword [r9]
mov dword [r10 + 0x2c], eax
mov eax, dword [r9 + 4]
mov dword [r10 + 0x30], eax
mov eax, dword [r9 + 8]
mov dword [r10 + 0x34], eax
mov eax, dword [r9 + 0xc]
mov dword [r10 + 0x38], eax
cmp edx, 8
je 0x8e9160
cmp edx, 0xc
jne 0x8e910c
mov eax, dword [r11]
mov dword [r10 + 0x18], eax
mov eax, dword [r11 + 4]
mov dword [r10 + 0x1c], eax
mov eax, dword [r11 + 8]
mov dword [r10 + 0x20], eax
pop rdi
pop r12
ret
mov dword [r10], 0x61707865
add r9, 0x10
mov dword [r10 + 0x14], 0x3320646e
mov dword [r10 + 0x28], 0x79622d32
mov dword [r10 + 0x3c], 0x6b206574
mov eax, dword [r9 - 0x10]
mov dword [r10 + 4], eax
mov eax, dword [r9 - 0xc]
mov dword [r10 + 8], eax
mov eax, dword [r9 - 8]
mov dword [r10 + 0xc], eax
mov eax, dword [r9 - 4]
mov dword [r10 + 0x10], eax
jmp 0x8e90cc
mov eax, dword [r11]
mov dword [r10 + 0x18], eax
mov eax, dword [r11 + 4]
mov dword [r10 + 0x1c], eax
pop rdi
pop r12
ret
Function at 0x8e9180
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbp, rcx
mov r13, rdx
mov rbx, r8
mov esi, r9d
test r9d, r9d
je 0x8e923f
movzx eax, byte [rdx + 0x81]
test al, al
jne 0x8e9250
mov rdi, rbx
lea r15, [rsp + 0x20]
cmp esi, 0x3f
jbe 0x8e9302
lea r12d, [rsi - 0x40]
mov r14, rbp
lea r15, [rsp + 0x20]
shr r12d, 6
add r12d, 1
shl r12, 6
lea rdi, [rbx + r12]
nop dword [rax]
movzx ecx, byte [r13 + 0x82]
mov r8, r13
mov rdx, r15
call fcn.008e8830
add dword [r13 + 0x20], 1
jne 0x8e9207
add dword [r13 + 0x24], 1
xor eax, eax
nop dword [rax]
movzx edx, byte [rbx + rax]
xor dl, byte [r15 + rax]
mov byte [r14 + rax], dl
add rax, 1
cmp rax, 0x40
jne 0x8e9210
add rbx, 0x40
add r14, 0x40
cmp rdi, rbx
jne 0x8e91e8
add rbp, r12
and esi, 0x3f
jne 0x8e9302
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, r9d
cmova eax, r9d
mov r8d, eax
xor eax, eax
nop dword [rax]
movzx edx, byte [r13 + 0x80]
add edx, eax
movsxd rdx, edx
movzx edx, byte [r13 + rdx + 0x40]
xor dl, byte [rbx + rax]
mov byte [rbp + rax], dl
add rax, 1
cmp r8d, eax
jg 0x8e9260
movzx eax, byte [r13 + 0x80]
mov edx, r8d
lea rax, [r13 + rax + 0x40]
cmp r8d, 8
jae 0x8e92d7
test r8b, 4
jne 0x8e93fb
test r8d, r8d
je 0x8e92b5
mov byte [rax], 0
test r8b, 2
jne 0x8e9424
sub byte [r13 + 0x81], r8b
add byte [r13 + 0x80], r8b
sub esi, r8d
je 0x8e923f
add rbx, rdx
add rbp, rdx
jmp 0x8e91b4
lea rdi, [rax + 8]
mov qword [rax], 0
mov qword [rax + rdx - 8], 0
and rdi, 0xfffffffffffffff8
sub rax, rdi
mov rcx, rax
xor eax, eax
add ecx, r8d
shr ecx, 3
rep stosq qword [rdi], rax
jmp 0x8e92b5
movzx ecx, byte [r13 + 0x82]
mov r8, r13
mov rdx, r15
call fcn.008e8830
add dword [r13 + 0x20], 1
jne 0x8e9321
add dword [r13 + 0x24], 1
xor eax, eax
movzx edx, byte [rdi + rax]
xor dl, byte [r15 + rax]
mov byte [rbp + rax], dl
add rax, 1
cmp esi, eax
ja 0x8e9323
test esi, esi
mov eax, 1
mov edx, 0x40
mov ecx, 1
cmovne eax, esi
sub edx, esi
mov byte [r13 + 0x81], dl
lea edx, [rax + 0x40]
mov byte [r13 + 0x80], al
movsxd rdx, edx
add r13, rdx
mov edx, 0x40
sub edx, eax
cmp eax, 0x3f
cdqe
cmovg rdx, rcx
add r15, rax
mov eax, edx
cmp edx, 8
jae 0x8e93b0
and edx, 4
jne 0x8e940e
test eax, eax
je 0x8e923f
movzx edx, byte [r15]
mov byte [r13], dl
test al, 2
je 0x8e923f
movzx edx, word [r15 + rax - 2]
mov word [r13 + rax - 2], dx
jmp 0x8e923f
mov rax, qword [r15]
lea rcx, [r13 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r13], rax
mov rax, qword [rdx + r15 - 8]
mov qword [r13 + rdx - 8], rax
sub r13, rcx
lea eax, [rdx + r13]
sub r15, r13
and eax, 0xfffffff8
cmp eax, 8
jb 0x8e923f
and eax, 0xfffffff8
xor edx, edx
mov r8d, edx
add edx, 8
mov r9, qword [r15 + r8]
mov qword [rcx + r8], r9
cmp edx, eax
jb 0x8e93e4
jmp 0x8e923f
mov dword [rax], 0
mov dword [rax + rdx - 4], 0
jmp 0x8e92b5
mov edx, dword [r15]
mov dword [r13], edx
mov edx, dword [r15 + rax - 4]
mov dword [r13 + rax - 4], edx
jmp 0x8e923f
xor ecx, ecx
mov word [rax + rdx - 2], cx
jmp 0x8e92b5
Function at 0x8ea420
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor r15d, r15d
mov rdi, qword [rsp + 0xb0]
mov eax, r8d
mov r12d, r8d
mov r13, rdx
mov r14d, r8d
sub eax, r9d
xor r12d, r9d
mov rsi, rcx
mov edx, eax
lea r10, [rsi + 8]
xor edx, r9d
or r12d, edx
xor r12d, r8d
sar r12d, 0x1f
and eax, r12d
lea edx, [r9 + rax]
mov r9d, dword [rcx]
mov r12, rdx
add rdx, qword [rcx]
mov qword [rcx], rdx
lea rax, [rdx*8]
and edx, 0x3f
mov ecx, 0x78
bswap rax
mov r8d, edx
mov qword [rsp + 0x38], rax
lea eax, [rdx - 0x38]
and r9d, 0x3f
xor r8d, 0x38
xor eax, 0x38
sub ecx, edx
mov r11d, r9d
or eax, r8d
mov r8d, 0x40
xor eax, edx
sub r8d, r9d
sar eax, 0x1f
and eax, 0x40
sub ecx, eax
mov dword [rsp + 0x28], ecx
lea rcx, [r10 + r11]
cmp r8d, 8
jae 0x8ea680
test r8b, 4
jne 0x8ea6c8
test r8d, r8d
je 0x8ea4e8
mov byte [rcx], 0
test r8b, 2
jne 0x8ea6dc
mov ecx, dword [rsp + 0x28]
lea r15d, [r14 + 0x40]
lea ebp, [rax + rdx - 0x78]
xor ebx, ebx
mov dword [rsp + 0xa0], r14d
add r15, 8
sub ebp, r12d
lea r8d, [r12 + rcx]
lea eax, [r12 + rcx + 8]
mov qword [rdi], 0
mov r14d, r8d
mov qword [rdi + 8], 0
mov r8d, dword [rsp + 0xa0]
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
mov dword [rsp + 0x2c], eax
jmp 0x8ea551
mov eax, ebx
add ebp, 1
cmp rax, r15
jae 0x8ea669
mov r11d, r9d
mov eax, r12d
xor ecx, ecx
xor eax, ebx
cmp r8d, ebx
jbe 0x8ea575
mov ecx, dword [rsp + 0x28]
add r13, 1
add ecx, ebp
xor ecx, r12d
or ecx, eax
xor ecx, ebx
sar ecx, 0x1f
and cl, byte [r13 - 1]
mov edx, eax
sub eax, 1
not edx
and eax, edx
sar eax, 0x1f
and eax, 0x80
or eax, ecx
cmp r9d, 0x37
jbe 0x8ea5ab
mov edx, ebx
mov ecx, r14d
xor ecx, ebp
xor edx, r14d
or edx, ecx
lea ecx, [r9 - 0x38]
xor edx, ebx
sar edx, 0x1f
not edx
and dl, byte [rsp + rcx + 0x38]
or eax, edx
add r9d, 1
xor byte [rsi + r11 + 8], al
add ebx, 1
cmp r9d, 0x40
jne 0x8ea540
mov rdx, r10
mov rcx, rsi
mov qword [rsp + 0x20], r10
mov dword [rsp + 0xa0], r8d
call fcn.008e9b30
mov eax, dword [rsp + 0x2c]
mov r10, qword [rsp + 0x20]
mov r8d, dword [rsp + 0xa0]
xor eax, ebx
mov qword [r10], 0
mov ecx, eax
sub eax, 1
mov qword [r10 + 8], 0
not ecx
mov qword [r10 + 0x10], 0
and eax, ecx
mov qword [r10 + 0x18], 0
mov qword [r10 + 0x20], 0
sar eax, 0x1f
mov qword [r10 + 0x28], 0
mov ecx, eax
xor eax, eax
mov qword [r10 + 0x30], 0
mov qword [r10 + 0x38], 0
nop word [rax + rax]
mov edx, dword [rsi + rax + 0x88]
and edx, ecx
bswap edx
xor dword [rdi + rax], edx
add rax, 4
cmp rax, 0x20
jne 0x8ea640
mov eax, ebx
xor r9d, r9d
add ebp, 1
cmp rax, r15
jb 0x8ea54e
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ebx, r8d
mov qword [rcx], 0
mov qword [rcx + rbx - 8], 0
lea rbx, [rcx + 8]
and rbx, 0xfffffffffffffff8
sub rcx, rbx
add ecx, r8d
and ecx, 0xfffffff8
cmp ecx, 8
jb 0x8ea4e8
and ecx, 0xfffffff8
xor r8d, r8d
mov ebp, r8d
add r8d, 8
mov qword [rbx + rbp], r15
cmp r8d, ecx
jb 0x8ea6b3
jmp 0x8ea4e8
mov dword [rcx], 0
mov dword [rcx + r8 - 4], 0
jmp 0x8ea4e8
xor ebx, ebx
mov word [rcx + r8 - 2], bx
jmp 0x8ea4e8