joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
movzx eax, r9b
mov rdx, qword [rdx + 8]
sub al, r8b
movzx ebx, al
mov rcx, r14
mov rdi, r9
sub rdx, qword [r14]
add rdx, rbx
call fcn.140007370
mov rsi, qword [r14 + 8]
mov r11b, 1
mov rbp, rsi
sub rsi, qword [r14]
sub rbp, qword [r14]
sub rsi, rbx
mov r9, rbp
sub r9, rdi
cmp r9, rbp
je 0x14001b0db
mov r10, r9
sub r10, rsi
mov rdx, qword [r14]
mov r8, r10
shr r8, 0x3f
mov rax, r9
shr rax, 0x3f
mov rcx, r9
xor r8b, al
shr rcx, 0x3f
mov rax, rsi
inc r10
shr rax, 0x3f
xor cl, al
mov rax, r9
or r8b, cl
shr rax, 0x3f
movzx ecx, byte [rdx + r9]
xor r8b, al
dec r8b
lea eax, [r11 + 1]
xor cl, r11b
xor al, r11b
and cl, r8b
and al, r8b
xor byte [rdx + r9], cl
xor r11b, al
inc r9
cmp r9, rbp
jne 0x14001b080
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14001b100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
movzx eax, r9b
sub al, r8b
mov rcx, r14
movzx ebx, al
mov rdi, r9
mov edx, ebx
sub rdx, qword [r14]
add rdx, qword [r14 + 8]
call fcn.140007370
mov rsi, qword [r14 + 8]
mov rbp, rsi
sub rsi, qword [r14]
sub rbp, qword [r14]
sub rsi, rbx
mov r11, rbp
sub r11, rdi
cmp r11, rbp
je 0x14001b1c3
nop word [rax + rax]
mov r10, qword [r14]
mov rdx, r11
xor rdx, rsi
mov r9, rsi
sub r9, r11
mov rax, rsi
shr rax, 0x3f
shr r9, 0x3f
xor r9b, al
lea rcx, [rdx - 1]
shr rcx, 0x3f
mov rax, rdx
shr rax, 0x3f
not rdx
or r9b, al
shr rdx, 0x3f
and cl, dl
mov rax, rsi
shr rax, 0x3f
neg cl
xor r9b, al
movzx eax, byte [r10 + r11]
xor al, 0x80
dec r9b
and cl, al
xor cl, byte [r10 + r11]
and r9b, cl
mov byte [r10 + r11], r9b
inc r11
cmp r11, rbp
jne 0x14001b160
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14001b1e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rdx
movzx r15d, r9b
sub r15b, r8b
mov rcx, r14
movzx ebx, r15b
mov rdi, r9
mov edx, ebx
sub rdx, qword [r14]
add rdx, qword [r14 + 8]
call fcn.140007370
mov rsi, qword [r14 + 8]
mov rbp, rsi
sub rsi, qword [r14]
sub rbp, qword [r14]
sub rsi, rbx
mov rax, rbp
sub rax, rdi
cmp rax, rbp
je 0x14001b28e
mov r11, rax
sub r11, rsi
nop dword [rax + rax]
mov r10, qword [r14]
mov r9, r11
shr r9, 0x3f
mov rcx, rax
shr rcx, 0x3f
mov rdx, rax
xor r9b, cl
shr rdx, 0x3f
mov rcx, rsi
inc r11
shr rcx, 0x3f
xor dl, cl
mov rcx, rax
shr rcx, 0x3f
or r9b, dl
xor r9b, cl
movzx ecx, byte [r10 + rax]
xor cl, r15b
dec r9b
and r9b, cl
xor byte [r10 + rax], r9b
inc rax
cmp rax, rbp
jne 0x14001b240
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14001b570
Capabilities:
Encode data using xor

Disassembly:
push rbx
lea rax, [r8 - 3]
mov rbx, rdx
cmp rax, 0xfc
jbe 0x14001b586
mov rax, r8
pop rbx
ret
movzx eax, byte [rdx + r8 - 1]
mov r11, r8
sub r11, rax
mov qword [rsp + 0x10], rsi
mov r10, r11
lea rsi, [r8 - 1]
xor r10, r8
xor r9d, r9d
mov rcx, r10
or rcx, r8
xor rcx, r8
shr rcx, 0x3f
neg rcx
test rsi, rsi
je 0x14001b613
mov qword [rsp + 0x18], rdi
lea rdi, [r11 + rdx]
nop dword [rax]
nop word [rax + rax]
lea rdx, [r9 + rbx]
mov rax, r9
mov r8, rdx
xor rax, r11
movzx edx, byte [rdx]
sub r8, rdi
xor r8, r9
dec rdx
or r8, rax
shr rdx, 0x3f
xor r8, r9
neg rdx
shr r8, 0x3f
inc r9
neg r8
or r8, rdx
not r8
or rcx, r8
cmp r9, rsi
jne 0x14001b5d0
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
and r10, rcx
xor r10, r11
mov rax, r10
pop rbx
ret

Function at 0x14001b630
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
lea rax, [r8 - 3]
mov r10, rdx
cmp rax, 0xfc
jbe 0x14001b64b
mov rax, r8
add rsp, 8
ret
movzx edx, byte [rdx + r8 - 1]
movzx eax, dl
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
movzx edi, r8b
xor al, dil
movzx r11d, dil
sub r11b, dl
mov r9d, edi
movzx ecx, r11b
movzx ebx, r11b
xor cl, dil
or cl, al
lea eax, [rdx - 1]
xor cl, dil
shr al, 7
shr cl, 7
not dl
shr dl, 7
neg cl
and al, dl
neg al
or cl, al
sub r9, 1
je 0x14001b6dd
nop word [rax + rax]
movzx eax, byte [r10 + r9]
mov r8, rbx
dec al
sub r8, r9
xor al, byte [r10 + r9 - 1]
shr r8, 0x3f
lea edx, [rax - 1]
not al
shr al, 7
shr dl, 7
and dl, al
mov rax, r9
shr rax, 0x3f
dec dl
or r8b, al
neg r8b
and dl, r8b
or cl, dl
sub r9, 1
jne 0x14001b6a0
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp]
movzx edx, r11b
xor rax, rdx
movzx edx, cl
and rax, rdx
movzx ecx, r11b
xor rax, rcx
add rsp, 8
ret

Function at 0x14001b720
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov r10, r8
mov rdi, rdx
cmp r8, 2
ja 0x14001b733
mov rax, r8
pop rdi
ret
xor cl, cl
mov qword [rsp + 0x10], rbx
xor al, al
lea r11, [r8 - 1]
mov rbx, r10
nop dword [rax]
nop word [rax + rax]
movzx r9d, byte [rdi + rbx - 1]
movzx r8d, r9b
xor r8b, 0x80
lea edx, [r8 - 1]
not r8b
shr dl, 7
shr r8b, 7
and dl, r8b
neg dl
or al, dl
movzx edx, al
not dl
movzx r8d, dl
mov edx, r8d
and edx, 1
sub r11, rdx
lea edx, [r9 - 1]
shr dl, 7
not r9b
shr r9b, 7
and dl, r9b
dec dl
and dl, r8b
or cl, dl
sub rbx, 1
jne 0x14001b750
mov rbx, qword [rsp + 0x10]
not al
movzx eax, al
movzx edx, cl
mov rcx, r11
or rax, rdx
xor rcx, r10
dec rax
shr rax, 0x3f
dec rax
and rax, rcx
xor rax, r11
pop rdi
ret
Function at 0x14001b7d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
lea rax, [r8 - 3]
cmp rax, 0xfc
jbe 0x14001b7e8
mov rax, r8
add rsp, 8
ret
mov qword [rsp + 0x18], rsi
mov r11, r8
mov qword [rsp], rdi
lea rsi, [r8 - 1]
movzx edi, byte [rdx + r8 - 1]
xor r10d, r10d
sub r11, rdi
mov r9, r11
xor r9, r8
mov rcx, r9
or rcx, r8
xor rcx, r8
shr rcx, 0x3f
neg rcx
test rsi, rsi
je 0x14001b873
mov qword [rsp + 0x10], rbx
lea rbx, [r11 + rdx]
nop dword [rax + rax]
mov rdx, r10
mov rax, r10
sub rdx, r11
xor rax, r11
mov r8, rdx
xor r8, r10
or r8, rax
movzx edx, byte [rdx + rbx]
xor r8, r10
xor rdx, rdi
shr r8, 0x3f
dec rdx
dec r8
shr rdx, 0x3f
inc r10
dec rdx
and r8, rdx
or rcx, r8
cmp r10, rsi
jne 0x14001b830
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
and r9, rcx
mov rsi, qword [rsp + 0x18]
xor r9, r11
mov rax, r9
add rsp, 8
ret
Function at 0x14001db40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx]
mov r15, r8
mov rsi, rdx
mov r14, rcx
call qword [rax + 0x20]
test al, al
jne 0x14001db65
mov rcx, r14
call fcn.14000dd30
mov rax, qword [r14 + 0x10]
cmp qword [r14 + 8], rax
je 0x14001dcc6
mov rcx, qword [r14 + 0x38]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov rbp, r15
mov qword [rsp + 0x50], rdi
mov rdi, qword [r14 + 0x50]
test rcx, rcx
je 0x14001dbcc
mov rdx, qword [r14 + 0x20]
mov rax, rdi
sub rax, rcx
mov rbx, r15
cmp rax, r15
cmovb rbx, rax
add rdx, rcx
mov r8, rbx
mov rcx, rsi
call fcn.14001e380
add qword [r14 + 0x38], rbx
sub rbp, rbx
add rsi, rbx
cmp qword [r14 + 0x38], rdi
jne 0x14001dbcc
mov rcx, r14
call fcn.14001e030
mov rbx, rbp
cmp rbp, rdi
jb 0x14001dc92
nop dword [rax + rax]
mov r9, qword [r14 + 0x20]
xor ecx, ecx
test rdi, rdi
je 0x14001dc78
cmp rdi, 0x10
jb 0x14001dc4a
lea rdx, [rdi - 1]
lea rax, [r9 - 1]
add rdx, rsi
add rax, rdi
cmp rsi, rax
ja 0x14001dc0d
cmp rdx, r9
jae 0x14001dc4a
mov rdx, rdi
and rdx, 0xfffffffffffffff0
mov r8, r9
mov rax, rsi
sub r8, rsi
nop dword [rax]
movdqu xmm0, xmmword [rax]
add rcx, 0x10
movdqu xmm1, xmmword [r8 + rax]
movdqu xmmword [r8 + rax], xmm0
lea rax, [rax + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp rcx, rdx
jne 0x14001dc20
cmp rcx, rdi
je 0x14001dc78
sub r9, rsi
lea rax, [rcx + rsi]
mov r8, rdi
sub r8, rcx
nop word [rax + rax]
movzx ecx, byte [rax]
movzx edx, byte [r9 + rax]
mov byte [r9 + rax], cl
xor byte [rax], dl
lea rax, [rax + 1]
sub r8, 1
jne 0x14001dc60
sub rbp, rdi
mov rcx, r14
mov rbx, rbp
add rsi, rdi
call fcn.14001e030
cmp rbp, rdi
jae 0x14001dbe0
mov rdi, qword [rsp + 0x50]
test rbx, rbx
je 0x14001dcaf
mov rdx, qword [r14 + 0x20]
mov r8, rbp
mov rcx, rsi
call fcn.14001e380
add qword [r14 + 0x38], rbx
mov rbp, qword [rsp + 0x48]
mov rax, r15
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
lea r8, str.src_lib_modes_cfb_cfb.cpp
lea rdx, str.process_msg
lea rcx, str.m_state.empty____false
call fcn.14000e420
int3
Function at 0x14001e380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r9d, r9d
mov r10, rdx
test r8, r8
je 0x14001e428
cmp r8, 0x10
jb 0x14001e3fe
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r8
add rax, r10
cmp rcx, rax
ja 0x14001e3b1
cmp rdx, r10
jae 0x14001e3fe
mov rdx, r8
mov qword [rsp], rbx
and rdx, 0xfffffffffffffff0
mov r11, r10
mov rax, rcx
sub r11, rcx
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r9, 0x10
movdqu xmm1, xmmword [r11 + rax]
movdqu xmmword [r11 + rax], xmm0
lea rax, [rax + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp r9, rdx
jne 0x14001e3d0
mov rbx, qword [rsp]
cmp r9, r8
je 0x14001e428
sub r10, rcx
lea rax, [r9 + rcx]
sub r8, r9
nop dword [rax + rax]
movzx ecx, byte [rax]
movzx edx, byte [r10 + rax]
mov byte [r10 + rax], cl
xor byte [rax], dl
lea rax, [rax + 1]
sub r8, 1
jne 0x14001e410
add rsp, 8
ret
Function at 0x14001f6d0
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [r11 - 0x78], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov dword [rsp + 0x20], 1
mov qword [r11 + 0x10], rdx
test rdx, rdx
je 0x14001f72a
movabs rax, 0x1fffffffffffffff
cmp rdx, rax
ja 0x14001f84c
lea rdx, [r11 + 0x10]
call fcn.14001f550
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14d, dword [rsp + 0x2c]
test rsi, rsi
je 0x14001f83a
lea r15, [r14 + r14*2]
nop word [rax + rax]
mov r9d, 4
mov r8d, 0x3000
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x14001f830
lea rbp, [rax + r14]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov rcx, rbx
test eax, eax
jne 0x14001f79d
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14001f830
mov r8, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0xa8], r12d
mov edx, dword [rsp + 0x2c]
lea r9, [rsp + 0xa8]
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0xb0], r12d
mov edx, dword [rsp + 0x2c]
lea rcx, [rbx + r14*2]
lea r9, [rsp + 0xb0]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0xb8], rbp
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14001f820
mov qword [rdx], rbp
add qword [rdi + 8], 8
jmp 0x14001f830
lea r8, [rsp + 0xb8]
mov rcx, rdi
call fcn.14001f3f0
sub rsi, 1
jne 0x14001f750
mov rax, rdi
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400156d0
int3
Function at 0x14001f8b0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push r14
push r15
sub rsp, 0x58
mov rsi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsi]
xor r15d, r15d
mov rax, qword [rsi + 8]
mov r14d, r15d
mov ebp, dword [rsp + 0x24]
sub rax, rcx
cmp rax, 8
jb 0x14001f9b5
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x50], rdi
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rcx + r14*8]
xor eax, eax
mov rdi, rbx
mov rcx, rbp
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
lea r9, [rsp + 0x80]
mov rdi, rbx
mov dword [rsp + 0x80], r15d
sub rdi, rbp
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
lea rcx, [rbx + rbp]
lea r9, [rsp + 0x88]
mov dword [rsp + 0x88], r15d
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsi]
inc r14
mov rax, qword [rsi + 8]
sub rax, rcx
sar rax, 3
cmp r14, rax
jne 0x14001f900
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x90]
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbp
ret

Function at 0x14001faa0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0x15
lea rax, str.BOTAN_MLOCK_POOL_SIZE
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
mov edi, 0x200
mov edx, edi
movdqa xmmword [rsp + 0x20], xmm0
call fcn.14001fe70
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
test eax, eax
je 0x14001fb47
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
imul rcx, rax, 0xb
mov rax, qword [rsp + 0x70]
cmp rax, rcx
jbe 0x14001fb47
sub rax, rcx
cmp rbx, rdi
cmova rbx, rdi
shl rbx, 0xa
cmp rbx, rax
cmovb rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x80]
xor eax, eax
add rsp, 0x60
pop rdi
ret
Function at 0x140024a00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov rdi, rdx
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.140007370
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x28]
call fcn.140007370
mov rcx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x18]
sub r8, rcx
je 0x140024a51
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x30]
sub r8, rcx
je 0x140024a65
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbp + 0x48]
xor ebx, ebx
mov r8, qword [rdi + 8]
cmp r8, rax
jbe 0x140024aca
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x20]
movups xmm0, xmmword [rdi]
mov qword [rsp + 0x50], rsi
mov rax, qword [rcx]
movaps xmmword [rsp + 0x20], xmm0
call qword [rax + 0x10]
mov rdi, qword [rbp + 8]
mov rax, qword [rbp + 0x10]
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi]
call qword [rsi]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
mov rcx, rdi
movdqa xmmword [rsp + 0x20], xmm0
call qword [rsi + 0x18]
mov rsi, qword [rsp + 0x50]
jmp 0x140024b56
cmp r8, 0x14
jb 0x140024ade
mov rdx, qword [rdi]
mov rcx, qword [rbp + 0x10]
call sub.VCRUNTIME140.dll_memmove
jmp 0x140024b56
test r8, r8
je 0x140024b56
mov r10, rbx
mov r9, rbx
test rax, rax
je 0x140024b56
mov rdi, qword [rdi]
mov r11, r8
shr r11, 0x3f
nop dword [rax + rax]
mov rcx, r9
mov rdx, r10
sub rcx, r8
sub rdx, r8
xor rcx, r9
shr rdx, 0x3f
mov rax, r8
xor rax, r9
or rcx, rax
xor rcx, r9
shr rcx, 0x3f
neg rcx
and r9, rcx
mov rcx, r10
shr rcx, 0x3f
xor dl, cl
movzx eax, cl
xor al, r11b
or dl, al
mov rax, qword [rbp + 0x10]
xor dl, cl
neg dl
and dl, byte [rdi + r9]
inc r9
mov byte [r10 + rax], dl
inc r10
cmp r10, qword [rbp + 0x48]
jne 0x140024b00
cmp qword [rbp + 0x48], rbx
je 0x140024b83
nop dword [rax]
mov rax, qword [rbp + 0x10]
xor byte [rax + rbx], 0x36
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rax + rbx]
mov rax, qword [rbp + 0x28]
xor cl, 0x6a
mov byte [rbx + rax], cl
inc rbx
cmp rbx, qword [rbp + 0x48]
jne 0x140024b60
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
mov rax, qword [rbp + 0x18]
sub rax, rdx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
mov rax, qword [rcx]
movdqa xmmword [rsp + 0x20], xmm0
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140026090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [rdx]
mov rax, rcx
mov rdi, rdx
mov rsi, rcx
xor rax, qword [rbx + 0x18]
mov r9, qword [rbx]
mov r10, qword [rbx + 8]
mov r11, qword [rbx + 0x10]
test r8, r8
je 0x140026106
nop
add r11, rax
add r9, r10
ror r10, 0x33
xor r10, r9
ror rax, 0x30
xor rax, r11
ror r9, 0x20
add r11, r10
add r9, rax
mov rdx, r11
ror r10, 0x2f
mov rcx, r11
shr rdx, 0x20
xor r10, r11
ror rax, 0x2b
shl rcx, 0x20
mov r11, rdx
or r11, rcx
xor rax, r9
sub r8, 1
jne 0x1400260c0
xor r9, rsi
mov rsi, qword [rsp + 0x10]
mov qword [rbx], r9
mov rcx, qword [rdi]
mov rbx, qword [rsp + 8]
mov qword [rcx + 8], r10
mov rcx, qword [rdi]
mov qword [rcx + 0x10], r11
mov rcx, qword [rdi]
mov rdi, qword [rsp + 0x18]
mov qword [rcx + 0x18], rax
ret
Function at 0x140026320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov rbx, rcx
add rcx, 8
mov r14, rdx
call qword [rax + 0x20]
test al, al
jne 0x140026353
lea rcx, [rbx + 8]
call fcn.14000dd30
mov rcx, qword [rbx + 0x58]
test rcx, rcx
jne 0x14002636a
movzx eax, byte [rbx + 0x60]
shl rax, 0x38
mov qword [rbx + 0x50], rax
jmp 0x140026393
cmp rcx, 8
jae 0x140026393
mov rdx, qword [rbx + 0x50]
mov eax, 8
sub al, cl
shl al, 3
movzx ecx, al
movzx eax, byte [rbx + 0x60]
shl rax, 0x38
shr rdx, cl
or rdx, rax
mov qword [rbx + 0x50], rdx
mov r8, qword [rbx + 0x10]
lea rdx, [rbx + 0x38]
mov rcx, qword [rbx + 0x50]
call fcn.140026090
mov rax, qword [rbx + 0x38]
xor qword [rax + 0x10], 0xff
mov rsi, qword [rbx + 0x38]
mov r11, qword [rbx + 0x18]
mov r10, qword [rsi]
mov r8, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
mov rax, qword [rsi + 0x18]
test r11, r11
je 0x140026416
nop dword [rax]
add r9, rax
add r10, r8
ror r8, 0x33
xor r8, r10
ror rax, 0x30
xor rax, r9
ror r10, 0x20
add r9, r8
add r10, rax
mov rdx, r9
ror r8, 0x2f
mov rcx, r9
shr rdx, 0x20
xor r8, r9
ror rax, 0x2b
shl rcx, 0x20
mov r9, rdx
or r9, rcx
xor rax, r10
sub r11, 1
jne 0x1400263d0
mov qword [rsi], r10
movabs rdx, 0x736f6d6570736575
mov rcx, qword [rbx + 0x38]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov qword [rcx + 8], r8
mov rcx, qword [rbx + 0x38]
mov qword [rcx + 0x10], r9
mov rcx, qword [rbx + 0x38]
mov qword [rcx + 0x18], rax
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax + 0x18]
xor rcx, qword [rax + 0x10]
xor rcx, qword [rax + 8]
xor rcx, qword [rax]
mov rax, qword [r14]
mov qword [rax], rcx
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax]
mov rax, qword [rbx + 0x38]
xor rcx, rdx
movabs rdx, 0x646f72616e646f6d
mov qword [rax], rcx
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + 8]
mov rax, qword [rbx + 0x38]
xor rcx, rdx
movabs rdx, 0x6c7967656e657261
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax]
mov rax, qword [rbx + 0x38]
xor rcx, rdx
movabs rdx, 0x7465646279746573
mov qword [rax + 0x10], rcx
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + 8]
mov rax, qword [rbx + 0x38]
xor rcx, rdx
mov qword [rax + 0x18], rcx
xor eax, eax
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x58], rax
mov byte [rbx + 0x60], al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x140026df0
Capabilities:
Hash data using sha512

Disassembly:
add rcx, 8
jmp method.Botan::BLAKE2b.virtual_40
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0xa8]
mov rbx, rcx
mov rcx, qword [rcx + 0xa0]
xor edx, edx
sub r8, rcx
xor edi, edi
and r8, 0xfffffffffffffff8
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rbx + 0x18], xmm0
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rbx + 0x48], xmm0
movups xmmword [rbx + 0x58], xmm0
movups xmmword [rbx + 0x68], xmm0
movups xmmword [rbx + 0x78], xmm0
movups xmmword [rbx + 0x88], xmm0
mov qword [rbx + 0x98], rdi
mov rcx, qword [rbx + 0xd8]
mov r8, qword [rbx + 0xe0]
sub r8, rcx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov qword [rbx + 0xd0], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14007d910
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0xa0]
test rcx, rcx
je 0x14007da19
mov r8d, 0x40
mov qword [rsp + 0x40], rdi
lea rdx, [0x1400c4810]
call sub.VCRUNTIME140.dll_memmove
mov rdx, qword [rbx + 0xa0]
lea rdi, [rbx + 0x18]
mov eax, dword [rbx + 0x10]
xorps xmm0, xmm0
shr rax, 3
movzx ecx, al
movzx eax, byte [rbx + 0xd0]
or rax, 0x10100
shl rax, 8
or rcx, rax
xor eax, eax
xor qword [rdx], rcx
mov qword [rbx + 0xc0], rax
mov qword [rbx + 0xb8], rax
mov qword [rbx + 0xc8], rax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
cmp qword [rbx + 0xd0], rax
jbe 0x14007d9e4
mov r8, qword [rbx + 0xe0]
mov rdx, qword [rbx + 0xd8]
mov rbx, r8
sub rbx, rdx
cmp rbx, 0x80
ja 0x14007d9ef
sub r8, rdx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
add qword [rdi + 0x80], rbx
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
lea r9, str.build_include_internal_botan_internal_alignment_buffer.h
mov dword [rsp + 0x20], 0x5c
lea r8, str.append
lea rdx, [0x1400caf07]
lea rcx, str.elements.size_____elements_until_alignment__
call fcn.14000e220
int3
lea r9, str.build_include_public_botan_mem_ops.h
mov dword [rsp + 0x20], 0x93
lea r8, str.copy_mem
lea rdx, str.If_n___0_then_args_are_not_null
lea rcx, str.n___0_implies_in___nullptr__out___nullptr
call fcn.14000e220
int3