joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c1d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov qword [rcx + 8], rsi
call fcn.180025dc0
mov edx, 0xa0
mov rcx, rbx
mov dword [rsp + 0x38], eax
call fcn.18000d860
mov rdi, rax
test rax, rax
jne 0x18000c227
mov rcx, rbx
call fcn.180025dd0
mov r11, qword [rbx]
mov dword [r11 + 0x28], 0x36
mov rcx, qword [rbx]
mov dword [rcx + 0x2c], esi
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
mov dword [rdi + 0x5c], 0x3b9aca00
lea rax, [fcn.18000b140]
lea rcx, str.JPEGMEM
mov qword [rdi], rax
lea rax, [fcn.18000b2f0]
mov qword [rdi + 8], rax
lea rax, [fcn.18000b420]
mov qword [rdi + 0x10], rax
lea rax, [fcn.18000b540]
mov qword [rdi + 0x18], rax
lea rax, [0x18000b650]
mov qword [rdi + 0x20], rax
lea rax, [0x18000b700]
mov qword [rdi + 0x28], rax
lea rax, [0x18000b7b0]
mov qword [rdi + 0x30], rax
lea rax, [0x18000ba10]
mov qword [rdi + 0x38], rax
lea rax, [0x18000bc70]
mov qword [rdi + 0x40], rax
lea rax, [0x18000bee0]
mov qword [rdi + 0x48], rax
lea rax, [0x18000c030]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x58], eax
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x70], rsi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x90], 0xa0
mov qword [rbx + 8], rdi
call fcn.18002ce3c
test rax, rax
je 0x18000c333
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._ld_c
mov rcx, rax
mov byte [rsp + 0x30], 0x78
call fcn.18002cd60
test eax, eax
jle 0x18000c333
movzx eax, byte [rsp + 0x30]
cmp al, 0x6d
je 0x18000c320
cmp al, 0x4d
je 0x18000c320
mov eax, dword [rsp + 0x38]
jmp 0x18000c32a
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [rdi + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14000fca2
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov eax, dword [rcx + 8]
test eax, eax
jne 0x14000fcc0
mov rcx, rsi
call fcn.14000f775
mov eax, dword [rsi + 8]
cmp eax, 2
je 0x14000fce7
cmp eax, 1
jne 0x14000fd57
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140060104
mov r9, qword [rsi]
test r9, r9
jne 0x14000fd0b
lea rcx, str.ctx__lgfp
lea rdx, str..._logging.c
mov r8d, 0x2f
call fcn.140089884
mov r9, qword [rsi]
mov rcx, qword [rdi]
mov r8, qword [rdi + 8]
mov edx, 1
call fcn.14008c3ec
cmp rax, qword [rdi + 8]
jae 0x14000fd57
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000fd36
call fcn.14008ba8c
mov qword [rsi], 0
mov dword [rsi + 8], 3
mov rcx, qword [rsi + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax]
lea rdx, str.Disabled_writing_session_log_due_to_error_while_writing
add rsp, 0x28
pop rdi
pop rsi
jmp rax
nop
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140014cc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx]
cmp rax, qword [rdx]
je 0x140014cf4
lea rcx, str.x0__nw__x1__nw
lea rdx, str..._mpint.c
mov r8d, 0x75
call fcn.140089884
mov rax, qword [rdi]
and ebx, 1
neg rbx
mov qword [rsp + 0x28], rbx
test rax, rax
je 0x140014d36
xor eax, eax
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx + rax*8]
xor rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x28]
and rcx, rdx
mov rdx, qword [rdi + 8]
xor qword [rdx + rax*8], rcx
mov rdx, qword [rsi + 8]
xor qword [rdx + rax*8], rcx
inc rax
cmp rax, qword [rdi]
jb 0x140014d06
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140014ff4
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov rax, qword [rcx + 8]
mov rcx, rax
shr rcx, 0x3e
je 0x14001502a
lea rcx, str.hex.len_____size_t_0____4
lea rdx, str..._mpint.c
mov r8d, 0xd5
call fcn.140089884
mov rax, qword [r14 + 8]
lea rcx, [rax*4 + 0x3f]
shr rcx, 6
mov eax, 1
cmp rcx, rax
cmovbe rcx, rax
call fcn.140014b05
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400150ce
xor r8d, r8d
xor r10d, r10d
xor r11d, r11d
add rcx, qword [r14]
movsx ecx, byte [r10 + rcx - 1]
movsxd rcx, ecx
lea rbx, [rcx - 0x61]
mov edx, 0x66
sub rdx, rcx
or rdx, rbx
sar rdx, 0x3f
lea r9, [rcx - 0x41]
mov ebx, 0x46
sub rbx, rcx
or rbx, r9
sar rbx, 0x3f
lea esi, [rcx - 0x30]
lea edi, [rcx - 0x57]
xor esi, edi
and edx, esi
add ecx, 0xffffffc9
xor edi, ecx
xor edi, edx
and ebx, edi
xor ebx, ecx
and ebx, 0xf
mov rdx, r11
shr rdx, 4
mov ecx, r8d
and cl, 0x3c
shl rbx, cl
mov rcx, qword [rax + 8]
or qword [rcx + rdx*8], rbx
inc r11
mov rcx, qword [r14 + 8]
dec r10
add r8, 4
cmp r11, rcx
jb 0x140015059
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400153c3
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r9, rcx
test r8, r8
je 0x1400153fc
lea rax, [r8 - 1]
mov rcx, 0xffffffffffffffff
movzx esi, byte [r9 + rax]
xor rsi, 0x30
dec rsi
sar rsi, 0x3f
xor r8, rax
and r8, rsi
xor r8, rax
dec rax
cmp rax, rcx
jne 0x1400153d9
jmp 0x1400153ff
xor r8d, r8d
test rdx, rdx
je 0x140015456
xor ecx, ecx
mov r10, r8
shr r10, cl
mov edi, 1
shl rdi, cl
cmp rdi, rdx
jae 0x140015448
and r10b, 1
neg r10b
mov r11, rdx
sub r11, rdi
add rdi, r9
xor esi, esi
mov bl, byte [r9 + rsi]
mov al, byte [rdi + rsi]
xor al, bl
and al, r10b
xor bl, al
mov byte [r9 + rsi], bl
xor byte [rdi + rsi], al
inc rsi
cmp r11, rsi
jne 0x14001542b
inc rcx
mov rax, rdx
shr rax, cl
test rax, rax
jne 0x140015406
pop rbx
pop rdi
pop rsi
ret

Function at 0x140015a12
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx]
test r8, r8
je 0x140015a44
mov r9, qword [rcx + 8]
xor eax, eax
xor r10d, r10d
mov rcx, r10
shl rcx, 6
mov ecx, 0
cmove rcx, rdx
xor rcx, qword [r9 + r10*8]
or rax, rcx
inc r10
cmp r10, r8
jb 0x140015a23
jmp 0x140015a46
xor eax, eax
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
neg rax
shr rax, 0x3f
xor eax, 1
ret
Function at 0x14001da78
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x36
call fcn.14000358b
cmp byte [rax], 0
je 0x14001da9c
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.14005f897
mov edx, 0x37
mov rcx, rsi
call fcn.14000335e
test al, al
je 0x14001dab7
add rsp, 0x20
pop rsi
jmp fcn.140074209
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14001f882
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov ebp, dword [rsp + 0x70]
mov rcx, r8
mov edx, r9d
call fcn.140003415
cmp eax, 1
je 0x14001f8ee
cmp eax, 2
je 0x14001f8f7
cmp eax, 3
jne 0x14001f900
mov rcx, rbx
mov edx, ebp
call fcn.14000358b
lea rcx, str.custom:
xor r8d, r8d
mov rdx, rax
call fcn.14005f8e8
mov rbx, rax
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.14007994c
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140011913
lea r8, str.implicit
jmp 0x14001f907
lea r8, str.explicit
jmp 0x14001f907
lea r8, str.none
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14007994c
Function at 0x140021f5c
Capabilities:
Hide graphical window

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov rax, qword [0x1400cb0e0]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
cmp byte [0x1400cbc90], 0
je 0x14002216a
mov edi, r8d
mov ebx, edx
mov r14, rcx
cmp qword [0x1400cbc98], 0
jne 0x140022068
cmp word [0x1400cbca0], 0
jne 0x140021ff8
lea rcx, [rsp + 0x80]
mov dword [rcx], 3
lea rax, [0x14002218a]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], 0
mov rax, qword [0x1400ce020]
mov qword [rcx + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x20], xmm0
lea rax, str.SizeTipClass
mov qword [rcx + 0x40], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
mov word [0x1400cbca0], ax
mov rsi, qword [sym.imp.USER32.dll_GetSysColor]
mov ecx, 0x18
call rsi
mov dword [0x1400cbca4], eax
mov ecx, 0x17
call rsi
mov dword [0x1400cbca8], eax
lea rsi, [rsp + 0x84]
xor edx, edx
mov r8d, 0x150
mov rcx, rsi
call fcn.14007f3a0
mov dword [rsi - 4], 0x154
lea r8, [rsp + 0x80]
mov ecx, 0x29
mov edx, 0x154
xor r9d, r9d
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
lea rcx, [rsp + 0x15c]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov qword [0x1400cbcb0], rax
lea rdx, str._dx_d
lea rcx, [rsp + 0x80]
mov r8d, ebx
mov r9d, edi
call fcn.1400042b4
mov rcx, qword [0x1400cbc98]
test rcx, rcx
je 0x1400220a1
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x14002216a
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rsi, rax
lea r15, [rsp + 0x80]
mov rcx, r15
call fcn.14008d450
lea rbx, [rsp + 0x78]
mov rcx, rsi
mov rdx, r15
mov r8d, eax
mov r9, rbx
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
lea rsi, [rsp + 0x68]
mov rcx, r14
mov rdx, rsi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsi]
mov ecx, dword [rsi + 4]
mov edx, 0xf
cmp eax, edx
mov esi, 0x10
cmovle eax, esi
mov edi, dword [rbx]
mov ebx, dword [rbx + 4]
sub ecx, ebx
cmp ecx, edx
cmovle ecx, esi
mov rsi, qword [0x1400ce020]
movzx edx, word [0x1400cbca0]
mov qword [rsp + 0x50], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x58], 0
mov ecx, 0x88
mov r9d, 0x80000000
mov r8, r15
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400cbc98], rax
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.14007de70
nop
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14003aac2
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r9b, byte [rcx]
mov r14b, byte [rcx + 1]
test r8d, r8d
jle 0x14003ab1f
mov r10d, r8d
mov eax, r9d
inc al
movzx r11d, al
xor esi, esi
lea eax, [r11 + rsi]
movzx eax, al
movzx edi, byte [rcx + rax + 2]
add r14b, dil
movzx ebp, r14b
mov bl, byte [rcx + rbp + 2]
mov byte [rcx + rax + 2], bl
mov byte [rcx + rbp + 2], dil
movzx eax, byte [rcx + rax + 2]
add edi, eax
movzx eax, dil
mov al, byte [rcx + rax + 2]
xor byte [rdx + rsi], al
inc rsi
cmp r10, rsi
jne 0x14003aae2
add r9b, r8b
mov byte [rcx], r9b
mov byte [rcx + 1], r14b
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14003c5d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x80
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
mov rax, qword [0x1400cb0e0]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmm2, xmmword [rcx + 0x20]
movups xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movdqa xmm3, xmmword [rsp + 0x30]
pshufd xmm1, xmmword [rsp + 0x50], 0x93
movdqa xmm0, xmmword [rsp + 0x20]
xor eax, eax
pshufd xmm2, xmmword [rsp + 0x40], 0x4e
paddd xmm0, xmm3
pshufd xmm4, xmm0, 0x93
pxor xmm4, xmm1
movdqa xmm1, xmm4
psrld xmm1, 0x10
pslld xmm4, 0x10
por xmm4, xmm1
pshufd xmm5, xmm4, 0x93
paddd xmm5, xmm2
pshufd xmm6, xmm5, 0x4e
pxor xmm6, xmm3
movdqa xmm1, xmm6
psrld xmm1, 0x14
pslld xmm6, 0xc
por xmm6, xmm1
paddd xmm0, xmm6
pshufd xmm1, xmm0, 0x93
pxor xmm1, xmm4
movdqa xmm2, xmm1
psrld xmm2, 0x18
pslld xmm1, 8
por xmm1, xmm2
pshufd xmm2, xmm1, 0x93
paddd xmm2, xmm5
pshufd xmm4, xmm2, 0x93
pshufd xmm3, xmm6, 0x39
pxor xmm3, xmm4
movdqa xmm4, xmm3
psrld xmm4, 0x19
pslld xmm3, 7
por xmm3, xmm4
paddd xmm0, xmm3
pxor xmm1, xmm0
movdqa xmm4, xmm1
psrld xmm4, 0x10
pslld xmm1, 0x10
por xmm1, xmm4
paddd xmm2, xmm1
pxor xmm3, xmm2
movdqa xmm4, xmm3
psrld xmm4, 0x14
pslld xmm3, 0xc
por xmm3, xmm4
paddd xmm0, xmm3
pxor xmm1, xmm0
movdqa xmm4, xmm1
psrld xmm4, 0x18
pslld xmm1, 8
por xmm1, xmm4
paddd xmm2, xmm1
pxor xmm3, xmm2
pshufd xmm3, xmm3, 0x93
movdqa xmm4, xmm3
psrld xmm4, 0x19
pslld xmm3, 7
por xmm3, xmm4
add eax, 2
cmp eax, 0x14
jb 0x14003c62f
movdqa xmmword [rsp + 0x30], xmm3
movdqa xmmword [rsp + 0x20], xmm0
pshufd xmm1, xmm1, 0x39
movdqa xmmword [rsp + 0x50], xmm1
pshufd xmm1, xmm2, 0x4e
movdqa xmmword [rsp + 0x40], xmm1
movd eax, xmm0
add eax, dword [rsi]
mov dword [rsp + 0x20], eax
mov eax, 1
mov ecx, dword [rsi + rax*4]
add dword [rsp + rax*4 + 0x20], ecx
inc rax
cmp rax, 0x10
jne 0x14003c764
xor eax, eax
movdqa xmm0, xmmword [0x1400a38d0]
movdqa xmm1, xmmword [0x1400a38e0]
movdqa xmm2, xmmword [0x1400a38f0]
movq xmm3, qword [rsp + rax*4 + 0x20]
pshufd xmm3, xmm3, 0xd4
pshufd xmm4, xmm3, 0xe8
pand xmm3, xmm0
movdqa xmm5, xmm3
psrlq xmm5, 8
movdqa xmm6, xmm3
psrlq xmm6, 0x10
psrlq xmm3, 0x18
pshuflw xmm4, xmm4, 0xe8
pshufd xmm5, xmm5, 0xe8
pshuflw xmm5, xmm5, 0xe8
punpckldq xmm4, xmm5
pshufd xmm3, xmm3, 0xe8
pshuflw xmm3, xmm3, 0xe8
pshufd xmm5, xmm6, 0xe8
pshuflw xmm5, xmm5, 0xe8
punpckldq xmm5, xmm3
pand xmm5, xmm1
pshuflw xmm3, xmm5, 0xd8
pshufd xmm3, xmm3, 0x60
packuswb xmm3, xmm0
movdqa xmm5, xmm2
pandn xmm5, xmm3
pand xmm4, xmm1
pshuflw xmm3, xmm4, 0xd8
pshufd xmm3, xmm3, 0xd4
packuswb xmm3, xmm0
pand xmm3, xmm2
por xmm3, xmm5
movq qword [rsi + rax*4 + 0x40], xmm3
add rax, 2
cmp rax, 0x10
jne 0x14003c78e
mov dword [rsi + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x40
call fcn.140074a74
inc dword [rsi + 0x30]
jne 0x14003c84d
inc dword [rsi + 0x34]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14007de70
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rsi
ret
Function at 0x14003c868
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movaps xmm0, xmmword [str.expand_32_byte_k]
movups xmmword [rcx], xmm0
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
mov dword [rcx + 0x80], 0x40
ret
Function at 0x14003ddbc
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rdx + 8]
test r9, r9
je 0x14003de1d
mov r8, qword [rdx]
xor r10d, r10d
movzx eax, byte [r8 + r10]
xor eax, ecx
mov ecx, eax
and ecx, 0xf
shr eax, 4
imul edx, ecx, 0x11111044
xor edx, eax
imul r11d, ecx, 0x8840020
imul eax, ecx, 0x4220000
xor eax, r11d
xor eax, edx
and edx, 0xf
shr eax, 4
imul ecx, edx, 0x11111044
imul r11d, edx, 0x8840020
xor r11d, ecx
imul ecx, edx, 0x4220000
xor ecx, eax
xor ecx, r11d
inc r10
cmp r9, r10
jne 0x14003ddcb
mov eax, ecx
ret

Function at 0x14003f4b1
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r9, rcx
shr r9, 0x20
mov r11d, dword [rdx + r8*4]
xor r11d, r9d
mov r10, rcx
shr r10, 0x3c
mov eax, r9d
shl eax, 4
or eax, r10d
xor eax, dword [rdx + r8*4 + 0x40]
movd xmm0, r11d
shr r11d, 8
movd xmm1, r11d
punpckldq xmm1, xmm0
movd xmm0, eax
shr eax, 8
movd xmm2, eax
punpckldq xmm2, xmm0
punpcklqdq xmm1, xmm2
pand xmm1, xmmword [0x1400a4580]
por xmm1, xmmword [0x1400a4590]
pxor xmm0, xmm0
lea rax, [0x1400a4380]
movdqa xmm2, xmmword [str._b_b_b_b_b_b_b_b]
lea rdx, [0x1400a4580]
movdqa xmm3, xmm1
movdqu xmm4, xmmword [rax]
pshufd xmm4, xmm4, 0x1b
pand xmm4, xmm3
pxor xmm0, xmm4
paddd xmm3, xmm2
add rax, 0x10
cmp rax, rdx
jb 0x14003f52a
pshufd xmm2, xmm1, 0xe7
movd eax, xmm2
add eax, 0x1000100
pshufd xmm2, xmm1, 0x4e
movd edx, xmm2
add edx, 0x1000100
pshufd xmm2, xmm1, 0xe5
movd r11d, xmm2
add r11d, 0x1000100
movd r10d, xmm1
add r10d, 0x1000100
pshufd xmm1, xmm0, 0xe7
movd r8d, xmm1
mov esi, r8d
shl esi, 4
and eax, 0x40004
imul eax, eax, 0x3c00
and eax, esi
xor eax, r8d
pshufd xmm1, xmm0, 0x4e
movd esi, xmm1
mov edi, esi
shl edi, 4
and edx, 0x40004
imul r8d, edx, 0x3c00
and r8d, edi
xor r8d, esi
pshufd xmm1, xmm0, 0xe5
movd esi, xmm1
mov edi, esi
shl edi, 4
and r11d, 0x40004
imul ebx, r11d, 0x3c00
and ebx, edi
xor ebx, esi
movd r11d, xmm0
mov edi, r11d
shl edi, 4
and r10d, 0x40004
imul esi, r10d, 0x3c00
and esi, edi
xor esi, r11d
and esi, 0xf000f000
shr eax, 0xc
and eax, 0xf000f
shr r8d, 4
and r8d, 0xf000f00
shr ebx, 8
and ebx, 0xf000f0
or ebx, r8d
or ebx, esi
or eax, ebx
shr ebx, 4
xor ebx, eax
and ebx, 0x7030702
xor eax, ebx
shl ebx, 4
xor ebx, eax
mov edx, ebx
shr edx, 8
xor edx, eax
and edx, 0x4e009e
xor ebx, edx
shl edx, 8
xor edx, ebx
mov eax, edx
shr eax, 0x10
xor eax, edx
and eax, 0xd9d3
xor edx, eax
shl eax, 0x10
xor eax, edx
mov edx, eax
shr edx, 4
xor edx, eax
and edx, 0x5040004
mov ebx, edx
xor ebx, eax
shl edx, 4
shr eax, 1
xor eax, ebx
and eax, 0x4045015
xor edx, ecx
xor edx, ebx
xor edx, eax
add eax, eax
xor eax, edx
shl rax, 0x20
or rax, r9
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400461ef
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x438
mov rdi, rcx
mov rax, qword [0x1400cb0e0]
xor rax, rsp
mov qword [rsp + 0x430], rax
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8d, 0x3ff
mov r9, rdi
call fcn.14008c144
mov rsi, rax
mov rcx, rdi
call fcn.14008cf24
test esi, esi
js 0x140046440
mov edi, 1
cmp esi, 0x20
jl 0x14004646c
movsxd rsi, esi
cmp rsi, 0x400
jb 0x14004626b
lea rcx, str.i___0__i___sizeof_buf_
lea rdx, str..._sshpubk.c
mov r8d, 0x615
call fcn.140089884
mov byte [rsp + rsi + 0x30], 0
movdqa xmm0, xmmword [rsp + 0x30]
movdqa xmm1, xmmword [rsp + 0x40]
pcmpeqb xmm1, xmmword [str.FILE_FORMAT_1.1_nSSH_PRIVATE_KEY_PuTTY_User_Key_FENCRYPTED_PRIVAT_____BEGIN_SSH2]
pcmpeqb xmm0, xmmword [0x1400a5090]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x140046444
lea rdx, str._____BEGIN_SSH2_PUBLIC_KEY
lea rcx, [rsp + 0x30]
mov r8d, 0x1a
call fcn.14007ee70
test eax, eax
je 0x14004644b
movdqa xmm0, xmmword [rsp + 0x30]
movd xmm1, dword [rsp + 0x40]
mov eax, 0x2d656c69
movq xmm2, rax
pcmpeqb xmm0, xmmword [0x1400a50a0]
pcmpeqb xmm2, xmm1
pand xmm0, xmm2
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x140046452
lea rdx, str._____BEGIN_OPENSSH_PRIVATE_KEY
lea rcx, [rsp + 0x30]
mov r8d, 0x1e
call fcn.14007ee70
test eax, eax
je 0x140046459
lea rdx, str._____BEGIN
lea rcx, [rsp + 0x30]
mov r8d, 0xb
call fcn.14007ee70
test eax, eax
je 0x140046460
movdqa xmm0, xmmword [rsp + 0x30]
movdqa xmm1, xmmword [rsp + 0x40]
pcmpeqb xmm1, xmmword [0x1400a50b0]
pcmpeqb xmm0, xmmword [0x1400a50c0]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x140046467
lea rdx, str.0123456789
lea rsi, [rsp + 0x30]
mov rcx, rsi
call fcn.14008d7d8
cmp byte [rsp + rax + 0x30], 0x20
jne 0x1400463d5
lea rdi, [rsp + rax]
add rdi, 0x30
lea rcx, [rdi + 1]
lea rdx, str.0123456789
call fcn.14008d7d8
cmp byte [rdi + rax + 1], 0x20
jne 0x1400463d5
add rdi, rax
add rdi, 1
lea rcx, [rdi + 1]
lea rdx, str.0123456789
call fcn.14008d7d8
movzx eax, byte [rdi + rax + 1]
cmp rax, 0x20
ja 0x1400463d5
mov edi, 8
movabs rcx, 0x100000401
bt rcx, rax
jb 0x14004646c
lea rdx, [0x1400bd99d]
mov rcx, rsi
call fcn.14008d1d8
mov rdi, rax
lea rcx, [rsp + 0x20]
mov qword [rcx], rsi
mov qword [rcx + 8], rax
call fcn.140044dc4
test rax, rax
je 0x140046439
lea rsi, [rsp + rdi]
add rsi, 0x30
lea rcx, [rsp + rdi]
add rcx, 0x31
lea rdx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_
call fcn.14008d7d8
movzx eax, byte [rax + rsi + 1]
cmp rax, 0x20
ja 0x140046439
mov edi, 0xa
movabs rcx, 0x100000401
bt rcx, rax
jb 0x14004646c
mov edi, 1
jmp 0x14004646c
xor edi, edi
jmp 0x14004646c
mov edi, 2
jmp 0x14004646c
mov edi, 9
jmp 0x14004646c
mov edi, 3
jmp 0x14004646c
mov edi, 6
jmp 0x14004646c
mov edi, 5
jmp 0x14004646c
mov edi, 7
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.14007de70
mov eax, edi
add rsp, 0x438
pop rdi
pop rsi
ret

Function at 0x140047af7
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.1400151dc
Function at 0x140047cc6
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r12d, dword [rsp + 0xd0]
mov rax, qword [0x1400cb0e0]
xor rax, rsp
mov qword [rsp + 0x60], rax
test r12d, r12d
jle 0x140047d81
mov rsi, r9
mov r14, rdx
mov rbx, rcx
movsxd r15, r8d
xor edi, edi
mov eax, dword [rbx + 0x20]
cmp r12d, eax
mov ebp, r12d
cmovg ebp, eax
cmp eax, 0x41
jl 0x140047d2e
mov r8d, 0x336
lea rcx, str.h__hlen___MAX_HASH_LEN
lea rdx, str..._sshrsa.c
call fcn.140089884
mov rcx, rbx
call qword [rbx]
mov r13, rax
mov rcx, qword [rax + 8]
mov rdx, r14
mov r8, r15
call fcn.1400112c8
mov rcx, qword [r13 + 8]
mov edx, edi
call fcn.1400113d5
mov rax, qword [r13]
mov rcx, r13
lea rdx, [rsp + 0x20]
call qword [rax + 0x10]
movsxd rax, ebp
test ebp, ebp
jle 0x140047d77
xor ecx, ecx
mov dl, byte [rsp + rcx + 0x20]
xor byte [rsi + rcx], dl
inc rcx
cmp rcx, rax
jl 0x140047d68
inc edi
add rsi, rax
sub r12d, eax
jg 0x140047d04
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14007de70
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14004a042
Capabilities:
Hash data using sha1 via x86 extensions

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm9, xmmword [rcx]
movdqa xmm8, xmmword [rcx + 0x10]
movdqa xmm6, xmmword [0x1400a2440]
movdqu xmm5, xmmword [rdx]
movdqu xmm4, xmmword [rdx + 0x10]
movdqu xmm3, xmmword [rdx + 0x20]
movdqu xmm2, xmmword [rdx + 0x30]
pshufb xmm5, xmm6
movdqa xmm7, xmm8
paddd xmm7, xmm5
movdqa xmm1, xmm9
sha1rnds4 xmm1, xmm7, 0
pshufb xmm4, xmm6
movdqa xmm7, xmm9
sha1nexte xmm7, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm5, xmm4
pshufb xmm3, xmm6
sha1nexte xmm1, xmm3
movaps xmm7, xmm0
sha1rnds4 xmm7, xmm1, 0
sha1msg1 xmm4, xmm3
pshufb xmm2, xmm6
sha1nexte xmm0, xmm2
pxor xmm5, xmm3
sha1msg2 xmm5, xmm2
movaps xmm1, xmm7
sha1rnds4 xmm1, xmm0, 0
sha1msg1 xmm3, xmm2
sha1nexte xmm7, xmm5
pxor xmm4, xmm2
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm7, 0
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm6, xmm2
sha1msg2 xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 1
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm1, xmm5
sha1msg2 xmm4, xmm5
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 1
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm0, xmm4
sha1msg2 xmm3, xmm4
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 1
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm6, xmm3
sha1msg2 xmm2, xmm3
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm1, xmm2
sha1msg2 xmm5, xmm2
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm0, xmm5
sha1msg2 xmm4, xmm5
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 2
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm6, xmm4
sha1msg2 xmm3, xmm4
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 2
sha1msg1 xmm5, xmm4
xorps xmm2, xmm4
sha1nexte xmm1, xmm3
sha1msg2 xmm2, xmm3
movaps xmm6, xmm0
sha1rnds4 xmm6, xmm1, 2
sha1msg1 xmm4, xmm3
xorps xmm5, xmm3
sha1nexte xmm0, xmm2
sha1msg2 xmm5, xmm2
movaps xmm1, xmm6
sha1rnds4 xmm1, xmm0, 3
sha1msg1 xmm3, xmm2
xorps xmm4, xmm2
sha1nexte xmm6, xmm5
sha1msg2 xmm4, xmm5
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm6, 3
sha1msg1 xmm2, xmm5
xorps xmm3, xmm5
sha1nexte xmm1, xmm4
sha1msg2 xmm3, xmm4
movaps xmm5, xmm0
sha1rnds4 xmm5, xmm1, 3
xorps xmm2, xmm4
sha1nexte xmm0, xmm3
sha1msg2 xmm2, xmm3
movaps xmm1, xmm5
sha1rnds4 xmm1, xmm0, 3
sha1nexte xmm5, xmm2
movaps xmm0, xmm1
sha1rnds4 xmm0, xmm5, 3
paddd xmm0, xmm9
movdqa xmmword [rcx], xmm0
sha1nexte xmm1, xmm8
movaps xmmword [rcx + 0x10], xmm1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret