joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088100
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140088248
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400882b8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400882b8
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400882b8
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400882b8
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400882b8
cmp dword [rcx + 0x84], 0xe
jbe 0x1400882b8
cmp dword [rcx + 0xf8], esi
je 0x1400882b8
mov ecx, r14d
call fcn.140088184
mov ecx, 2
call fcn.14008fc3c
nop
cmp byte [0x1400d04ec], 0
jne 0x140088382
mov r15d, 1
mov eax, r15d
xchg dword [0x1400d04e8], eax
test ebx, ebx
jne 0x14008832b
mov rdi, qword [0x1400cb0e0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400d04e0]
cmp rcx, rax
je 0x140088322
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [section..00cfg]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400d0608]
jmp 0x140088337
cmp ebx, r15d
jne 0x14008833d
lea rcx, [0x1400d0620]
call fcn.140088894
nop
test ebx, ebx
jne 0x140088354
lea rdx, [0x1400c51d0]
lea rcx, [0x1400c51b0]
call fcn.140089080
lea rdx, [0x1400c51e0]
lea rcx, [0x1400c51d8]
call fcn.140089080
movzx eax, byte [0x1400d04ec]
test esi, esi
cmove eax, r15d
mov byte [0x1400d04ec], al
jmp 0x140088382
mov ecx, 2
call fcn.14008fc58
test esi, esi
jne 0x140088399
mov ecx, r14d
call fcn.1400881f0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x14008d450
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x14008d46d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14008d4c8
test al, 7
jne 0x14008d460
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14008d481
mov rdx, qword [rax - 8]
test dl, dl
je 0x14008d4f2
test dh, dh
je 0x14008d4ec
shr rdx, 0x10
test dl, dl
je 0x14008d4e6
test dh, dh
je 0x14008d4e0
shr rdx, 0x10
test dl, dl
je 0x14008d4da
test dh, dh
je 0x14008d4d4
shr edx, 0x10
test dl, dl
je 0x14008d4ce
test dh, dh
jne 0x14008d481
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret
Function at 0x140093b94
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.14008f994
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x140093be7
test rbx, rbx
je 0x140093bd8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x140093be7
mov edi, 4
jmp 0x140093c90
call fcn.14008f7d4
test al, al
jne 0x140093c04
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x140093c90
test bpl, bpl
je 0x140093c67
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x140093cb0]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140093c90
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x140093c61
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140093c90
mov edi, dword [rsp + 0x44]
jmp 0x140093c59
call fcn.14008f8c0
test al, al
jne 0x140093c78
bts esi, 0x15
xor ecx, ecx
jmp 0x140093c80
call fcn.14008f830
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.14008f74c
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x14009542c
Capabilities:
Read file on windows

Disassembly:
jmp 0x140095434
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14009547c
call fcn.140090c48
mov dword [rax], 0x16
call fcn.140090518
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140095464
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140095464
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400954ae
lock or dword [rax + 0x14], 0x10
jmp 0x140095464
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400954cb
mov rcx, qword [rbp + 0x10]
call fcn.140098d8c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400921b4
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140095cf8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140095522
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140095464
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14009558e
mov rcx, qword [rbp + 0x10]
call fcn.1400921b4
cmp eax, 0xffffffff
je 0x140095575
mov rcx, qword [rbp + 0x10]
call fcn.1400921b4
cmp eax, 0xfffffffe
je 0x140095575
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400921b4
movsxd rdi, eax
lea rsi, [0x1400d0c00]
mov rcx, rbx
sar rdi, 6
call fcn.1400921b4
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14009557c
lea rax, [0x1400cb680]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14009558e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400955c4
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400955c0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400955c0
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140095467
Function at 0x141343058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1413431df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141343089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14134306f
add dl, dl
jne 0x141343096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413430f6
xor eax, eax
add dl, dl
jne 0x1413430a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413431ad
add dl, dl
jne 0x1413430b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413430c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413430d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413430dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1413430ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14134307e
mov eax, 1
add dl, dl
jne 0x141343106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141343113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413430fb
sub eax, ebx
mov ebx, 1
jne 0x14134314c
mov ecx, 1
add dl, dl
jne 0x14134312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14134313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141343123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14134307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141343168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141343175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14134315d
cmp eax, 0x7d00
jae 0x14134319b
cmp eax, 0x500
jb 0x141343196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14134307e
cmp eax, 0x7f
ja 0x14134319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14134307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1413431d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14134307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001a60
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 2
jmp sym.nimiq_node_avx2.node_argon2_verify_ctx

Function at 0x180001de0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x18003a008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180001ed5
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x180001eb1
xor eax, eax
mov byte [rsp + 0x20], dil
xor edx, edx
mov qword [rsp + 0x32], rax
mov r8d, 0xf0
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov word [rsp + 0x21], 0x100
mov byte [rsp + 0x23], 1
mov dword [rsp + 0x24], 0
mov word [rsp + 0x30], 0
call fcn.1800151d0
vmovups ymm0, ymmword [0x18002d4a0]
mov rax, qword [rsp + 0x20]
vmovups ymmword [rbx], ymm0
vmovups ymm1, ymmword [0x18002d4c0]
vmovups ymmword [rbx + 0x20], ymm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x180001eda
xor eax, eax
mov rdi, rbx
mov ecx, 0xf0
rep stosb byte [rdi], al
cmp byte [rbx + 0xe8], al
je 0x180001ecd
mov qword [rbx + 0x58], 0xffffffffffffffff
mov qword [rbx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
vzeroupper
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180013d10
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x180002f39
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x180003157
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x830
mov rax, qword [0x18003a008]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x180003137
mov r11, qword [rdx]
mov r10d, dword [rdx + 0x18]
mov edx, 8
mov eax, r10d
shl rax, 0xa
lea rcx, [r11 - 0x400]
add rcx, rax
lea rax, [rsp + 0x20]
nop dword [rax]
lea rax, [rax + 0x80]
vmovups ymm0, ymmword [rcx]
vmovups xmm1, xmmword [rcx + 0x70]
lea rcx, [rcx + 0x80]
vmovups ymmword [rax - 0x80], ymm0
vmovups ymm0, ymmword [rcx - 0x60]
vmovups ymmword [rax - 0x60], ymm0
vmovups ymm0, ymmword [rcx - 0x40]
vmovups ymmword [rax - 0x40], ymm0
vmovups xmm0, xmmword [rcx - 0x20]
vmovups xmmword [rax - 0x20], xmm0
vmovups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x180002f90
mov r9d, dword [rbx + 0x1c]
mov r8d, 1
mov qword [rsp + 0x850], rdi
cmp r9d, r8d
jbe 0x1800030a7
inc r8d
lea rdi, [rsp + 0x20]
mov edx, r8d
xor eax, eax
imul edx, r10d
dec edx
shl rdx, 0xa
add rdx, r11
lea rcx, [rdx + 0x3f8]
cmp rdi, rcx
ja 0x180003039
lea rcx, [rsp + 0x418]
cmp rcx, rdx
jb 0x180003039
mov rcx, qword [rdx + rax*8]
xor qword [rsp + rax*8 + 0x20], rcx
inc rax
cmp rax, 0x80
jl 0x180003023
jmp 0x18000309e
lea rcx, [rsp + 0x20]
sub rcx, rdx
lea rdi, [rsp + 0x40]
sub rdi, rdx
lea rax, [rdx + 0x40]
mov edx, 8
vmovdqu ymm1, ymmword [rcx + rax - 0x40]
vpxor ymm1, ymm1, ymmword [rax - 0x40]
vmovdqu ymmword [rcx + rax - 0x40], ymm1
vmovdqu ymm1, ymmword [rdi + rax - 0x40]
vpxor ymm1, ymm1, ymmword [rax - 0x20]
vmovdqu ymmword [rdi + rax - 0x40], ymm1
vmovdqu ymm1, ymmword [rax]
vpxor ymm1, ymm1, ymmword [rcx + rax]
vmovdqu ymmword [rcx + rax], ymm1
vmovdqu ymm1, ymmword [rax + rdi]
vpxor ymm1, ymm1, ymmword [rax + 0x20]
vmovdqu ymmword [rax + rdi], ymm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x180003052
cmp r8d, r9d
jb 0x180002ff0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x420]
vzeroupper
call fcn.180002bc0
mov edx, dword [rsi + 8]
lea r8, [rsp + 0x420]
mov rcx, qword [rsi]
mov r9d, 0x400
call fcn.180002780
mov r9d, dword [rsi + 0x70]
and r9d, 4
jne 0x1800030fc
xor eax, eax
lea rdi, [rsp + 0x20]
mov ecx, 0x400
rep stosb byte [rdi], al
lea rdi, [rsp + 0x420]
mov ecx, 0x400
rep stosb byte [rdi], al
mov edx, dword [rbx + 0x10]
mov r8, qword [rbx]
shl rdx, 0xa
test r9d, r9d
jne 0x18000311a
test r8, r8
je 0x18000311a
mov rdi, r8
xor eax, eax
mov rcx, rdx
rep stosb byte [rdi], al
mov rax, qword [rsi + 0x68]
mov rcx, r8
mov rdi, qword [rsp + 0x850]
test rax, rax
je 0x180003132
call rax
jmp 0x180003137
call fcn.180015f78
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.180013d10
mov rbx, qword [rsp + 0x858]
add rsp, 0x830
pop rsi
ret
Function at 0x180003f40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r14, rcx
mov rsi, r8
mov r8, rdx
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rcx, r9
mov rdi, r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rcx, rax
lea rbp, [rdx*4]
sub rcx, 1
je 0x180003f8e
cmp rcx, 1
jne 0x180003f92
inc rbp
add rbp, 2
cmp r8, rbp
ja 0x180003fb0
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
xor eax, eax
mov qword [rsp + 0x10], rbx
mov ebx, eax
test r9, r9
je 0x180004109
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
shl eax, 8
dec rdi
add eax, ecx
add ebx, 8
cmp ebx, 6
jb 0x180004078
nop dword [rax + rax]
add ebx, 0xfffffffa
shrx r11d, eax, ebx
and r11d, 0x3f
mov r9d, r11d
mov ecx, r11d
xor r9d, 0x3e
xor ecx, 0x3f
neg r9d
neg ecx
shr r9d, 8
lea edx, [r11 - 0x3e]
shr ecx, 8
lea r8d, [r11 - 0x34]
not r9b
shr edx, 8
and r9b, 0xfb
shr r8d, 8
not cl
lea r10d, [r11 - 0x1a]
or r9b, cl
shr r10d, 8
lea ecx, [r11 - 4]
and r9b, 0x2f
and dl, cl
movzx ecx, r8b
not cl
and dl, cl
movzx ecx, r10b
or r9b, dl
not cl
lea edx, [r11 + 0x47]
add r11b, 0x41
and dl, cl
and r11b, r10b
and dl, r8b
or r9b, dl
or r9b, r11b
mov byte [r14], r9b
inc r14
cmp ebx, 6
jae 0x180003ff0
test rdi, rdi
jne 0x180003fd0
test ebx, ebx
je 0x180004109
mov ecx, 6
sub ecx, ebx
shlx r10d, eax, ecx
and r10d, 0x3f
mov r8d, r10d
mov eax, r10d
xor r8d, 0x3e
xor eax, 0x3f
neg r8d
neg eax
shr r8d, 8
lea ecx, [r10 - 0x3e]
shr eax, 8
lea edx, [r10 - 0x34]
not r8b
shr ecx, 8
and r8b, 0xfb
shr edx, 8
not al
lea r9d, [r10 - 0x1a]
or r8b, al
shr r9d, 8
lea eax, [r10 - 4]
and r8b, 0x2f
and cl, al
movzx eax, dl
not al
and cl, al
movzx eax, r9b
or r8b, cl
not al
lea ecx, [r10 + 0x47]
add r10b, 0x41
and cl, al
and r10b, r9b
and cl, dl
or r8b, cl
or r8b, r10b
mov byte [r14], r8b
inc r14
mov rbx, qword [rsp + 0x10]
mov rax, rbp
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov byte [r14], 0
pop r14
ret
Function at 0x180006060
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xa8]
sub rsp, 0x1a8
mov rax, qword [0x18003a008]
xor rax, rsp
mov qword [rbp + 0x90], rax
vmovaps ymm0, ymmword [0x180035ba0]
xor eax, eax
mov r14, rcx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov r15, r9
mov qword [rsp + 0x30], rax
mov rsi, r8
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov qword [rsp + 0x40], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x48], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbp - 0x80], rax
lea edi, [rcx + 0x40]
mov qword [rbp - 0x78], rcx
vmovups ymmword [rsp + 0x50], ymm0
vmovdqu xmm0, xmmword [0x180035b40]
vmovdqu xmmword [rsp + 0x70], xmm0
test rdx, rdx
je 0x1800061c0
nop dword [rax + rax]
test rcx, rcx
jne 0x18000613d
cmp rdi, 0x80
jb 0x18000613d
mov rdx, rbx
lea rcx, [rsp + 0x40]
vzeroupper
call fcn.18000e760
test eax, eax
jne 0x1800061bc
add qword [rsp + 0x40], 0x400
sub rbx, 0xffffffffffffff80
mov rcx, qword [rbp - 0x78]
add rdi, 0xffffffffffffff80
jmp 0x1800061b1
mov eax, 0x80
mov r8, rdi
sub rax, rcx
cmp rdi, rax
cmovae r8, rax
xor edx, edx
test r8, r8
je 0x180006177
nop word [rax + rax]
movzx eax, byte [rdx + rbx]
add rcx, rdx
inc rdx
mov byte [rbp + rcx - 0x70], al
mov rcx, qword [rbp - 0x78]
cmp rdx, r8
jb 0x180006160
add rcx, r8
add rbx, r8
sub rdi, r8
mov qword [rbp - 0x78], rcx
cmp rcx, 0x80
jne 0x1800061b1
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
vzeroupper
call fcn.18000e760
test eax, eax
jne 0x1800061bc
add qword [rsp + 0x40], 0x400
xor ecx, ecx
mov qword [rbp - 0x78], rcx
test rdi, rdi
jne 0x180006100
jmp 0x1800061c0
mov rcx, qword [rbp - 0x78]
mov ebx, 0x20
test rsi, rsi
je 0x18000629b
cmp rcx, 0x80
ja 0x18000629b
nop dword [rax + rax]
test rcx, rcx
jne 0x18000621d
cmp rbx, 0x80
jb 0x18000621d
mov rdx, rsi
lea rcx, [rsp + 0x40]
vzeroupper
call fcn.18000e760
test eax, eax
jne 0x18000629b
add qword [rsp + 0x40], 0x400
sub rsi, 0xffffffffffffff80
mov rcx, qword [rbp - 0x78]
add rbx, 0xffffffffffffff80
jmp 0x180006292
mov eax, 0x80
mov r8, rbx
sub rax, rcx
cmp rbx, rax
cmovae r8, rax
xor eax, eax
test r8, r8
je 0x180006258
nop word [rax + rax]
lea rdx, [rcx + rax]
movzx ecx, byte [rax + rsi]
inc rax
mov byte [rbp + rdx - 0x70], cl
mov rcx, qword [rbp - 0x78]
cmp rax, r8
jb 0x180006240
add rcx, r8
add rsi, r8
sub rbx, r8
mov qword [rbp - 0x78], rcx
cmp rcx, 0x80
jne 0x180006292
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
vzeroupper
call fcn.18000e760
test eax, eax
jne 0x18000629b
add qword [rsp + 0x40], 0x400
xor ecx, ecx
mov qword [rbp - 0x78], rcx
test rbx, rbx
jne 0x1800061e0
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x40]
vzeroupper
call fcn.18000f150
lea rcx, [rbp + 0x50]
call fcn.18000bcd0
lea r8, [rbp + 0x10]
mov edx, 0x20
mov rcx, r15
call fcn.18000f430
movzx eax, byte [rbp + 0x2f]
lea r9, [rsp + 0x20]
and byte [rbp + 0x10], 0xf8
lea r8, [rbp + 0x10]
and al, 0x3f
lea rdx, [rbp + 0x50]
or al, 0x40
mov rcx, r14
mov byte [rbp + 0x2f], al
call fcn.18000cae0
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.180013d10
add rsp, 0x1a8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18000f790
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x18003a008]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
lea r8, [rbp + 0x90]
mov rcx, qword [rbp + 0x180]
mov edi, 0x20
mov edx, edi
mov r12, r9
call fcn.18000f430
movzx eax, byte [rbp + 0xaf]
lea rbx, [rbp + 0xb0]
vmovaps ymm0, ymmword [0x180035ba0]
and byte [rbp + 0x90], 0xf8
and al, 0x3f
or al, 0x40
mov byte [rbp + 0xaf], al
xor ecx, ecx
movabs rax, 0x6a09e667f3bcc908
mov qword [rbp + 8], rcx
mov qword [rbp - 0x38], rax
movabs rax, 0x5be0cd19137e2179
vmovups ymmword [rbp - 0x30], ymm0
vmovdqu xmm0, xmmword [0x180035b40]
mov qword [rbp], rax
mov qword [rbp - 0x40], rcx
vmovdqu xmmword [rbp - 0x10], xmm0
test rcx, rcx
jne 0x18000f87b
cmp rdi, 0x80
jb 0x18000f87b
mov rdx, rbx
lea rcx, [rbp - 0x40]
vzeroupper
call fcn.18000e760
test eax, eax
jne 0x18000f8f9
add qword [rbp - 0x40], 0x400
sub rbx, 0xffffffffffffff80
mov rcx, qword [rbp + 8]
add rdi, 0xffffffffffffff80
jmp 0x18000f8f0
mov eax, 0x80
mov r8, rdi
sub rax, rcx
cmp rdi, rax
cmovae r8, rax
xor eax, eax
test r8, r8
je 0x18000f8b8
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rcx + rax]
movzx ecx, byte [rax + rbx]
inc rax
mov byte [rbp + rdx + 0x10], cl
mov rcx, qword [rbp + 8]
cmp rax, r8
jb 0x18000f8a0
add rcx, r8
add rbx, r8
sub rdi, r8
mov qword [rbp + 8], rcx
cmp rcx, 0x80
jne 0x18000f8f0
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x40]
vzeroupper
call fcn.18000e760
test eax, eax
jne 0x18000f8f9
add qword [rbp - 0x40], 0x400
xor ecx, ecx
mov qword [rbp + 8], rcx
test rdi, rdi
jne 0x18000f840
mov r8, r15
lea rcx, [rbp - 0x40]
mov rdx, r14
vzeroupper
call fcn.18000f020
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x40]
call fcn.18000f150
lea rcx, [rbp + 0xd0]
call fcn.18000bcd0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp - 0x40]
call fcn.18000af30
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1800070e0
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x70]
call fcn.180007360
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x68]
call fcn.180007360
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.180008a00
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.180008a00
movzx eax, byte [rsp + 0x40]
lea rcx, [rsi + 0x20]
shl al, 7
mov r9, rsi
xor byte [rsi + 0x1f], al
mov r8, r15
lea rax, [rbp + 0x90]
mov rdx, r14
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.18000f4e0
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.180013d10
add rsp, 0x220
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400112f3
Capabilities:
Terminate process

Disassembly:
jmp 0x140015db0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400113b6
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017100
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017120
xor al, al
jmp 0x1400171a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017133
xor al, al
jmp 0x1400171a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001715d
xor al, al
jmp 0x1400171a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017171
xor al, al
jmp 0x1400171a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017183
xor al, al
jmp 0x1400171a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001719f
xor al, al
jmp 0x1400171a1
mov al, 1
add rsp, 0x38
ret