joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4821c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x4822e0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x482220
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x482220
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x482220
Function at 0x485610
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xc8]
mov rbx, rcx
mov rdi, rdx
mov r12, r9
test r8, r8
je 0x485693
lea r13, [rcx + r8]
mov ecx, dword [rsp + 0xc0]
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
test ecx, ecx
jne 0x4856a0
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
movzx edx, byte [rsi]
xor edx, eax
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov byte [rdi - 1], dl
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x485650
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
xor al, byte [rsi]
mov byte [rdi - 1], al
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x4856a0
jmp 0x485693
Function at 0x488050
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 0x30]
mov r15, qword [rcx + 0x168]
lea r10, [rax*8]
mov rax, qword [rcx + 0x38]
mov rbx, rcx
mov r12, rdx
lea rbp, [rcx + 0x188]
mov rdi, r8
lea rsi, [rax*8]
mov eax, dword [rcx + 0x170]
lea r14, [rcx + 0x60]
lea r13, [rcx + 0x40]
test eax, eax
jne 0x488148
mov eax, dword [rcx + 0x174]
test eax, eax
jne 0x488120
mov rcx, rbp
mov r9d, 0x10
mov rdx, r10
mov rax, rsi
mov r8, rbp
bswap rdx
bswap rax
mov qword [rcx], rdx
mov rdx, r14
mov qword [rcx + 8], rax
mov rcx, r13
call r15
movdqu xmm0, xmmword [rbx + 0x40]
movdqu xmm1, xmmword [rbx + 0x20]
pxor xmm0, xmm1
movups xmmword [rbx + 0x40], xmm0
test r12, r12
je 0x4881c0
cmp rdi, 0x10
ja 0x4881c0
mov r8, rdi
mov rdx, r12
mov rcx, r13
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.CRYPTO_memcmp
mov qword [rsp + 0x20], r10
mov rcx, r13
mov rdx, r14
call qword [rbx + 0x160]
mov r10, qword [rsp + 0x20]
mov rcx, rbp
mov r9d, 0x10
jmp 0x4880b8
lea r9d, [rax + 0xf]
mov ecx, eax
xor edx, edx
mov qword [rsp + 0x28], r10
and r9d, 0xfffffff0
add rcx, rbp
mov r8d, r9d
mov dword [rsp + 0x20], r9d
sub r8d, eax
call sym.memset
mov r9d, dword [rsp + 0x20]
mov r10, qword [rsp + 0x28]
cmp r9d, 0x30
je 0x488190
mov ecx, r9d
add r9d, 0x10
add rcx, rbp
jmp 0x4880b8
mov qword [rsp + 0x20], r10
mov rcx, r13
mov r8, rbp
mov rdx, r14
mov r9d, 0x30
call r15
mov r10, qword [rsp + 0x20]
mov rcx, rbp
mov r9d, 0x10
jmp 0x4880b8
mov eax, 0xffffffff
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x48a580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rcx + 0x28]
mov rax, qword [rcx + 0x58]
mov rbx, rcx
mov rsi, rdx
cmp rdi, rdx
jae 0x48a76f
mov rcx, qword [rcx + 0x30]
cmp rcx, rdx
jbe 0x48a736
lea r11, [rdi + 1]
mov r10, r11
shl r10, 4
jmp 0x48a5c8
mov rax, qword [rbx + 0x58]
add r11, 1
lea rdx, [rax + r10]
lea rax, [rax + r10 - 0x10]
movzx r9d, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
movzx ecx, byte [rax]
lea ebp, [r8 + r8]
lea edi, [r9 + r9]
sar r9d, 7
sar r8d, 7
or r9d, ebp
sar cl, 7
mov byte [rdx + 0xe], r9b
movzx r9d, byte [rax + 0xd]
and ecx, 0xffffff87
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xd], r8b
movzx r8d, byte [rax + 0xc]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xc], r9b
movzx r9d, byte [rax + 0xb]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xb], r8b
movzx r8d, byte [rax + 0xa]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xa], r9b
movzx r9d, byte [rax + 9]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 9], r8b
movzx r8d, byte [rax + 8]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 8], r9b
movzx r9d, byte [rax + 7]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 7], r8b
movzx r8d, byte [rax + 6]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 6], r9b
movzx r9d, byte [rax + 5]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 5], r8b
movzx r8d, byte [rax + 4]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 4], r9b
movzx r9d, byte [rax + 3]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 3], r8b
movzx r8d, byte [rax + 2]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 2], r9b
movzx r9d, byte [rax + 1]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 1], r8b
movzx r8d, byte [rax]
lea eax, [r8 + r8]
or eax, r9d
xor ecx, edi
add r10, 0x10
mov byte [rdx], al
mov byte [rdx + 0xf], cl
cmp r11, rsi
jne 0x48a5c0
mov rax, qword [rbx + 0x58]
mov qword [rbx + 0x28], r11
shl r11, 4
add rax, r11
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [rdx + 4]
mov r9d, 0x71
lea r8, str.crypto_modes_ocb128.c
sub rdx, rcx
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, rax
mov qword [rbx + 0x30], rdx
shl rdx, 4
call sym.CRYPTO_realloc
test rax, rax
je 0x48a72d
mov qword [rbx + 0x58], rax
jmp 0x48a5ac
shl rsi, 4
add rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x493100
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x493135
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x493110
and r10, 0xf
je 0x493166
mov r9, 0x10
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x493141
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x49315a
mov rax, r8
repz ret

Function at 0x493170
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x4931ad
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x493180
pxor xmm1, xmm1
and r10, 0xf
je 0x4931e4
mov r9, 0x10
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x4931bc
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x4931d8
mov rax, r8
repz ret
Function at 0x4999a0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov r8d, 1
jmp sym.ripemd160_block_data_order
Function at 0x4a2600
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x30
mov esi, dword [rsp + 0x90]
mov r13, rcx
mov ebx, edx
mov r12, r8
mov edi, r9d
test edx, edx
js 0x4a27e8
test r9d, r9d
js 0x4a27e8
movsxd r14, esi
cmp r9d, esi
jg 0x4a2758
cmp esi, 0xa
jle 0x4a2758
xor r15d, r15d
cmp r9d, esi
je 0x4a2687
mov r8d, 0xb3
lea rdx, str.crypto_rsa_rsa_pk1.c
mov rcx, r14
call sym.CRYPTO_zalloc
mov r15, rax
test rax, rax
je 0x4a27ef
movsxd r8, edi
mov rcx, r14
mov rdx, r12
mov r12, r15
sub rcx, r8
add rcx, rax
call sym.memcpy
movzx eax, byte [r12 + 1]
lea r10d, [rsi - 3]
xor r8d, r8d
xor r9d, r9d
movzx edx, byte [r12]
add r10, 3
mov ecx, 2
xor eax, 2
movzx eax, al
mov r11d, eax
sub eax, 1
not r11d
and eax, r11d
mov r11d, edx
sub edx, 1
not r11d
and r11d, edx
and r11d, eax
sar r11d, 0x1f
nop word [rax + rax]
movzx edx, byte [r12 + rcx]
mov edi, r8d
xor edi, ecx
add rcx, 1
mov eax, edx
sub edx, 1
not eax
and edx, eax
mov eax, edx
mov edx, r9d
not edx
sar eax, 0x1f
and edx, edi
or r9d, eax
and edx, eax
xor r8d, edx
cmp r10, rcx
jne 0x4a26d0
lea eax, [r8 - 0xa]
mov edx, r8d
xor edx, 0xa
xor eax, 0xa
or eax, edx
mov edx, ebx
xor eax, r8d
add r8d, 1
sar eax, 0x1f
sub esi, r8d
not eax
sub edx, esi
and r11d, eax
mov eax, esi
xor edx, esi
xor eax, ebx
or edx, eax
xor ebx, edx
sar ebx, 0x1f
not ebx
test ebx, r11d
jne 0x4a27b0
mov r9d, 0xf1
lea r8, str.crypto_rsa_rsa_pk1.c
mov rdx, r14
mov rcx, r15
call sym.CRYPTO_clear_free
jmp 0x4a276f
mov r9d, 0xf1
lea r8, str.crypto_rsa_rsa_pk1.c
mov rdx, r14
xor ecx, ecx
call sym.CRYPTO_clear_free
mov r8d, 0x9f
mov edx, 0x71
mov ecx, 4
mov dword [rsp + 0x20], 0xf3
lea r9, str.crypto_rsa_rsa_pk1.c
mov esi, 0xffffffff
call sym.ERR_put_error
mov eax, esi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
movsxd r8, r8d
mov rcx, r13
lea rdx, [r12 + r8]
movsxd r8, esi
call sym.memcpy
mov r9d, 0xf1
mov rdx, r14
mov rcx, r15
lea r8, str.crypto_rsa_rsa_pk1.c
call sym.CRYPTO_clear_free
cmp esi, 0xffffffff
jne 0x4a2798
jmp 0x4a276f
mov esi, 0xffffffff
jmp 0x4a2798
mov dword [rsp + 0x20], 0xb5
lea r9, str.crypto_rsa_rsa_pk1.c
mov r8d, 0x41
or esi, 0xffffffff
mov edx, 0x71
mov ecx, 4
call sym.ERR_put_error
jmp 0x4a2798

Function at 0x4a4e40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x4a4e60
mov rax, qword [sym.SEED_encrypt]
mov qword [rsp + 0x30], rax
jmp sym.CRYPTO_cbc128_encrypt
mov rax, qword [sym.SEED_decrypt]
mov qword [rsp + 0x30], rax
jmp sym.CRYPTO_cbc128_decrypt
Function at 0x4a5360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rdi, [rdi + 0x64]
sub rsp, 0xe8
mov r9, rsi
lea rsi, [rsp + 0x64]
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
lea r15, [0x004a5540]
mov qword [rsi + 0x74], rcx
cmp rdx, rcx
jb 0x4a5400
shr rcx, 3
lea r8, [rdi - 0x64]
mov rax, qword [r9]
lea r9, [r9 + 8]
xor rax, qword [r8]
lea r8, [r8 + 8]
sub rdx, 8
mov qword [r8 - 8], rax
sub rcx, 1
jne 0x4a53c6
mov qword [rsi + 0x64], r9
mov qword [rsi + 0x6c], rdx
call sym.__KeccakF1600
mov r9, qword [rsi + 0x64]
mov rdx, qword [rsi + 0x6c]
mov rcx, qword [rsi + 0x74]
jmp 0x4a53b9
mov rax, rdx
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x4a826d
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8

Function at 0x4b2240
Capabilities:
Encode data using xor
Hash data using sha1 via x86 extensions

Disassembly:
mov r8d, 1
jmp sym.sha1_block_data_order
Function at 0x4b4dad
Capabilities:
Encode data using xor
Hash data using sha256 via x86 extensions

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
Function at 0x4bfdb0
Capabilities:
Encode data using xor
Hash data using sha256 via x86 extensions
Resolve function by parsing pe exports

Disassembly:
mov r8d, 1
jmp sym.sha256_block_data_order

Function at 0x4c00e0
Capabilities:
Hash data using sha256

Disassembly:
push r13
push r12
push rdi
sub rsp, 0x90
lea rax, [0x0063ee60]
movdqu xmm0, xmmword [0x005e6390]
test r8, r8
mov r12, r8
lea r8, [rsp + 0x40]
mov r9, rcx
cmove r12, rax
mov ecx, 9
xor eax, eax
mov rdi, r8
rep stosq qword [rdi], rax
movups xmmword [rsp + 0x20], xmm0
movdqu xmm0, xmmword [0x005e63a0]
lea r13, [rsp + 0x20]
movups xmmword [rsp + 0x30], xmm0
mov dword [rdi], 0
mov dword [rsp + 0x8c], 0x20
test rdx, rdx
je 0x4c0155
mov r8, rdx
mov rcx, r13
mov rdx, r9
call sym.SHA256_Update.part.0
mov rdx, r13
mov rcx, r12
call sym.SHA256_Final
mov edx, 0x70
mov rcx, r13
call sym.OPENSSL_cleanse
mov rax, r12
add rsp, 0x90
pop rdi
pop r12
pop r13
ret
Function at 0x4c17e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x28]
add qword [rcx], r8
mov rdi, qword [rcx + 8]
mov rsi, qword [rcx + 0x10]
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
mov r12, rcx
mov r13, rdx
mov r14, r8
test eax, eax
je 0x4c188a
mov r15d, 8
lea rcx, [rcx + rax + 0x38]
sub r15d, eax
cmp r8, r15
jb 0x4c195a
mov r8, r15
sub r14, r15
add r13, r15
call sym.memcpy
mov rcx, qword [r12 + 0x38]
mov edx, dword [r12 + 0x30]
xor rbx, rcx
test edx, edx
jle 0x4c1887
xor eax, eax
nop dword [rax + rax]
add rdi, rsi
add rbp, rbx
rol rsi, 0xd
add eax, 1
rol rbx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rbx, rbp
add rbp, rsi
rol rsi, 0x11
add rdi, rbx
rol rbx, 0x15
xor rsi, rbp
xor rbx, rdi
rol rbp, 0x20
cmp eax, edx
jne 0x4c1850
xor rdi, rcx
mov r9d, r14d
and r14, 0xfffffffffffffff8
lea r8, [r13 + r14]
and r9d, 7
cmp r13, r8
je 0x4c18fb
mov ecx, dword [r12 + 0x30]
nop dword [rax]
mov rdx, qword [r13]
xor rbx, rdx
test ecx, ecx
jle 0x4c18ef
xor eax, eax
nop dword [rax]
add rdi, rsi
add rbp, rbx
rol rsi, 0xd
add eax, 1
rol rbx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rbx, rbp
add rbp, rsi
rol rsi, 0x11
add rdi, rbx
rol rbx, 0x15
xor rsi, rbp
xor rbx, rdi
rol rbp, 0x20
cmp ecx, eax
jne 0x4c18b8
add r13, 8
xor rdi, rdx
cmp r8, r13
jne 0x4c18a8
test r9d, r9d
jne 0x4c193e
movq xmm0, rdi
movq xmm1, rsi
movq xmm2, rbx
mov dword [r12 + 0x28], r9d
punpcklqdq xmm0, xmm1
movups xmmword [r12 + 8], xmm0
movq xmm0, rbp
punpcklqdq xmm0, xmm2
movups xmmword [r12 + 0x18], xmm0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r10, [r12 + 0x38]
xor eax, eax
mov edx, eax
add eax, 1
movzx ecx, byte [r8 + rdx]
mov byte [r10 + rdx], cl
cmp eax, r9d
jb 0x4c1945
jmp 0x4c1900
call sym.memcpy
add dword [r12 + 0x28], r14d
jmp 0x4c192d
Function at 0x4c1970
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
xor r11d, r11d
movsxd rax, dword [rcx + 0x2c]
mov rsi, rax
cmp rax, r8
jne 0x4c1b23
mov r8, qword [rcx]
shl r8, 0x38
cmp dword [rcx + 0x28], 7
ja case.0x4c19a4.0
mov eax, dword [rcx + 0x28]
lea r9, [0x005e64b0]
movsxd rax, dword [r9 + rax*4]
add rax, r9
jmp rax
movzx eax, byte [rcx + 0x3e]
shl rax, 0x30
or r8, rax
movzx eax, byte [rcx + 0x3d]
shl rax, 0x28
or r8, rax
movzx eax, byte [rcx + 0x3c]
shl rax, 0x20
or r8, rax
movzx eax, byte [rcx + 0x3b]
shl rax, 0x18
or r8, rax
movzx eax, byte [rcx + 0x3a]
shl rax, 0x10
or r8, rax
movzx eax, byte [rcx + 0x39]
shl rax, 8
or r8, rax
movzx eax, byte [rcx + 0x38]
or r8, rax
mov r9, qword [rcx + 0x20]
mov edi, dword [rcx + 0x30]
mov r10, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
mov r11, qword [rcx + 0x18]
xor r9, r8
test edi, edi
jle 0x4c1a4f
xor ebx, ebx
nop dword [rax]
add r10, rax
add r11, r9
rol rax, 0xd
add ebx, 1
rol r9, 0x10
xor rax, r10
rol r10, 0x20
xor r9, r11
add r11, rax
rol rax, 0x11
add r10, r9
rol r9, 0x15
xor rax, r11
xor r9, r10
rol r11, 0x20
cmp ebx, edi
jne 0x4c1a18
xor r10, r8
mov ebx, dword [rcx + 0x34]
mov r8, r11
xor r11b, 0xff
xor r8b, 0xee
cmp esi, 0x10
cmovne r8, r11
xor r11d, r11d
test ebx, ebx
jle 0x4c1aa9
nop
add r10, rax
add r8, r9
rol rax, 0xd
rol r9, 0x10
xor rax, r10
rol r10, 0x20
add r11d, 1
xor r9, r8
add r8, rax
rol rax, 0x11
add r10, r9
rol r9, 0x15
xor rax, r8
xor r9, r10
rol r8, 0x20
cmp r11d, ebx
jne 0x4c1a70
mov r11, r10
xor r11, rax
xor r11, r8
xor r11, r9
mov qword [rdx], r11
cmp dword [rcx + 0x2c], 8
mov r11d, 1
je 0x4c1b23
mov r11d, dword [rcx + 0x34]
xor al, 0xdd
test r11d, r11d
jle 0x4c1b10
xor ecx, ecx
nop dword [rax]
add r10, rax
add r8, r9
rol rax, 0xd
add ecx, 1
rol r9, 0x10
xor rax, r10
rol r10, 0x20
xor r9, r8
add r8, rax
rol rax, 0x11
add r10, r9
rol r9, 0x15
xor rax, r8
xor r9, r10
rol r8, 0x20
cmp r11d, ecx
jne 0x4c1ad8
xor rax, r10
mov r11d, 1
xor r8, rax
xor r9, r8
mov qword [rdx + 8], r9
mov eax, r11d
pop rbx
pop rsi
pop rdi
ret
Function at 0x4cac70
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
mov r13, rcx
mov rcx, rdx
mov r12, rdx
call sym.UI_get_string_type
cmp eax, 2
je 0x4cacb0
cmp eax, 3
je 0x4cadb0
cmp eax, 1
je 0x4cad60
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
mov rcx, r12
call sym.UI_get0_output_string
mov rcx, qword [0x0063ef30]
lea rdx, str.Verifying____s
mov r8, rax
call sym.fprintf
mov rcx, qword [0x0063ef30]
call sym.fflush
mov rcx, r12
call sym.UI_get_input_flags
mov r9d, 1
mov rdx, r12
mov rcx, r13
and eax, 1
mov r8d, eax
call sym.read_string_inner
test eax, eax
jle 0x4caca4
mov rcx, r12
call sym.UI_get0_test_string
mov rcx, r12
mov r13, rax
call sym.UI_get0_result_string
mov rdx, r13
mov rcx, rax
call sym.strcmp
mov r8d, eax
mov eax, 1
test r8d, r8d
je 0x4caca4
mov r9, qword [0x0063ef30]
mov r8d, 0xf
mov edx, 1
lea rcx, str.Verify_failure_n
call sym.fwrite
mov rcx, qword [0x0063ef30]
call sym.fflush
xor eax, eax
jmp 0x4caca4
mov r14, qword [0x0063ef30]
mov rcx, r12
call sym.UI_get0_output_string
mov rcx, rax
mov rdx, r14
call sym.fputs
mov rcx, qword [0x0063ef30]
call sym.fflush
mov rcx, r12
call sym.UI_get_input_flags
mov r9d, 1
and eax, 1
mov rdx, r12
mov rcx, r13
mov r8d, eax
add rsp, 0x20
pop r12
pop r13
pop r14
jmp sym.read_string_inner
mov r14, qword [0x0063ef30]
mov rcx, r12
call sym.UI_get0_output_string
mov rcx, rax
mov rdx, r14
call sym.fputs
mov r14, qword [0x0063ef30]
mov rcx, r12
call sym.UI_get0_action_string
mov rcx, rax
mov rdx, r14
call sym.fputs
mov rcx, qword [0x0063ef30]
call sym.fflush
mov rcx, r12
call sym.UI_get_input_flags
xor r9d, r9d
jmp 0x4cad94
Function at 0x4e0a2d
Capabilities:
Encrypt data using aes via x86 extensions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8

Function at 0x4e11ed
Capabilities:
Decrypt data using aes via x86 extensions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8

Function at 0x4e1c00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov r10d, dword [0x00640500]
mov r11, qword [0x00640504]
bt r11, 0x3d
jb sym.aesni_cbc_sha1_enc_shaext
and r11d, 0x10000000
and r10d, 0x40000000
or r10d, r11d
cmp r10d, 0x50000000
je sym.aesni_cbc_sha1_enc_avx
jmp sym.aesni_cbc_sha1_enc_ssse3
Function at 0x4e48c0
Capabilities:
Encrypt data using aes via x86 extensions
Resolve function by parsing pe exports

Disassembly:
lea r11, [0x00640500]
mov eax, 1
cmp rcx, 0
je 0x4e4925
mov eax, dword [r11]
mov r10, qword [r11 + 4]
bt r10, 0x3d
jb sym.aesni_cbc_sha256_enc_shaext
mov r11, r10
shr r11, 0x20
test r10d, 0x800
jne sym.aesni_cbc_sha256_enc_xop
and r11d, 0x128
cmp r11d, 0x128
je sym.aesni_cbc_sha256_enc_avx2
and r10d, 0x10000000
jne sym.aesni_cbc_sha256_enc_avx
ud2
repz ret
Function at 0x4e9360
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4e9380
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x4e93c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4e93e0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x4e9420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4e9443
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x4e9490
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4e94b3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x4e9500
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x4e9529
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret