joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4949c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494a8a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0076e390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x494a6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00576a60]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x494a5e
mov edi, 1
lea rsi, [0x00576a60]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005ebd60]
lea rsi, [0x005ea110]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4a74c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a756c
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0076e390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x4a7533
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call sym.runtime.stringtoslicebyte
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x4a7546
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x4a7559
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x4a7543
mov byte [rax + rcx], dl
jmp 0x4a7543
mov rcx, rbx
mov rbx, rax
xor eax, eax
call sym.runtime.slicebytetostring
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp sym.internal_filepathlite.replaceStringByte
Function at 0x4d2800
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d2a0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4d2924
cmp rdx, 0x40
ja 0x4d29fd
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4d2894
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4d2900
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0076e390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4d29f5
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4d2927
mov r8, rcx
cmp r8, 0x40
jl 0x4d29a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x0076e390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4d29e8
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4d29e4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x4d3590
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4d360a
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4d35c0
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4d35e0
cmp rdx, 0
je 0x4d362c
test rdx, 0xf
je 0x4d35ad
test rdx, 7
jne 0x4d35e0
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4d35ad
ret
Function at 0x4f9f80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4f9fbf
jb 0x4f9fd4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x4fa040
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4fa07f
jb 0x4fa094
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4fa100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4fa1d4
jb 0x4fa233
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 1
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 2
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 2
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 4
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 4
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 8
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 8
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x10
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 0x10
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x20
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 0x20
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x40
call sym._expand_key_256a
jmp 0x4fa2a1
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 2
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 4
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 8
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 0x10
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 0x20
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 0x40
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 0x80
call sym._expand_key_192b
jmp 0x4fa2a1
aeskeygenassist xmm1, xmm0, 1
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 2
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 4
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 8
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x10
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x20
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x40
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x80
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x1b
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x36
call sym._expand_key_128
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4fa2ae
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x4fa3e0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x005ea2a0]
movdqu xmm14, xmmword [0x005ea2b0]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x4fa4cb
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x4fa4cb
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x4fa530
ret
Function at 0x4fbca0
Capabilities:
Encrypt data using des

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
xor eax, eax
jmp 0x4fbcaf
inc rax
cmp rax, 8
jge 0x4fbcb9
xor ecx, ecx
jmp 0x4fbcc2
add rsp, 0x10
pop rbp
ret
inc rcx
cmp rcx, 4
jge 0x4fbcac
xor edx, edx
jmp 0x4fbce0
mov dword [rbx + rax*4], ecx
lea rbx, [rdi + 1]
mov rax, r10
mov rcx, r9
mov rdx, rbx
nop dword [rax]
cmp rdx, 0x10
jge 0x4fbcbf
mov rbx, rax
shl rax, 6
lea rsi, [0x006e11a0]
lea rdi, [rsi + rax]
mov r8, rcx
shl rcx, 4
add rdi, rcx
movzx edi, byte [rdi + rdx]
lea rcx, [rbx - 7]
neg rcx
shl rcx, 2
shl rdi, cl
cmp rcx, 0x40
sbb r9, r9
and rdi, r9
xor eax, eax
xor ecx, ecx
jmp 0x4fbdb6
mov rdi, r8
and r8d, 2
shl r8, 4
mov r9, rdi
and edi, 1
or r8, rdi
mov rdi, rdx
shl rdx, 1
or r8d, edx
mov rdx, rcx
shl rcx, 1
shr rdx, 0x1f
mov r10, rbx
shl rbx, 8
movzx eax, r8b
or rcx, rdx
lea rdx, [0x00770220]
add rbx, rdx
cmp rax, 0x40
jb 0x4fbccc
jmp 0x4fbdc5
lea r9, [0x006dd500]
movzx r10d, byte [r9 + rax]
mov r11, rcx
mov ecx, r10d
mov r12, rdi
shr r12, cl
lea r13, [rax - 0x1f]
neg r13
inc rax
cmp cl, 0x40
sbb rcx, rcx
and rcx, r12
and ecx, 1
mov r10, rcx
mov rcx, r13
shl r10, cl
cmp rcx, 0x40
sbb rcx, rcx
and rcx, r10
or rcx, r11
cmp rax, 0x20
jl 0x4fbd72
nop dword [rax]
jmp 0x4fbd27
mov ecx, 0x40
call sym.runtime.panicIndex
nop
int3

Function at 0x4fce80
Capabilities:
Encrypt data using tea

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rsi
cmp r8, 3
jbe 0x4fcfbc
lea rdx, [r8 - 4]
cmp rdx, 3
jbe 0x4fcfaf
mov qword [rsp + 0x40], rdi
lea rdx, [r9 - 4]
neg rdx
sar rdx, 0x3f
and edx, 4
mov r8d, dword [rsi]
mov edx, dword [rsi + rdx]
mov esi, dword [rax]
mov r9d, dword [rax + 4]
mov r10d, dword [rax + 8]
mov r11d, dword [rax + 0xc]
bswap r8d
bswap edx
bswap esi
bswap r9d
bswap r10d
bswap r11d
xor r12d, r12d
xor r13d, r13d
jmp 0x4fcf45
mov r15d, edx
shl edx, 4
add edx, esi
lea edi, [r13 + r15]
lea edi, [rdi - 0x61c88647]
xor edi, edx
mov edx, r15d
shr r15d, 5
add r15d, r9d
xor r15d, edi
add r8d, r15d
mov r15d, r8d
shl r15d, 4
add r15d, r10d
lea edi, [r13 + r8]
lea edi, [rdi - 0x61c88647]
xor edi, r15d
mov r15d, r8d
shr r15d, 5
add r15d, r11d
xor r15d, edi
inc r12
add r13d, 0x9e3779b9
add edx, r15d
mov rdi, qword [rsp + 0x40]
mov r15, qword [rax + 0x10]
mov qword [rsp + 0x10], r15
shr r15, 0x3f
mov rdi, qword [rsp + 0x10]
add rdi, r15
sar rdi, 1
nop dword [rax]
cmp r12, rdi
jl 0x4fcee9
nop
cmp rcx, 3
jbe 0x4fcfa5
add rcx, 0xfffffffffffffffc
bswap r8d
mov dword [rbx], r8d
cmp rcx, 3
jbe 0x4fcf9a
mov rax, qword [rsp + 0x40]
add rax, 0xfffffffffffffffc
neg rax
sar rax, 0x3f
and eax, 4
bswap edx
mov dword [rbx + rax], edx
add rsp, 0x18
pop rbp
ret
mov eax, 3
nop
call sym.runtime.panicIndex
mov eax, 3
call sym.runtime.panicIndex
mov eax, 3
mov rcx, rdx
call sym.runtime.panicIndex
mov eax, 3
mov rcx, r8
call sym.runtime.panicIndex
nop
int3
Function at 0x4fcfe0
Capabilities:
Encrypt data using tea

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
cmp r8, 3
jbe 0x4fd0fc
lea rdx, [r8 - 4]
cmp rdx, 3
jbe 0x4fd0ef
lea rdx, [r9 - 4]
neg rdx
sar rdx, 0x3f
and edx, 4
mov r8, qword [rax + 0x10]
mov r9, r8
shr r8, 0x3f
add r8, r9
sar r8, 1
mov r9d, dword [rsi]
mov edx, dword [rsi + rdx]
mov esi, dword [rax]
mov r10d, dword [rax + 4]
mov r11d, dword [rax + 8]
mov r12d, dword [rax + 0xc]
imul r13d, r8d, 0x9e3779b9
bswap r9d
bswap edx
bswap esi
bswap r10d
bswap r11d
bswap r12d
jmp 0x4fd0a1
mov r15d, r9d
shl r15d, 4
add r15d, r11d
lea eax, [r9 + r13]
xor eax, r15d
mov r15d, r9d
shr r15d, 5
add r15d, r12d
xor eax, r15d
sub edx, eax
mov r15d, edx
shl r15d, 4
add r15d, esi
lea eax, [rdx + r13]
xor eax, r15d
mov r15d, edx
shr r15d, 5
add r15d, r10d
xor eax, r15d
dec r8
sub r9d, eax
add r13d, 0x61c88647
test r8, r8
jg 0x4fd056
nop
cmp rcx, 3
jbe 0x4fd0e5
add rcx, 0xfffffffffffffffc
bswap r9d
mov dword [rbx], r9d
cmp rcx, 3
jbe 0x4fd0d6
lea rax, [rdi - 4]
neg rax
sar rax, 0x3f
and eax, 4
bswap edx
mov dword [rbx + rax], edx
add rsp, 0x10
pop rbp
ret
mov eax, 3
nop dword [rax + rax]
call sym.runtime.panicIndex
mov eax, 3
call sym.runtime.panicIndex
mov eax, 3
mov rcx, rdx
call sym.runtime.panicIndex
mov eax, 3
mov rcx, r8
call sym.runtime.panicIndex
nop
int3
Function at 0x501620
Capabilities:
Encrypt data using blowfish

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x501781
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
lea rax, [0x0059ed80]
call sym.runtime.newobject
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x50165d
cmp rbx, 0x38
jle 0x501677
mov rax, rbx
call sym.runtime.convT64
lea rbx, [0x005ec1a0]
mov rcx, rax
xor eax, eax
add rsp, 0x28
pop rbp
ret
mov qword [rsp + 0x20], rax
nop
lea rdx, [0x006dda20]
cmp rax, rdx
je 0x5016a0
mov rbx, rdx
mov ecx, 0x48
call sym.runtime.memmove
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
lea rdx, [rax + 0x48]
lea rsi, [0x006e5420]
cmp rsi, rdx
je 0x5016cf
mov rax, rdx
mov rbx, rsi
mov ecx, 0x400
nop dword [rax + rax]
call sym.runtime.memmove
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
lea rdx, [rax + 0x448]
lea rsi, [0x006e5820]
nop dword [rax]
cmp rsi, rdx
je 0x5016ff
mov rax, rdx
mov rbx, rsi
mov ecx, 0x400
call sym.runtime.memmove
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
lea rdx, [rax + 0x848]
lea rsi, [0x006e5c20]
cmp rsi, rdx
je 0x50172f
mov rax, rdx
mov rbx, rsi
mov ecx, 0x400
nop dword [rax]
call sym.runtime.memmove
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
lea rdx, [rax + 0xc48]
lea rsi, [0x006e6020]
nop dword [rax]
cmp rsi, rdx
je 0x50175f
mov rax, rdx
mov rbx, rsi
mov ecx, 0x400
call sym.runtime.memmove
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rdi, rax
mov rax, qword [rsp + 0x38]
call sym.golang.org_x_crypto_blowfish.ExpandKey
mov rax, qword [rsp + 0x20]
xor ebx, ebx
xor ecx, ecx
add rsp, 0x28
pop rbp
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.golang.org_x_crypto_blowfish.NewCipher
Function at 0x5017c0
Capabilities:
Encrypt data using blowfish

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x501963
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rdi
nop dword [rax]
test rsi, rsi
je 0x501958
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
lea rax, [0x0059ed80]
call sym.runtime.newobject
mov rbx, qword [rsp + 0x58]
nop dword [rax + rax]
test rbx, rbx
je 0x50193f
mov qword [rsp + 0x38], rax
nop
lea rdx, [0x006dda20]
cmp rax, rdx
je 0x501852
mov rbx, rdx
mov ecx, 0x48
call sym.runtime.memmove
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x58]
lea rdx, [rax + 0x48]
lea r10, [0x006e5420]
nop dword [rax]
cmp r10, rdx
je 0x50187f
mov rax, rdx
mov rbx, r10
mov ecx, 0x400
call sym.runtime.memmove
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x58]
lea rdx, [rax + 0x448]
lea r10, [0x006e5820]
cmp r10, rdx
je 0x5018af
mov rax, rdx
mov rbx, r10
mov ecx, 0x400
nop dword [rax]
call sym.runtime.memmove
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x58]
lea rdx, [rax + 0x848]
lea r10, [0x006e5c20]
nop dword [rax]
cmp r10, rdx
je 0x5018df
mov rax, rdx
mov rbx, r10
mov ecx, 0x400
call sym.runtime.memmove
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x58]
lea rdx, [rax + 0xc48]
lea r10, [0x006e6020]
cmp r10, rdx
je 0x50190f
mov rax, rdx
mov rbx, r10
mov ecx, 0x400
nop dword [rax]
call sym.runtime.memmove
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov r9, rax
mov rax, qword [rsp + 0x50]
call sym.golang.org_x_crypto_blowfish.expandKeyWithSalt
mov rax, qword [rsp + 0x38]
xor ebx, ebx
xor ecx, ecx
add rsp, 0x40
pop rbp
ret
xor eax, eax
call sym.runtime.convT64
lea rbx, [0x005ec1a0]
mov rcx, rax
xor eax, eax
add rsp, 0x40
pop rbp
ret
call sym.golang.org_x_crypto_blowfish.NewCipher
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp sym.golang.org_x_crypto_blowfish.NewSaltedCipher