joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140140ae0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r9, rdx
xor r11d, r11d
mov rax, r9
mov rdx, rcx
and eax, 7
and edx, 7
cmp rdx, rax
jne 0x140140bed
test rdx, rdx
je 0x140140b18
test r8d, r8d
je 0x140140b18
movzx eax, byte [r9]
inc r9
xor byte [rcx], al
inc rcx
dec r8d
jmp 0x140140b02
mov r10d, r8d
mov ebx, r11d
shr r10d, 3
test r10d, r10d
je 0x140140be9
mov qword [rsp + 0x10], rdi
cmp r10d, 8
jb 0x140140bbd
lea eax, [r10 - 1]
lea rdi, [rcx + rax*8]
lea rax, [r9 + rax*8]
cmp rcx, rax
ja 0x140140b50
cmp rdi, r9
jae 0x140140bbd
mov eax, r10d
and eax, 0xfffffff8
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
add ebx, 8
movdqu xmm1, xmmword [r9]
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [r9 + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm0, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [r9 + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm0, xmmword [rcx + 0x30]
movdqu xmm1, xmmword [r9 + 0x30]
add r9, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp ebx, eax
jb 0x140140b60
cmp ebx, r10d
jae 0x140140be4
sub r10d, ebx
mov edx, r10d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r9]
add r9, 8
xor qword [rcx], rax
add rcx, 8
sub rdx, 1
jne 0x140140bd0
mov rdi, qword [rsp + 0x10]
and r8d, 7
test r8d, r8d
je 0x140140cb1
cmp r8d, 0x40
jb 0x140140c88
lea eax, [r8 - 1]
lea r10, [rax + rcx]
add rax, r9
cmp rcx, rax
ja 0x140140c15
cmp r10, r9
jae 0x140140c88
mov r10d, r8d
and r10d, 0xffffffc0
mov ebx, 0x20
movdqu xmm0, xmmword [r11 + rcx]
lea eax, [rbx - 0x10]
movdqu xmm1, xmmword [r11 + r9]
xorps xmm1, xmm0
movdqu xmmword [r11 + rcx], xmm1
add r11d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + r9]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + r9]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rbx + 0x10]
add ebx, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + r9]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r11d, r10d
jb 0x140140c21
cmp r11d, r8d
jae 0x140140cb1
sub r9, rcx
mov edx, r11d
add rdx, rcx
sub r8d, r11d
mov ecx, r8d
nop word [rax + rax]
movzx eax, byte [r9 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x140140ca0
pop rbx
ret
Function at 0x140140d00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov rax, rcx
mov r10, rdx
and eax, 7
and edx, 7
xor ebx, ebx
cmp rax, rdx
jne 0x140140e44
mov rax, r8
and eax, 7
cmp rdx, rax
jne 0x140140e44
test rdx, rdx
je 0x140140d51
test r9d, r9d
je 0x140140d51
movzx eax, byte [r8]
dec r9d
xor al, byte [r10]
inc r8
mov byte [rcx], al
inc r10
inc rcx
test r10b, 7
jne 0x140140d31
mov r11d, r9d
mov edi, ebx
shr r11d, 3
test r11d, r11d
je 0x140140e40
mov qword [rsp + 0x10], rsi
cmp r11d, 8
jb 0x140140e15
lea eax, [r11 - 1]
mov edx, eax
lea rsi, [rcx + rax*8]
lea rax, [r10 + rax*8]
cmp rcx, rax
ja 0x140140d8e
cmp rsi, r10
jae 0x140140e15
lea rax, [r8 + rdx*8]
cmp rcx, rax
ja 0x140140d9c
cmp rsi, r8
jae 0x140140e15
mov eax, r11d
and eax, 0xfffffff8
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [r10]
add edi, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x10]
movdqu xmmword [rcx], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x20]
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x30]
add r10, 0x40
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp edi, eax
jb 0x140140db0
cmp edi, r11d
jae 0x140140e3b
sub r11d, edi
mov edx, r11d
nop dword [rax + rax]
mov rax, qword [r8]
add r8, 8
xor rax, qword [r10]
add r10, 8
mov qword [rcx], rax
add rcx, 8
sub rdx, 1
jne 0x140140e20
mov rsi, qword [rsp + 0x10]
and r9d, 7
test r9d, r9d
je 0x140140f24
cmp r9d, 0x40
jb 0x140140ef8
lea eax, [r9 - 1]
mov edx, eax
lea r11, [rax + rcx]
add rax, r10
cmp rcx, rax
ja 0x140140e72
cmp r11, r10
jae 0x140140ef8
lea rax, [rdx + r8]
cmp rcx, rax
ja 0x140140e80
cmp r11, r8
jae 0x140140ef8
mov r11d, r9d
and r11d, 0xffffffc0
mov edi, 0x20
nop dword [rax]
movdqu xmm0, xmmword [rbx + r10]
lea eax, [rdi - 0x10]
movdqu xmm1, xmmword [rbx + r8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax + r10]
movdqu xmmword [rbx + rcx], xmm1
add ebx, 0x40
movdqu xmm1, xmmword [rax + r8]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, edi
movdqu xmm0, xmmword [rax + r10]
movdqu xmm1, xmmword [rax + r8]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rdi + 0x10]
add edi, 0x40
movdqu xmm1, xmmword [rax + r8]
movdqu xmm0, xmmword [rax + r10]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp ebx, r11d
jb 0x140140e90
cmp ebx, r9d
jae 0x140140f24
sub r8, r10
mov edx, ebx
add rdx, r10
sub rcx, r10
sub r9d, ebx
mov r10d, r9d
nop dword [rax]
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
sub r10, 1
jne 0x140140f10
mov rbx, qword [rsp + 0x18]
pop rdi
ret
Function at 0x140141ea0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140141faa
test rdx, rdx
je 0x140141faa
mov eax, dword [rcx]
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 0xc]
cmp eax, 0x3f
jbe 0x140141ee7
mov rdi, qword [rsp + 0x38]
mov eax, 0xffffff7c
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov byte [rax + rdi], 0x80
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov dword [rbx], ecx
cmp ecx, 0x38
jbe 0x140141f25
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.14014e180
mov rdx, rdi
mov dword [rbx], 0x40
mov rcx, rbx
call fcn.140141660
mov ecx, ebp
mov dword [rbx], ebp
mov r8d, 0x38
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.14014e180
mov r8d, dword [rbx + 4]
mov rdx, rdi
mov eax, dword [rbx + 8]
mov ecx, r8d
shr ecx, 0x1d
lea ecx, [rcx + rax*8]
mov dword [rbx + 8], ecx
lea eax, [r8*8]
mov dword [rbx + 4], eax
mov rcx, rbx
mov dword [rdi + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0x3c], eax
call fcn.140141660
movups xmm0, xmmword [rbx + 0x4c]
mov rdi, qword [rsp + 0x38]
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rbx], rbp
mov dword [rbx + 8], ebp
mov rbp, qword [rsp + 0x30]
mov dword [rbx + 0x4c], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffff53
add rsp, 0x20
pop rsi
ret
Function at 0x140143a70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r12
push r14
sub rsp, 0x20
mov esi, r9d
mov r12, r8
shr esi, 3
mov rbx, rdx
mov r14, rcx
test esi, esi
je 0x140143c03
mov qword [rsp + 0x40], rbp
mov rbp, rcx
and ebp, 7
mov qword [rsp + 0x50], r15
sub r12, rdx
mov qword [rsp + 0x48], rdi
nop dword [rax]
mov rax, qword [r12 + rbx]
lea rdx, [r14 + 8]
mov r8, rbx
mov qword [r14 + 8], rax
mov rcx, r14
dec esi
call fcn.140142330
mov rcx, rbx
mov r9d, 8
and ecx, 7
mov rax, rbx
mov r8, r14
cmp rcx, rbp
jne 0x140143bca
test rcx, rcx
je 0x140143b06
nop dword [rax]
test r9d, r9d
je 0x140143b06
movzx ecx, byte [r8]
inc r8
xor byte [rax], cl
inc rax
dec r9d
jmp 0x140143af0
mov r10d, r9d
xor r11d, r11d
shr r10d, 3
test r10d, r10d
je 0x140143bc4
cmp r10d, 8
jb 0x140143b9f
lea ecx, [r10 - 1]
lea rdi, [rax + rcx*8]
lea rcx, [r8 + rcx*8]
cmp rax, rcx
ja 0x140143b39
cmp rdi, r8
jae 0x140143b9f
mov ecx, r10d
and ecx, 0xfffffff8
nop
movdqu xmm0, xmmword [rax]
add r11d, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp r11d, ecx
jb 0x140143b40
cmp r11d, r10d
jae 0x140143bc4
sub r10d, r11d
mov edx, r10d
nop word [rax + rax]
mov rcx, qword [r8]
add r8, 8
xor qword [rax], rcx
add rax, 8
sub rdx, 1
jne 0x140143bb0
and r9d, 7
jbe 0x140143be1
sub r8, rax
mov edx, r9d
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140143bd0
mov rax, qword [r14 + 8]
add rbx, 8
mov qword [r14], rax
test esi, esi
jne 0x140143ab0
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
Function at 0x140143cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
sub rsp, 0x20
mov esi, r9d
mov r12, r8
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x140143e9a
test rdx, rdx
je 0x140143e9a
test r8, r8
je 0x140143e9a
shr esi, 3
test esi, esi
je 0x140143e8a
mov qword [rsp + 0x48], r14
sub r12, rdx
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x40], rdi
mov rax, qword [r12 + rbx]
lea rdx, [rbp + 0x188]
mov r8, rbx
mov qword [rbp + 0x188], rax
mov rcx, rbp
dec esi
call fcn.140142180
mov rdx, rbx
lea rcx, [rbp + 0x180]
and edx, 7
lea r8, [rbp + 0x180]
and ecx, 7
mov r9d, 8
mov rax, rbx
cmp rdx, rcx
jne 0x140143e4a
test rdx, rdx
je 0x140143d86
nop
test r9d, r9d
je 0x140143d86
movzx ecx, byte [r8]
inc r8
xor byte [rax], cl
inc rax
dec r9d
jmp 0x140143d70
mov r10d, r9d
xor r11d, r11d
shr r10d, 3
test r10d, r10d
je 0x140143e44
cmp r10d, 8
jb 0x140143e1f
lea ecx, [r10 - 1]
lea rdi, [rax + rcx*8]
lea rcx, [r8 + rcx*8]
cmp rax, rcx
ja 0x140143db9
cmp rdi, r8
jae 0x140143e1f
mov ecx, r10d
and ecx, 0xfffffff8
nop
movdqu xmm0, xmmword [rax]
add r11d, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp r11d, ecx
jb 0x140143dc0
cmp r11d, r10d
jae 0x140143e44
sub r10d, r11d
mov edx, r10d
nop word [rax + rax]
mov rcx, qword [r8]
add r8, 8
xor qword [rax], rcx
add rax, 8
sub rdx, 1
jne 0x140143e30
and r9d, 7
jbe 0x140143e61
sub r8, rax
mov edx, r9d
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140143e50
mov rax, qword [rbp + 0x188]
add rbx, 8
mov qword [rbp + 0x180], rax
test esi, esi
jne 0x140143d21
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x58]
mov eax, 0xffffff53
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
Function at 0x140143ec0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
sub rsp, 0x20
mov esi, r9d
mov rbx, r8
mov r14, rdx
mov r15, rcx
test rcx, rcx
je 0x140144079
test rdx, rdx
je 0x140144079
test rbx, rbx
je 0x140144079
shr esi, 3
test esi, esi
je 0x140144068
mov qword [rsp + 0x48], rdi
sub r14, rbx
mov qword [rsp + 0x40], rbp
nop dword [rax]
lea rdx, [r15 + 0x180]
mov rcx, rbx
and edx, 7
lea rax, [r15 + 0x180]
and ecx, 7
dec esi
mov r9d, 8
mov r8, rbx
cmp rdx, rcx
jne 0x14014401a
test rdx, rdx
je 0x140143f56
test r9d, r9d
je 0x140143f56
movzx ecx, byte [r8]
inc r8
xor byte [rax], cl
inc rax
dec r9d
jmp 0x140143f40
mov r10d, r9d
xor r11d, r11d
shr r10d, 3
test r10d, r10d
je 0x140144014
cmp r10d, 8
jb 0x140143fef
lea ecx, [r10 - 1]
lea rbp, [rax + rcx*8]
lea rcx, [r8 + rcx*8]
cmp rax, rcx
ja 0x140143f89
cmp rbp, r8
jae 0x140143fef
mov ecx, r10d
and ecx, 0xfffffff8
nop
movdqu xmm0, xmmword [rax]
add r11d, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp r11d, ecx
jb 0x140143f90
cmp r11d, r10d
jae 0x140144014
sub r10d, r11d
mov edx, r10d
nop word [rax + rax]
mov rcx, qword [r8]
add r8, 8
xor qword [rax], rcx
add rax, 8
sub rdx, 1
jne 0x140144000
and r9d, 7
jbe 0x140144031
sub r8, rax
mov edx, r9d
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140144020
lea r8, [r15 + 0x180]
mov rcx, r15
lea rdx, [r15 + 0x180]
call fcn.140142180
mov rax, qword [r15 + 0x180]
mov qword [r14 + rbx], rax
add rbx, 8
test esi, esi
jne 0x140143f10
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0xffffff53
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x140144a50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
xor ebx, ebx
lea edi, [rdx - 4]
xor r11d, r11d
mov esi, edx
mov rbp, rcx
test edi, edi
je 0x140144adb
mov qword [rsp + 0x10], r14
mov r14d, 4
cmp edi, r14d
mov r8d, r14d
cmovbe r8d, edi
xor r9d, r9d
test r8d, r8d
jle 0x140144abc
mov eax, r11d
add rax, rbp
mov r10d, r8d
nop word [rax + rax]
movzx edx, byte [r10 + rax]
movzx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x140144aa0
test r9d, r9d
jne 0x140144ac1
mov ebx, 3
add r11d, r14d
mov r8d, esi
sub r8d, r11d
cmp r8d, r14d
cmova r8d, r14d
cmp r11d, edi
jb 0x140144a86
mov r14, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x28]
pop rdi
ret
Function at 0x140145630
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov r15, rdx
mov r14d, 1
test rcx, rcx
jne 0x140145660
mov eax, r14d
add rsp, 0x110
pop r15
pop r14
pop rbp
ret
movups xmm0, xmmword [r9]
mov qword [rsp + 0x130], rbx
test r8d, r8d
movups xmm1, xmmword [r9 + 0x10]
mov qword [rsp + 0x138], rsi
mov esi, 0
mov qword [rsp + 0x140], rdi
mov edi, r14d
cmovne edi, r8d
mov qword [rsp + 0x108], r12
mov qword [rsp + 0x100], r13
test dil, 0x1f
mov r13d, esi
lea ebx, [rsi + 0x37]
setne r13b
mov eax, edi
shr eax, 5
mov r12d, esi
add r13d, eax
mov eax, dword [r9 + 0x30]
mov dword [rsp + 0x50], eax
movzx eax, word [r9 + 0x34]
movups xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x54], ax
movups xmm0, xmmword [r9 + 0x20]
movzx eax, byte [r9 + 0x36]
mov byte [rsp + 0x56], al
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x40], xmm0
je 0x1401457ec
nop
mov r8d, ebx
mov dword [rbp - 0x80], 0x6a09e667
lea rdx, [rsp + 0x20]
mov dword [rbp - 0x7c], 0xbb67ae85
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x78], 0x3c6ef372
mov dword [rbp - 0x74], 0xa54ff53a
mov dword [rbp - 0x70], 0x510e527f
mov dword [rbp - 0x6c], 0x9b05688c
mov dword [rbp - 0x68], 0x1f83d9ab
mov dword [rbp - 0x64], 0x5be0cd19
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x10], rsi
call fcn.14013bb20
mov r14d, eax
test eax, eax
jne 0x1401457ec
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call fcn.14013c850
mov r14d, eax
test eax, eax
jne 0x1401457ec
test r15, r15
je 0x1401457e0
test edi, edi
je 0x1401457e0
cmp edi, 0x20
jb 0x1401457ce
movups xmm0, xmmword [rsp + 0x58]
add edi, 0xffffffe0
lea rcx, [rsp + 0x54]
movups xmm1, xmmword [rsp + 0x68]
mov edx, 0x36
lea rax, [rsp + 0x54]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
add r15, 0x20
sub rdx, rcx
add byte [rax + 2], 1
jne 0x1401457e0
add byte [rax + 1], 1
jne 0x1401457e0
add byte [rax], 1
jne 0x1401457e0
add byte [rax - 1], 1
jne 0x1401457e0
add byte [rax - 2], 1
jne 0x1401457e0
sub rax, 5
lea rcx, [rdx + rax]
test rcx, rcx
jns 0x1401457a2
jmp 0x1401457e0
mov r8d, edi
lea rdx, [rsp + 0x58]
mov rcx, r15
call fcn.14014dae0
mov edi, esi
inc r12d
cmp r12d, r13d
jb 0x1401456f0
mov r13, qword [rsp + 0x100]
lea rcx, [rsp + 0x20]
mov r12, qword [rsp + 0x108]
mov rdi, qword [rsp + 0x140]
nop dword [rax]
mov byte [rcx], sil
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x140145810
mov rbx, qword [rsp + 0x130]
test r14d, r14d
setne sil
mov eax, esi
mov rsi, qword [rsp + 0x138]
add rsp, 0x110
pop r15
pop r14
pop rbp
ret
Function at 0x140146db0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov rax, rcx
mov r10, rdx
and eax, 7
and edx, 7
xor ebx, ebx
cmp rax, rdx
jne 0x140146ef4
mov rax, r8
and eax, 7
cmp rdx, rax
jne 0x140146ef4
test rdx, rdx
je 0x140146e01
test r9d, r9d
je 0x140146e01
movzx eax, byte [r8]
dec r9d
xor al, byte [r10]
inc r8
mov byte [rcx], al
inc r10
inc rcx
test r10b, 7
jne 0x140146de1
mov r11d, r9d
mov edi, ebx
shr r11d, 3
test r11d, r11d
je 0x140146ef0
mov qword [rsp + 0x10], rsi
cmp r11d, 8
jb 0x140146ec5
lea eax, [r11 - 1]
mov edx, eax
lea rsi, [rcx + rax*8]
lea rax, [r10 + rax*8]
cmp rcx, rax
ja 0x140146e3e
cmp rsi, r10
jae 0x140146ec5
lea rax, [r8 + rdx*8]
cmp rcx, rax
ja 0x140146e4c
cmp rsi, r8
jae 0x140146ec5
mov eax, r11d
and eax, 0xfffffff8
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [r10]
add edi, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x10]
movdqu xmmword [rcx], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x20]
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x30]
add r10, 0x40
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp edi, eax
jb 0x140146e60
cmp edi, r11d
jae 0x140146eeb
sub r11d, edi
mov edx, r11d
nop dword [rax + rax]
mov rax, qword [r8]
add r8, 8
xor rax, qword [r10]
add r10, 8
mov qword [rcx], rax
add rcx, 8
sub rdx, 1
jne 0x140146ed0
mov rsi, qword [rsp + 0x10]
and r9d, 7
test r9d, r9d
je 0x140146fd4
cmp r9d, 0x40
jb 0x140146fa8
lea eax, [r9 - 1]
mov edx, eax
lea r11, [rax + rcx]
add rax, r10
cmp rcx, rax
ja 0x140146f22
cmp r11, r10
jae 0x140146fa8
lea rax, [rdx + r8]
cmp rcx, rax
ja 0x140146f30
cmp r11, r8
jae 0x140146fa8
mov r11d, r9d
and r11d, 0xffffffc0
mov edi, 0x20
nop dword [rax]
movdqu xmm0, xmmword [rbx + r10]
lea eax, [rdi - 0x10]
movdqu xmm1, xmmword [rbx + r8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax + r10]
movdqu xmmword [rbx + rcx], xmm1
add ebx, 0x40
movdqu xmm1, xmmword [rax + r8]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, edi
movdqu xmm0, xmmword [rax + r10]
movdqu xmm1, xmmword [rax + r8]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rdi + 0x10]
add edi, 0x40
movdqu xmm1, xmmword [rax + r8]
movdqu xmm0, xmmword [rax + r10]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp ebx, r11d
jb 0x140146f40
cmp ebx, r9d
jae 0x140146fd4
sub r8, r10
mov edx, ebx
add rdx, r10
sub rcx, r10
sub r9d, ebx
mov r10d, r9d
nop dword [rax]
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
sub r10, 1
jne 0x140146fc0
mov rbx, qword [rsp + 0x18]
pop rdi
ret
Function at 0x140147050
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, r8d
mov r9, rdx
mov rbx, rcx
test rcx, rcx
je 0x140147113
test rdx, rdx
je 0x140147113
lea eax, [rdi - 0x10]
test eax, 0xffffffef
jne 0x140147113
test dl, 3
je 0x14014709a
mov r8d, edi
lea rcx, [rsp + 0x20]
call fcn.14014dae0
lea r9, [rsp + 0x20]
mov eax, dword [r9]
lea rcx, [r9 + 0x10]
mov dword [rbx + 0x10], eax
lea rdx, str.expand_32_byte_kexpand_16_byte_k
mov eax, dword [r9 + 4]
cmp edi, 0x20
mov dword [rbx + 0x14], eax
mov eax, dword [r9 + 8]
cmovne rcx, r9
mov dword [rbx + 0x18], eax
mov eax, dword [r9 + 0xc]
mov dword [rbx + 0x1c], eax
lea rax, [0x1401d6170]
cmovne rdx, rax
mov eax, dword [rcx]
mov dword [rbx + 0x20], eax
mov eax, dword [rcx + 4]
mov dword [rbx + 0x24], eax
mov eax, dword [rcx + 8]
mov dword [rbx + 0x28], eax
mov eax, dword [rcx + 0xc]
mov dword [rbx + 0x2c], eax
mov eax, dword [rdx]
mov dword [rbx], eax
mov eax, dword [rdx + 4]
mov dword [rbx + 4], eax
mov eax, dword [rdx + 8]
mov dword [rbx + 8], eax
mov eax, dword [rdx + 0xc]
mov dword [rbx + 0xc], eax
xor eax, eax
mov dword [rbx + 0x40], 0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0xffffff53
add rsp, 0x40
pop rdi
ret
Function at 0x14014a4c0
Capabilities:
Enumerate pe sections

Disassembly:
mov r9, rdx
mov r10, rcx
test rdx, rdx
je 0x14014a697
test rcx, rcx
je 0x14014a697
movzx eax, byte [rdx + 6]
movabs r11, 0xffc0fffffff
movzx r8d, byte [rdx + 7]
movzx ecx, byte [r9 + 0xa]
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 5]
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 4]
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 3]
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 2]
shl r8, 8
or r8, rax
movzx eax, byte [rdx + 1]
shl r8, 8
or r8, rax
movzx eax, byte [rdx]
movzx edx, byte [rdx + 0xf]
shl rdx, 8
shl r8, 8
or r8, rax
movzx eax, byte [r9 + 0xe]
or rdx, rax
movzx eax, byte [r9 + 0xd]
shl rdx, 8
or rdx, rax
movzx eax, byte [r9 + 0xc]
shl rdx, 8
or rdx, rax
movzx eax, byte [r9 + 0xb]
shl rdx, 8
or rdx, rax
mov rax, rdx
shl rax, 8
or rcx, rax
movzx eax, byte [r9 + 9]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 8]
shl rcx, 8
or rcx, rax
mov rax, r8
shl rcx, 0x14
and rax, r11
mov qword [r10], rax
movabs rax, 0xfffffc0ffff
shr r8, 0x2c
or r8, rcx
and r8, rax
movabs rax, 0xffffffc0f
and rdx, rax
mov qword [r10 + 8], r8
mov qword [r10 + 0x10], rdx
xor edx, edx
mov qword [r10 + 0x18], rdx
mov qword [r10 + 0x20], rdx
mov qword [r10 + 0x28], rdx
movzx eax, byte [r9 + 0x16]
movzx ecx, byte [r9 + 0x17]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x15]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x14]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x13]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x12]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x11]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x10]
shl rcx, 8
or rcx, rax
mov qword [r10 + 0x30], rcx
movzx eax, byte [r9 + 0x1e]
movzx ecx, byte [r9 + 0x1f]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x1d]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x1c]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x1b]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x1a]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x19]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 + 0x18]
shl rcx, 8
or rcx, rax
mov qword [r10 + 0x40], rdx
mov qword [r10 + 0x38], rcx
xor eax, eax
mov byte [r10 + 0x58], dl
ret
mov eax, 0xffffff53
ret
Function at 0x14014b510
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r8, rdx
mov r9d, 8
mov rax, r8
mov rdx, rcx
and eax, 7
and edx, 7
cmp rdx, rax
jne 0x14014b61e
test rdx, rdx
je 0x14014b54d
test r9d, r9d
je 0x14014b54d
movzx eax, byte [r8]
inc r8
xor byte [rcx], al
inc rcx
dec r9d
jmp 0x14014b537
mov r10d, r9d
xor r11d, r11d
shr r10d, 3
test r10d, r10d
je 0x14014b618
mov qword [rsp], rbx
cmp r10d, 8
jb 0x14014b5ef
lea eax, [r10 - 1]
lea rbx, [rcx + rax*8]
lea rax, [r8 + rax*8]
cmp rcx, rax
ja 0x14014b584
cmp rbx, r8
jae 0x14014b5ef
mov eax, r10d
and eax, 0xfffffff8
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
add r11d, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm0, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm0, xmmword [rcx + 0x30]
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp r11d, eax
jb 0x14014b590
cmp r11d, r10d
jae 0x14014b614
sub r10d, r11d
mov edx, r10d
nop word [rax + rax]
mov rax, qword [r8]
add r8, 8
xor qword [rcx], rax
add rcx, 8
sub rdx, 1
jne 0x14014b600
mov rbx, qword [rsp]
and r9d, 7
jbe 0x14014b641
sub r8, rcx
mov edx, r9d
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14014b630
add rsp, 8
ret