joyce8/EMBER2024-capa huggingface dataset:
Function at 0x652e90
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r9, r8
mov r8d, 1
call sym.fwrite
add rsp, 0x28
ret

Function at 0x658bf0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12d, 1
mov ebx, r12d
mov edi, dword [rsp + 0xc0]
mov qword [rsp + 0xa0], rcx
mov ecx, edi
mov esi, r9d
shl ebx, cl
mov rcx, qword [rsp + 0xa0]
mov dword [rsp + 0xa8], edx
mov qword [rsp + 0xb0], r8
call sym.bn_wexpand
test rax, rax
je 0x658e98
cmp edi, 3
jg 0x658ce8
mov edx, dword [rsp + 0xa8]
test edx, edx
jle 0x658e70
mov rax, qword [rsp + 0xa0]
movsxd r11, ebx
mov rbp, qword [rsp + 0xb0]
shl r11, 3
mov r10, qword [rax]
mov eax, dword [rsp + 0xa8]
lea r9, [r10 + 8]
sub eax, 1
lea rdi, [r9 + rax*8]
nop dword [rax + rax]
mov rcx, rbp
xor r8d, r8d
xor edx, edx
nop dword [rax + rax]
mov r13d, edx
mov r12, qword [rcx]
add edx, 1
add rcx, 8
xor r13d, esi
lea eax, [r13 - 1]
not r13d
and eax, r13d
shr eax, 0x1f
neg rax
and rax, r12
or r8, rax
cmp ebx, edx
jne 0x658ca0
mov qword [r10], r8
add rbp, r11
mov r10, r9
cmp rdi, r9
je 0x658e70
add r9, 8
jmp 0x658c90
lea ecx, [rdi - 2]
shl r12d, cl
lea eax, [r12 - 1]
and eax, esi
sar esi, cl
mov dword [rsp + 0x24], eax
mov eax, esi
lea edx, [rsi - 1]
mov r9d, esi
not eax
mov ebp, r9d
xor esi, 1
mov edi, r9d
and eax, edx
sub esi, 1
xor ebp, 3
xor edi, 2
shr eax, 0x1f
sub ebp, 1
sub edi, 1
neg rax
mov qword [rsp + 0x28], rax
mov eax, r9d
xor eax, 0xfffffffe
and esi, eax
mov eax, r9d
xor r9d, 0xfffffffc
xor eax, 0xfffffffd
and r9d, ebp
shr esi, 0x1f
and edi, eax
shr r9d, 0x1f
mov eax, dword [rsp + 0xa8]
neg rsi
shr edi, 0x1f
mov ebp, r9d
neg rdi
neg rbp
test eax, eax
jle 0x658e70
movsxd rbx, ebx
movsxd r14, r12d
lea rax, [rbx*8]
shl r14, 3
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rax]
mov eax, dword [rsp + 0xa8]
mov qword [rsp + 0x30], rbx
sub eax, 1
add rbx, 8
lea rax, [rbx + rax*8]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rax
mov eax, 2
shl eax, cl
movsxd r13, eax
mov eax, 3
shl eax, cl
shl r13, 3
movsxd r15, eax
shl r15, 3
nop dword [rax]
mov rdx, qword [rsp + 0xb0]
xor ebx, ebx
xor r9d, r9d
nop dword [rax]
lea rcx, [r14 + rdx]
mov rax, qword [rdx]
lea r8, [r15 + rdx]
and rax, qword [rsp + 0x28]
mov r11, qword [rcx]
lea rcx, [r13 + rdx]
add rdx, 8
mov rcx, qword [rcx]
mov r10, qword [r8]
mov r8d, dword [rsp + 0x24]
and r11, rsi
and rcx, rdi
and r10, rbp
xor r8d, r9d
or rcx, r11
add r9d, 1
or rax, rcx
mov ecx, r8d
sub r8d, 1
not ecx
or rax, r10
and r8d, ecx
shr r8d, 0x1f
neg r8
and rax, r8
or rbx, rax
cmp r12d, r9d
jne 0x658dd8
mov rax, qword [rsp + 0x30]
mov qword [rax], rbx
mov rax, qword [rsp + 0x40]
add qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x48], rax
je 0x658e70
add rax, 8
mov qword [rsp + 0x38], rax
jmp 0x658dc8
mov rax, qword [rsp + 0xa0]
mov edi, dword [rsp + 0xa8]
mov dword [rax + 8], edi
mov eax, 1
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x658e87
Function at 0x65a740
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r13, rcx
mov r12, rdx
mov rcx, r8
mov edx, 4
mov rbx, r8
mov rsi, r9
call sym.BN_get_flags
test eax, eax
jne 0x65a78a
mov edx, 4
mov rcx, r12
call sym.BN_get_flags
test eax, eax
je 0x65a7c0
mov r9, rsi
mov r8, rbx
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.BN_mod_exp_mont_consttime
mov edx, 4
mov rcx, rsi
call sym.BN_get_flags
test eax, eax
jne 0x65a78a
mov r9, rsi
mov r8, rbx
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.BN_mod_exp_mont.part.0

Function at 0x661280
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x6612a0
mov rax, qword [sym.Camellia_encrypt]
mov qword [rsp + 0x30], rax
jmp sym.CRYPTO_cbc128_encrypt
mov rax, qword [sym.Camellia_decrypt]
mov qword [rsp + 0x30], rax
jmp sym.CRYPTO_cbc128_decrypt

Function at 0x661360
Capabilities:
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
movups xmmword [rsp + 0xa0], xmm6
movups xmmword [rsp + 0xb0], xmm7
movups xmmword [rsp + 0xc0], xmm8
mov rax, qword [rsp + 0x140]
mov ebx, dword [r9]
mov esi, dword [r9 + 4]
mov edi, dword [r9 + 8]
mov r14d, dword [r9 + 0x14]
mov r10d, dword [r9 + 0x18]
mov r15d, dword [r9 + 0x1c]
mov qword [rsp + 0x130], r8
mov r8d, dword [rax]
cmp qword [rsp + 0x130], 0
mov qword [rsp + 0x120], rcx
mov dword [rsp + 0x30], r8d
mov r8d, dword [rax + 4]
mov qword [rsp + 0x128], rdx
mov ecx, dword [r9 + 0xc]
mov dword [rsp + 0x34], r8d
mov edx, dword [r9 + 0x10]
mov r8d, dword [rax + 8]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x4c], r14d
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x5c], eax
je 0x661824
movd xmm1, ecx
movd xmm5, edi
movd xmm2, esi
movdqu xmm6, xmmword [str.expand_32_byte_k]
punpckldq xmm5, xmm1
movd xmm4, ebx
movd xmm1, r15d
movd xmm3, r10d
punpckldq xmm4, xmm2
movd xmm2, edx
punpckldq xmm3, xmm1
movd xmm1, r14d
movd xmm7, eax
punpckldq xmm2, xmm1
movd xmm1, r8d
punpckldq xmm1, xmm7
nop word cs:[rax + rax]
Function at 0x67a2d0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x1b0
lea r12, [rsp + 0xd0]
mov rbx, rcx
mov rcx, rdx
mov edx, 0x20
mov r8, r12
lea rsi, [rsp + 0x40]
lea r13, [rsp + 0x70]
call sym.SHA512
movzx eax, byte [rsp + 0xef]
mov rdx, r12
lea r14, [rsp + 0x110]
mov rcx, r14
and byte [rsp + 0xd0], 0xf8
and eax, 0x3f
or eax, 0x40
mov byte [rsp + 0xef], al
call sym.ge_scalarmult_base_1
lea rdx, [rsp + 0x160]
mov rcx, rsi
call sym.fe_invert_1
mov r8, rsi
mov rdx, r14
mov rcx, r13
call sym.fe_mul_1
lea r14, [rsp + 0xa0]
mov r8, rsi
lea rdx, [rsp + 0x138]
mov rcx, r14
call sym.fe_mul_1
mov rdx, r14
mov rcx, rbx
call sym.fe_tobytes_1
lea rcx, [rsp + 0x20]
mov rdx, r13
call sym.fe_tobytes_1
movzx eax, byte [rsp + 0x20]
mov edx, 0x40
mov rcx, r12
and eax, 1
shl eax, 7
xor byte [rbx + 0x1f], al
call sym.OPENSSL_cleanse
nop
add rsp, 0x1b0
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret

Function at 0x67a400
Capabilities:
Encrypt data using curve25519

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x178
movdqu xmm2, xmmword [rdx + 0x10]
movdqu xmm1, xmmword [rdx]
movups xmmword [rsp + 0x30], xmm2
movzx eax, byte [rsp + 0x3f]
mov r12, rcx
lea r14, [rsp + 0x20]
lea rcx, [rsp + 0xd0]
mov rdx, r14
movups xmmword [rsp + 0x20], xmm1
lea rbx, [rsp + 0xa0]
and eax, 0x7f
and byte [rsp + 0x20], 0xf8
lea r13, [rsp + 0x40]
or eax, 0x40
mov byte [rsp + 0x3f], al
call sym.ge_scalarmult_base_1
mov r8d, dword [rsp + 0x118]
movdqu xmm0, xmmword [rsp + 0xf8]
paddd xmm0, xmmword [rsp + 0x120]
mov edx, dword [rsp + 0x140]
movdqu xmm3, xmmword [rsp + 0xf8]
mov ecx, dword [rsp + 0x11c]
movups xmmword [rsp + 0x40], xmm0
lea eax, [rdx + r8]
sub edx, r8d
movdqu xmm0, xmmword [rsp + 0x108]
paddd xmm0, xmmword [rsp + 0x130]
mov dword [rsp + 0x60], eax
movdqu xmm4, xmmword [rsp + 0x108]
mov eax, dword [rsp + 0x144]
mov dword [rsp + 0x90], edx
lea rdx, [rsp + 0x70]
movups xmmword [rsp + 0x50], xmm0
movdqu xmm0, xmmword [rsp + 0x120]
lea r9d, [rax + rcx]
sub eax, ecx
mov rcx, rbx
psubd xmm0, xmm3
mov dword [rsp + 0x64], r9d
movups xmmword [rsp + 0x70], xmm0
movdqu xmm0, xmmword [rsp + 0x130]
mov dword [rsp + 0x94], eax
psubd xmm0, xmm4
movups xmmword [rsp + 0x80], xmm0
call sym.fe_invert_1
mov r8, rbx
mov rdx, r13
mov rcx, r13
call sym.fe_mul_1
mov rdx, r13
mov rcx, r12
call sym.fe_tobytes_1
mov edx, 0x20
mov rcx, r14
call sym.OPENSSL_cleanse
nop
add rsp, 0x178
pop rbx
pop r12
pop r13
pop r14
ret

Function at 0x684190
Capabilities:
Encode data using base64

Disassembly:
mov r10, rcx
mov rcx, rdx
mov rdx, r8
mov r8, r9
lea r9, [r10 + 0x48]
jmp sym.BN_GF2m_mod_mul_arr
Function at 0x6887f0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r12, rcx
mov r13, rdx
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2e
mov edx, 1
lea rcx, str._TEST_ENG_OPENSSL_RC4__test_init_key___called_n
mov r9, rax
call sym.fwrite
mov rcx, r12
call sym.EVP_CIPHER_CTX_key_length
mov rcx, r12
mov ebx, eax
call sym.EVP_CIPHER_CTX_get_cipher_data
movsxd r8, ebx
mov rdx, r13
mov rcx, rax
call sym.memcpy
mov rcx, r12
call sym.EVP_CIPHER_CTX_get_cipher_data
mov rcx, r12
mov rbx, rax
call sym.EVP_CIPHER_CTX_key_length
mov rcx, r12
mov r13d, eax
call sym.EVP_CIPHER_CTX_get_cipher_data
mov r8, rbx
mov edx, r13d
lea rcx, [rax + 0x10]
call sym.RC4_set_key
mov eax, 1
add rsp, 0x20
pop rbx
pop r12
pop r13
ret

Function at 0x68ce20
Capabilities:
Encode data using base64

Disassembly:
push rbx
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test rcx, rcx
je 0x68ce3c
test byte [rcx + 0x5c], 2
lea rax, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
cmovne r10, rax
xor r11d, r11d
test r9d, r9d
jg 0x68cea1
jmp 0x68cee3
movzx eax, byte [r8 + 1]
add r8, 3
shl eax, 8
or eax, ecx
movzx ecx, byte [r8 - 1]
mov ebx, eax
shr ebx, 0x12
or ecx, eax
shr eax, 0xc
movzx ebx, byte [r10 + rbx]
and eax, 0x3f
mov byte [rdx - 4], bl
movzx eax, byte [r10 + rax]
mov byte [rdx - 3], al
mov eax, ecx
and ecx, 0x3f
shr eax, 6
and eax, 0x3f
movzx eax, byte [r10 + rax]
mov byte [rdx - 2], al
movzx eax, byte [r10 + rcx]
mov byte [rdx - 1], al
sub r9d, 3
je 0x68cee3
movzx eax, byte [r8]
mov rbx, rdx
add r11d, 4
add rdx, 4
shl eax, 0x10
mov ecx, eax
cmp r9d, 2
jg 0x68ce50
je 0x68cef0
shr eax, 0x12
movzx eax, byte [r10 + rax]
mov byte [rbx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x30
movzx eax, byte [r10 + rax]
mov byte [rbx + 1], al
mov eax, 0x3d
mov byte [rbx + 2], al
mov byte [rbx + 3], 0x3d
mov eax, r11d
mov byte [rdx], 0
pop rbx
ret
movzx r8d, byte [r8 + 1]
shl r8d, 8
or r8d, eax
shr eax, 0x12
movzx eax, byte [r10 + rax]
mov byte [rbx], al
mov eax, r8d
shr r8d, 6
shr eax, 0xc
and r8d, 0x3c
and eax, 0x3f
movzx eax, byte [r10 + rax]
mov byte [rbx + 1], al
movzx eax, byte [r10 + r8]
jmp 0x68cedc

Function at 0x68d410
Capabilities:
Encode data using base64

Disassembly:
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
jmp sym.evp_encodeblock_int
Function at 0x6914e0
Capabilities:
Hash data using murmur3

Disassembly:
mov r8d, 1
jmp sym.md4_block_data_order

Function at 0x691650
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x120], r8
mov r13, rcx
mov r14, rdx
test r8, r8
je 0x69176b
lea rax, [rsp + 0x30]
movzx edx, byte [rcx + 0xc]
lea rbp, [rcx + 0xc]
xor r12d, r12d
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x38]
movzx r8d, byte [rcx + 0x14]
lea rdi, [rcx + 0x14]
mov qword [rsp + 0x28], rax
lea rsi, [rsp + 0x40]
nop word [rax + rax]
and edx, 0xffffff9f
and r8d, 0xffffff9f
mov ebx, dword [r14 + r12]
mov r15d, dword [r14 + r12 + 4]
or r8d, 0x20
or edx, 0x40
mov rcx, rbp
add r12, 8
mov byte [r13 + 0x14], r8b
mov byte [r13 + 0xc], dl
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x3c], r15d
mov dword [rsp + 0x34], r15d
call sym.DES_set_odd_parity
mov rdx, rsi
mov rcx, rbp
call sym.DES_set_key_unchecked
mov rcx, qword [rsp + 0x20]
mov r8d, 1
mov rdx, rsi
call sym.DES_encrypt1
mov rcx, rdi
call sym.DES_set_odd_parity
mov rdx, rsi
mov rcx, rdi
call sym.DES_set_key_unchecked
mov rcx, qword [rsp + 0x28]
mov r8d, 1
mov rdx, rsi
call sym.DES_encrypt1
mov ecx, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
xor ecx, ebx
xor r8d, r15d
xor ebx, dword [rsp + 0x30]
xor r15d, dword [rsp + 0x34]
mov dword [r13 + 0x10], r8d
mov edx, ebx
mov r8d, ecx
mov dword [r13 + 0xc], ebx
mov dword [r13 + 0x14], ecx
mov dword [r13 + 0x18], r15d
cmp qword [rsp + 0x120], r12
ja 0x6916b0
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x699ce0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov r8d, 1
jmp sym.ripemd160_block_data_order
Function at 0x69cf10
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x28]
add qword [rcx], r8
mov rdi, qword [rcx + 8]
mov rsi, qword [rcx + 0x10]
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
mov r12, rcx
mov r13, rdx
mov r14, r8
test eax, eax
je 0x69cfba
mov r15d, 8
lea rcx, [rcx + rax + 0x38]
sub r15d, eax
cmp r8, r15
jb 0x69d08a
mov r8, r15
sub r14, r15
add r13, r15
call sym.memcpy
mov rcx, qword [r12 + 0x38]
mov edx, dword [r12 + 0x30]
xor rbx, rcx
test edx, edx
jle 0x69cfb7
xor eax, eax
nop dword [rax + rax]
add rdi, rsi
add rbp, rbx
rol rsi, 0xd
add eax, 1
rol rbx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rbx, rbp
add rbp, rsi
rol rsi, 0x11
add rdi, rbx
rol rbx, 0x15
xor rsi, rbp
xor rbx, rdi
rol rbp, 0x20
cmp eax, edx
jne 0x69cf80
xor rdi, rcx
mov r9d, r14d
and r14, 0xfffffffffffffff8
lea r8, [r13 + r14]
and r9d, 7
cmp r13, r8
je 0x69d02b
mov ecx, dword [r12 + 0x30]
nop dword [rax]
mov rdx, qword [r13]
xor rbx, rdx
test ecx, ecx
jle 0x69d01f
xor eax, eax
nop dword [rax]
add rdi, rsi
add rbp, rbx
rol rsi, 0xd
add eax, 1
rol rbx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rbx, rbp
add rbp, rsi
rol rsi, 0x11
add rdi, rbx
rol rbx, 0x15
xor rsi, rbp
xor rbx, rdi
rol rbp, 0x20
cmp ecx, eax
jne 0x69cfe8
add r13, 8
xor rdi, rdx
cmp r8, r13
jne 0x69cfd8
test r9d, r9d
jne 0x69d06e
movq xmm0, rdi
movq xmm1, rsi
movq xmm2, rbx
mov dword [r12 + 0x28], r9d
punpcklqdq xmm0, xmm1
movups xmmword [r12 + 8], xmm0
movq xmm0, rbp
punpcklqdq xmm0, xmm2
movups xmmword [r12 + 0x18], xmm0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r10, [r12 + 0x38]
xor eax, eax
mov edx, eax
add eax, 1
movzx ecx, byte [r8 + rdx]
mov byte [r10 + rdx], cl
cmp eax, r9d
jb 0x69d075
jmp 0x69d030
call sym.memcpy
add dword [r12 + 0x28], r14d
jmp 0x69d05d
Function at 0x69d0a0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
xor r11d, r11d
movsxd rax, dword [rcx + 0x2c]
mov rsi, rax
cmp rax, r8
jne 0x69d253
mov r8, qword [rcx]
shl r8, 0x38
cmp dword [rcx + 0x28], 7
ja case.0x69d0d4.0
mov eax, dword [rcx + 0x28]
lea r9, [0x00980800]
movsxd rax, dword [r9 + rax*4]
add rax, r9
jmp rax
movzx eax, byte [rcx + 0x3e]
shl rax, 0x30
or r8, rax
movzx eax, byte [rcx + 0x3d]
shl rax, 0x28
or r8, rax
movzx eax, byte [rcx + 0x3c]
shl rax, 0x20
or r8, rax
movzx eax, byte [rcx + 0x3b]
shl rax, 0x18
or r8, rax
movzx eax, byte [rcx + 0x3a]
shl rax, 0x10
or r8, rax
movzx eax, byte [rcx + 0x39]
shl rax, 8
or r8, rax
movzx eax, byte [rcx + 0x38]
or r8, rax
mov r9, qword [rcx + 0x20]
mov edi, dword [rcx + 0x30]
mov r10, qword [rcx + 8]
mov rax, qword [rcx + 0x10]
mov r11, qword [rcx + 0x18]
xor r9, r8
test edi, edi
jle 0x69d17f
xor ebx, ebx
nop dword [rax]
add r10, rax
add r11, r9
rol rax, 0xd
add ebx, 1
rol r9, 0x10
xor rax, r10
rol r10, 0x20
xor r9, r11
add r11, rax
rol rax, 0x11
add r10, r9
rol r9, 0x15
xor rax, r11
xor r9, r10
rol r11, 0x20
cmp ebx, edi
jne 0x69d148
xor r10, r8
mov ebx, dword [rcx + 0x34]
mov r8, r11
xor r11b, 0xff
xor r8b, 0xee
cmp esi, 0x10
cmovne r8, r11
xor r11d, r11d
test ebx, ebx
jle 0x69d1d9
nop
add r10, rax
add r8, r9
rol rax, 0xd
rol r9, 0x10
xor rax, r10
rol r10, 0x20
add r11d, 1
xor r9, r8
add r8, rax
rol rax, 0x11
add r10, r9
rol r9, 0x15
xor rax, r8
xor r9, r10
rol r8, 0x20
cmp r11d, ebx
jne 0x69d1a0
mov r11, r10
xor r11, rax
xor r11, r8
xor r11, r9
mov qword [rdx], r11
cmp dword [rcx + 0x2c], 8
mov r11d, 1
je 0x69d253
mov r11d, dword [rcx + 0x34]
xor al, 0xdd
test r11d, r11d
jle 0x69d240
xor ecx, ecx
nop dword [rax]
add r10, rax
add r8, r9
rol rax, 0xd
add ecx, 1
rol r9, 0x10
xor rax, r10
rol r10, 0x20
xor r9, r8
add r8, rax
rol rax, 0x11
add r10, r9
rol r9, 0x15
xor rax, r8
xor r9, r10
rol r8, 0x20
cmp r11d, ecx
jne 0x69d208
xor rax, r10
mov r11d, 1
xor r8, rax
xor r9, r8
mov qword [rdx + 8], r9
mov eax, r11d
pop rbx
pop rsi
pop rdi
ret
Function at 0x6a62e0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push r14
push r13
push r12
sub rsp, 0x20
mov r13, rcx
mov rcx, rdx
mov r12, rdx
call sym.UI_get_string_type
cmp eax, 2
je 0x6a6320
cmp eax, 3
je 0x6a6420
cmp eax, 1
je 0x6a63d0
mov eax, 1
add rsp, 0x20
pop r12
pop r13
pop r14
ret
mov rcx, r12
call sym.UI_get0_output_string
mov rcx, qword [0x00a5c6b0]
lea rdx, str.Verifying____s
mov r8, rax
call sym.fprintf
mov rcx, qword [0x00a5c6b0]
call sym.fflush
mov rcx, r12
call sym.UI_get_input_flags
mov r9d, 1
mov rdx, r12
mov rcx, r13
and eax, 1
mov r8d, eax
call sym.read_string_inner
test eax, eax
jle 0x6a6314
mov rcx, r12
call sym.UI_get0_test_string
mov rcx, r12
mov r13, rax
call sym.UI_get0_result_string
mov rdx, r13
mov rcx, rax
call sym.strcmp
mov r8d, eax
mov eax, 1
test r8d, r8d
je 0x6a6314
mov r9, qword [0x00a5c6b0]
mov r8d, 0xf
mov edx, 1
lea rcx, str.Verify_failure_n
call sym.fwrite
mov rcx, qword [0x00a5c6b0]
call sym.fflush
xor eax, eax
jmp 0x6a6314
mov r14, qword [0x00a5c6b0]
mov rcx, r12
call sym.UI_get0_output_string
mov rcx, rax
mov rdx, r14
call sym.fputs
mov rcx, qword [0x00a5c6b0]
call sym.fflush
mov rcx, r12
call sym.UI_get_input_flags
mov r9d, 1
and eax, 1
mov rdx, r12
mov rcx, r13
mov r8d, eax
add rsp, 0x20
pop r12
pop r13
pop r14
jmp sym.read_string_inner
mov r14, qword [0x00a5c6b0]
mov rcx, r12
call sym.UI_get0_output_string
mov rcx, rax
mov rdx, r14
call sym.fputs
mov r14, qword [0x00a5c6b0]
mov rcx, r12
call sym.UI_get0_action_string
mov rcx, rax
mov rdx, r14
call sym.fputs
mov rcx, qword [0x00a5c6b0]
call sym.fflush
mov rcx, r12
call sym.UI_get_input_flags
xor r9d, r9d
jmp 0x6a6404
Function at 0x6b1650
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x00989020]
lea rsi, [0x00989020]
mov r11d, 0x48
mov qword [rcx], rax
mov rax, qword [0x0098a060]
lea rdi, [rcx + 8]
mov rbp, rcx
and rdi, 0xfffffffffffffff8
mov r10, rbp
mov qword [rcx + 0x1040], rax
mov rax, rcx
sub rax, rdi
sub rsi, rax
add eax, 0x1048
shr eax, 3
cmp edx, 0x48
cmovle r11d, edx
mov ecx, eax
mov rax, r8
rep movsq qword [rdi], qword [rsi]
lea rdi, [rbp + 0x48]
movsxd r11, r11d
add r11, r8
nop dword [rax]
lea rcx, [rax + 1]
movzx eax, byte [rax]
cmp r11, rcx
cmovbe rcx, r8
shl eax, 8
movzx edx, byte [rcx]
lea r9, [rcx + 1]
or edx, eax
cmp r11, r9
cmovbe r9, r8
mov eax, edx
shl eax, 8
movzx edx, byte [r9]
lea rcx, [r9 + 1]
or edx, eax
cmp r11, rcx
cmovbe rcx, r8
shl edx, 8
lea rax, [rcx + 1]
movzx ecx, byte [rcx]
or edx, ecx
cmp r11, rax
cmovbe rax, r8
xor dword [r10], edx
add r10, 4
cmp rdi, r10
jne 0x6b16b8
mov qword [rsp + 0x28], 0
mov rbx, rbp
lea rsi, [rsp + 0x28]
nop
mov rdx, rbp
mov rcx, rsi
add rbx, 8
call sym.BF_encrypt
mov eax, dword [rsp + 0x28]
mov dword [rbx - 8], eax
mov eax, dword [rsp + 0x2c]
mov dword [rbx - 4], eax
cmp rbx, rdi
jne 0x6b1720
lea rdi, [rbp + 0x1048]
nop dword [rax]
mov rdx, rbp
mov rcx, rsi
add rbx, 8
call sym.BF_encrypt
mov eax, dword [rsp + 0x28]
mov dword [rbx - 8], eax
mov eax, dword [rsp + 0x2c]
mov dword [rbx - 4], eax
cmp rdi, rbx
jne 0x6b1750
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6b1820
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.BLAKE2b_Init

Function at 0x6b18a0
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 0x28
call sym.EVP_MD_CTX_md_data
mov rcx, rax
add rsp, 0x28
jmp sym.BLAKE2s_Init
Function at 0x6b1c90
Capabilities:
Encode data using xor

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [r8 + 8]
mov rbx, rdx
mov edx, dword [rdx + 8]
mov r12, rcx
mov rsi, r8
cmp edx, eax
jge 0x6b1cb7
mov edx, eax
mov rax, rbx
mov rbx, r8
mov rsi, rax
mov rcx, r12
call sym.bn_wexpand
test rax, rax
je 0x6b1e20
mov eax, dword [rsi + 8]
test eax, eax
jle 0x6b1e58
mov r10, qword [rbx]
mov r9, qword [r12]
lea edx, [rax - 1]
mov rcx, qword [rsi]
lea r8, [r10 + 0xf]
sub r8, r9
cmp r8, 0x1e
lea r8, [rcx + 0xf]
seta r11b
sub r8, r9
cmp r8, 0x1e
seta r8b
test r11b, r8b
je 0x6b1e30
cmp edx, 2
jbe 0x6b1e30
mov r8d, eax
xor edx, edx
shr r8d, 1
shl r8, 4
nop dword [rax]
movdqu xmm0, xmmword [r10 + rdx]
movdqu xmm1, xmmword [rcx + rdx]
pxor xmm0, xmm1
movups xmmword [r9 + rdx], xmm0
add rdx, 0x10
cmp rdx, r8
jne 0x6b1d20
mov edx, eax
and edx, 0xfffffffe
test al, 1
je 0x6b1d52
mov r8, qword [r10 + rdx*8]
xor r8, qword [rcx + rdx*8]
mov qword [r9 + rdx*8], r8
mov r11d, dword [rbx + 8]
cmp eax, r11d
jge 0x6b1de7
mov r9, qword [rbx]
mov r8, qword [r12]
movsxd rdx, eax
lea r10, [rdx*8 + 0x10]
lea rcx, [rdx*8]
lea rsi, [r9 + r10]
lea rbx, [r8 + rcx]
add rcx, r9
cmp rbx, rsi
setae sil
add r10, r8
cmp rcx, r10
setae r10b
or sil, r10b
je 0x6b1e08
lea r10d, [r11 - 1]
sub r10d, eax
cmp r10d, 3
jbe 0x6b1e08
mov esi, r11d
xor edx, edx
sub esi, eax
mov r10d, esi
shr r10d, 1
shl r10, 4
nop dword [rax + rax]
movdqu xmm2, xmmword [rcx + rdx]
movups xmmword [rbx + rdx], xmm2
add rdx, 0x10
cmp rdx, r10
jne 0x6b1dc0
mov edx, esi
and edx, 0xfffffffe
add eax, edx
cmp esi, edx
je 0x6b1de7
cdqe
mov rdx, qword [r9 + rax*8]
mov qword [r8 + rax*8], rdx
mov dword [r12 + 8], r11d
mov rcx, r12
call sym.bn_correct_top
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
mov rax, qword [r9 + rdx*8]
mov qword [r8 + rdx*8], rax
add rdx, 1
cmp r11d, edx
jg 0x6b1e08
jmp 0x6b1de7
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
mov r11d, edx
xor edx, edx
nop dword [rax]
mov r8, qword [r10 + rdx*8]
xor r8, qword [rcx + rdx*8]
mov qword [r9 + rdx*8], r8
mov r8, rdx
add rdx, 1
cmp r8, r11
jne 0x6b1e38
jmp 0x6b1d52
xor eax, eax
jmp 0x6b1d52
Function at 0x6c3dc0
Capabilities:
Hash data using sha512

Disassembly:
push rdi
sub rsp, 0x40
xor eax, eax
movdqu xmm0, xmmword [0x00998780]
mov rdx, rcx
mov word [rsp + 0x10], ax
xor ecx, ecx
lea rdi, [rdx + 0x48]
mov eax, edx
mov word [rsp + 0x1e], cx
and rdi, 0xfffffffffffffff8
mov qword [rsp], 0x1010040
sub eax, edi
mov dword [rsp + 0x1a], 0
lea ecx, [rax + 0xe8]
xor eax, eax
mov qword [rsp + 8], 0
shr ecx, 3
mov qword [rsp + 0x12], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rdx + 0x40], 0
mov qword [rdx + 0xe0], 0
rep stosq qword [rdi], rax
mov eax, 1
pxor xmm0, xmmword [rsp]
movups xmmword [rdx], xmm0
movdqu xmm0, xmmword [0x00998790]
pxor xmm0, xmmword [rsp + 0x10]
movups xmmword [rdx + 0x10], xmm0
movdqu xmm0, xmmword [0x009987a0]
pxor xmm0, xmmword [rsp + 0x20]
movups xmmword [rdx + 0x20], xmm0
movdqu xmm0, xmmword [0x009987b0]
pxor xmm0, xmmword [rsp + 0x30]
movups xmmword [rdx + 0x30], xmm0
add rsp, 0x40
pop rdi
ret
Function at 0x6c5350
Capabilities:
Hash data using sha256

Disassembly:
push rdi
sub rsp, 0x20
movdqu xmm0, xmmword [0x009987c0]
lea rdi, [rcx + 0x28]
mov eax, ecx
mov rdx, rcx
mov qword [rsp], 0x1010020
mov qword [rsp + 8], 0
and rdi, 0xfffffffffffffff8
mov qword [rsp + 0x10], 0
sub eax, edi
mov qword [rsp + 0x18], 0
mov qword [rcx + 0x20], 0
mov qword [rcx + 0x70], 0
lea ecx, [rax + 0x78]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
mov eax, 1
pxor xmm0, xmmword [rsp]
movups xmmword [rdx], xmm0
movdqu xmm0, xmmword [0x009987d0]
pxor xmm0, xmmword [rsp + 0x10]
movups xmmword [rdx + 0x10], xmm0
add rsp, 0x20
pop rdi
ret

Function at 0x6e5af0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]