joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bdc90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rdi, rcx
mov ebp, r8d
xor r8d, r8d
mov r10d, r9d
mov r12, rdx
mov r14d, r8d
mov ecx, r8d
movzx eax, byte [rdi + 0xe90d]
movzx r15d, byte [rdi + 0xe911]
cmp al, 1
jne 0x1400bde86
mov edx, r8d
test byte [rdi + 0xea7a], al
je 0x1400bdcea
movzx edx, word [rdi + 0xe908]
mov eax, edx
mov rcx, rbp
sub rcx, rax
mov dword [rsp + 0x110], 1
mov rsi, rbp
movzx r14d, byte [rcx + r12 - 1]
mov ecx, r14d
mov r13d, r14d
cmp word [rdi + 0xea78], r8w
jge 0x1400bde01
sub ebp, edx
mov eax, 0xff
movsxd rdx, ebp
dec rdx
add rdx, r12
lea ecx, [rbp - 1]
movzx r10d, byte [rdx]
mov esi, r10d
sub esi, ebp
add esi, r15d
shr esi, 0x1f
dec sil
cmp ecx, eax
cmovg ecx, eax
movsxd r9, ecx
test ecx, ecx
jle 0x1400bdd74
nop dword [rax + rax]
mov ecx, r10d
lea rdx, [rdx - 1]
sub ecx, r8d
movzx eax, r10b
xor al, byte [rdx + 1]
inc r8d
shr ecx, 0x1f
dec cl
and cl, al
or sil, cl
sub r9, 1
jne 0x1400bdd50
mov eax, dword [rsp + 0x128]
lea rdx, [rsp + 0x90]
mov dword [rsp + 0x38], 1
mov r9d, ebp
sub r9d, r15d
mov dword [rsp + 0x30], 1
sub r9d, r14d
mov dword [rsp + 0x28], eax
dec r9d
mov dword [rsp + 0x20], r14d
mov r8, r12
mov rcx, rdi
call qword [rdi + 0x6138]
movzx r8d, byte [rdi + 0xe911]
lea r9, [rsp + 0x90]
mov edx, ebp
mov rcx, r12
mov ebx, eax
call fcn.1400be7e0
or al, sil
not al
movzx ecx, al
shr cl, 4
and al, cl
movzx ecx, al
mov edx, ecx
shr edx, 2
and edx, ecx
mov eax, edx
shr eax, 1
and eax, edx
dec eax
add eax, ebx
je 0x1400bde7d
mov eax, 0xfffffecf
jmp 0x1400bdf0d
sub ebp, r15d
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x28], r10d
lea eax, [rbp - 1]
cmp r14d, eax
mov dword [rsp + 0x40], eax
cmova r14d, r8d
cmp r13d, eax
cmovbe r8d, ecx
mov rcx, rdi
sub ebp, r8d
mov ebx, r8d
mov r8, r12
mov dword [rsp + 0x20], ebx
lea r9d, [rbp - 1]
call qword [rdi + 0x6138]
sub rsi, rbx
lea rdx, [r12 - 1]
sub rsi, r15
lea rcx, [rsp + 0x50]
add rdx, rsi
mov r8d, r15d
mov ebp, eax
call fcn.1400c8e60
test eax, eax
jne 0x1400bddf7
test ebp, ebp
jne 0x1400bddf7
cmp r13d, dword [rsp + 0x40]
ja 0x1400bddf7
mov ecx, dword [rsp + 0x110]
jmp 0x1400bdee9
test al, al
jne 0x1400bdee9
mov dword [rsp + 0x38], 1
lea rdx, [rsp + 0x50]
mov r9d, ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], r10d
sub r9d, r15d
mov r8, r12
mov dword [rsp + 0x20], 0xffffffff
mov rcx, rdi
call qword [rdi + 0x6138]
mov rdx, rbp
lea rcx, [rsp + 0x50]
sub rdx, r15
mov r8d, r15d
add rdx, r12
mov ebx, eax
call fcn.1400c8e60
test eax, eax
jne 0x1400bddf7
test ebx, ebx
jne 0x1400bddf7
mov ecx, r14d
cmp byte [rdi + 0xe90d], 2
jne 0x1400bdefb
movzx ecx, word [rdi + 0xe90a]
jmp 0x1400bdf01
add ecx, r15d
add ecx, r14d
mov rax, qword [rsp + 0x130]
mov dword [rax], ecx
xor eax, eax
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400be7e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
movsxd r12, edx
xor edi, edi
movsxd r15, r8d
mov r14d, r12d
sub r14d, r15d
xor sil, sil
sub r14d, 0x100
mov r13, r9
movzx eax, byte [r12 + rcx - 1]
mov ebx, edi
mov ecx, r12d
sub ecx, eax
mov eax, r14d
shr eax, 0x1f
dec ecx
dec eax
mov dword [rsp + 0xc8], ecx
and r14d, eax
sub ecx, r15d
mov eax, ecx
shr eax, 0x1f
dec eax
and ecx, eax
lea eax, [r15 - 1]
mov edx, eax
mov dword [rsp + 0xd0], ecx
and edx, r15d
mov dword [rsp + 0x20], edx
jne 0x1400be864
mov ebx, ecx
sub ebx, r14d
add ebx, r15d
and ebx, eax
jmp 0x1400be8b2
cmp r15d, 0x14
jne 0x1400be88b
mov ebx, ecx
mov eax, 0x66666667
sub ebx, r14d
add ebx, r15d
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
jmp 0x1400be8b0
cmp r15d, 0x30
jne 0x1400be8b2
mov ebx, ecx
mov eax, 0x2aaaaaab
sub ebx, r14d
add ebx, r15d
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 4
sub ebx, eax
mov r8, r15
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.14014e180
movsxd r11, r14d
mov rcx, r12
cmp r11, r12
jge 0x1400be961
mov rsi, qword [rsp + 0xc0]
lea rax, [rsp + 0x30]
mov r13d, dword [rsp + 0xc8]
mov r9d, r14d
neg r9d
sub rsi, rax
nop
mov r10, rdi
test r15d, r15d
jle 0x1400be948
mov r8d, r14d
nop dword [rax + rax]
cmp r8d, r12d
jge 0x1400be945
mov eax, r8d
lea rdx, [rsp + 0x30]
sub eax, dword [rsp + 0xd0]
add rdx, r10
shr eax, 0x1f
mov ecx, r13d
sub ecx, r9d
dec al
sub ecx, r8d
inc r10
sub ecx, r14d
inc r8d
dec ecx
shr ecx, 0x1f
dec cl
and cl, al
lea rax, [rsi + r11]
and cl, byte [rax + rdx]
or byte [rdx], cl
cmp r10, r15
jl 0x1400be900
mov rcx, r12
add r14d, r15d
sub r9d, r15d
add r11, r15
cmp r11, rcx
jl 0x1400be8f0
mov r13, qword [rsp + 0xd8]
xor sil, sil
cmp dword [rsp + 0x20], edi
jne 0x1400be9a1
test r15d, r15d
jle 0x1400bea25
lea rax, [r15 - 1]
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, ebx
inc ebx
and rcx, rax
movzx ecx, byte [rsp + rcx + 0x30]
xor cl, byte [rdi + r13]
inc rdi
or sil, cl
cmp rdi, r15
jl 0x1400be980
jmp 0x1400bea25
cmp r15d, 0x14
jne 0x1400be9e6
test r15d, r15d
jle 0x1400bea25
nop dword [rax]
mov eax, 0x66666667
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
inc ebx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
movzx eax, byte [rsp + rcx + 0x30]
xor al, byte [rdi + r13]
inc rdi
or sil, al
cmp rdi, r15
jl 0x1400be9b0
jmp 0x1400bea25
cmp r15d, 0x30
jne 0x1400bea25
test r15d, r15d
jle 0x1400bea25
mov eax, 0x2aaaaaab
imul ebx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ebx
inc ebx
lea ecx, [rdx + rdx*2]
shl ecx, 4
sub eax, ecx
movsxd rcx, eax
movzx eax, byte [rsp + rcx + 0x30]
xor al, byte [rdi + r13]
inc rdi
or sil, al
cmp rdi, r15
jl 0x1400be9f1
movzx eax, sil
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400c8e60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov r10, rcx
mov r9d, eax
test r8d, r8d
jle 0x1400c8f32
cmp r8d, 8
jb 0x1400c8f32
mov qword [rsp + 0x10], rbx
lea r11, [rdx + 4]
mov qword [rsp], rdi
sub rcx, rdx
movsxd rbx, r8d
mov rdi, 0xfffffffffffffffc
and rbx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rdi, rdx
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r11 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r11 - 4]
lea r11, [r11 + 8]
punpcklbw xmm2, xmm0
lea rax, [rdi + r11]
punpcklwd xmm2, xmm0
add r9d, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [r11 - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + r11 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rax, rbx
jl 0x1400c8eb0
mov rdi, qword [rsp]
orps xmm3, xmm4
mov rbx, qword [rsp + 0x10]
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
movsxd r11, r9d
movsxd r9, r8d
cmp r11, r9
jge 0x1400c8f68
sub r10, rdx
lea rcx, [r11 + rdx]
sub r9, r11
nop word [rax + rax]
movzx r8d, byte [rcx + r10]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or eax, r8d
sub r9, 1
jne 0x1400c8f50
add rsp, 8
ret
Function at 0x1400cf4b0
Capabilities:
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
add rcx, 0x5b28
mov r8d, 0x3e8
mov qword [rbx + 0x5b20], rcx
call fcn.14014e180
mov rax, qword [rbx + 0x5b20]
mov rcx, qword [rbx + 0x5fd0]
add rax, 0x1b0
je 0x1400cf68e
xor edx, edx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [rax + 0x70], rcx
mov dword [rax], 0x6a09e667
mov dword [rax + 4], 0xbb67ae85
mov dword [rax + 8], 0x3c6ef372
mov dword [rax + 0xc], 0xa54ff53a
mov dword [rax + 0x10], 0x510e527f
mov dword [rax + 0x14], 0x9b05688c
mov dword [rax + 0x18], 0x1f83d9ab
mov dword [rax + 0x1c], 0x5be0cd19
mov qword [rax + 0x60], rdx
mov dword [rax + 0x68], edx
mov rcx, qword [rbx + 0x5b20]
add rcx, 0x228
je 0x1400cf68e
mov rax, qword [rbx + 0x5fd0]
mov qword [rcx + 0xd8], rax
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
mov dword [rcx + 0xc0], edx
mov qword [rcx + 0xc8], rdx
mov qword [rcx + 0xd0], rdx
mov rcx, qword [rbx + 0x5b20]
add rcx, 0x308
je 0x1400cf68e
mov rax, qword [rbx + 0x5fd0]
mov qword [rcx + 0xd8], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], edx
mov qword [rcx + 0xc8], rdx
mov qword [rcx + 0xd0], rdx
add rsp, 0x20
pop rbx
ret
mov eax, 0xffffff53
add rsp, 0x20
pop rbx
ret
Function at 0x1400d82d0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov rbx, rcx
mov r9d, 0xffffff53
sub r8d, 4
je 0x1400d84a4
sub r8d, 1
je 0x1400d83dc
cmp r8d, 1
jne 0x1400d8528
movdqa xmm0, xmmword [0x1401d6480]
xor eax, eax
movdqa xmm1, xmmword [0x1401d6470]
movabs rcx, 0x6a09e667f3bcc908
mov qword [rsp + 0x20], rcx
movabs rcx, 0xbb67ae8584caa73b
movdqa xmmword [rbp - 0x79], xmm0
movdqa xmm0, xmmword [0x1401d6400]
mov qword [rsp + 0x28], rcx
movdqa xmmword [rbp - 0x59], xmm0
mov qword [rbp + 0x4f], rax
movdqa xmmword [rbp - 0x69], xmm1
mov dword [rbp + 0x37], eax
mov qword [rbp + 0x3f], rax
mov qword [rbp + 0x47], rax
test rbx, rbx
jne 0x1400d8368
test edx, edx
jne 0x1400d83d2
mov r8d, edx
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140134cd0
mov r9d, eax
test eax, eax
jne 0x1400d83d2
test rbx, rbx
je 0x1400d83cc
lea rcx, [rsp + 0x20]
call fcn.140134b90
mov r9d, eax
test eax, eax
jne 0x1400d83d2
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x20]
movaps xmm1, xmmword [rbp - 0x79]
movups xmmword [rbx], xmm0
movaps xmm0, xmmword [rbp - 0x69]
movups xmmword [rbx + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x59]
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm1
call fcn.1401360f0
mov r9d, eax
mov eax, 0x40
jmp 0x1400d8523
mov r9d, 0xffffff53
mov eax, 0x40
jmp 0x1400d8523
movdqa xmm0, xmmword [0x1401d63c0]
xor eax, eax
movdqa xmm1, xmmword [0x1401d6450]
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rsp + 0x20], rcx
movabs rcx, 0x629a292a367cd507
movdqa xmmword [rbp - 0x79], xmm0
movdqa xmm0, xmmword [0x1401d63f0]
mov qword [rsp + 0x28], rcx
movdqa xmmword [rbp - 0x59], xmm0
mov qword [rbp + 0x4f], rax
movdqa xmmword [rbp - 0x69], xmm1
mov dword [rbp + 0x37], eax
mov qword [rbp + 0x3f], rax
mov qword [rbp + 0x47], rax
test rbx, rbx
jne 0x1400d843b
test edx, edx
jne 0x1400d849d
mov r8d, edx
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140134cd0
mov r9d, eax
test eax, eax
jne 0x1400d849d
test rbx, rbx
je 0x1400d8497
lea rcx, [rsp + 0x20]
call fcn.140134b90
mov r9d, eax
test eax, eax
jne 0x1400d849d
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x20]
movaps xmm1, xmmword [rbp - 0x79]
movups xmmword [rbx], xmm0
movaps xmm0, xmmword [rbp - 0x69]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
call fcn.140134a10
mov r9d, eax
mov eax, 0x30
jmp 0x1400d8523
mov r9d, 0xffffff53
mov eax, 0x30
jmp 0x1400d8523
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rbp - 0x7d], 0xa54ff53a
mov dword [rbp - 0x79], 0x510e527f
mov dword [rbp - 0x75], 0x9b05688c
mov dword [rbp - 0x71], 0x1f83d9ab
mov dword [rbp - 0x6d], 0x5be0cd19
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
mov qword [rbp - 0x19], rax
test rbx, rbx
jne 0x1400d84f7
test edx, edx
je 0x1400d850e
jmp 0x1400d851e
mov r8d, edx
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14013bb20
mov r9d, eax
test eax, eax
jne 0x1400d851e
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14013c850
mov r9d, eax
mov eax, 0x20
test r9d, r9d
je 0x1400d852b
mov eax, r9d
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rbp
ret
Function at 0x1400d8550
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f]
sub rsp, 0x100
mov rbx, rcx
mov r9d, 0xffffff53
mov ecx, dword [rbp + 0x7f]
sub ecx, 4
je 0x1400d871e
sub ecx, 1
je 0x1400d8659
cmp ecx, 1
jne 0x1400d879f
movdqa xmm0, xmmword [0x1401d6480]
xor eax, eax
movdqa xmm1, xmmword [0x1401d6470]
movabs rcx, 0x6a09e667f3bcc908
mov qword [rsp + 0x20], rcx
movabs rcx, 0xbb67ae8584caa73b
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x1401d6400]
mov qword [rsp + 0x28], rcx
movdqa xmmword [rbp - 0x61], xmm0
mov qword [rbp + 0x47], rax
movdqa xmmword [rbp - 0x71], xmm1
mov dword [rbp + 0x2f], eax
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x3f], rax
test rdx, rdx
jne 0x1400d85ea
test r8d, r8d
jne 0x1400d864f
lea rcx, [rsp + 0x20]
call fcn.140134cd0
mov r9d, eax
test eax, eax
jne 0x1400d864f
test rbx, rbx
je 0x1400d8649
lea rcx, [rsp + 0x20]
call fcn.140134b90
mov r9d, eax
test eax, eax
jne 0x1400d864f
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movaps xmm0, xmmword [rbp - 0x71]
movups xmmword [rbx + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x61]
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm1
call fcn.1401360f0
mov r9d, eax
mov eax, 0x40
jmp 0x1400d879a
mov r9d, 0xffffff53
mov eax, 0x40
jmp 0x1400d879a
movdqa xmm0, xmmword [0x1401d63c0]
xor eax, eax
movdqa xmm1, xmmword [0x1401d6450]
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rsp + 0x20], rcx
movabs rcx, 0x629a292a367cd507
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x1401d63f0]
mov qword [rsp + 0x28], rcx
movdqa xmmword [rbp - 0x61], xmm0
mov qword [rbp + 0x47], rax
movdqa xmmword [rbp - 0x71], xmm1
mov dword [rbp + 0x2f], eax
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x3f], rax
test rdx, rdx
jne 0x1400d86ba
test r8d, r8d
jne 0x1400d8717
lea rcx, [rsp + 0x20]
call fcn.140134cd0
mov r9d, eax
test eax, eax
jne 0x1400d8717
test rbx, rbx
je 0x1400d8711
lea rcx, [rsp + 0x20]
call fcn.140134b90
mov r9d, eax
test eax, eax
jne 0x1400d8717
movaps xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movaps xmm0, xmmword [rbp - 0x71]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
call fcn.140134a10
mov r9d, eax
mov eax, 0x30
jmp 0x1400d879a
mov r9d, 0xffffff53
mov eax, 0x30
jmp 0x1400d879a
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rbp - 0x7d], 0x9b05688c
mov dword [rbp - 0x79], 0x1f83d9ab
mov dword [rbp - 0x75], 0x5be0cd19
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x29], eax
mov qword [rbp - 0x21], rax
test rdx, rdx
jne 0x1400d8774
test r8d, r8d
je 0x1400d8785
jmp 0x1400d8795
lea rcx, [rsp + 0x20]
call fcn.14013bb20
mov r9d, eax
test eax, eax
jne 0x1400d8795
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14013c850
mov r9d, eax
mov eax, 0x20
test r9d, r9d
je 0x1400d87a2
mov eax, r9d
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rbp
ret
Function at 0x1400de230
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov r8d, dword [rbp + 0xd0]
mov rdi, r9
mov rsi, rdx
mov rbx, rcx
sub r8d, 4
je 0x1400de323
cmp r8d, 1
je 0x1400de276
mov eax, 0xffffff18
jmp 0x1400de3d6
mov rax, qword [rcx + 0x5fd0]
xor r8d, r8d
movdqa xmm0, xmmword [0x1401d63c0]
lea rcx, [rsp + 0x60]
movdqa xmm1, xmmword [0x1401d6450]
xor edx, edx
mov qword [rbp + 0x38], rax
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rsp + 0x60], rax
movabs rax, 0x629a292a367cd507
mov qword [rsp + 0x68], rax
xor eax, eax
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x1401d63f0]
mov dword [rbp + 0x20], eax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rax
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmmword [rbp - 0x70], xmm0
call fcn.140134cd0
test eax, eax
jne 0x1400de319
lea rcx, [rsp + 0x60]
call fcn.140134b90
test eax, eax
jne 0x1400de319
movaps xmm0, xmmword [rsp + 0x60]
lea rcx, [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movaps xmmword [rbp + 0x40], xmm0
movaps xmm0, xmmword [rbp - 0x80]
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm1
call fcn.140134a10
mov edx, 0x30
lea ecx, [rdx - 0x29]
jmp 0x1400de38d
xor eax, eax
mov dword [rsp + 0x60], 0x6a09e667
mov qword [rbp - 0x40], rax
lea rdx, [rbp + 0x40]
mov dword [rbp - 0x38], eax
mov rax, qword [rcx + 0x5fd0]
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x30], rax
mov dword [rsp + 0x64], 0xbb67ae85
mov dword [rsp + 0x68], 0x3c6ef372
mov dword [rsp + 0x6c], 0xa54ff53a
mov dword [rsp + 0x70], 0x510e527f
mov dword [rsp + 0x74], 0x9b05688c
mov dword [rsp + 0x78], 0x1f83d9ab
mov dword [rsp + 0x7c], 0x5be0cd19
call fcn.14013c850
mov edx, 0x20
lea ecx, [rdx - 0x1a]
test eax, eax
jne 0x1400de3d6
cmp byte [rbx + 0xe901], 4
je 0x1400de3a1
mov eax, 0xfffffeba
jmp 0x1400de3d6
mov dword [rsp + 0x50], ecx
lea rax, [rbp + 0x40]
mov dword [rsp + 0x48], edx
mov r9d, edx
mov qword [rsp + 0x40], rax
mov r8, rdi
mov eax, dword [rbp + 0xb8]
mov rcx, rsi
mov dword [rsp + 0x38], eax
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x30], rax
call fcn.140147a50
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400e0770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r15
sub rsp, 0x20
movzx esi, r9b
mov rdi, rcx
mov qword [rsp + 0x40], rbp
mov r15, r8
lea ebp, [rsi*8]
lea r9d, [rbp - 1]
mov byte [r9 + rcx + 0xc8], 0
movzx eax, byte [rcx + 0x190]
mov byte [rax + rcx + 0xc8], 6
or byte [r9 + rcx + 0xc8], 0x80
movzx ecx, byte [rcx + 0x190]
lea eax, [rcx + 1]
cmp r9d, eax
jbe 0x1400e07e2
mov r8d, ebp
xor edx, edx
sub r8d, ecx
add rcx, 0xc9
add rcx, rdi
sub r8d, 2
call fcn.14014e180
xor ebx, ebx
mov r8d, ebx
test esi, esi
je 0x1400e081d
mov r9, rdi
nop
lea eax, [r8*8]
inc r8d
mov edx, dword [rax + rdi + 0xcc]
lea r9, [r9 + 8]
mov eax, dword [rax + rdi + 0xc8]
shl rdx, 0x20
or rdx, rax
xor qword [r9 - 8], rdx
cmp r8d, esi
jb 0x1400e07f0
mov esi, dword [rsp + 0x60]
cmp esi, ebp
jb 0x1400e0857
mov qword [rsp + 0x48], r14
mov r14d, ebp
nop dword [rax]
mov rcx, rdi
call fcn.1400e0b50
mov ecx, ebx
mov r8, r14
add rcx, r15
mov rdx, rdi
call fcn.14014dae0
add ebx, ebp
mov eax, esi
sub eax, ebx
cmp eax, ebp
jae 0x1400e0830
mov r14, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
cmp ebx, esi
je 0x1400e087a
mov rcx, rdi
call fcn.1400e0b50
sub esi, ebx
mov ecx, ebx
add rcx, r15
mov r8d, esi
mov rdx, rdi
call fcn.14014dae0
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x1400e0890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rdx
movzx ebp, r9b
movzx edx, byte [rcx + 0x190]
mov esi, r8d
mov rbx, rcx
test dl, dl
je 0x1400e097c
movzx eax, bpl
xor r9d, r9d
shl al, 3
sub al, dl
add rdx, 0xc8
movzx ecx, al
add rdx, rbx
cmp ecx, r8d
movzx eax, sil
cmovbe eax, ecx
test al, al
je 0x1400e0911
mov r8, rdi
movzx r9d, al
sub r8, rdx
mov ecx, r9d
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x1400e0900
add byte [rbx + 0x190], r9b
sub esi, r9d
movzx ecx, byte [rbx + 0x190]
mov eax, r9d
add rdi, rax
lea eax, [rbp*8]
cmp ecx, eax
jne 0x1400e097c
xor r9d, r9d
test bpl, bpl
je 0x1400e096d
mov r8, rbx
nop
lea eax, [r9*8]
inc r9d
mov edx, dword [rax + rbx + 0xcc]
lea r8, [r8 + 8]
mov eax, dword [rax + rbx + 0xc8]
shl rdx, 0x20
or rdx, rax
xor qword [r8 - 8], rdx
cmp r9d, ebp
jb 0x1400e0940
mov rcx, rbx
call fcn.1400e0b50
mov byte [rbx + 0x190], 0
xor edx, edx
lea r15d, [rbp*8]
mov eax, esi
div r15d
mov r14d, eax
test eax, eax
je 0x1400e0a38
mov qword [rsp + 0x40], r12
mov r12d, r15d
nop
xor r9d, r9d
test ebp, ebp
je 0x1400e0a1b
mov r8, rbx
nop word [rax + rax]
lea ecx, [r9*8]
inc r9d
add rcx, rdi
lea r8, [r8 + 8]
movzx eax, byte [rcx + 6]
movzx edx, byte [rcx + 7]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 5]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 4]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 3]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 2]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx]
shl rdx, 8
or rdx, rax
xor qword [r8 - 8], rdx
cmp r9d, ebp
jb 0x1400e09b0
mov rcx, rbx
call fcn.1400e0b50
sub esi, r15d
add rdi, r12
add r14d, 0xffffffff
jne 0x1400e09a0
mov r12, qword [rsp + 0x40]
mov r8d, esi
lea rcx, [rbx + 0xc8]
mov rdx, rdi
call fcn.14014dae0
add byte [rbx + 0x190], sil
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400ed770
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov ebp, r9d
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400ed8ca
test rdx, rdx
je 0x1400ed8ca
test r8, r8
je 0x1400ed8ca
xor edx, edx
mov r8d, 0xb8
call fcn.14014e180
test ebp, ebp
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
setne al
mov byte [rbx + 0xb1], al
mov rax, rdi
movups xmmword [rsp + 0x40], xmm0
and eax, 3
je 0x1400ed7e9
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm1
test rax, rax
lea rcx, [rsp + 0x50]
lea r8, [rsp + 0x30]
cmove rcx, rdi
lea rdx, [rsp + 0x30]
xor edi, edi
mov eax, dword [rcx]
mov dword [rbx + 0x10], eax
lea r9d, [rdi + 0x20]
mov eax, dword [rcx + 4]
mov dword [rbx + 0x14], eax
mov eax, dword [rcx + 8]
mov dword [rbx + 0x18], eax
mov eax, dword [rcx + 0xc]
mov dword [rbx + 0x1c], eax
mov eax, dword [rcx + 0x10]
mov dword [rbx + 0x20], eax
mov eax, dword [rcx + 0x14]
mov dword [rbx + 0x24], eax
mov eax, dword [rcx + 0x18]
mov dword [rbx + 0x28], eax
mov eax, dword [rcx + 0x1c]
mov dword [rbx + 0x2c], eax
mov dword [rbx], 0x61707865
mov dword [rbx + 4], 0x3320646e
mov dword [rbx + 8], 0x79622d32
mov dword [rbx + 0xc], 0x6b206574
mov dword [rbx + 0x40], edi
movsd xmm0, qword [rsi]
mov ecx, dword [rsi + 8]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [rsp + 0x20]
mov dword [rbx + 0x34], eax
mov rax, qword [rsp + 0x20]
shr rax, 0x20
mov dword [rbx + 0x3c], ecx
mov rcx, rbx
mov dword [rbx + 0x38], eax
mov dword [rbx + 0x30], edi
call fcn.1401466e0
lea rcx, [rbx + 0x48]
lea rdx, [rsp + 0x30]
call fcn.14014a4c0
test eax, eax
jne 0x1400ed8cf
movsd xmm0, qword [rsi]
mov ecx, dword [rsi + 8]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [rsp + 0x20]
mov dword [rbx + 0x34], eax
mov rax, qword [rsp + 0x20]
shr rax, 0x20
mov dword [rbx + 0x38], eax
mov eax, edi
mov dword [rbx + 0x40], edi
mov dword [rbx + 0x30], 1
mov dword [rbx + 0x3c], ecx
mov byte [rbx + 0xb0], 1
jmp 0x1400ed8cf
mov eax, 0xffffff53
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret