joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ad1c0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
sub rcx, 1
mov r11, rdx
mov rax, r8
not r10
and rcx, r10
shr rcx, 0x3f
lea r10, [rcx - 1]
mov ecx, dword [rdx + 8]
mov edx, dword [r8 + 8]
xor edx, ecx
movsxd rdx, edx
and rdx, r10
xor ecx, edx
mov dword [r11 + 8], ecx
mov ecx, dword [r11 + 0x10]
xor dword [r8 + 8], edx
mov edx, dword [r8 + 0x10]
xor edx, ecx
movsxd rdx, edx
and rdx, r10
xor ecx, edx
mov dword [r11 + 0x10], ecx
mov ecx, dword [r11 + 0x14]
xor dword [r8 + 0x10], edx
mov edx, dword [r8 + 0x14]
xor edx, ecx
and rdx, r10
and edx, 4
xor ecx, edx
mov dword [r11 + 0x14], ecx
xor dword [r8 + 0x14], edx
test r9d, r9d
jle 0x1400ad2d1
mov r8, qword [r11]
mov r11, qword [rax]
lea eax, [r9 - 1]
lea rdx, [r8 + 0xf]
sub rdx, r11
cmp rdx, 0x1e
jbe 0x1400ad2d8
cmp eax, 1
jbe 0x1400ad2d8
mov eax, r9d
movq xmm2, r10
mov rcx, r8
mov rdx, r11
shr eax, 1
punpcklqdq xmm2, xmm2
shl rax, 4
add rax, r8
movdqu xmm3, xmmword [rcx]
movdqu xmm0, xmmword [rdx]
add rcx, 0x10
add rdx, 0x10
pxor xmm0, xmm3
movdqu xmm1, xmm3
pand xmm0, xmm2
pxor xmm1, xmm0
movups xmmword [rcx - 0x10], xmm1
movdqu xmm4, xmmword [rdx - 0x10]
pxor xmm0, xmm4
movups xmmword [rdx - 0x10], xmm0
cmp rcx, rax
jne 0x1400ad270
mov eax, r9d
and eax, 0xfffffffe
and r9d, 1
je 0x1400ad2d1
shl rax, 3
add r8, rax
add rax, r11
mov rcx, qword [r8]
mov rdx, qword [rax]
xor rdx, rcx
and rdx, r10
xor rcx, rdx
mov qword [r8], rcx
xor qword [rax], rdx
ret
mov r9d, eax
xor ecx, ecx
nop dword [rax]
mov rdx, qword [r8 + rcx*8]
mov rax, qword [r11 + rcx*8]
xor rax, rdx
and rax, r10
xor rdx, rax
mov qword [r8 + rcx*8], rdx
xor qword [r11 + rcx*8], rax
mov rax, rcx
add rcx, 1
cmp r9, rax
jne 0x1400ad2e0
ret
Function at 0x1400cc8a0
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, qword [rcx + 0x78]
test rdx, rdx
je 0x1400cc9f8
movzx ecx, byte [rdx + 1]
movzx r9d, byte [rdx + 2]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx]
or ecx, r9d
movzx r9d, byte [rdx + 3]
shl r9d, 0x18
or ecx, r9d
mov dword [rax], ecx
movzx ecx, byte [rdx + 5]
movzx r9d, byte [rdx + 6]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 4]
or ecx, r9d
movzx r9d, byte [rdx + 7]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 4], ecx
movzx ecx, byte [rdx + 9]
movzx r9d, byte [rdx + 0xa]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 8]
or ecx, r9d
movzx r9d, byte [rdx + 0xb]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 8], ecx
movzx ecx, byte [rdx + 0xd]
movzx r9d, byte [rdx + 0xe]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0xc]
or ecx, r9d
movzx r9d, byte [rdx + 0xf]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0xc], ecx
movzx ecx, byte [rdx + 0x11]
movzx r9d, byte [rdx + 0x12]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x10]
or ecx, r9d
movzx r9d, byte [rdx + 0x13]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x10], ecx
movzx ecx, byte [rdx + 0x15]
movzx r9d, byte [rdx + 0x16]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x14]
or ecx, r9d
movzx r9d, byte [rdx + 0x17]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x14], ecx
movzx ecx, byte [rdx + 0x19]
movzx r9d, byte [rdx + 0x1a]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x18]
or ecx, r9d
movzx r9d, byte [rdx + 0x1b]
shl r9d, 0x18
or ecx, r9d
mov dword [rax + 0x18], ecx
movzx ecx, byte [rdx + 0x1d]
movzx r9d, byte [rdx + 0x1e]
shl ecx, 8
shl r9d, 0x10
or ecx, r9d
movzx r9d, byte [rdx + 0x1c]
movzx edx, byte [rdx + 0x1f]
or ecx, r9d
shl edx, 0x18
or edx, ecx
mov dword [rax + 0x1c], edx
test r8, r8
je 0x1400cca98
movzx edx, byte [r8 + 2]
movzx ecx, byte [r8 + 1]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8]
or edx, ecx
movzx ecx, byte [r8 + 3]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x20], edx
movzx edx, byte [r8 + 6]
movzx ecx, byte [r8 + 5]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8 + 4]
or edx, ecx
movzx ecx, byte [r8 + 7]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x24], edx
movzx edx, byte [r8 + 0xa]
movzx ecx, byte [r8 + 9]
shl edx, 0x10
shl ecx, 8
or edx, ecx
movzx ecx, byte [r8 + 8]
or edx, ecx
movzx ecx, byte [r8 + 0xb]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x28], edx
movzx edx, byte [r8 + 0xd]
movzx ecx, byte [r8 + 0xe]
shl edx, 8
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [r8 + 0xc]
or edx, ecx
movzx ecx, byte [r8 + 0xf]
shl ecx, 0x18
or edx, ecx
mov dword [rax + 0x2c], edx
mov dword [rax + 0x70], 0
mov eax, 1
ret
Function at 0x1400f7850
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x1406a42a0]
test eax, eax
je 0x1400f7880
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [0x1406a42a0], 1
mov r8d, 0x30
lea rdx, [0x1406a4240]
lea rcx, str.OPENSSL_ia32cap
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0x2e
ja 0x1400f7a60
movzx ebp, word [0x1406a4240]
xor edx, edx
mov esi, 0xa
lea rax, [0x1406a4240]
cmp bp, 0x7e
sete dl
lea rbx, [rax + rdx*2]
cmp word [rbx], 0x30
je 0x1400f7ac0
xor r13d, r13d
mov edi, esi
jmp 0x1400f78f8
sub r12d, 0x30
cmp esi, r12d
jbe 0x1400f7921
imul r13, rdi
add r13, r12
movzx r12d, word [rbx]
add rbx, 2
mov ecx, r12d
call fcn.1400f81c0
test eax, eax
jne 0x1400f78e8
mov edx, 0x10
mov ecx, r12d
call fcn.1400f81a0
test eax, eax
jne 0x1400f7a18
cmp bp, 0x7e
je 0x1400f7a80
movzx r14d, word [0x1406a4240]
cmp r14w, 0x3a
je 0x1400f7b00
test r14w, r14w
je 0x1400f7a48
lea rax, [0x1406a4240]
jmp 0x1400f7966
add rax, 2
test r14w, r14w
je 0x1400f7a48
mov edx, r14d
movzx r14d, word [rax + 2]
cmp dx, 0x3a
jne 0x1400f7958
xor edx, edx
cmp r14w, 0x7e
sete dl
add rdx, 1
lea rbx, [rax + rdx*2]
cmp word [rbx], 0x30
je 0x1400f7b40
mov esi, 0xa
xor ebp, ebp
mov edi, esi
jmp 0x1400f79b0
sub r12d, 0x30
cmp esi, r12d
jbe 0x1400f79d5
imul rbp, rdi
add rbp, r12
movzx r12d, word [rbx]
add rbx, 2
mov ecx, r12d
call fcn.1400f81c0
test eax, eax
jne 0x1400f79a0
mov edx, 0x10
mov ecx, r12d
call fcn.1400f81a0
test eax, eax
jne 0x1400f7a30
mov rax, rbp
shr rax, 0x20
cmp r14w, 0x7e
je 0x1400f7ae0
mov rdx, qword [0x14061b060]
mov qword [rdx + 8], rbp
mov eax, r13d
shr r13, 0x20
or ah, 4
mov dword [rdx + 4], r13d
mov dword [rdx], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, r12d
call fcn.1400f81f0
lea r12d, [rax - 0x57]
jmp 0x1400f78ec
mov ecx, r12d
call fcn.1400f81f0
lea r12d, [rax - 0x57]
jmp 0x1400f79a4
mov rdx, qword [0x14061b060]
mov qword [rdx + 8], 0
jmp 0x1400f79f2
mov rcx, qword [0x14061b060]
call fcn.140098510
mov rdx, qword [0x14061b060]
mov r13, rax
jmp 0x1400f79f2
mov rcx, qword [0x14061b060]
call fcn.140098510
mov r8, rax
mov rax, r13
not rax
and rax, r8
test r13d, 0x1000000
je 0x1400f7b20
movabs r12, 0xedfff7fdffffffff
movzx r14d, word [0x1406a4240]
and rax, r12
mov r13, rax
jmp 0x1400f793e
movzx ecx, word [rbx + 2]
call fcn.1400f81f0
cmp eax, 0x78
je 0x1400f7b30
add rbx, 2
mov esi, 8
jmp 0x1400f78da
mov rdx, qword [0x14061b060]
mov r12d, ebp
not eax
not r12d
and dword [rdx + 0xc], eax
and dword [rdx + 8], r12d
jmp 0x1400f79f2
mov rcx, qword [0x14061b060]
call fcn.140098510
movzx r14d, word [0x1406a4240]
mov r13, rax
jmp 0x1400f793e
movzx r14d, word [0x1406a4240]
mov r13, rax
jmp 0x1400f793e
add rbx, 4
mov esi, 0x10
jmp 0x1400f78da
movzx ecx, word [rbx + 2]
call fcn.1400f81f0
cmp eax, 0x78
je 0x1400f7b5c
add rbx, 2
mov esi, 8
jmp 0x1400f7995
add rbx, 4
mov esi, 0x10
jmp 0x1400f7995
Function at 0x1401044b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x120], r8
mov r13, rcx
mov r14, rdx
test r8, r8
je 0x1401045cb
lea rax, [rsp + 0x30]
movzx edx, byte [rcx + 0xc]
lea rbp, [rcx + 0xc]
xor r12d, r12d
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x38]
movzx r8d, byte [rcx + 0x14]
lea rdi, [rcx + 0x14]
mov qword [rsp + 0x28], rax
lea rsi, [rsp + 0x40]
nop word [rax + rax]
and edx, 0xffffff9f
and r8d, 0xffffff9f
mov ebx, dword [r14 + r12]
mov r15d, dword [r14 + r12 + 4]
or r8d, 0x20
or edx, 0x40
mov rcx, rbp
add r12, 8
mov byte [r13 + 0x14], r8b
mov byte [r13 + 0xc], dl
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x3c], r15d
mov dword [rsp + 0x34], r15d
call fcn.14021c320
mov rdx, rsi
mov rcx, rbp
call fcn.14021c580
mov rcx, qword [rsp + 0x20]
mov r8d, 1
mov rdx, rsi
call fcn.140218af0
mov rcx, rdi
call fcn.14021c320
mov rdx, rsi
mov rcx, rdi
call fcn.14021c580
mov rcx, qword [rsp + 0x28]
mov r8d, 1
mov rdx, rsi
call fcn.140218af0
mov ecx, dword [rsp + 0x38]
mov r8d, dword [rsp + 0x3c]
xor ecx, ebx
xor r8d, r15d
xor ebx, dword [rsp + 0x30]
xor r15d, dword [rsp + 0x34]
mov dword [r13 + 0x10], r8d
mov edx, ebx
mov r8d, ecx
mov dword [r13 + 0xc], ebx
mov dword [r13 + 0x14], ecx
mov dword [r13 + 0x18], r15d
cmp qword [rsp + 0x120], r12
ja 0x140104510
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140104f00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140105020
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140104f60
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140104f60
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140104f60
Function at 0x140108330
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xc8]
mov rbx, rcx
mov rdi, rdx
mov r12, r9
test r8, r8
je 0x1401083b3
lea r13, [rcx + r8]
mov ecx, dword [rsp + 0xc0]
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
test ecx, ecx
jne 0x1401083c0
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
movzx edx, byte [rsi]
xor edx, eax
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov byte [rdi - 1], dl
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x140108370
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, rsi
add rbx, 1
mov qword [rsp + 0x28], rdx
mov rdx, rsi
add rdi, 1
call rbp
movzx eax, byte [rbx - 1]
xor al, byte [rsi]
mov byte [rdi - 1], al
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x21]
mov rdx, qword [rsp + 0x29]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
cmp r13, rbx
jne 0x1401083c0
jmp 0x1401083b3
Function at 0x14010adc0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 0x30]
lea rdi, [rax*8]
mov rax, qword [rcx + 0x38]
mov rbx, rcx
mov r12, rdx
lea r13, [rcx + 0x190]
mov rbp, r8
lea rsi, [rax*8]
mov eax, dword [rcx + 0x178]
lea r15, [rcx + 0x60]
lea r14, [rcx + 0x40]
test eax, eax
jne 0x14010aeb0
mov eax, dword [rcx + 0x17c]
test eax, eax
jne 0x14010ae90
mov rcx, r13
mov r9d, 0x10
mov rdx, rdi
mov rax, rsi
mov r8, r13
bswap rdx
bswap rax
mov qword [rcx], rdx
mov rdx, r15
mov qword [rcx + 8], rax
mov rcx, r14
call qword [rbx + 0x168]
movdqu xmm0, xmmword [rbx + 0x40]
movdqu xmm1, xmmword [rbx + 0x20]
pxor xmm0, xmm1
movups xmmword [rbx + 0x40], xmm0
test r12, r12
je 0x14010af18
cmp rbp, 0x10
ja 0x14010af18
mov r8, rbp
mov rdx, r12
mov rcx, r14
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140098790
mov rcx, r14
mov rdx, r15
call qword [rbx + 0x170]
mov rcx, r13
mov r9d, 0x10
jmp 0x14010ae21
lea r9d, [rax + 0xf]
mov ecx, eax
xor edx, edx
and r9d, 0xfffffff0
add rcx, r13
mov r8d, r9d
mov dword [rsp + 0x2c], r9d
sub r8d, eax
call sub.msvcrt.dll_memset
mov r9d, dword [rsp + 0x2c]
cmp r9d, 0x30
je 0x14010aef0
mov ecx, r9d
add r9d, 0x10
add rcx, r13
jmp 0x14010ae21
mov r9d, 0x30
mov rcx, r14
mov r8, r13
mov rdx, r15
call qword [rbx + 0x168]
mov rcx, r13
mov r9d, 0x10
jmp 0x14010ae21
mov eax, 0xffffffff
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14010d400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, qword [rcx + 0x28]
mov rax, qword [rcx + 0x58]
mov rbx, rcx
mov rsi, rdx
cmp rdi, rdx
jae 0x14010d5ef
mov rcx, qword [rcx + 0x30]
cmp rcx, rdx
jbe 0x14010d5b6
lea r11, [rdi + 1]
mov r10, r11
shl r10, 4
jmp 0x14010d448
mov rax, qword [rbx + 0x58]
add r11, 1
lea rdx, [rax + r10]
lea rax, [rax + r10 - 0x10]
movzx r9d, byte [rax + 0xf]
movzx r8d, byte [rax + 0xe]
movzx ecx, byte [rax]
lea ebp, [r8 + r8]
lea edi, [r9 + r9]
sar r9d, 7
sar r8d, 7
or r9d, ebp
sar cl, 7
mov byte [rdx + 0xe], r9b
movzx r9d, byte [rax + 0xd]
and ecx, 0xffffff87
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xd], r8b
movzx r8d, byte [rax + 0xc]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xc], r9b
movzx r9d, byte [rax + 0xb]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 0xb], r8b
movzx r8d, byte [rax + 0xa]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 0xa], r9b
movzx r9d, byte [rax + 9]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 9], r8b
movzx r8d, byte [rax + 8]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 8], r9b
movzx r9d, byte [rax + 7]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 7], r8b
movzx r8d, byte [rax + 6]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 6], r9b
movzx r9d, byte [rax + 5]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 5], r8b
movzx r8d, byte [rax + 4]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 4], r9b
movzx r9d, byte [rax + 3]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 3], r8b
movzx r8d, byte [rax + 2]
lea ebp, [r8 + r8]
sar r8d, 7
or r9d, ebp
mov byte [rdx + 2], r9b
movzx r9d, byte [rax + 1]
lea ebp, [r9 + r9]
sar r9d, 7
or r8d, ebp
mov byte [rdx + 1], r8b
movzx r8d, byte [rax]
lea eax, [r8 + r8]
or eax, r9d
xor ecx, edi
add r10, 0x10
mov byte [rdx], al
mov byte [rdx + 0xf], cl
cmp r11, rsi
jne 0x14010d440
mov rax, qword [rbx + 0x58]
mov qword [rbx + 0x28], r11
shl r11, 4
add rax, r11
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [rdx + 4]
mov r9d, 0x71
lea r8, str.crypto_modes_ocb128.c
sub rdx, rcx
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, rax
mov qword [rbx + 0x30], rdx
shl rdx, 4
call fcn.140095b70
test rax, rax
je 0x14010d5ad
mov qword [rbx + 0x58], rax
jmp 0x14010d42c
shl rsi, 4
add rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1401154c0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x1401154f5
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x1401154d0
and r10, 0xf
je 0x140115526
mov r9, 0x10
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140115501
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x14011551a
mov rax, r8
repz ret
Function at 0x140115530
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x14011556d
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140115540
pxor xmm1, xmm1
and r10, 0xf
je 0x1401155a4
mov r9, 0x10
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x14011557c
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140115598
mov rax, r8
repz ret
Function at 0x140128350
Capabilities:
Check for software breakpoints

Disassembly:
push r12
sub rsp, 0x20
mov eax, dword [rsp + 0x50]
cmp eax, r9d
jne 0x140128438
movzx r9d, byte [r8]
lea edx, [r9 - 0x6a]
cmp dl, 1
ja 0x140128438
lea rdx, [r8 + 1]
lea r12d, [rax - 2]
cmp r9b, 0x6b
je 0x1401283a8
movsxd rax, r12d
cmp byte [rdx + rax], 0xcc
jne 0x140128472
mov r8d, r12d
call sub.msvcrt.dll_memcpy
mov eax, r12d
add rsp, 0x20
pop r12
ret
lea r12d, [rax - 3]
test r12d, r12d
jle 0x1401283db
xor eax, eax
jmp 0x1401283c6
cmp r8b, 0xbb
jne 0x1401283f0
add eax, 1
cmp r12d, eax
je 0x140128430
movzx r8d, byte [rdx]
add rdx, 1
cmp r8b, 0xba
jne 0x1401283b8
sub r12d, eax
test eax, eax
jne 0x140128382
call fcn.1400bf100
lea r8, str.RSA_padding_check_X931
mov edx, 0x56
jmp 0x140128401
call fcn.1400bf100
lea r8, str.RSA_padding_check_X931
mov edx, 0x4e
lea rcx, str.crypto_rsa_rsa_x931.c
mov r12d, 0xffffffff
call fcn.1400bf220
xor r8d, r8d
mov edx, 0x8a
mov ecx, 4
call fcn.1400bf330
mov eax, r12d
add rsp, 0x20
pop r12
ret
xor r12d, r12d
jmp 0x140128382
call fcn.1400bf100
mov edx, 0x43
lea r8, str.RSA_padding_check_X931
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.1400bf220
xor r8d, r8d
mov edx, 0x89
mov ecx, 4
call fcn.1400bf330
mov r12d, 0xffffffff
jmp 0x140128397
call fcn.1400bf100
mov edx, 0x5f
lea r8, str.RSA_padding_check_X931
lea rcx, str.crypto_rsa_rsa_x931.c
call fcn.1400bf220
xor r8d, r8d
mov edx, 0x8b
mov ecx, 4
call fcn.1400bf330
mov r12d, 0xffffffff
jmp 0x140128397

Function at 0x14012a800
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14012a820
mov rax, qword [0x14061b110]
mov qword [rsp + 0x30], rax
jmp fcn.140105780
mov rax, qword [0x14061b100]
mov qword [rsp + 0x30], rax
jmp fcn.1401059a0
Function at 0x1401488d0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
lea r9, [0x140599de0]
lea rax, [0x14059ae60]
lea rsi, [r9 + 0x80]
mov r11d, dword [rcx]
mov r10d, dword [rcx + 4]
mov r8d, dword [rcx + 8]
mov ecx, dword [rcx + 0xc]
bswap r11d
bswap r10d
xor r11d, 0xa3b1bac6
xor r10d, 0x56aa3350
bswap r8d
bswap ecx
mov edi, r8d
mov ebx, ecx
xor edi, 0x677d9197
xor ebx, 0xb27022dc
nop dword [rax + rax]
mov r8d, ebx
mov ebp, r10d
xor r8d, edi
xor ebp, r8d
xor ebp, dword [r9]
xor r8d, dword [r9 + 4]
mov ecx, ebp
movzx r12d, bpl
shr ecx, 0x18
movzx r12d, byte [rax + r12]
movzx ecx, byte [rax + rcx]
shl ecx, 0x18
or ecx, r12d
mov r12d, ebp
shr r12d, 0x10
movzx r12d, r12b
movzx r12d, byte [rax + r12]
shl r12d, 0x10
or r12d, ecx
mov ecx, ebp
movzx ebp, ch
mov ecx, r12d
movzx ebp, byte [rax + rbp]
shl ebp, 8
or ecx, ebp
mov ebp, ecx
mov r12d, ecx
rol ebp, 0xd
ror r12d, 9
xor ebp, r12d
xor ecx, ebp
xor r11d, ecx
xor r8d, r11d
mov ecx, r8d
movzx ebp, r8b
shr ecx, 0x18
movzx ebp, byte [rax + rbp]
movzx ecx, byte [rax + rcx]
shl ecx, 0x18
or ecx, ebp
mov ebp, r8d
shr ebp, 0x10
movzx ebp, bpl
movzx ebp, byte [rax + rbp]
shl ebp, 0x10
or ebp, ecx
mov ecx, r8d
movzx ecx, ch
movzx r8d, byte [rax + rcx]
mov ecx, ebp
shl r8d, 8
or ecx, r8d
mov r8d, ecx
rol r8d, 0xd
xor r8d, ecx
ror ecx, 9
xor r10d, r8d
xor r10d, ecx
mov ecx, dword [r9 + 8]
xor ecx, ebx
xor ecx, r11d
add r9, 0x10
xor ecx, r10d
mov r8d, ecx
movzx ebp, cl
shr r8d, 0x18
movzx ebp, byte [rax + rbp]
movzx r8d, byte [rax + r8]
shl r8d, 0x18
or r8d, ebp
mov ebp, ecx
movzx ecx, ch
shr ebp, 0x10
movzx ecx, byte [rax + rcx]
movzx ebp, bpl
movzx ebp, byte [rax + rbp]
shl ecx, 8
shl ebp, 0x10
or r8d, ebp
or r8d, ecx
mov ecx, r8d
rol ecx, 0xd
xor ecx, r8d
ror r8d, 9
xor edi, ecx
mov ecx, dword [r9 - 4]
mov dword [rdx], r11d
xor edi, r8d
mov dword [rdx + 4], r10d
xor ecx, r11d
mov dword [rdx + 8], edi
xor ecx, r10d
xor ecx, edi
mov r8d, ecx
movzx ebp, cl
shr r8d, 0x18
movzx ebp, byte [rax + rbp]
movzx r8d, byte [rax + r8]
shl r8d, 0x18
or r8d, ebp
mov ebp, ecx
movzx ecx, ch
shr ebp, 0x10
movzx ecx, byte [rax + rcx]
movzx ebp, bpl
movzx ebp, byte [rax + rbp]
shl ecx, 8
shl ebp, 0x10
or r8d, ebp
or ecx, r8d
mov r8d, ecx
rol r8d, 0xd
xor r8d, ecx
ror ecx, 9
xor ebx, r8d
xor ebx, ecx
add rdx, 0x10
mov dword [rdx - 4], ebx
cmp r9, rsi
jne 0x140148928
mov eax, 1
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14017a8e0
Capabilities:
Hash data using sha512

Disassembly:
push rdi
movdqu xmm3, xmmword [0x1405b7ed0]
movdqu xmm2, xmmword [0x1405b7ee0]
movdqu xmm1, xmmword [0x1405b7ef0]
movdqu xmm0, xmmword [0x1405b7f00]
lea rdi, [rcx + 0x48]
mov eax, ecx
mov r8, rcx
mov qword [rcx + 0x40], 0
mov qword [rcx + 0xe8], 0
and rdi, 0xfffffffffffffff8
sub eax, edi
lea ecx, [rax + 0xf0]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
movups xmmword [r8], xmm3
movups xmmword [r8 + 0x10], xmm2
movups xmmword [r8 + 0x20], xmm1
movups xmmword [r8 + 0x30], xmm0
movzx eax, byte [rdx]
mov qword [r8 + 0xe8], rax
lea rax, [r8 + 0xf]
sub rax, rdx
cmp rax, 0x1e
jbe 0x14017a9a0
movdqu xmm4, xmmword [rdx]
mov eax, 1
pxor xmm3, xmm4
movups xmmword [r8], xmm3
movdqu xmm5, xmmword [rdx + 0x10]
pxor xmm2, xmm5
movups xmmword [r8 + 0x10], xmm2
movdqu xmm4, xmmword [rdx + 0x20]
pxor xmm1, xmm4
movups xmmword [r8 + 0x20], xmm1
movdqu xmm1, xmmword [rdx + 0x30]
pxor xmm0, xmm1
movups xmmword [r8 + 0x30], xmm0
pop rdi
ret
mov rax, qword [rdx]
xor qword [r8], rax
mov rax, qword [rdx + 8]
xor qword [r8 + 8], rax
mov rax, qword [rdx + 0x10]
xor qword [r8 + 0x10], rax
mov rax, qword [rdx + 0x18]
xor qword [r8 + 0x18], rax
mov rax, qword [rdx + 0x20]
xor qword [r8 + 0x20], rax
mov rax, qword [rdx + 0x28]
xor qword [r8 + 0x28], rax
mov rax, qword [rdx + 0x30]
xor qword [r8 + 0x30], rax
mov rax, qword [rdx + 0x38]
xor qword [r8 + 0x38], rax
mov eax, 1
pop rdi
ret
Function at 0x14017c250
Capabilities:
Hash data using sha256

Disassembly:
push rdi
movdqu xmm1, xmmword [0x1405b7f20]
movdqu xmm0, xmmword [0x1405b7f30]
lea rdi, [rcx + 0x28]
mov eax, ecx
mov r8, rcx
mov qword [rcx + 0x20], 0
and rdi, 0xfffffffffffffff8
mov qword [rcx + 0x78], 0
sub eax, edi
lea ecx, [rax + 0x80]
xor eax, eax
shr ecx, 3
rep stosq qword [rdi], rax
movups xmmword [r8], xmm1
movups xmmword [r8 + 0x10], xmm0
movzx eax, byte [rdx]
mov qword [r8 + 0x78], rax
lea rax, [r8 + 0xf]
sub rax, rdx
cmp rax, 0x1e
jbe 0x14017c2d0
movdqu xmm2, xmmword [rdx]
mov eax, 1
pxor xmm1, xmm2
movups xmmword [r8], xmm1
movdqu xmm1, xmmword [rdx + 0x10]
pxor xmm0, xmm1
movups xmmword [r8 + 0x10], xmm0
pop rdi
ret
mov eax, dword [rdx]
xor dword [r8], eax
mov eax, dword [rdx + 4]
xor dword [r8 + 4], eax
mov eax, dword [rdx + 8]
xor dword [r8 + 8], eax
mov eax, dword [rdx + 0xc]
xor dword [r8 + 0xc], eax
mov eax, dword [rdx + 0x10]
xor dword [r8 + 0x10], eax
mov eax, dword [rdx + 0x14]
xor dword [r8 + 0x14], eax
mov eax, dword [rdx + 0x18]
xor dword [r8 + 0x18], eax
mov eax, dword [rdx + 0x1c]
xor dword [r8 + 0x1c], eax
mov eax, 1
pop rdi
ret