joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140044363
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov eax, dword [rsi + 8]
test eax, eax
jne 0x140044385
mov rcx, rsi
call fcn.140043d99
mov eax, dword [rsi + 8]
cmp eax, 2
je 0x1400443ac
cmp eax, 1
jne 0x14004441a
add rsi, 0x10
mov rcx, rsi
mov rdx, rdi
mov r8d, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140047aed
mov r9, qword [rsi]
test r9, r9
jne 0x1400443d0
lea rcx, str.ctx__lgfp
lea rdx, str..._logging.c
mov r8d, 0x2f
call fcn.1400b5fb0
mov r9, qword [rsi]
movsxd rbx, ebx
mov edx, 1
mov rcx, rdi
mov r8, rbx
call fcn.1400b8598
cmp rax, rbx
jae 0x14004441a
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400443fc
call fcn.1400b795c
mov qword [rsi], 0
mov dword [rsi + 8], 3
mov rcx, qword [rsi + 0x30]
lea rdx, str.Disabled_writing_session_log_due_to_error_while_writing
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140092645
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140047976
Capabilities:
Encode data using base64

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x14002e420]
mov qword [rsp + 0x38], rax
mov rsi, 0xffffffffffffffff
movsx r8d, byte [rcx + rsi + 1]
mov eax, r8d
add al, 0xbf
cmp al, 0x19
ja 0x1400479a3
add r8d, 0xffffffbf
jmp 0x1400479ed
mov eax, r8d
add al, 0x9f
cmp al, 0x19
ja 0x1400479b2
add r8d, 0xffffffb9
jmp 0x1400479ed
mov eax, r8d
add al, 0xd0
cmp al, 9
ja 0x1400479c1
add r8d, 4
jmp 0x1400479ed
cmp r8b, 0x2b
je 0x1400479df
cmp r8b, 0x3d
je 0x1400479e7
cmp r8b, 0x2f
jne 0x140047a95
mov r8d, 0x3f
jmp 0x1400479ed
mov r8d, 0x3e
jmp 0x1400479ed
mov r8d, 0xffffffff
mov dword [rsp + rsi*4 + 0x24], r8d
inc rsi
cmp rsi, 3
jl 0x14004798e
mov ecx, dword [rsp + 0x20]
xor esi, esi
cmp ecx, 0xffffffff
je 0x140047a97
mov eax, dword [rsp + 0x24]
cmp eax, 0xffffffff
je 0x140047a97
mov r8d, dword [rsp + 0x28]
mov r9d, dword [rsp + 0x2c]
cmp r8d, 0xffffffff
je 0x140047a81
xor esi, esi
cmp r9d, 0xffffffff
sete sil
mov r10d, 3
sub r10d, esi
and r9d, 0x3f
shl ecx, 0x12
shl eax, 0xc
or ecx, eax
shr ecx, 0x10
mov byte [rdx], cl
mov esi, 1
cmp r10d, 2
jb 0x140047a97
shl r8d, 6
mov ecx, r8d
and ecx, 0xf00
or ecx, eax
mov byte [rdx + 1], ch
mov esi, 2
cmp r10d, 3
jne 0x140047a97
or r9d, r8d
mov byte [rdx + 2], r9b
mov esi, 3
jmp 0x140047a97
cmp r9d, 0xffffffff
jne 0x140047a97
mov r10d, 1
mov r9d, 0x3f
jmp 0x140047a3e
xor esi, esi
mov rcx, qword [rsp + 0x38]
call fcn.1400a8e70
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x140047f55
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140047f7e
xor r9d, r9d
mov al, byte [rdx]
inc rdx
xor al, byte [rcx]
inc rcx
movzx eax, al
or r9d, eax
dec r8
jne 0x140047f5d
mov eax, 0x100
sub eax, r9d
shr eax, 8
ret
mov eax, 1
ret

Function at 0x14004c408
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x34
call fcn.140039aa1
cmp byte [rax], 0
je 0x14004c42c
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.1400471aa
mov edx, 0x35
mov rcx, rsi
call fcn.140039937
test eax, eax
je 0x14004c447
add rsp, 0x20
pop rsi
jmp fcn.14009f47f
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14005051c
Capabilities:
Hide graphical window

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1e0
mov edi, r8d
mov ebx, edx
mov r14, rcx
mov rax, qword [0x14002e420]
mov qword [rsp + 0x1d8], rax
cmp dword [0x140029098], 0
je 0x140050727
cmp qword [0x1400290a0], 0
jne 0x140050625
cmp word [0x1400290a8], 0
jne 0x1400505b5
lea rcx, [rsp + 0x80]
mov dword [rcx], 3
lea rax, [0x140050744]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], 0
mov rax, qword [0x14002b2b0]
mov qword [rcx + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x20], xmm0
lea rax, str.SizeTipClass
mov qword [rcx + 0x40], rax
call qword [sym.imp.USER32.dll_RegisterClassA]
mov word [0x1400290a8], ax
mov rsi, qword [sym.imp.USER32.dll_GetSysColor]
mov ecx, 0x18
call rsi
mov dword [0x1400290ac], eax
mov ecx, 0x17
call rsi
mov dword [0x1400290b0], eax
lea rsi, [rsp + 0x84]
xor edx, edx
mov r8d, 0x150
mov rcx, rsi
call fcn.1400aa3a0
mov dword [rsi - 4], 0x154
lea r8, [rsp + 0x80]
mov ecx, 0x29
mov edx, 0x154
xor r9d, r9d
call qword [sym.imp.USER32.dll_SystemParametersInfoA]
lea rcx, [rsp + 0x15c]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov qword [0x1400290b8], rax
lea rdx, str._dx_d
lea rcx, [rsp + 0x80]
mov r8d, ebx
mov r9d, edi
call fcn.14003a950
mov rcx, qword [0x1400290a0]
test rcx, rcx
je 0x14005065e
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x140050727
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rsi, rax
lea r15, [rsp + 0x80]
mov rcx, r15
call fcn.1400b93d0
lea rbx, [rsp + 0x78]
mov rcx, rsi
mov rdx, r15
mov r8d, eax
mov r9, rbx
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
lea rsi, [rsp + 0x68]
mov rcx, r14
mov rdx, rsi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsi]
mov ecx, dword [rsi + 4]
mov edx, 0xf
cmp eax, edx
mov esi, 0x10
cmovle eax, esi
mov edi, dword [rbx]
mov ebx, dword [rbx + 4]
sub ecx, ebx
cmp ecx, edx
cmovle ecx, esi
mov rsi, qword [0x14002b2b0]
movzx edx, word [0x1400290a8]
mov qword [rsp + 0x50], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x58], 0
mov ecx, 0x88
mov r9d, 0x80000000
mov r8, r15
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400290a0], rax
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x1d8]
call fcn.1400a8e70
nop
add rsp, 0x1e0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140057440
Capabilities:
Parse credit card information

Disassembly:
cmp edx, 3
jne 0x140057453
cmp r8d, 0x3c
jne 0x140057453
lea rax, str.SSH2_MSG_USERAUTH_GSSAPI_RESPONSE
ret
cmp edx, 3
jne 0x140057466
cmp r8d, 0x3d
jne 0x140057466
lea rax, str.SSH2_MSG_USERAUTH_GSSAPI_TOKEN
ret
cmp edx, 3
jne 0x140057479
cmp r8d, 0x3f
jne 0x140057479
lea rax, str.SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE
ret
cmp edx, 3
jne 0x14005748c
cmp r8d, 0x40
jne 0x14005748c
lea rax, str.SSH2_MSG_USERAUTH_GSSAPI_ERROR
ret
cmp edx, 3
jne 0x14005749f
cmp r8d, 0x41
jne 0x14005749f
lea rax, str.SSH2_MSG_USERAUTH_GSSAPI_ERRTOK
ret
cmp edx, 3
jne 0x1400574b2
cmp r8d, 0x42
jne 0x1400574b2
lea rax, str.SSH2_MSG_USERAUTH_GSSAPI_MIC
ret
lea r9d, [r8 - 1]
cmp r9d, 5
ja case.default.0x1400574d1
lea rax, str.SSH2_MSG_DISCONNECT
lea rcx, [0x140057680]
movsxd rdx, dword [rcx + r9*4]
add rdx, rcx
jmp rdx
ret
cmp r8d, 0x14
je 0x140057510
cmp r8d, 0x15
jne 0x140057518
lea rax, str.SSH2_MSG_NEWKEYS
ret
lea rax, str.SSH2_MSG_IGNORE
ret
lea rax, str.SSH2_MSG_UNIMPLEMENTED
ret
lea rax, str.SSH2_MSG_DEBUG
ret
lea rax, str.SSH2_MSG_SERVICE_REQUEST
ret
lea rax, str.SSH2_MSG_SERVICE_ACCEPT
ret
lea rax, str.SSH2_MSG_KEXINIT
ret
cmp ecx, 1
jne 0x14005752b
cmp r8d, 0x1e
jne 0x14005752b
lea rax, str.SSH2_MSG_KEXDH_INIT
ret
cmp ecx, 1
jne 0x14005753e
cmp r8d, 0x1f
jne 0x14005753e
lea rax, str.SSH2_MSG_KEXDH_REPLY
ret
cmp ecx, 2
jne 0x140057551
cmp r8d, 0x1e
jne 0x140057551
lea rax, str.SSH2_MSG_KEX_DH_GEX_REQUEST_OLD
ret
cmp ecx, 2
jne 0x140057564
cmp r8d, 0x22
jne 0x140057564
lea rax, str.SSH2_MSG_KEX_DH_GEX_REQUEST
ret
cmp ecx, 2
jne 0x140057577
cmp r8d, 0x1f
jne 0x140057577
lea rax, str.SSH2_MSG_KEX_DH_GEX_GROUP
ret
cmp ecx, 2
jne 0x14005758a
cmp r8d, 0x20
jne 0x14005758a
lea rax, str.SSH2_MSG_KEX_DH_GEX_INIT
ret
cmp ecx, 2
jne 0x14005759d
cmp r8d, 0x21
jne 0x14005759d
lea rax, str.SSH2_MSG_KEX_DH_GEX_REPLY
ret
cmp ecx, 4
jne 0x1400575b0
cmp r8d, 0x1e
jne 0x1400575b0
lea rax, str.SSH2_MSG_KEXRSA_PUBKEY
ret
cmp ecx, 4
jne 0x1400575c3
cmp r8d, 0x1f
jne 0x1400575c3
lea rax, str.SSH2_MSG_KEXRSA_SECRET
ret
cmp ecx, 4
jne 0x1400575d6
cmp r8d, 0x20
jne 0x1400575d6
lea rax, str.SSH2_MSG_KEXRSA_DONE
ret
cmp ecx, 3
jne 0x1400575e9
cmp r8d, 0x1e
jne 0x1400575e9
lea rax, str.SSH2_MSG_KEX_ECDH_INIT
ret
cmp ecx, 3
jne 0x1400575fc
cmp r8d, 0x1f
jne 0x1400575fc
lea rax, str.SSH2_MSG_KEX_ECDH_REPLY
ret
lea eax, [r8 - 0x32]
cmp eax, 4
jae 0x140057613
cdqe
lea rcx, str.SSH2_MSG_USERAUTH_REQUEST
mov rax, qword [rcx + rax*8]
ret
cmp edx, 1
jne 0x140057626
cmp r8d, 0x3c
jne 0x140057626
lea rax, str.SSH2_MSG_USERAUTH_PK_OK
ret
cmp edx, 2
jne 0x140057639
cmp r8d, 0x3c
jne 0x140057639
lea rax, str.SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ
ret
cmp edx, 4
jne 0x14005764c
cmp r8d, 0x3c
jne 0x14005764c
lea rax, str.SSH2_MSG_USERAUTH_INFO_REQUEST
ret
cmp edx, 4
jne 0x14005765f
cmp r8d, 0x3d
jne 0x14005765f
lea rax, str.SSH2_MSG_USERAUTH_INFO_RESPONSE
ret
add r8d, 0xffffffb0
cmp r8d, 0x15
jae 0x140057678
movsxd rax, r8d
lea rcx, str.SSH2_MSG_GLOBAL_REQUEST
mov rax, qword [rcx + rax*8]
ret
lea rax, str.unknown
ret
Function at 0x140057698
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x14002e420]
mov qword [rsp + 0x50], rax
cmp qword [rsi + 0x88], 0
jne 0x1400576cd
mov rax, qword [rsi]
cmp dword [rax + 0x25c], 0
je 0x1400576e9
mov rcx, qword [rsp + 0x50]
call fcn.1400a8e70
nop
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [rax + 0x250], 2
jne 0x1400576f8
cmp dword [rsi + 0x40], 0
je 0x1400576cd
lea rdi, [rsi + 0x70]
test byte [rsi + 0x18], 1
jne 0x140057739
mov rcx, rdi
call fcn.140047ae9
mov ebp, eax
cmp ebp, 4
jae 0x140057743
mov eax, dword [rsi + 0x18]
test al, 4
je 0x1400576cd
test al, 1
jne 0x1400576cd
mov rax, qword [rsi]
cmp dword [rax + 0x1d0], 4
je 0x1400576cd
mov dword [rsi + 0x1c], 1
mov rcx, rsi
call fcn.140050ced
jmp 0x1400576cd
mov rcx, rdi
call fcn.140047ab7
jmp 0x1400576cd
lea r12, [rsp + 0x4c]
lea r13, [0x1400578a7]
lea r14, [rsp + 0x40]
lea r15, [rsp + 0x3c]
mov r8d, 4
mov rcx, rdi
mov rdx, r12
call fcn.140047c74
mov ebx, dword [rsp + 0x4c]
bswap ebx
cmp ebx, 0x2001
jae 0x140057819
add ebp, 0xfffffffc
cmp ebx, ebp
ja 0x140057711
add ebx, 4
mov edx, 1
mov rcx, rbx
call fcn.14004723d
mov rbp, rax
mov rcx, rdi
mov rdx, rbp
mov r8d, ebx
call fcn.140047c74
mov rcx, rdi
mov edx, ebx
call fcn.140047bb6
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
mov rcx, rbp
mov edx, ebx
mov r8, r14
mov r9, r15
call fcn.1400a2e9c
mov qword [rsi + 0x88], rax
mov rcx, rbp
call fcn.140047430
cmp qword [rsi + 0x88], 0
jne 0x1400576cd
mov r8d, dword [rsp + 0x3c]
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call fcn.140057845
mov rcx, qword [rsp + 0x40]
call fcn.140047430
mov rcx, rdi
call fcn.140047ae9
mov ebp, eax
cmp ebp, 3
ja 0x140057759
jmp 0x140057711
xor edx, edx
xor r8d, r8d
mov rcx, rsi
call fcn.140057845
mov rax, qword [rsi]
cmp dword [rax + 0x1d0], 4
je 0x1400576cd
test byte [rsi + 0x18], 1
jne 0x1400576cd
jmp 0x140057728
Function at 0x1400642b3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15d, r8d
mov r14, rdx
mov r12, rcx
cmp r15d, 0x20
ja 0x1400642e5
mov eax, r15d
movabs rcx, 0x101010000
bt rcx, rax
jb 0x1400642fe
lea rcx, str.keylen__16__keylen__24__keylen__32
lea rdx, str..._sshaes.c
mov r8d, 0x3a7
call fcn.1400b5fb0
mov r9d, r15d
sar r9d, 0x1f
shr r9d, 0x1e
add r9d, r15d
sar r9d, 2
mov dword [r12 + 0x3f0], 4
lea eax, [r9 + 6]
cmp r15d, 0x10
mov ebx, 0xa
cmovge ebx, eax
mov dword [r12 + 0x3f4], ebx
lea rax, [0x140064ad1]
movq xmm0, rax
lea rax, [0x1400647e7]
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [r12 + 0x3c0], xmm1
lea eax, [rbx*4 + 4]
test eax, eax
jle 0x14006447f
movsxd rsi, r9d
lea rax, [rsi*4]
mov r8, r12
sub r8, rax
mov r13d, 1
xor edi, edi
lea r10, str.cw
mov r11d, 0x1b
xor ecx, ecx
cmp rcx, rsi
jge 0x1400643a4
movsxd rax, edi
mov ebx, dword [r14 + rax]
bswap ebx
jmp 0x140064451
mov ebx, dword [r12 + rcx*4 - 4]
mov eax, ecx
cdq
idiv r9d
test edx, edx
je 0x1400643fd
cmp r15d, 0x1c
jl 0x14006444d
cmp edx, 4
jne 0x14006444d
mov eax, ebx
movzx edx, bh
movzx ebp, bl
shr ebx, 0x18
shr eax, 0x10
movzx eax, al
movzx ebx, byte [rbx + r10]
shl ebx, 8
movzx eax, byte [rax + r10]
or eax, ebx
shl eax, 8
movzx edx, byte [rdx + r10]
or edx, eax
shl edx, 8
movzx ebx, byte [rbp + r10]
or ebx, edx
jmp 0x14006444d
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, bh
movzx ebp, bl
shr ebx, 0x18
movzx eax, byte [rax + r10]
xor eax, r13d
shl eax, 8
movzx edx, byte [rdx + r10]
or edx, eax
shl edx, 8
movzx eax, byte [rbp + r10]
or eax, edx
shl eax, 8
movzx ebx, byte [rbx + r10]
or ebx, eax
mov eax, r13d
and eax, 0x7f
add eax, eax
test r13b, r13b
mov r13d, 0
cmovs r13d, r11d
xor r13d, eax
xor ebx, dword [r8 + rcx*4]
mov dword [r12 + rcx*4], ebx
inc rcx
mov eax, dword [r12 + 0x3f0]
mov ebx, dword [r12 + 0x3f4]
lea edx, [rbx + 1]
imul edx, eax
movsxd rdx, edx
add edi, 4
cmp rcx, rdx
jl 0x140064391
jmp 0x140064484
mov eax, 4
test ebx, ebx
js 0x140064543
xor r15d, r15d
lea r14, str.cw
lea r8, [0x1400100d0]
lea r9, [0x1400104d0]
lea r10, [0x1400108d0]
lea r11, [0x140010cd0]
xor r13d, r13d
test eax, eax
jle 0x140064530
xor ebp, ebp
lea edx, [r15 + rbx]
imul edx, eax
add edx, ebp
test r13d, r13d
movsxd rdx, edx
mov edx, dword [r12 + rdx*4]
je 0x14006450a
cmp ebx, r13d
je 0x14006450a
mov ebx, edx
movzx ecx, dh
movzx esi, dl
shr edx, 0x18
shr ebx, 0x10
movzx ebx, bl
movzx edi, byte [rdx + r14]
movzx edx, byte [rbx + r14]
mov edx, dword [r9 + rdx*4]
xor edx, dword [r8 + rdi*4]
movzx ecx, byte [rcx + r14]
xor edx, dword [r10 + rcx*4]
movzx ecx, byte [rsi + r14]
xor edx, dword [r11 + rcx*4]
imul eax, r13d
add eax, ebp
cdqe
mov dword [r12 + rax*4 + 0x1e0], edx
inc ebp
mov eax, dword [r12 + 0x3f0]
mov ebx, dword [r12 + 0x3f4]
cmp ebp, eax
jl 0x1400644bb
dec r15d
cmp r13d, ebx
lea ecx, [r13 + 1]
mov r13d, ecx
jl 0x1400644b5
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140064678
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, r8
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x14002e420]
mov qword [rsp + 0x58], rax
test bl, 0xf
je 0x1400646b5
lea rcx, str._len__15___0
lea rdx, str..._sshaes.c
mov r8d, 0x41f
call fcn.1400b5fb0
lea r15, [rsi + 0x3d0]
movups xmm0, xmmword [rsi + 0x3d0]
movaps xmmword [rsp + 0x40], xmm0
test ebx, ebx
jle 0x14006474b
lea r14, [rsp + 0x30]
xor eax, eax
mov ecx, dword [rdi + rax*4]
bswap ecx
mov dword [rsp + rax*4 + 0x20], ecx
mov dword [rsp + rax*4 + 0x30], ecx
inc rax
cmp rax, 4
jne 0x1400646d3
mov rcx, rsi
mov rdx, r14
call qword [rsi + 0x3c8]
xor eax, eax
mov ecx, dword [rsp + rax*4 + 0x30]
xor ecx, dword [rsp + rax*4 + 0x40]
shr ecx, 0x18
mov byte [rdi + rax*4], cl
mov ecx, dword [rsp + rax*4 + 0x30]
xor ecx, dword [rsp + rax*4 + 0x40]
shr ecx, 0x10
mov byte [rdi + rax*4 + 1], cl
mov ecx, dword [rsp + rax*4 + 0x30]
xor ecx, dword [rsp + rax*4 + 0x40]
mov byte [rdi + rax*4 + 2], ch
mov ecx, dword [rsp + rax*4 + 0x30]
xor ecx, dword [rsp + rax*4 + 0x40]
mov byte [rdi + rax*4 + 3], cl
mov ecx, dword [rsp + rax*4 + 0x20]
mov dword [rsp + rax*4 + 0x40], ecx
inc rax
cmp rax, 4
jne 0x1400646f7
add rdi, 0x10
cmp ebx, 0x10
lea eax, [rbx - 0x10]
mov ebx, eax
jg 0x1400646d1
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [r15], xmm0
mov rcx, qword [rsp + 0x58]
call fcn.1400a8e70
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140064f05
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rsi
push rbx
mov al, byte [rcx]
mov r9b, byte [rcx + 1]
test r8d, r8d
jle 0x140064f64
lea r10d, [r8 + 0xff]
add r10b, al
mov r8d, r8d
inc al
movzx r9d, r9b
movzx eax, al
movzx r11d, byte [rcx + rax + 2]
add r9d, r11d
movzx esi, r9b
mov bl, byte [rcx + rsi + 2]
mov byte [rcx + rax + 2], bl
mov byte [rcx + rsi + 2], r11b
movzx esi, byte [rcx + rax + 2]
add esi, r11d
movzx ebx, sil
mov bl, byte [rcx + rbx + 2]
xor byte [rdx], bl
inc rdx
inc al
dec r8
jne 0x140064f21
inc r10b
mov al, r10b
mov byte [rcx], al
mov byte [rcx + 1], r9b
pop rbx
pop rsi
ret

Function at 0x140064f8d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x130
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14002e420]
mov qword [rsp + 0x128], rax
cmp edi, 0x101
jb 0x140064fd0
lea rcx, str.keybytes___256
lea rdx, str..._ssharcf.c
mov r8d, 0x26
call fcn.1400b5fb0
mov word [rsi], 0
xor ecx, ecx
mov byte [rsi + rcx + 2], cl
xor edx, edx
mov eax, ecx
div edi
mov al, byte [rbx + rdx]
mov byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x100
jne 0x140064fd7
xor eax, eax
xor ecx, ecx
movzx edx, byte [rsi + rax + 2]
add ecx, edx
movzx ebx, byte [rsp + rax + 0x20]
add ebx, ecx
movzx ecx, bl
mov bl, byte [rsi + rcx + 2]
mov byte [rsi + rax + 2], bl
mov byte [rsi + rcx + 2], dl
inc rax
cmp rax, 0x100
jne 0x140064ff8
mov rcx, qword [rsp + 0x128]
call fcn.1400a8e70
nop
add rsp, 0x130
pop rbx
pop rdi
pop rsi
ret
Function at 0x140069704
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movaps xmm0, xmmword [str.expand_32_byte_k]
movups xmmword [rcx], xmm0
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
mov dword [rcx + 0x80], pe_nt_image_headers64
ret
Function at 0x14006a390
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test r8, r8
je 0x14006a3b5
lea r9, [0x140013cf0]
movzx r10d, byte [rdx]
inc rdx
movzx eax, cl
xor eax, r10d
shr ecx, 8
xor ecx, dword [r9 + rax*4]
dec r8
jne 0x14006a39c
mov eax, ecx
ret

Function at 0x14006a3b8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
test rdx, rdx
je 0x14006a3e0
lea r8, [0x140013cf0]
movzx r9d, byte [rcx]
inc rcx
movzx r10d, al
xor r10d, r9d
shr eax, 8
xor eax, dword [r8 + r10*4]
dec rdx
jne 0x14006a3c6
ret
Function at 0x14006e0a8
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x14002e420]
mov qword [rsp + 0x140], rax
mov eax, dword [r14]
cmp eax, 2
je 0x14006e107
test eax, eax
jne 0x14006e19f
add r14, 0x40
mov rcx, qword [rsp + 0x140]
call fcn.1400a8e70
mov rcx, r14
mov rdx, rdi
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14006dd72
lea rcx, [rsp + 0x28]
call fcn.14007801c
mov ebp, dword [r14 + 0x18]
shr ebp, 3
je 0x14006e151
xor ebx, ebx
lea r15, [rsp + 0x28]
lea rsi, [rsp + 0x100]
mov rcx, rdi
mov edx, ebx
call fcn.140068ae8
mov byte [rsp + 0x100], al
mov r8d, 1
mov rcx, r15
mov rdx, rsi
call fcn.14007805c
inc ebx
cmp ebp, ebx
jne 0x14006e129
lea rcx, [rsp + 0x28]
lea rsi, [rsp + 0x100]
mov rdx, rsi
call fcn.140078f96
and byte [rsi], 0xf8
mov al, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
mov edx, 0x20
mov rcx, rsi
call fcn.140068660
mov rdi, rax
add r14, 0x38
mov rcx, r14
mov rdx, rdi
call fcn.14006dd72
mov rsi, rax
mov rcx, rdi
call fcn.1400662e1
jmp 0x14006e1a1
xor esi, esi
mov rcx, qword [rsp + 0x140]
call fcn.1400a8e70
mov rax, rsi
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14007012a
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x14002e420]
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 0x20]
call qword [rax]
mov rdi, rax
mov ecx, 1
mov edx, 0x38
call fcn.14004723d
mov rsi, rax
mov qword [rsi], 0
mov qword [rsi + 8], rdi
cmp dword [rdi], 1
jne 0x1400701cb
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
xor edi, edi
call fcn.1400756c3
mov byte [rsp + rdi + 0x20], al
inc rdi
cmp rdi, 0x20
jne 0x140070176
lea rdi, [rsp + 0x20]
and byte [rdi], 0xf8
mov al, byte [rdi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rdi + 0x1f], al
mov edx, 0x20
mov rcx, rdi
call fcn.140068660
mov qword [rsi + 0x30], rax
mov edx, 0x20
mov rcx, rdi
call fcn.14009f467
mov rdx, qword [rsi + 0x30]
test rdx, rdx
je 0x140070224
mov rcx, qword [rsi + 8]
add rcx, 0x38
jmp 0x1400701ef
mov rdx, qword [rdi + 0x38]
mov rcx, qword [0x14002e2a8]
call fcn.140068874
mov qword [rsi + 0x30], rax
test rax, rax
je 0x140070224
mov rcx, qword [rsi + 8]
add rcx, 0x40
mov rdx, rax
call fcn.14006dd72
test rax, rax
je 0x14007021b
mov rcx, qword [rax + 8]
mov qword [rsi + 0x10], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x20], 0
mov rcx, rax
call fcn.140047430
jmp 0x14007022e
mov rcx, qword [rsi + 0x30]
call fcn.1400662e1
mov rcx, rsi
call fcn.140047430
xor esi, esi
mov rcx, qword [rsp + 0x40]
call fcn.1400a8e70
mov rax, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140072d5e
Capabilities:
Authenticate hmac

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14002e420]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [str.6666666666666666hmac_md5]
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
test ebp, ebp
jle 0x140072dd0
mov al, byte [rdi]
xor al, 0x36
mov byte [rsp + 0x20], al
cmp ebp, 1
je 0x140072dd0
movsxd rax, ebp
mov ecx, 1
mov dl, byte [rdi + rcx]
xor byte [rsp + rcx + 0x20], dl
lea rdx, [rcx + 1]
cmp rdx, rax
jge 0x140072dd0
cmp rcx, 0x3f
mov rcx, rdx
jl 0x140072db7
movaps xmm6, xmmword [0x140015e20]
movups xmmword [rsi], xmm6
mov qword [rsi + 0x50], 0
xor eax, eax
mov dword [rsi + 0x58], eax
lea rbx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
mov rcx, rsi
mov rdx, rbx
call fcn.14007221e
test ebp, ebp
movaps xmm0, xmmword [0x140015e70]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
jle 0x140072e45
mov al, byte [rdi]
xor al, 0x5c
mov byte [rsp + 0x20], al
cmp ebp, 1
je 0x140072e45
movsxd rax, ebp
mov ecx, 1
mov dl, byte [rdi + rcx]
xor byte [rsp + rcx + 0x20], dl
lea rdx, [rcx + 1]
cmp rdx, rax
jge 0x140072e45
cmp rcx, 0x3f
mov rcx, rdx
jl 0x140072e2c
movups xmmword [rsi + 0x5c], xmm6
mov qword [rsi + 0xac], 0
mov dword [rsi + 0xb4], 0
lea rcx, [rsi + 0x5c]
lea rsi, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
mov rdx, rsi
call fcn.14007221e
mov edx, pe_nt_image_headers64
mov rcx, rsi
call fcn.14009f467
mov rcx, qword [rsp + 0x68]
call fcn.1400a8e70
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
ret