joyce8/EMBER2024-capa huggingface dataset:
Function at 0x29e85ae0380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x29e85ae03a3
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x29e85ae0400
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x29e85ae0423
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x29e85ae0480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x29e85ae04a9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret

Function at 0x29e85ae0510
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x29e85ae0539
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret
Function at 0x29e85ae05a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
add rax, 0x10
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm0, xmmword [rcx + rax - 0x10]
jmp 0x29e85ae061e

Function at 0x29e85ae0600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.29e85ae0600
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x29e85ae0690
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
add rax, 0x10
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm0, xmmword [rcx + rax - 0x10]
jmp 0x29e85ae070e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x29e85ae06f0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret

Function at 0x29e85ae0780
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
add rax, 0x10
pxor xmm7, xmm0
aesenc xmm3, xmm1
pxor xmm8, xmm0
pxor xmm9, xmm0
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm0, xmmword [rcx + rax - 0x10]
jmp fcn.29e85ae081a
Function at 0x29e85ae081a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x29e85ae07f0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x29e85ae08b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
add rax, 0x10
pxor xmm7, xmm0
aesdec xmm3, xmm1
pxor xmm8, xmm0
pxor xmm9, xmm0
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm0, xmmword [rcx + rax - 0x10]
jmp 0x29e85ae094a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x29e85ae0920
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x29e85ae34f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.29e85ae3560
shl edx, 4
test eax, eax
jne 0x29e85ae3556
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x29e85ae351f
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
movups xmmword [rcx], xmm0
add rsp, 8
repz ret

Function at 0x29e85ae3560
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
mov rax, 0xffffffffffffffff
test rcx, rcx
je 0x29e85ae3777
test r8, r8
je 0x29e85ae3777
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x29e85ae36b0
cmp edx, 0xc0
je 0x29e85ae3630
cmp edx, 0x80
jne 0x29e85ae3770
mov edx, 9
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.29e85ae3787
aeskeygenassist xmm1, xmm0, 2
call fcn.29e85ae3780
aeskeygenassist xmm1, xmm0, 4
call fcn.29e85ae3780
aeskeygenassist xmm1, xmm0, 8
call fcn.29e85ae3780
aeskeygenassist xmm1, xmm0, 0x10
call fcn.29e85ae3780
aeskeygenassist xmm1, xmm0, 0x20
call fcn.29e85ae3780
aeskeygenassist xmm1, xmm0, 0x40
call fcn.29e85ae3780
aeskeygenassist xmm1, xmm0, 0x80
call fcn.29e85ae3780
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.29e85ae3780
aeskeygenassist xmm1, xmm0, 0x36
call fcn.29e85ae3780
movups xmmword [rax], xmm0
mov dword [rax + 0x50], edx
xor eax, eax
jmp 0x29e85ae3777
movq xmm2, qword [rcx + 0x10]
mov edx, 0xb
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.29e85ae37a7
aeskeygenassist xmm1, xmm2, 2
call fcn.29e85ae37e0
aeskeygenassist xmm1, xmm2, 4
call fcn.29e85ae37a0
aeskeygenassist xmm1, xmm2, 8
call fcn.29e85ae37e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.29e85ae37a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.29e85ae37e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.29e85ae37a0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.29e85ae37e0
movups xmmword [rax], xmm0
mov dword [rax + 0x30], edx
xor rax, rax
jmp 0x29e85ae3777
movups xmm2, xmmword [rcx + 0x10]
mov edx, 0xd
lea rax, [rax + 0x10]
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.29e85ae3807
aeskeygenassist xmm1, xmm0, 1
call fcn.29e85ae3820
aeskeygenassist xmm1, xmm2, 2
call fcn.29e85ae3800
aeskeygenassist xmm1, xmm0, 2
call fcn.29e85ae3820
aeskeygenassist xmm1, xmm2, 4
call fcn.29e85ae3800
aeskeygenassist xmm1, xmm0, 4
call fcn.29e85ae3820
aeskeygenassist xmm1, xmm2, 8
call fcn.29e85ae3800
aeskeygenassist xmm1, xmm0, 8
call fcn.29e85ae3820
aeskeygenassist xmm1, xmm2, 0x10
call fcn.29e85ae3800
aeskeygenassist xmm1, xmm0, 0x10
call fcn.29e85ae3820
aeskeygenassist xmm1, xmm2, 0x20
call fcn.29e85ae3800
aeskeygenassist xmm1, xmm0, 0x20
call fcn.29e85ae3820
aeskeygenassist xmm1, xmm2, 0x40
call fcn.29e85ae3800
movups xmmword [rax], xmm0
mov dword [rax + 0x10], edx
xor rax, rax
jmp 0x29e85ae3777
mov rax, 0xfffffffffffffffe
add rsp, 8
repz ret
Function at 0x29e85aed2b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x29e85cc0760]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x200
call fcn.29e85b462a0
call fcn.29e85aed4c0
lea rcx, [rsp + 0xa8]
mov rbx, rax
call fcn.29e85aed030
lea rcx, [rsp + 0x58]
call fcn.29e85aecf90
lea rcx, [rsp + 0x30]
call fcn.29e85aed120
or ecx, 0xffffffff
or r9, 0xffffffffffffffff
mov r8, r9
lea rax, [rsp + 0xa8]
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x29e85aed320
lea r10, [rsp + 0xa8]
lea r11, [0x29e85c98fe0]
test r8, r8
je 0x29e85aed35e
nop
movzx eax, byte [r10]
movzx edx, cl
lea r10, [r10 + 1]
xor rdx, rax
mov eax, ecx
mov ecx, dword [r11 + rdx*4]
shr eax, 8
xor ecx, eax
dec r8
jne 0x29e85aed340
lea rax, [rsp + 0x58]
mov r8, r9
inc r8
cmp byte [rax + r8], 0
jne 0x29e85aed366
lea r10, [rsp + 0x58]
test r8, r8
je 0x29e85aed39e
nop word [rax + rax]
movzx eax, byte [r10]
movzx edx, cl
lea r10, [r10 + 1]
xor rdx, rax
mov eax, ecx
mov ecx, dword [r11 + rdx*4]
shr eax, 8
xor ecx, eax
dec r8
jne 0x29e85aed380
lea rax, [rsp + 0x30]
mov r8, r9
inc r8
cmp byte [rax + r8], 0
jne 0x29e85aed3a6
lea r10, [rsp + 0x30]
test r8, r8
je 0x29e85aed3de
nop word [rax + rax]
movzx eax, byte [r10]
movzx edx, cl
lea r10, [r10 + 1]
xor rdx, rax
mov eax, ecx
mov ecx, dword [r11 + rdx*4]
shr eax, 8
xor ecx, eax
dec r8
jne 0x29e85aed3c0
test rbx, rbx
je 0x29e85aed41e
inc r9
cmp byte [rbx + r9], 0
jne 0x29e85aed3e3
mov r8, rbx
test r9, r9
je 0x29e85aed41e
nop word [rax + rax]
movzx eax, byte [r8]
movzx edx, cl
lea r8, [r8 + 1]
xor rdx, rax
mov eax, ecx
mov ecx, dword [r11 + rdx*4]
shr eax, 8
xor ecx, eax
dec r9
jne 0x29e85aed400
not ecx
mov eax, ecx
mov byte [rsp + 0x23], cl
shr eax, 0x18
mov byte [rsp + 0x20], al
mov eax, ecx
shr eax, 0x10
mov byte [rsp + 0x21], al
mov eax, ecx
shr eax, 8
mov byte [rsp + 0x22], al
test rbx, rbx
je 0x29e85aed44c
mov rcx, rbx
call fcn.29e85b46db8
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.29e85b464e0
add rsp, 0x240
pop rbx
ret
Function at 0x29e85afc270
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x28]
mov rbx, r8
call qword [0x29e85c50310]
lea rax, [rsp + 0x48]
lea r8, [0x29e85afc3f0]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
xor ecx, ecx
mov qword [rdi], rbx
mov dword [rsp + 0x20], 0
call fcn.29e85b492a0
mov rsi, rax
mov qword [rsp + 0x40], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x29e85afc33a
mov rcx, qword [rdi + 0x10]
lea rbx, [rdi + 8]
lea rax, [rsp + 0x40]
cmp rax, rcx
jae 0x29e85afc31b
mov rdx, qword [rbx]
lea rax, [rsp + 0x40]
cmp rdx, rax
ja 0x29e85afc31b
lea rdi, [rsp + 0x40]
sub rdi, rdx
sar rdi, 3
cmp rcx, qword [rbx + 0x10]
jne 0x29e85afc306
mov rcx, rbx
call fcn.29e85b03410
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x29e85afc335
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
mov qword [rdx], rcx
jmp 0x29e85afc335
cmp rcx, qword [rbx + 0x10]
jne 0x29e85afc329
mov rcx, rbx
call fcn.29e85b03410
mov rax, qword [rbx + 8]
test rax, rax
je 0x29e85afc335
mov qword [rax], rsi
add qword [rbx + 8], 8
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov al, 1
add rsp, 0x30
pop rdi
ret

Function at 0x29e85b00640
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov rbx, rcx
lea rsi, [0x29e85c9d318]
mov qword [rsp + 0x38], rsi
lea rdi, [0x29e85cc4c98]
mov qword [rsp + 0x40], rdi
mov rcx, rdi
call qword [0x29e85c50330]
nop
cmp qword [0x29e85cc26a8], 0xffffffffffffffff
je 0x29e85b00733
cmp qword [0x29e85cc26c8], 0xffffffffffffffff
jne 0x29e85b00733
test rbx, rbx
je 0x29e85b00733
mov qword [0x29e85cc4948], rbx
mov byte [0x29e85cc2161], 0
mov rcx, qword [0x29e85cc26b0]
call qword [0x29e85c50310]
mov rcx, qword [0x29e85cc26c0]
call qword [0x29e85c50310]
mov rcx, qword [0x29e85cc26b8]
call qword [0x29e85c50310]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x29e85afec20]
xor edx, edx
xor ecx, ecx
call fcn.29e85b492a0
test rax, rax
jne 0x29e85b0071a
mov rcx, qword [0x29e85cc26c0]
call qword [0x29e85c50318]
mov qword [0x29e85cc26c8], 0xffffffffffffffff
jmp 0x29e85b00733
mov qword [0x29e85cc26c8], rax
or edx, 0xffffffff
mov rcx, qword [0x29e85cc26b8]
call qword [0x29e85c50308]
jmp 0x29e85b00736
or ebx, 0xffffffff
mov qword [rsp + 0x38], rsi
mov rcx, rdi
call qword [0x29e85c50328]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x29e85b11500
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov rbx, rcx
lea rbp, [0x29e85c9d318]
mov qword [rsp + 0x38], rbp
lea rdi, [rcx + 0x1e8]
mov qword [rsp + 0x40], rdi
mov rcx, rdi
call qword [0x29e85c50330]
nop
cmp byte [rbx], 0
jne 0x29e85b11602
call fcn.29e85b10e60
lea rcx, [rbx + 8]
mov r8d, 0xf
lea rdx, [0x29e85c9d7d8]
call fcn.29e85af7ec0
lea rcx, [rbx + 0xe8]
call fcn.29e85b0f470
test al, al
je 0x29e85b115a7
lea rcx, [rbx + 0x130]
call fcn.29e85b10860
test al, al
je 0x29e85b115a7
lea rcx, [rbx + 0x168]
call fcn.29e85b10860
test al, al
je 0x29e85b115a7
lea rcx, [rbx + 0x1a0]
call fcn.29e85b10860
test al, al
jne 0x29e85b115ab
xor bl, bl
jmp 0x29e85b11604
mov rcx, rbx
call fcn.29e85b15520
mov rcx, qword [rbx + 0x60]
call qword [0x29e85c50310]
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x29e85b15880]
xor edx, edx
xor ecx, ecx
call fcn.29e85b492a0
mov rsi, rax
test rax, rax
je 0x29e85b115ff
mov rcx, qword [rbx + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x29e85b115fb
call qword [0x29e85c50568]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov qword [rbx + 0x68], rsi
mov byte [rbx], 1
mov bl, 1
mov qword [rsp + 0x38], rbp
mov rcx, rdi
call qword [0x29e85c50328]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x29e85b6c050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
push rdx
call fcn.29e85ad2580
mov r8, qword [rsp]
cmp eax, 0
jne 0x29e85ad2a41
mov r14d, dword [r8 + 0xf0]
xor rdi, rdi
lea rcx, [rdi + r14*4]
mov rsi, r8
lea rdi, [r8 + rcx*4]
mov rax, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
lea rsi, [rsi + 0x10]
lea rdi, [rdi - 0x10]
cmp rdi, rsi
jne 0x29e85ad2878
lea rax, [0x29e85ad3c80]
mov rsi, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
mov rbp, qword [rax + 0x38]
mov r15, r8
sub r14d, 1
nop
lea r15, [r15 + 0x10]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov r9, rsi
mov r12, rsi
and r9, rax
and r12, rcx
mov rbx, r9
mov rdx, r12
shr r9, 7
lea r8, [rax + rax]
shr r12, 7
lea r11, [rcx + rcx]
sub rbx, r9
sub rdx, r12
and r8, rdi
and r11, rdi
and rbx, rbp
and rdx, rbp
xor r8, rbx
xor r11, rdx
mov r10, rsi
mov r13, rsi
and r10, r8
and r13, r11
mov rbx, r10
mov rdx, r13
shr r10, 7
lea r9, [r8 + r8]
shr r13, 7
lea r12, [r11 + r11]
sub rbx, r10
sub rdx, r13
and r9, rdi
and r12, rdi
and rbx, rbp
and rdx, rbp
xor r9, rbx
xor r12, rdx
mov r10, rsi
mov r13, rsi
and r10, r9
and r13, r12
mov rbx, r10
mov rdx, r13
shr r10, 7
xor r8, rax
shr r13, 7
xor r11, rcx
sub rbx, r10
sub rdx, r13
lea r10, [r9 + r9]
lea r13, [r12 + r12]
xor r9, rax
xor r12, rcx
and r10, rdi
and r13, rdi
and rbx, rbp
and rdx, rbp
xor r10, rbx
xor r13, rdx
xor rax, r10
xor rcx, r13
xor r8, r10
xor r11, r13
mov rbx, rax
mov rdx, rcx
xor r9, r10
shr rbx, 0x20
xor r12, r13
shr rdx, 0x20
xor r10, r8
rol eax, 8
xor r13, r11
rol ecx, 8
xor r10, r9
rol ebx, 8
xor r13, r12
rol edx, 8
xor eax, r10d
shr r10, 0x20
xor ecx, r13d
shr r13, 0x20
xor ebx, r10d
xor edx, r13d
mov r10, r8
rol r8d, 0x18
mov r13, r11
rol r11d, 0x18
shr r10, 0x20
xor eax, r8d
shr r13, 0x20
xor ecx, r11d
rol r10d, 0x18
mov r8, r9
rol r13d, 0x18
mov r11, r12
shr r8, 0x20
xor ebx, r10d
shr r11, 0x20
xor edx, r13d
rol r9d, 0x10
rol r12d, 0x10
rol r8d, 0x10
xor eax, r9d
rol r11d, 0x10
xor ecx, r12d
xor ebx, r8d
xor edx, r11d
mov dword [r15], eax
mov dword [r15 + 4], ebx
mov dword [r15 + 8], ecx
mov dword [r15 + 0xc], edx
sub r14d, 1
jne 0x29e85ad28c0
xor rax, rax
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
jmp 0x29e85ad2830
Function at 0x29e85b7cda0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
test r8, r8
je 0x29e85b7cdc3
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
lea rcx, [rcx + 1]
xor al, byte [rcx - 1]
or r9b, al
dec r8
jne 0x29e85b7cdb0
movzx eax, r9b
ret
Function at 0x29e85b82e80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 8
mov qword [rsp + 0x18], rsi
mov qword [rsp], rdi
mov edi, 0x80
cmp edx, edi
mov r10, rcx
mov byte [rcx], 0
cmovg edx, edi
mov r11d, 0x400
test r9d, r9d
jle 0x29e85b82eb2
cmp r9d, r11d
cmovg r9d, r11d
mov r11d, r9d
movsxd r9, edx
test edx, edx
jle 0x29e85b82ed1
sub r8, rcx
mov rdx, r9
nop
movzx eax, byte [r8 + rcx]
lea rcx, [rcx + 1]
mov byte [rcx - 1], al
dec rdx
jne 0x29e85b82ec0
movzx ecx, byte [r9 + r10 - 1]
lea rdx, [r9 + r10]
lea rsi, [0x29e85c72ff0]
cmp r9, rdi
jge 0x29e85b82f1e
mov qword [rsp + 0x10], rbx
mov rbx, r9
mov r8, rdi
neg rbx
sub r8, r9
nop dword [rax + rax]
movzx eax, byte [rdx + rbx]
lea rdx, [rdx + 1]
add eax, ecx
movzx ecx, al
movzx ecx, byte [rcx + rsi]
mov byte [rdx - 1], cl
dec r8
jne 0x29e85b82f00
mov rbx, qword [rsp + 0x10]
lea r9d, [r11 + 7]
neg r11d
mov eax, 0xff
sar r9d, 3
and r11d, 7
sub edi, r9d
movzx ecx, r11b
sar eax, cl
movsxd r8, edi
mov rdi, qword [rsp]
mov ecx, eax
movzx eax, byte [r8 + r10]
lea rdx, [r8 + r10]
and rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rdx], al
test r8, r8
je 0x29e85b82f78
movsxd r9, r9d
nop
movzx ecx, byte [rdx + r9 - 1]
lea rdx, [rdx - 1]
xor rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rdx], al
dec r8
jne 0x29e85b82f60
mov rsi, qword [rsp + 0x18]
lea rcx, [r10 - 1]
mov r8d, 0x40
lea rax, [rcx + 0x7f]
sub r10, rcx
nop
movzx edx, byte [r10 + rax]
movzx ecx, byte [rax]
lea rax, [rax - 2]
shl dx, 8
or dx, cx
mov word [r10 + rax + 1], dx
dec r8
jne 0x29e85b82f90
add rsp, 8
ret
Function at 0x29e85b85af0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xc0
mov rax, qword [0x29e85cc0760]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor eax, eax
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test r9, r9
je 0x29e85b85b35
mov eax, 1
mov qword [rcx], r9
jmp 0x29e85b85b38
mov rbp, qword [rcx]
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xb0], r15
test rdx, rdx
je 0x29e85b85bed
mov rcx, rbp
call fcn.29e85b7a1a0
cmp rax, rsi
jae 0x29e85b85baf
lea rcx, [rbx + 8]
mov r8, r12
mov rdx, rbp
call fcn.29e85b79eb0
test eax, eax
je 0x29e85b85cde
lea rcx, [rbx + 8]
mov r8, rsi
mov rdx, rdi
call fcn.29e85b79f50
test eax, eax
je 0x29e85b85cde
lea rdi, [rbx + 0x98]
lea rdx, [rbx + 0x9c]
lea rcx, [rbx + 8]
mov r8, rdi
call fcn.29e85b79e60
test eax, eax
jne 0x29e85b85bca
jmp 0x29e85b85ce7
lea rcx, [rbx + 0x9c]
mov r8, rsi
mov rdx, rdi
call fcn.29e85b45d20
lea rdi, [rbx + 0x98]
mov dword [rdi], esi
mov eax, dword [rdi]
mov r8d, 0x80
cmp eax, r8d
je 0x29e85b85bf5
lea rcx, [rbx + 0x9c]
sub r8, rax
xor edx, edx
add rcx, rax
call fcn.29e85b462a0
jmp 0x29e85b85bf5
test eax, eax
je 0x29e85b85ccd
lea rdx, [rsp + 0x20]
mov rax, rbx
mov edi, 0x40
sub rax, rdx
lea rcx, [rsp + 0x20]
mov edx, edi
lea rsi, [rax + 0x9c]
lea r14, [rax + 0x9d]
nop word [rax + rax]
movzx eax, byte [rsi + rcx]
lea rcx, [rcx + 2]
xor al, 0x36
mov byte [rcx - 2], al
movzx eax, byte [r14 + rcx - 2]
xor al, 0x36
mov byte [rcx - 1], al
dec rdx
jne 0x29e85b85c20
lea rcx, [rbx + 0x38]
mov r8, r12
mov rdx, rbp
call fcn.29e85b79eb0
test eax, eax
je 0x29e85b85cde
mov rcx, rbp
call fcn.29e85b7a1a0
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x38]
mov r8, rax
call fcn.29e85b79f50
test eax, eax
je 0x29e85b85cde
lea rdx, [rsp + 0x20]
nop word [rax + rax]
movzx eax, byte [rdx + rsi]
lea rdx, [rdx + 2]
xor al, 0x5c
mov byte [rdx - 2], al
movzx eax, byte [rdx + r14 - 2]
xor al, 0x5c
mov byte [rdx - 1], al
dec rdi
jne 0x29e85b85c80
lea rcx, [rbx + 0x68]
mov r8, r12
mov rdx, rbp
call fcn.29e85b79eb0
test eax, eax
je 0x29e85b85cde
mov rcx, rbp
call fcn.29e85b7a1a0
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x68]
mov r8, rax
call fcn.29e85b79f50
test eax, eax
je 0x29e85b85cde
lea rdx, [rbx + 0x38]
lea rcx, [rbx + 8]
call fcn.29e85b79ff0
test eax, eax
jne 0x29e85b85ce2
xor eax, eax
jmp 0x29e85b85ce7
mov eax, 1
mov r15, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.29e85b464e0
add rsp, 0xc0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret