joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8ea730
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor eax, eax
movsxd r8, r8d
mov r10, rcx
mov rcx, rdx
test r8d, r8d
je 0x8ea761
mov rdx, qword [rcx + rax*8]
xor qword [r10 + rax*8], rdx
add rax, 1
cmp r8, rax
jne 0x8ea750
mov qword [rsp], 1
lea rbx, [r10 + 8]
mov rax, qword [r10]
lea r14, [0x02422508]
mov qword [rsp + 8], rbx
lea r12, [r10 + 0xc8]
lea rsi, [rsp + 0x10]
mov ebp, 0xcccccccd
lea r13, [r10 + 0x28]
lea rbx, [0x024224a0]
lea r11, [0x02422440]
nop
mov r9, qword [rsp + 8]
mov rdi, rsi
mov rdx, r10
mov r8, rax
mov rcx, qword [r9 + 0x20]
xor rcx, qword [r9 + 0x48]
add rdi, 8
xor rcx, qword [r9 + 0x70]
xor rcx, qword [r9 + 0x98]
xor rcx, r8
mov qword [rdi - 8], rcx
cmp r13, r9
je 0x8ea7e0
mov r8, qword [r9]
add r9, 8
jmp 0x8ea7ae
mov rcx, r12
xor r9d, r9d
lea edi, [r9 + 4]
mov r8, rdi
imul rdi, rbp
shr rdi, 0x22
lea edi, [rdi + rdi*4]
sub r8d, edi
lea edi, [r9 + 1]
mov r9, rdi
imul rdi, rbp
movsxd r8, r8d
shr rdi, 0x22
lea r15d, [rdi + rdi*4]
mov edi, r9d
sub edi, r15d
movsxd rdi, edi
mov rdi, qword [rsp + rdi*8 + 0x10]
rol rdi, 1
xor rdi, qword [rsp + r8*8 + 0x10]
lea r8, [rcx - 0xc8]
xor rax, rdi
mov qword [r8], rax
add r8, 0x28
cmp rcx, r8
je 0x8ea850
mov rax, qword [r8]
add r8, 0x28
xor rax, rdi
mov qword [r8 - 0x28], rax
cmp rcx, r8
jne 0x8ea83d
add rcx, 8
cmp r9d, 5
je 0x8ea868
mov rax, qword [rcx - 0xc8]
jmp 0x8ea7e6
mov r8, qword [r10 + 8]
xor eax, eax
mov r9d, 0xa
mov ecx, 1
jmp 0x8ea88a
mov ecx, dword [rbx + rax]
movsxd r9, dword [r11 + rax]
mov r8, rdi
lea r9, [r10 + r9*8]
rol r8, cl
add rax, 4
mov rdi, qword [r9]
mov qword [r9], r8
cmp rax, 0x60
jne 0x8ea880
movdqu xmm0, xmmword [rdx]
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx + 0x10]
movaps xmmword [rsi], xmm0
mov r8, qword [rsp + 0x18]
mov qword [rsi + 0x18], rcx
mov r9, rax
mov rcx, r8
mov qword [rsi + 0x10], rax
mov rax, qword [rdx + 0x20]
not rcx
and rcx, r9
xor qword [rdx], rcx
mov rcx, qword [rsp + 0x28]
not r9
mov qword [rsi + 0x20], rax
and r9, rcx
not rcx
xor qword [rdx + 8], r9
and rcx, rax
xor qword [rdx + 0x10], rcx
mov rcx, qword [rsp + 0x10]
not rax
and rax, rcx
not rcx
xor qword [rdx + 0x18], rax
and rcx, r8
xor qword [rdx + 0x20], rcx
add rdx, 0x28
cmp r12, rdx
jne 0x8ea8a1
mov rax, qword [rsp]
lea rdx, str.SHA_512__d
xor rax, qword [r10]
mov qword [r10], rax
cmp rdx, r14
je 0x8ea935
mov rdx, qword [r14]
add r14, 8
mov qword [rsp], rdx
jmp 0x8ea7a0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x8eb4f0
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov ebx, edx
mov r13, r8
mov r12, rcx
mov edx, 1
call fcn.008eaa90
shr ebx, 3
mov rdx, r13
mov rcx, r12
mov r8d, ebx
add rsp, 0x20
pop rbx
pop r12
pop r13
jmp fcn.008eab30
Function at 0x8ebbf0
Capabilities:
Hash data using sha512

Disassembly:
push rdi
xor eax, eax
lea rdi, [rcx + 8]
mov qword [rcx], 0
mov rdx, rcx
and rdi, 0xfffffffffffffff8
sub rcx, rdi
add ecx, 0xd0
shr ecx, 3
rep stosq qword [rdi], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rdx + 0x90], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdx + 0x98], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdx + 0xa0], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdx + 0xa8], rax
movabs rax, 0x510e527fade682d1
mov qword [rdx + 0xb0], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdx + 0xb8], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdx + 0xc0], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdx + 0xc8], rax
pop rdi
ret
Function at 0x8ec6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
xor eax, eax
mov rsi, qword [rsp + 0x88]
mov ebx, dword [rsp + 0x80]
lea rdi, [rcx + 8]
mov r12, rcx
mov qword [rcx], 0
mov r10d, edx
and rdi, 0xfffffffffffffff8
mov edx, r8d
mov r8, r9
mov r9d, 8
mov qword [rcx + 0x80], 0
sub rcx, rdi
add ecx, 0x88
shr ecx, 3
rep stosq qword [rdi], rax
mov byte [r12 + 0x82], r10b
mov rcx, r12
mov qword [rsp + 0x20], rsi
call fcn.008e8f60
lea edx, [rbx - 8]
lea r8, [rsi + 8]
mov rcx, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
jmp fcn.008ec5e0
Function at 0x8ec760
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x448
mov r12d, 1
xor r15d, r15d
mov rax, rdx
mov qword [rsp + 0x490], rcx
mov rcx, r8
mov rdx, r8
movdqu xmm1, xmmword [rax + 0x10]
movdqu xmm0, xmmword [rax]
movabs r8, 0x7ffffffffffff
movaps xmmword [rsp + 0x2b0], xmm1
movzx eax, byte [rsp + 0x2bf]
movaps xmmword [rsp + 0x2a0], xmm0
and eax, 0x7f
and byte [rsp + 0x2a0], 0xf8
or eax, 0x40
mov byte [rsp + 0x2bf], al
call fcn.008ec750
lea rcx, [rdx + 6]
and rax, r8
mov r14, rax
mov qword [rsp + 0x278], rax
call fcn.008ec750
lea rcx, [rdx + 0xc]
shr rax, 3
and rax, r8
mov rbx, rax
mov qword [rsp + 0xd0], rax
call fcn.008ec750
lea rcx, [rdx + 0x13]
shr rax, 6
mov rdi, rax
and rdi, r8
mov qword [rsp + 0x128], rdi
call fcn.008ec750
lea rcx, [rdx + 0x18]
shr rax, 1
mov rsi, rax
and rsi, r8
mov qword [rsp + 0x240], rsi
call fcn.008ec750
mov rcx, r14
mov qword [rsp + 0x2f8], 0
mov qword [rsp + 0x300], 0
shr rax, 0xc
mov qword [rsp + 0x308], 0
and rax, r8
mov qword [rsp + 0x280], rax
mov rdx, rax
mov qword [rsp + 0x310], 0
mov qword [rsp + 0x2f0], 1
mov qword [rsp + 0x328], 0
mov qword [rsp + 0x330], 0
mov qword [rsp + 0x338], 0
mov qword [rsp + 0x340], 0
mov qword [rsp + 0x320], 1
mov qword [rsp + 0x350], 0
mov qword [rsp + 0x358], 0
mov qword [rsp + 0x360], 0
mov qword [rsp + 0x368], 0
mov qword [rsp + 0x370], 0
mov qword [rsp + 0x380], 0
mov qword [rsp + 0x388], 0
mov qword [rsp + 0x390], 0
mov qword [rsp + 0x398], 0
mov qword [rsp + 0x3a0], 0
mov qword [rsp + 0x3b8], 0
mov qword [rsp + 0x3c0], 0
mov qword [rsp + 0x3c8], 0
mov qword [rsp + 0x2e0], rax
lea rax, [rax + rax*8]
lea rax, [rdx + rax*2]
mov qword [rsp + 0x2c8], rbx
mov qword [rsp + 0xd8], rax
lea rax, [rbx + rbx*8]
lea rax, [rbx + rax*2]
lea rbx, [rsp + 0x410]
mov qword [rsp + 0x3d0], 0
mov qword [rsp + 0xc8], rbx
lea rbx, [rsp + 0x3e0]
mov qword [rsp + 0xa8], rbx
lea rbx, [rsp + 0x3b0]
mov qword [rsp + 0x120], rbx
lea rbx, [rsp + 0x380]
mov qword [rsp + 0x288], rax
lea rax, [rdi + rdi*8]
mov qword [rsp + 0xc0], rbx
lea rax, [rdi + rax*2]
lea rbx, [rsp + 0x350]
mov qword [rsp + 0x118], rbx
lea rbx, [rsp + 0x320]
mov qword [rsp + 0x248], rax
lea rax, [rsi + rsi*8]
mov qword [rsp + 0x110], rbx
lea rax, [rsi + rax*2]
lea rbx, [rsp + 0x2f0]
mov qword [rsp + 0xa0], rbx
lea rbx, [rsp + 0x2c0]
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x3b0], 1
mov qword [rsp + 0x3e0], 0
mov qword [rsp + 0x3e8], 0
mov qword [rsp + 0x3f0], 0
mov qword [rsp + 0x3f8], 0
mov qword [rsp + 0x400], 0
mov qword [rsp + 0x418], 0
mov qword [rsp + 0x420], 0
mov qword [rsp + 0x428], 0
mov qword [rsp + 0x430], 0
mov qword [rsp + 0x410], 1
mov qword [rsp + 0x2c0], r14
mov qword [rsp + 0x2d0], rdi
mov qword [rsp + 0x2d8], rsi
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x298], rax
lea rax, [rsp + 0x2bf]
mov qword [rsp + 0x290], rax
mov eax, 1
nop
Function at 0x8f3260
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rdx
lea rbp, [r8 + 0x40]
mov rbx, rcx
mov r12, r8
mov rdx, rbp
mov r8d, 0x98aa
mov rcx, rsi
mov r13, r9
lea r14, [r12 + 0x80]
lea rdi, [rsp + 0x60]
call fcn.008f9d20
lea r8, [r12 + 0xc0]
mov rdx, rsi
mov rcx, rbx
call fcn.008f9720
mov rdx, r12
mov r8, r14
mov rcx, rsi
call fcn.008f9720
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.008fa700
lea r12, [rsp + 0x20]
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.008fa7f0
mov r8, rbp
mov rdx, r14
mov rcx, r12
call fcn.008fa700
mov r8, rsi
mov rdx, r12
mov rcx, rbx
call fcn.008f9720
mov r8d, 0x98a9
mov rdx, rbx
mov rcx, r12
call fcn.008f9d20
mov rdx, r12
mov rcx, rsi
call fcn.008fa240
lea rdx, [0x024280a0]
mov rcx, r12
mov r15, rax
call fcn.008fabb0
or rax, r15
je 0x8f34a0
mov r8d, 0x98a9
mov rdx, rsi
mov rcx, r12
call fcn.008f9d20
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.008f9720
mov r8, r14
mov rdx, r12
mov rcx, rsi
call fcn.008f9720
mov r8, rsi
mov rdx, rsi
mov rcx, rsi
call fcn.008fa7f0
lea r14, [rsp + 0xa0]
mov rcx, rsi
call fcn.008fa8c0
mov r8, rsi
lea rdx, [0x024280a0]
mov rcx, r14
mov r15, rax
call fcn.008fa700
xor r15, qword [rsp + 0x160]
xor eax, eax
not r15
movd xmm2, r15d
pshufd xmm6, xmm2, 0
nop dword [rax]
movdqa xmm0, xmmword [rsi + rax]
pxor xmm0, xmmword [r14 + rax]
pand xmm0, xmm6
pxor xmm0, xmmword [rsi + rax]
movaps xmmword [rsi + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x8f33b8
mov r8, rbx
lea rdx, [0x024280a0]
mov rcx, r14
call fcn.008fa700
xor eax, eax
nop
movdqa xmm0, xmmword [rbx + rax]
pxor xmm0, xmmword [r14 + rax]
pand xmm0, xmm6
pxor xmm0, xmmword [rbx + rax]
movaps xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x8f33f0
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
call fcn.008fa7f0
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.008f9720
mov rcx, rbx
call fcn.008fa8c0
mov r8, rbx
lea rdx, [0x024280a0]
mov rcx, r14
xor r13, rax
call fcn.008fa700
movd xmm3, r13d
xor eax, eax
pshufd xmm1, xmm3, 0
nop word [rax + rax]
movdqa xmm0, xmmword [rbx + rax]
pxor xmm0, xmmword [r14 + rax]
pand xmm0, xmm1
pxor xmm0, xmmword [rbx + rax]
movaps xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x8f3460
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, 0x9a
lea rdx, [0x02422860]
lea rcx, str.ok__cryptonite_gf_eq_b_ZERO_
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x8f333e
Function at 0x8f6570
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x190], xmm7
movaps xmmword [rsp + 0x1a0], xmm8
pxor xmm8, xmm8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x208], rdx
mov rbp, rcx
mov rdx, r8
mov rsi, rax
mov rcx, rax
lea r8, [0x02427fe0]
mov qword [rsp + 0x38], rax
call fcn.008f8f30
mov rdx, rsi
mov rcx, rsi
lea r15, [rsp + 0xc0]
call fcn.008f9660
lea rax, [rsp + 0x140]
mov dword [rsp + 0x30], 0x11
lea rsi, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov ebx, dword [rsp + 0x30]
mov r13, qword [rsp + 0x208]
pcmpeqd xmm7, xmm7
cmp ebx, 0x11
setne byte [rsp + 0x2f]
test ebx, ebx
setne byte [rsp + 0x34]
xor r14d, r14d
mov eax, r14d
mov r14, r13
mov r13d, eax
mov r8d, ebx
xor edx, edx
xor r11d, r11d
mov eax, edx
cmp r8d, 0x1bd
ja 0x8f6657
mov eax, r8d
mov ecx, r8d
shr eax, 6
mov rax, qword [rsp + rax*8 + 0x40]
shr rax, cl
mov ecx, r11d
and eax, 1
shl rax, cl
or eax, edx
mov edx, eax
add r11d, 1
add r8d, 0x12
cmp r11d, 5
jne 0x8f662e
sar edx, 4
mov ecx, 0x18
mov rdi, r15
xor r11d, r11d
sub edx, 1
pxor xmm0, xmm0
lea r8, [rsp + 0x180]
xor eax, edx
and eax, 0xf
movd xmm4, eax
xor eax, eax
rep stosq qword [rdi], rax
pshufd xmm3, xmm4, 0
nop dword [rax]
movdqa xmm2, xmm3
lea rcx, [r14 + r11]
mov rdi, r15
mov rax, r15
pcmpeqd xmm2, xmm8
jmp 0x8f66b4
movdqa xmm0, xmmword [rax]
movdqa xmm1, xmmword [rcx]
add rax, 0x10
add rcx, 0x10
pand xmm1, xmm2
por xmm0, xmm1
movaps xmmword [rax - 0x10], xmm0
cmp r8, rax
jne 0x8f66b0
add r11, 0xc0
paddd xmm3, xmm7
movdqa xmm0, xmmword [rsp + 0xc0]
cmp r11, 0xc00
jne 0x8f6698
movd xmm5, edx
lea r12, [r15 + 0x40]
mov rax, r15
pshufd xmm6, xmm5, 0
jmp 0x8f6704
movdqa xmm0, xmmword [rax]
movdqa xmm1, xmmword [rax + 0x40]
add rax, 0x10
pxor xmm1, xmm0
pand xmm1, xmm6
pxor xmm0, xmm1
movaps xmmword [rax - 0x10], xmm0
movdqa xmm0, xmmword [rax + 0x30]
pxor xmm0, xmm1
movaps xmmword [rax + 0x30], xmm0
cmp r12, rax
jne 0x8f6700
mov r8, qword [rsp + 0x20]
lea rdx, [0x024280a0]
mov rcx, rsi
call fcn.008fa700
mov rax, rsi
nop word cs:[rax + rax]
movdqa xmm0, xmmword [rdi + 0x80]
pxor xmm0, xmmword [rax]
add rdi, 0x10
add rax, 0x10
pand xmm0, xmm6
pxor xmm0, xmmword [rdi + 0x70]
movaps xmmword [rdi + 0x70], xmm0
cmp r12, rdi
jne 0x8f6750
lea edi, [r13 + 1]
test r13d, r13d
jne 0x8f67a3
cmp byte [rsp + 0x2f], 0
jne 0x8f67a3
mov rdx, r15
mov rcx, rbp
call fcn.008f1bd0
add r14, 0xc00
add ebx, 0x5a
mov r13d, edi
jmp 0x8f6626
xor r8d, r8d
cmp r13d, 4
mov rdx, r15
mov rcx, rbp
sete r8b
and r8d, dword [rsp + 0x34]
call fcn.008f2ad0
cmp edi, 5
jne 0x8f6791
sub dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
cmp eax, 0xffffffff
je 0x8f67e4
xor r8d, r8d
mov rdx, rbp
mov rcx, rbp
call fcn.008f2230
jmp 0x8f65fb
mov rcx, r15
mov edx, 0xc0
call fcn.008fac10
mov rcx, qword [rsp + 0x38]
mov edx, 0x38
call fcn.008fac10
nop
movaps xmm6, xmmword [rsp + 0x180]
movaps xmm7, xmmword [rsp + 0x190]
movaps xmm8, xmmword [rsp + 0x1a0]
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x8f6830
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
mov r10, r9
add r10, 0xffffffffffffffff
adc r11, 0xffffffffffffffff
mov rax, r11
not rax
movd xmm2, eax
xor eax, eax
pshufd xmm1, xmm2, 0
nop
movdqa xmm0, xmmword [rdx + rax]
pxor xmm0, xmmword [r8 + rax]
pand xmm0, xmm1
pxor xmm0, xmmword [rdx + rax]
movaps xmmword [rcx + rax], xmm0
add rax, 0x10
cmp rax, 0x100
jne 0x8f6850
ret
Function at 0x8f8fe0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r9, rcx
mov r8, rdx
xor ecx, ecx
nop word [rax + rax]
mov rdx, qword [r9 + rax]
xor rdx, qword [r8 + rax]
add rax, 8
or rcx, rdx
cmp rax, 0x38
jne 0x8f8ff0
mov rax, rcx
xor edx, edx
add rax, 0xffffffffffffffff
adc rdx, 0xffffffffffffffff
mov rax, rdx
ret

Function at 0x90dc10
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
sub rsp, 0x168
lea r12, [rsp + 0x90]
mov r14, rcx
lea r15, [rsp + 0x50]
mov r13, rdx
mov rcx, r12
call fcn.008ebbf0
mov r8d, 0x20
mov rdx, r14
mov rcx, r12
call fcn.008ebca0
mov rdx, r15
mov rcx, r12
lea r14, [rsp + 0x20]
call fcn.008ebe90
movzx eax, byte [rsp + 0x6f]
mov rdx, r15
mov rcx, r14
mov r8d, 0x20
and byte [rsp + 0x50], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [rsp + 0x6f], al
call fcn.00906220
mov rdx, r14
mov rcx, r12
call fcn.00905b80
mov rdx, r12
mov rcx, r13
call fcn.009015a0
nop
add rsp, 0x168
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x90dcb0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x398
mov rsi, qword [rsp + 0x400]
mov r12, rcx
mov r13, r8
mov r14, r9
mov rdi, rdx
lea rbx, [rsp + 0x2c0]
lea r15, [rsp + 0x90]
mov rcx, rbx
lea rbp, [rsp + 0x30]
call fcn.008ebbf0
mov r8d, 0x20
mov rdx, r13
mov rcx, rbx
call fcn.008ebca0
mov rdx, r15
mov rcx, rbx
lea r13, [rsp + 0x1f0]
call fcn.008ebe90
movzx eax, byte [rsp + 0xaf]
mov rcx, r13
and byte [rsp + 0x90], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [rsp + 0xaf], al
call fcn.008ebbf0
lea rdx, [rsp + 0xb0]
mov rcx, r13
mov r8d, 0x20
call fcn.008ebca0
mov r8d, edi
mov rdx, r12
mov rcx, r13
call fcn.008ebca0
lea rdx, [rsp + 0xd0]
mov rcx, r13
lea r13, [rsp + 0x150]
mov qword [rsp + 0x28], rdx
call fcn.008ebe90
mov rdx, qword [rsp + 0x28]
mov r8d, 0x40
mov rcx, rbp
call fcn.00906220
mov rdx, rbp
mov rcx, r13
call fcn.00905b80
mov rdx, r13
mov rcx, rsi
lea r13, [rsp + 0x110]
call fcn.009015a0
mov rcx, rbx
call fcn.008ebbf0
mov rdx, rsi
mov rcx, rbx
mov r8d, 0x20
call fcn.008ebca0
mov rdx, r14
mov rcx, rbx
mov r8d, 0x20
call fcn.008ebca0
mov r8d, edi
mov rdx, r12
mov rcx, rbx
call fcn.008ebca0
lea r12, [rsp + 0x60]
mov rdx, r13
mov rcx, rbx
call fcn.008ebe90
mov rdx, r13
mov rcx, r12
mov r8d, 0x40
call fcn.00906220
mov rdx, r15
mov rcx, rbx
mov r8d, 0x20
call fcn.00906220
mov r8, rbx
mov rdx, r12
mov rcx, r12
call fcn.008fb960
mov rax, qword [rsp + 0x30]
add rax, qword [rsp + 0x60]
movabs rcx, 0xffffffffffffff
mov rdx, rax
shr rax, 0x38
and rdx, rcx
mov qword [rsp + 0x60], rdx
mov rdx, rax
mov rax, qword [rsp + 0x38]
add rax, qword [rsp + 0x68]
add rax, rdx
mov rdx, rax
shr rax, 0x38
and rdx, rcx
mov qword [rsp + 0x68], rdx
mov rdx, rax
mov rax, qword [rsp + 0x40]
add rax, qword [rsp + 0x70]
add rax, rdx
mov rdx, rax
shr rax, 0x38
and rdx, rcx
mov qword [rsp + 0x70], rdx
mov rdx, rax
mov rax, qword [rsp + 0x48]
add rax, qword [rsp + 0x78]
add rax, rdx
mov rdx, qword [rsp + 0x50]
add rdx, qword [rsp + 0x80]
and rcx, rax
shr rax, 0x38
add rax, rdx
mov qword [rsp + 0x78], rcx
mov rcx, r12
mov qword [rsp + 0x80], rax
call fcn.008fb350
lea rcx, [rsi + 0x20]
mov rdx, r12
call fcn.009061c0
nop
add rsp, 0x398
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x90def0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x258
mov r14, rcx
mov rsi, rdx
mov r13, r8
mov rbx, r9
test byte [r9 + 0x3f], 0xe0
jne 0x90e017
lea r15, [rsp + 0xe0]
mov rdx, r8
mov rcx, r15
call fcn.009063c0
test eax, eax
je 0x90e017
lea r12, [rsp + 0x180]
mov rcx, r12
call fcn.008ebbf0
mov r8d, 0x20
mov rdx, rbx
mov rcx, r12
call fcn.008ebca0
mov rdx, r13
mov r8d, 0x20
mov rcx, r12
call fcn.008ebca0
mov r8d, esi
mov rdx, r14
mov rcx, r12
lea r13, [rsp + 0xa0]
lea rsi, [rsp + 0x40]
call fcn.008ebca0
mov rdx, r13
mov rcx, r12
call fcn.008ebe90
mov rdx, r13
mov rcx, rsi
mov r8d, 0x40
call fcn.00906220
lea r13, [rsp + 0x70]
lea rdx, [rbx + 0x20]
mov r8d, 0x20
mov rcx, r13
call fcn.00906220
mov r8, rsi
mov r9, r13
mov rdx, r15
mov rcx, r12
lea rsi, [rsp + 0x20]
call fcn.00901f60
mov rdx, r12
mov rcx, rsi
call fcn.009015a0
xor edx, edx
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rdx]
xor al, byte [rsi + rdx]
add rdx, 1
movzx eax, al
or rcx, rax
cmp rdx, 0x20
jne 0x90dfe0
lea rax, [rcx - 1]
shr rax, 8
and eax, 1
sub eax, 1
add rsp, 0x258
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 0xffffffff
jmp 0x90e005
Function at 0x916e80
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, r8d
movzx r8d, r8b
cmp al, 0x18
je 0x8e7530
cmp al, 0x20
je 0x8e7550
cmp al, 0x10
je 0x8e7540
jmp 0x916e80
mov r9d, 0x10c
mov word [rcx], r9w
jmp 0x916e80
mov r10d, 0xa
mov word [rcx], r10w
jmp 0x916e80
mov eax, 0x20e
mov word [rcx], ax
jmp 0x916e80
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rax, rcx
mov r9, rdx
cmp r8b, 0x18
je 0x916ec0
cmp r8b, 0x20
je 0x916ff0
cmp r8b, 0x10
je 0x916fe0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rcx], 0xc
mov r14d, 0xd0
movzx edi, r8b
xor edx, edx
nop
movzx ecx, byte [r9 + rdx]
mov byte [rax + rdx + 8], cl
add rdx, 1
cmp edi, edx
jg 0x916ed0
movzx r9d, r8b
mov r13d, 1
lea r8, [rax + 8]
lea rcx, [rax + r9]
lea rbp, [0x0242fe60]
lea r15, [0x0242fd20]
cmp r9, r14
jb 0x916f90
jmp 0x916eac
movabs rax, 0xa0a0a0a0a0a0a0a1
movsxd r12, r13d
add r13d, 1
mul r12
shr rdx, 5
lea rax, [rdx + rdx*2]
mov rdx, rax
shl rdx, 4
add rax, rdx
sub r12, rax
movzx eax, sil
movzx esi, byte [rbp + r11]
movzx r11d, byte [rbp + r10]
movzx edx, byte [r15 + r12]
movzx r10d, byte [rbp + rbx]
movzx ebx, byte [rbp + rax]
xor ebx, edx
xor bl, byte [r8]
add r9, 4
add rcx, 4
add r8, 4
mov byte [rcx + 4], bl
movzx eax, byte [r8 - 3]
xor eax, esi
mov byte [rcx + 5], al
xor r11b, byte [r8 - 2]
mov byte [rcx + 6], r11b
xor r10b, byte [r8 - 1]
mov byte [rcx + 7], r10b
cmp r9, r14
jae 0x916eac
mov eax, r9d
movzx ebx, byte [rcx + 4]
movzx esi, byte [rcx + 5]
cdq
movzx r11d, byte [rcx + 6]
movzx r10d, byte [rcx + 7]
idiv edi
test edx, edx
je 0x916f10
cmp edx, 0x10
jne 0x916f5b
cmp edi, 0x20
jne 0x916f5b
movzx eax, sil
movzx ebx, byte [rbp + rbx]
movzx r11d, byte [rbp + r11]
movzx esi, byte [rbp + rax]
movzx r10d, byte [rbp + r10]
jmp 0x916f5b
mov byte [rcx], 0xa
mov r14d, 0xb0
jmp 0x916ec9
mov byte [rcx], 0xe
mov r14d, 0xf0
jmp 0x916ec9

Function at 0x917030
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
mov r11d, 3
mov r10d, 4
movabs rbx, 0xe100000000000000
mov r9, rcx
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov rcx, qword [rdx + 8]
mov rdx, qword [rdx]
bswap rcx
bswap rdx
mov qword [r9 + 0x88], rcx
mov qword [r9 + 0x80], rdx
mov rax, rcx
movsxd r8, r10d
mov rsi, rcx
mov rcx, rdx
shl r8, 4
and eax, 1
shr rsi, 1
shl rcx, 0x3f
neg rax
shr rdx, 1
add r8, r9
and rax, rbx
or rcx, rsi
sar r10d, 1
xor rdx, rax
mov qword [r8 + 8], rcx
mov qword [r8], rdx
sub r11d, 1
jne 0x917076
mov esi, 3
mov ebx, 2
lea rdi, [r9 + 0x18]
movsxd rcx, ebx
lea r8d, [rbx - 2]
mov rdx, rdi
shl rcx, 4
shl r8, 4
add rcx, r9
mov r10, qword [rcx]
mov r11, qword [rcx + 8]
lea rax, [rcx + 0x10]
lea r8, [rcx + r8 + 0x20]
nop dword [rax]
mov qword [rax], r10
add rdx, 0x10
mov qword [rax + 8], r11
mov rcx, qword [rdx - 0x18]
xor qword [rax], rcx
mov rcx, qword [rdx - 0x10]
xor qword [rax + 8], rcx
add rax, 0x10
cmp rax, r8
jne 0x9170e8
add ebx, ebx
sub esi, 1
jne 0x9170c0
pop rbx
pop rsi
pop rdi
ret
Function at 0xacaa10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, r8
test rdx, rdx
je 0xacaa3c
movabs r9, 0x100000001b3
add rdx, rcx
nop dword [rax]
imul rax, r9
movzx r8d, byte [rcx]
add rcx, 1
xor rax, r8
cmp rdx, rcx
jne 0xacaa28
ret

Function at 0xacaa40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, r9
add rdx, rcx
test r8, r8
je 0xacaa74
movabs rcx, 0x100000001b3
add r8, rdx
nop dword [rax + rax]
imul rax, rcx
movzx r9d, byte [rdx]
add rdx, 1
xor rax, r9
cmp rdx, r8
jne 0xacaa60
ret
Function at 0x17755c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov qword [rsp + 0x70], rcx
mov rcx, rdx
mov r13, rdx
mov rbx, rdx
call sub.msvcrt.dll_strlen
movabs rdx, 0x27d4eb2f166667cc
mov r14, rax
lea r11, [r13 + rax]
cmp rax, 0x1f
jbe 0x177575d
lea r15, [r11 - 0x20]
mov rdx, r13
mov ebp, 0x100007
movabs rdi, 0x61c8864e7a243580
movabs r12, 0xc2b2ae3d27e4eb56
movabs rax, 0x60ea27eeadd0b5dd
movabs rbx, 0xc2b2ae3d27d4eb4f
movabs r10, 0x9e3779b185ebca87
nop dword [rax]
mov rsi, qword [rdx]
mov r9, qword [rdx + 8]
add rdx, 0x20
mov r8, qword [rdx - 0x10]
mov rcx, qword [rdx - 8]
imul rsi, rbx
imul r9, rbx
imul r8, rbx
imul rcx, rbx
add rsi, rax
add r9, r12
rol rsi, 0x1f
add r8, rbp
rol r9, 0x1f
mov rax, rsi
add rcx, rdi
rol r8, 0x1f
imul rax, r10
mov r12, r9
rol rcx, 0x1f
imul r12, r10
mov rbp, r8
mov rdi, rcx
imul rbp, r10
imul rdi, r10
cmp r15, rdx
jae 0x1775640
mov rdx, r11
lea r15, [r11 - 0x1f]
sub rdx, r13
sub rdx, 0x20
and rdx, 0xffffffffffffffe0
lea rbx, [rdx + 0x20]
lea rdx, [r13 + 1]
cmp r15, rdx
mov edx, 0x20
cmovb rbx, rdx
rol rax, 1
rol r12, 7
lea rdx, [rax + r12]
add rbx, r13
rol rbp, 0xc
mov rax, r8
movabs r13, 0xdef35b010f796ca9
rol rdi, 0x12
add rdx, rbp
imul rsi, r13
add rdx, rdi
imul r9, r13
imul rax, r13
rol rsi, 0x1f
imul rcx, r13
mov rdi, rsi
rol r9, 0x1f
movabs rsi, 0x85ebca77c2b2ae63
imul rdi, r10
rol rax, 0x1f
imul r9, r10
rol rcx, 0x1f
imul rax, r10
xor rdx, rdi
imul rcx, r10
mov rdi, rdx
imul rdi, r10
lea rdx, [rdi + rsi]
xor rdx, r9
imul rdx, r10
add rdx, rsi
xor rdx, rax
mov rax, rdx
imul rax, r10
lea rdx, [rax + rsi]
xor rdx, rcx
imul r10, rdx
lea rdx, [r10 + rsi]
lea r10, [rbx + 8]
add rdx, r14
cmp r11, r10
jb 0x17757cc
movabs r9, 0xc2b2ae3d27d4eb4f
mov rax, r10
mov rsi, rdx
movabs rcx, 0x9e3779b185ebca87
movabs r8, 0x85ebca77c2b2ae63
nop dword [rax]
mov rdx, qword [rax - 8]
add rax, 8
imul rdx, r9
rol rdx, 0x1f
imul rdx, rcx
xor rdx, rsi
rol rdx, 0x1b
imul rdx, rcx
lea rsi, [rdx + r8]
cmp r11, rax
jae 0x1775790
lea rax, [r11 - 8]
mov rdx, rsi
sub rax, rbx
and rax, 0xfffffffffffffff8
mov rbx, rax
add rbx, r10
lea rax, [rbx + 4]
cmp r11, rax
jb 0x177580b
movabs rcx, 0x9e3779b185ebca87
mov r14d, dword [rbx]
mov rbx, rax
imul r14, rcx
xor r14, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
rol r14, 0x17
imul r14, rdx
movabs rdx, 0x165667b19e3779f9
add rdx, r14
cmp r11, rbx
jbe 0x177584e
movabs rcx, 0x27d4eb2f165667c5
mov r8, rdx
movabs rax, 0x9e3779b185ebca87
nop word [rax + rax]
movzx edx, byte [rbx]
add rbx, 1
imul rdx, rcx
xor rdx, r8
rol rdx, 0xb
imul rdx, rax
mov r8, rdx
cmp r11, rbx
jne 0x1775830
mov r14, rdx
mov rdi, qword [rsp + 0x70]
shr r14, 0x21
xor r14, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
imul r14, rdx
mov rdx, r14
shr rdx, 0x1d
xor r14, rdx
movabs rdx, 0x165667b19e3779f9
imul r14, rdx
mov rax, r14
shr rax, 0x20
xor r14, rax
mov eax, dword [rdi + 8]
and eax, r14d
cmp dword [rdi], eax
jle 0x177589d
mov eax, dword [rdi + 0xc]
and eax, r14d
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret