joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1dd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm0, xmmword [rcx]
movdqu xmm2, xmmword [rcx + 0x10]
movdqa xmm5, xmm0
aeskeygenassist xmm4, xmm2, 1
pslldq xmm5, 4
pshufd xmm4, xmm4, 0xff
movdqa xmm1, xmm5
movups xmmword [rdx], xmm0
pslldq xmm1, 4
movups xmmword [rdx + 0x10], xmm2
movdqa xmm3, xmm1
pxor xmm1, xmm5
movdqa xmm5, xmm2
pslldq xmm3, 4
pslldq xmm5, 4
pxor xmm3, xmm4
pxor xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm5
pslldq xmm0, 4
aeskeygenassist xmm4, xmm1, 0
movups xmmword [rdx + 0x20], xmm1
movdqa xmm3, xmm0
pshufd xmm4, xmm4, 0xaa
pxor xmm0, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm1
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm5
pslldq xmm2, 4
aeskeygenassist xmm4, xmm0, 2
movups xmmword [rdx + 0x30], xmm0
movdqa xmm3, xmm2
pshufd xmm4, xmm4, 0xff
pxor xmm2, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm0
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm2, xmm3
pxor xmm2, xmm1
movdqa xmm1, xmm5
pslldq xmm1, 4
aeskeygenassist xmm4, xmm2, 0
movups xmmword [rdx + 0x40], xmm2
movdqa xmm3, xmm1
pshufd xmm4, xmm4, 0xaa
pxor xmm1, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm2
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm5
pslldq xmm0, 4
aeskeygenassist xmm4, xmm1, 4
movups xmmword [rdx + 0x50], xmm1
movdqa xmm3, xmm0
pshufd xmm4, xmm4, 0xff
pxor xmm0, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm1
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm5
pslldq xmm2, 4
aeskeygenassist xmm4, xmm0, 0
movups xmmword [rdx + 0x60], xmm0
movdqa xmm3, xmm2
pshufd xmm4, xmm4, 0xaa
pxor xmm2, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm0
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm2, xmm3
pxor xmm2, xmm1
movdqa xmm1, xmm5
pslldq xmm1, 4
aeskeygenassist xmm4, xmm2, 8
movups xmmword [rdx + 0x70], xmm2
movdqa xmm3, xmm1
pshufd xmm4, xmm4, 0xff
pxor xmm1, xmm5
pslldq xmm3, 4
movdqa xmm5, xmm2
pxor xmm3, xmm4
pslldq xmm5, 4
pxor xmm1, xmm3
pxor xmm1, xmm0
movdqa xmm0, xmm5
pslldq xmm0, 4
aeskeygenassist xmm4, xmm1, 0
movups xmmword [rdx + 0x80], xmm1
movdqa xmm3, xmm0
pshufd xmm4, xmm4, 0xaa
pxor xmm0, xmm5
pslldq xmm3, 4
pxor xmm3, xmm4
movdqa xmm4, xmm1
pslldq xmm4, 4
pxor xmm0, xmm3
movdqa xmm3, xmm4
pxor xmm0, xmm2
pslldq xmm3, 4
movups xmmword [rdx + 0x90], xmm0
aeskeygenassist xmm0, xmm0, 0x10
movdqa xmm2, xmm3
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm4
pslldq xmm2, 4
pxor xmm0, xmm2
pxor xmm0, xmm3
pxor xmm0, xmm1
movups xmmword [rdx + 0xa0], xmm0
ret
Function at 0x1400b2130
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call sym.SetLockPagesPrivilege
lea rcx, [0x140170220]
call sym.__emutls_get_address
mov r9d, 4
mov r8d, 0x20003000
mov edx, 0x200000
mov rcx, qword [rax]
mov rbx, rax
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rdi
lea rcx, [0x140170240]
mov qword [rbx], rax
mov rsi, rax
call sym.__emutls_get_address
mov dword [rax], 1
test rsi, rsi
je 0x1400b2200
lea rcx, [0x140170280]
call sym.__emutls_get_address
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1fff
mov rcx, qword [rax]
mov rsi, rax
call rdi
lea rcx, [0x1401702a0]
mov qword [rsi], rax
mov rbx, rax
call sym.__emutls_get_address
mov dword [rax], 1
test rbx, rbx
je 0x1400b2220
mov rbx, qword [rsi]
lea rcx, [0x140170260]
add rbx, 0xfff
call sym.__emutls_get_address
and rbx, 0xfffffffffffff000
mov qword [rax], rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov dword [rax], 0
mov ecx, 0x200000
call sym.malloc
mov qword [rbx], rax
jmp 0x1400b2193
mov dword [rax], 0
mov ecx, 0x1fff
call sym.malloc
mov qword [rsi], rax
mov rbx, rax
jmp 0x1400b21d8

Function at 0x1400b2240
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
endbr64
sub rsp, 0x28
lea rcx, [0x140170220]
call sym.__emutls_get_address
cmp qword [rax], 0
je 0x1400b2260
add rsp, 0x28
ret
add rsp, 0x28
jmp sym.cn_slow_hash_allocate_state.part.0
Function at 0x1400b8200
Capabilities:
Query environment variable

Disassembly:
endbr64
sub rsp, 0x28
mov rdx, qword [rcx]
mov r9d, dword [rcx + 0xc]
mov r8d, dword [rcx + 8]
mov rcx, qword [0x140269608]
call sym.randomx_init_dataset
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__endthreadex]
nop
nop dword [rax + rax]

Function at 0x1400b8230
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.SEEDHASH_EPOCH_LAG
call sym.getenv
test rax, rax
je 0x1400b8258
mov rcx, rax
call sym.atoi
mov dword [0x14017036c], eax
cmp eax, 0x40
jbe 0x1400b8270
mov dword [0x14017036c], 0x40
mov eax, 0x40
add rsp, 0x28
ret
movsxd rdx, eax
test rdx, rdx
je 0x1400b8258
lea rcx, [rdx - 1]
test rcx, rdx
je 0x1400b8267
jmp 0x1400b8258
Function at 0x1400b8330
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov eax, 3
cmp rcx, rax
cmovae rax, rcx
lea rbx, [rax - 2]
mov qword [rsp + 0x30], rax
mov rdi, rbx
shl rdi, 4
mov rcx, rdi
call sym.malloc
mov r13, rax
test rax, rax
je 0x1400b8575
call sym.randomx_dataset_item_count
xor edx, edx
mov rcx, qword [rsp + 0x30]
mov eax, eax
div rbx
mov rsi, rcx
mov r8d, eax
sub rsi, 3
je 0x1400b84f9
shl rcx, 4
mov r9, qword [0x140269600]
mov rdx, r13
lea r10, [r13 + rcx - 0x30]
xor ecx, ecx
nop word cs:[rax + rax]
mov dword [rdx + 8], ecx
add rdx, 0x10
add ecx, r8d
mov qword [rdx - 0x10], r9
mov dword [rdx - 4], r8d
cmp rdx, r10
jne 0x1400b83b0
mov ecx, dword [rsp + 0x30]
lea r14, [r13 + rdi - 0x10]
mov qword [r14], r9
lea ebp, [rcx - 3]
imul ebp, eax
mov dword [r14 + 8], ebp
call sym.randomx_dataset_item_count
lea rcx, [rbx*8]
sub eax, ebp
mov dword [r14 + 0xc], eax
call sym.malloc
mov rbx, rax
test rax, rax
je 0x1400b8527
lea rax, [0x140269610]
mov r12, r13
xor r15d, r15d
mov rcx, rax
mov qword [rsp + 0x38], rax
lea rdi, [sym.rx_seedthread]
call sym.AcquireSRWLockShared
mov rbp, qword [sym.imp.msvcrt.dll__beginthreadex]
nop dword [rax]
mov qword [rsp + 0x28], 0
mov r9, r12
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov r8, rdi
call rbp
mov qword [rbx + r15*8], rax
test rax, rax
je 0x1400b8569
add r15, 1
add r12, 0x10
cmp rsi, r15
jne 0x1400b8430
mov rdx, qword [r14]
mov r9d, dword [r14 + 0xc]
mov rsi, rbx
mov r8d, dword [r14 + 8]
mov rcx, qword [0x140269608]
call sym.randomx_init_dataset
mov rax, qword [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbp, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r14, [rbx + rax*8 - 0x18]
nop dword [rax]
mov rdi, qword [rsi]
add rsi, 8
mov edx, 0xffffffff
mov rcx, rdi
call r12
mov rcx, rdi
call rbp
cmp r14, rsi
jne 0x1400b84a0
mov rcx, qword [rsp + 0x38]
call sym.ReleaseSRWLockShared
mov rcx, rbx
call sym.free
mov rcx, r13
call sym.free
lea rdx, str.RandomX_dataset_initialized
lea rcx, str.randomx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.minfo
mov rax, qword [0x140269600]
mov dword [r13 + 8], 0
mov qword [r13], rax
call sym.randomx_dataset_item_count
mov ecx, 8
mov dword [r13 + 0xc], eax
call sym.malloc
mov rbx, rax
test rax, rax
jne 0x1400b8538
lea rcx, str.Couldnt_allocate_RandomX_mining_threadlist
call sym.local_abort
nop dword [rax + rax]
lea rax, [0x140269610]
mov rcx, rax
mov qword [rsp + 0x38], rax
call sym.AcquireSRWLockShared
mov rdx, qword [r13]
mov r9d, dword [r13 + 0xc]
mov r8d, dword [r13 + 8]
mov rcx, qword [0x140269608]
call sym.randomx_init_dataset
jmp 0x1400b84bc
lea rcx, str.Couldnt_start_RandomX_seed_thread
call sym.local_abort
lea rcx, str.Couldnt_allocate_RandomX_mining_threadinfo
call sym.local_abort
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400b8590
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, qword [0x14023b4a0]
mov rax, qword [rbp]
mov qword [rsp + 0x28], rax
xor eax, eax
mov ebx, ecx
mov rcx, qword [rdx]
mov rsi, rdx
mov rdi, r8
test rcx, rcx
jne 0x1400b8670
test bl, 8
je 0x1400b85dc
lea rcx, [0x140170340]
call sym.__emutls_get_address
mov edx, dword [rax]
test edx, edx
jne 0x1400b85dc
or ebx, 0x10
and ebx, 0xfffffffb
mov eax, dword [0x140170360]
mov r12d, ebx
or r12d, 1
cmp eax, 0xffffffff
je 0x1400b8630
not eax
and r12d, eax
xor r8d, r8d
mov rdx, rdi
mov ecx, r12d
call sym.randomx_create_vm
mov qword [rsi], rax
test rax, rax
je 0x1400b86b0
mov rax, qword [rsp + 0x28]
sub rax, qword [rbp]
jne 0x1400b8784
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.LUNEXA_RANDOMX_UMASK
call sym.getenv
mov r13, rax
test rax, rax
je 0x1400b8698
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.strtol
cmp r13, qword [rsp + 0x20]
je 0x1400b8666
cmp eax, 0x7ffffffe
jbe 0x1400b8758
xor eax, eax
mov dword [0x140170360], eax
jmp 0x1400b85f6
mov rax, qword [rsp + 0x28]
sub rax, qword [rbp]
jne 0x1400b8784
mov rdx, r8
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.randomx_vm_set_cache
mov dword [0x140170360], 0
jmp 0x1400b85f6
mov eax, dword [0x140269580]
test eax, eax
je 0x1400b86f0
mov eax, dword [0x140170360]
cmp eax, 0xffffffff
je 0x1400b8710
not eax
and ebx, eax
xor r8d, r8d
mov rdx, rdi
mov ecx, ebx
call sym.randomx_create_vm
mov qword [rsi], rax
test rax, rax
jne 0x1400b8610
lea rcx, str.Couldnt_allocate_RandomX_light_VM
call sym.local_abort
nop
lea rdx, str.Couldnt_allocate_RandomX_light_VM_using_large_pages__will_print_only_once_
lea rcx, str.randomx
mov dword [0x140269580], 1
call sym.mdebug
jmp 0x1400b86ba
lea rcx, str.LUNEXA_RANDOMX_UMASK
call sym.getenv
mov r12, rax
test rax, rax
je 0x1400b8768
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.strtol
cmp r12, qword [rsp + 0x20]
je 0x1400b8780
cmp eax, 0x7ffffffe
ja 0x1400b8780
mov edx, eax
not edx
and ebx, edx
mov dword [0x140170360], eax
jmp 0x1400b86c9
mov edx, eax
not edx
and r12d, edx
jmp 0x1400b8668
mov dword [0x140170360], 0
jmp 0x1400b86c9
xor eax, eax
jmp 0x1400b8748
call dbg.__stack_chk_fail
nop
nop word [rax + rax]
Function at 0x1400b8d90
Capabilities:
Query environment variable

Disassembly:
endbr64
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x14017036c]
mov rsi, rcx
cmp eax, 0xffffffff
je 0x1400b8dd8
mov edx, dword [0x140170368]
movsxd rbx, eax
cmp edx, 0xffffffff
je 0x1400b8deb
lea rcx, [rbx + rdx]
xor eax, eax
cmp rcx, rsi
jae 0x1400b8dce
lea rax, [rsi - 1]
neg rdx
sub rax, rbx
and rax, rdx
add rsp, 0x28
pop rbx
pop rsi
ret
call sym.get_seedhash_epoch_lag.part.0
mov edx, dword [0x140170368]
movsxd rbx, eax
cmp edx, 0xffffffff
jne 0x1400b8db6
lea rcx, str.SEEDHASH_EPOCH_BLOCKS
call sym.getenv
test rax, rax
je 0x1400b8e28
mov rcx, rax
call sym.atoi
lea edx, [rax - 2]
mov dword [0x140170368], eax
cmp edx, 0x7fe
ja 0x1400b8e28
movsxd rdx, eax
lea rax, [rdx - 1]
test rax, rdx
je 0x1400b8db6
nop dword [rax]
mov dword [0x140170368], 0x800
mov edx, 0x800
jmp 0x1400b8db6

Function at 0x1400b8e90
Capabilities:
Create thread

Disassembly:
endbr64
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [0x1402695d0]
mov rbx, rcx
mov rsi, rdx
test eax, eax
je 0x1400b8ec4
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
xor rax, qword [0x1402695e0]
xor rdx, qword [0x1402695e8]
or rax, rdx
je 0x1400b8f28
mov ecx, 0x28
call sym.malloc
mov r9, rax
test rax, rax
je 0x1400b8f56
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbx + 0x10]
mov qword [rax + 0x20], rsi
xor ecx, ecx
lea r8, [sym.rx_set_main_seedhash_thread]
xor edx, edx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rcx, rax
test rax, rax
je 0x1400b8f4a
add rsp, 0x38
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rcx + 0x18]
xor rax, qword [0x1402695f0]
xor rdx, qword [0x1402695f8]
or rax, rdx
jne 0x1400b8ec4
add rsp, 0x38
pop rbx
pop rsi
ret
lea rcx, str.Couldnt_start_RandomX_seed_thread
call sym.local_abort
lea rcx, str.Couldnt_allocate_RandomX_mining_threadinfo
call sym.local_abort
nop
nop word cs:[rax + rax]
nop
Function at 0x1400b96e0
Capabilities:
Query environment variable

Disassembly:
endbr64
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, qword [0x14023b4a0]
lea rbp, [0x140269618]
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov ebx, ecx
lea rcx, [0x140170340]
mov rsi, rdx
call sym.__emutls_get_address
mov rcx, rbp
mov dword [rax], ebx
call sym.AcquireSRWLockExclusive
cmp qword [0x140269608], 0
jne 0x1400b9763
mov ebx, dword [0x140170364]
cmp ebx, 0xffffffff
je 0x1400b9788
mov eax, dword [0x140170360]
cmp eax, 0xffffffff
je 0x1400b97a0
not eax
and ebx, eax
mov edx, 1
mov ecx, ebx
call sym.rx_alloc_dataset.constprop.0
cmp qword [0x140269608], 0
je 0x1400b9763
mov rcx, rsi
call sym.rx_init_dataset.part.0
mov rax, qword [rsp + 0x28]
sub rax, qword [rdi]
jne 0x1400b97f8
mov rcx, rbp
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.ReleaseSRWLockExclusive
call sym.randomx_get_flags
mov dword [0x140170364], eax
mov ebx, eax
mov eax, dword [0x140170360]
cmp eax, 0xffffffff
jne 0x1400b9741
lea rcx, str.LUNEXA_RANDOMX_UMASK
call sym.getenv
mov r12, rax
test rax, rax
je 0x1400b97e0
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rax
call sym.strtol
cmp r12, qword [rsp + 0x20]
je 0x1400b97d2
cmp eax, 0x7ffffffe
jbe 0x1400b97f0
xor eax, eax
mov dword [0x140170360], eax
jmp 0x1400b9745
mov dword [0x140170360], 0
jmp 0x1400b9745
mov edx, eax
not edx
and ebx, edx
jmp 0x1400b97d4
call dbg.__stack_chk_fail
nop
nop
Function at 0x1400bb090
Capabilities:
Hash data using sha256

Disassembly:
endbr64
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash
Function at 0x1400bcfa0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, qword [0x14023b4a0]
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rsi, rcx
test rcx, rcx
je 0x1400bd1b5
mov rax, qword [rcx]
test rax, rax
je 0x1400bd1a7
mov rdx, qword [rax]
shr rdx, 2
mov qword [rax + 0x28], rdx
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x28]
add rax, 7
mov qword [rdx + 0x20], rax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x20]
shl rax, 4
mov qword [rdx + 0x10], rax
mov rdi, qword [rcx]
mov edx, 1
mov rcx, qword [rdi + 0x10]
call sym.calloc
mov qword [rdi + 0x18], rax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x1400bd1ae
mov r8, qword [rax]
mov rdx, qword [rax + 8]
call sym.memcpy
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x20]
mov r8, qword [rcx + 0x28]
shl rax, 2
cmp r8, rax
jae 0x1400bd150
lea r9, [r8*4]
mov r12, r8
lea r10, [rsp + 0x20]
lea r11, [rsp + 0x24]
lea rdi, [0x1402319e0]
lea rbp, [0x140231ae0]
nop dword [rax]
mov rax, qword [rcx + 0x18]
xor edx, edx
mov r13d, dword [rax + r9 - 4]
mov rax, r8
div r12
mov dword [rsp + 0x20], r13d
test rdx, rdx
je 0x1400bd0f0
cmp rdx, 4
jne 0x1400bd09b
cmp r12, 6
ja 0x1400bd170
xor eax, eax
mov rdx, qword [rcx + 0x18]
mov r14, r8
sub r14, qword [rcx + 0x28]
lea r12, [rdx + rax]
lea rdx, [rdx + r14*4]
movzx edx, byte [rdx + rax]
xor dl, byte [r10 + rax]
add rax, 1
mov byte [r12 + r9], dl
cmp rax, 4
je 0x1400bd0d0
mov rcx, qword [rsi]
jmp 0x1400bd09d
mov rcx, qword [rsi]
add r8, 1
add r9, 4
mov rax, qword [rcx + 0x20]
shl rax, 2
cmp r8, rax
jae 0x1400bd150
mov r12, qword [rcx + 0x28]
jmp 0x1400bd070
movzx edx, word [rsp + 0x21]
mov r12, r10
mov word [r11], dx
movzx edx, byte [rsp + 0x23]
mov byte [r11 + 2], dl
mov byte [rsp + 0x27], r13b
mov edx, dword [rsp + 0x24]
mov dword [rsp + 0x20], edx
movzx edx, byte [r12]
add r12, 1
mov r13, rdx
and edx, 0xf0
and r13d, 0xf
add rdx, rdi
movzx edx, byte [rdx + r13]
mov byte [r12 - 1], dl
cmp r12, r11
jne 0x1400bd112
movzx eax, byte [rbp + rax - 1]
xor byte [rsp + 0x20], al
jmp 0x1400bd09b
xor eax, eax
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rbx]
jne 0x1400bd1bc
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, r10
lea r14, [rsp + 0x24]
lea r13, [0x1402319e0]
movzx eax, byte [rdx]
add rdx, 1
mov r12, rax
and eax, 0xf0
and r12d, 0xf
add rax, r13
movzx eax, byte [rax + r12]
mov byte [rdx - 1], al
cmp r14, rdx
jne 0x1400bd17f
jmp 0x1400bd09b
mov eax, 7
jmp 0x1400bd152
mov eax, 8
jmp 0x1400bd152
mov eax, 2
jmp 0x1400bd152
call dbg.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400bd870
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
endbr64
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, qword [0x14023b4a0]
mov edx, 1
mov ecx, 0x20
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
xor eax, eax
call sym.calloc
mov rsi, rax
test rax, rax
je 0x1400bd932
lea rbx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__ftime64]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__gmtime64]
movzx r13d, word [rsp + 0x28]
mov ecx, 1
mov rbp, rax
mov rdx, r13
call sym.calloc
mov edx, dword [rbp + 0x14]
mov r12, rax
mov eax, dword [rbp + 0x10]
lea ebx, [rdx + rax + 0x76d]
add ebx, dword [rbp + 0xc]
add ebx, dword [rbp + 8]
add ebx, dword [rbp + 4]
add ebx, dword [rbp]
call sym.getpid
add ebx, r13d
add r13, r12
add eax, r13d
add ebx, eax
test r12, r12
je 0x1400bd914
mov rcx, r12
call sym.free
mov ecx, ebx
call sym.srand
xor r8d, r8d
mov edx, 2
mov rcx, rsi
mov qword [rsi], 0
call sym.oaes_set_option
mov rax, qword [rsp + 0x38]
sub rax, qword [rdi]
jne 0x1400bd94e
mov rax, rsi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call dbg.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop
Function at 0x1400be240
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
endbr64
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
test rcx, rcx
je 0x1400be2da
test rdx, rdx
je 0x1400be2e6
lea r9, [rdx + 0x10]
lea r8, [0x1402319e0]
nop dword [rax]
movzx eax, byte [rdx]
add rdx, 1
mov rcx, rax
and eax, 0xf0
and ecx, 0xf
add rax, r8
movzx eax, byte [rax + rcx]
mov byte [rdx - 1], al
cmp r9, rdx
jne 0x1400be270
mov rcx, rbx
call sym.oaes_shift_rows.isra.0
call sym.oaes_mix_cols.isra.0
lea rcx, [rbx + 4]
call sym.oaes_mix_cols.isra.0
lea rcx, [rbx + 8]
call sym.oaes_mix_cols.isra.0
lea rcx, [rbx + 0xc]
call sym.oaes_mix_cols.isra.0
xor eax, eax
nop dword [rax + rax]
movzx edx, byte [rsi + rax]
xor byte [rbx + rax], dl
add rax, 1
cmp rax, 0x10
jne 0x1400be2c0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, 2
add rsp, 0x28
pop rbx
pop rsi
ret
mov eax, 3
jmp 0x1400be2d3
Function at 0x1400c2b80
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
endbr64
mov r9d, 1
mov r8d, 0x81
jmp sym.blake256_final_h

Function at 0x1400c2ba0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
endbr64
xor r9d, r9d
mov r8d, pe_nt_image_headers64
jmp sym.blake256_final_h

Function at 0x1400c2bc0
Capabilities:
Hash data using sha256

Disassembly:
endbr64
push rdi
push rsi
push rbx
sub rsp, 0xb0
movdqu xmm0, xmmword [0x140231ff0]
mov rsi, qword [0x14023b4a0]
movups xmmword [rsp + 0x20], xmm0
lea rdi, [rsp + 0x20]
movdqu xmm0, xmmword [0x140232000]
mov rbx, rcx
mov rax, qword [rsi]
mov qword [rsp + 0xa8], rax
xor eax, eax
mov rcx, rdi
lea r8, [r8*8]
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x30], xmm0
pxor xmm0, xmm0
mov qword [rsp + 0x50], 0
movups xmmword [rsp + 0x40], xmm0
call sym.blake256_update
mov r9d, 1
mov rdx, rbx
mov rcx, rdi
mov r8d, 0x81
call sym.blake256_final_h
mov rax, qword [rsp + 0xa8]
sub rax, qword [rsi]
jne 0x1400c2c5e
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
ret
call dbg.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop

Function at 0x1400c2c70
Capabilities:
Hash data using sha256

Disassembly:
endbr64
push rdi
push rsi
push rbx
sub rsp, 0xb0
movdqu xmm0, xmmword [0x140232010]
mov rsi, qword [0x14023b4a0]
movups xmmword [rsp + 0x20], xmm0
lea rdi, [rsp + 0x20]
movdqu xmm0, xmmword [0x140232020]
mov rbx, rcx
mov rax, qword [rsi]
mov qword [rsp + 0xa8], rax
xor eax, eax
mov rcx, rdi
lea r8, [r8*8]
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x30], xmm0
pxor xmm0, xmm0
mov qword [rsp + 0x50], 0
movups xmmword [rsp + 0x40], xmm0
call sym.blake256_update
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
mov r8d, pe_nt_image_headers64
call sym.blake256_final_h
mov rax, qword [rsp + 0xa8]
sub rax, qword [rsi]
jne 0x1400c2d0b
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
ret
call dbg.__stack_chk_fail
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400c2d20
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
endbr64
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
movups xmmword [rsp + 0x90], xmm6
movups xmmword [rsp + 0xa0], xmm7
movups xmmword [rsp + 0xb0], xmm8
mov rsi, qword [0x14023b4a0]
mov rax, qword [rsi]
mov qword [rsp + 0x88], rax
xor eax, eax
mov r13, rcx
mov rbx, rdx
mov rbp, r8
cmp r8, 0x40
ja 0x1400c2ed8
movdqu xmm0, xmmword [str.6666666666666666_]
pxor xmm8, xmm8
movdqu xmm7, xmmword [0x140231ff0]
mov qword [rcx + 0x38], 0
movdqu xmm6, xmmword [0x140232000]
movups xmmword [rcx + 0x20], xmm8
lea r12, [rsp + 0x40]
mov qword [rcx + 0x30], 0
movups xmmword [rcx], xmm7
movups xmmword [rcx + 0x10], xmm6
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
test r8, r8
je 0x1400c2f50
lea rdi, [rsp + 0x20]
mov rax, r12
mov rdx, rbx
lea r8, [r12 + rbp]
nop dword [rax]
movzx ecx, byte [rdx]
xor byte [rax], cl
add rax, 1
add rdx, 1
cmp r8, rax
jne 0x1400c2de0
mov r8d, 0x200
mov rdx, r12
mov rcx, r13
call sym.blake256_update
pxor xmm0, xmm0
mov rax, r12
mov rdx, rbx
movups xmmword [r13 + 0xa0], xmm0
movdqu xmm0, xmmword [0x140232040]
lea r8, [r12 + rbp]
lea rcx, [r13 + 0x80]
mov qword [r13 + 0xb8], 0
mov qword [r13 + 0xb0], 0
movups xmmword [r13 + 0x80], xmm7
movups xmmword [r13 + 0x90], xmm6
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
nop word [rax + rax]
movzx r9d, byte [rdx]
xor byte [rax], r9b
add rax, 1
add rdx, 1
cmp r8, rax
jne 0x1400c2e68
mov rdx, r12
mov r8d, 0x200
call sym.blake256_update
mov edx, 0x20
mov rcx, rdi
call sym.memwipe
mov rax, qword [rsp + 0x88]
sub rax, qword [rsi]
jne 0x1400c2fb9
movups xmm6, xmmword [rsp + 0x90]
movups xmm7, xmmword [rsp + 0xa0]
movups xmm8, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdi, [rsp + 0x20]
mov ebp, 0x20
lea r12, [rsp + 0x40]
mov rcx, rdi
mov rbx, rdi
call sym.blake256_hash
pxor xmm0, xmm0
movdqu xmm7, xmmword [0x140231ff0]
movdqu xmm6, xmmword [0x140232000]
movups xmmword [r13 + 0x20], xmm0
movdqu xmm0, xmmword [str.6666666666666666_]
mov qword [r13 + 0x38], 0
mov qword [r13 + 0x30], 0
movups xmmword [r13], xmm7
movups xmmword [r13 + 0x10], xmm6
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
jmp 0x1400c2dd3
mov r8d, 0x200
mov rdx, r12
lea rdi, [rsp + 0x20]
call sym.blake256_update
movdqu xmm0, xmmword [0x140232040]
mov qword [r13 + 0xb8], 0
lea rcx, [r13 + 0x80]
mov qword [r13 + 0xb0], 0
movups xmmword [r13 + 0x80], xmm7
movups xmmword [r13 + 0x90], xmm6
movups xmmword [r13 + 0xa0], xmm8
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
jmp 0x1400c2e7c
call dbg.__stack_chk_fail
nop
nop