joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007b5c0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rsi
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15, rcx
lea r9, [r8 + 1]
movabs rax, 0x5851f42d4c957f2d
movabs rcx, 0x810a978a59f5a1fc
imul r9, rax
xor r14d, r14d
mov rsi, rdx
mov rax, r9
mov qword [rbp - 0x58], r9
xor rax, rcx
movabs rcx, 0xa77099df38c2d846
mov qword [rbp - 0x50], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x8126b91cbf22495c
mov qword [rbp - 0x48], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x494d2597179f8a62
mov qword [rbp - 0x40], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x9237efb9ceaaec0c
mov qword [rbp - 0x38], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x2f2a56746ce62d78
mov qword [rbp - 0x30], rax
mov rax, r9
xor rax, rcx
mov qword [rbp - 0x28], rax
movabs rax, 0x84853bf7b62ce54e
xor r9, rax
cmp dword [0x1400bd6d8], r14d
mov qword [rbp - 0x20], r9
jbe 0x14007b74d
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x28], r12
nop
mov edi, dword [0x1400bd6c0]
shl edi, 0xa
shr edi, 6
dec edi
and rdi, r8
shl rdi, 6
add rdi, qword [r15]
prefetchnta byte [rdi]
mov eax, r14d
lea rdx, [r15 + 0x28]
imul rbx, rax, 0x1878
lea r8, [r15 + 0x187a8]
add rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.14007ffe0
mov rax, qword [rdi]
inc r14d
xor qword [rbp - 0x58], rax
mov rax, qword [rdi + 8]
xor qword [rbp - 0x50], rax
mov rax, qword [rdi + 0x10]
xor qword [rbp - 0x48], rax
mov rax, qword [rdi + 0x18]
xor qword [rbp - 0x40], rax
mov rax, qword [rdi + 0x20]
xor qword [rbp - 0x38], rax
mov rax, qword [rdi + 0x28]
xor qword [rbp - 0x30], rax
mov rax, qword [rdi + 0x30]
xor qword [rbp - 0x28], rax
mov rax, qword [rdi + 0x38]
xor qword [rbp - 0x20], rax
cmp r14d, dword [0x1400bd6d8]
movsxd rax, dword [rbx + r15 + 0x183c]
mov r8, qword [rbp + rax*8 - 0x58]
jb 0x14007b6a0
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
movaps xmm0, xmmword [rbp - 0x58]
movaps xmm1, xmmword [rbp - 0x48]
movups xmmword [rsi], xmm0
movaps xmm0, xmmword [rbp - 0x38]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x28]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140087840
add rsp, 0x78
pop r15
pop r14
pop rsi
pop rbp
ret
Function at 0x14007b850
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [0x1400bd6f4]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x140082ce0
sub rsp, 0x68
movdqa xmm4, xmmword [0x1400bd780]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x1400bd790]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400bd7a0]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x1400bd7b0]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1400bd7c0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1400bd7d0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1400bd7e0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1400bd7f0]
cmp r8, r9
jae 0x140082de9
lea rcx, [r8 + 0x20]
nop dword [rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm11
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r9
jb 0x140082d70
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret

Function at 0x14007ba50
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x11f0]
mov rax, rdx
mov edx, dword [0x1400bd6f0]
mov rcx, rax
jmp 0x140081820
sub rsp, 0x28
movdqa xmm4, xmmword [0x14009b260]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x14009b210]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x14009b220]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x14009b230]
cmp r8, r10
jae 0x1400818a5
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x140081870
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x14007db80
Capabilities:
Hash data using sha512

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rsi, qword [rbp + 0x110]
or r14d, 0xffffffff
mov r12, r9
mov r13, r8
mov rdi, rdx
mov r15, rcx
test r8, r8
jne 0x14007dbd1
test r9, r9
jne 0x14007dd75
test r15, r15
je 0x14007dd75
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x14007dd75
mov qword [rsp + 0x1a8], rbx
mov rbx, qword [rbp + 0x118]
test rsi, rsi
jne 0x14007dc05
test rbx, rbx
jne 0x14007dd6d
cmp rbx, 0x40
ja 0x14007dd6d
test rbx, rbx
je 0x14007dd38
test rsi, rsi
je 0x14007dd6d
xor eax, eax
mov byte [rbp + 0x10], dil
xor edx, edx
mov qword [rbp + 0x22], rax
mov r8d, 0xf0
mov qword [rbp + 0x2a], rax
lea rcx, [rsp + 0x20]
mov qword [rbp + 0x32], rax
mov qword [rbp + 0x3a], rax
mov qword [rbp + 0x42], rax
mov dword [rbp + 0x4a], eax
mov word [rbp + 0x4e], ax
mov byte [rbp + 0x11], bl
mov word [rbp + 0x12], 0x101
mov dword [rbp + 0x14], 0
mov word [rbp + 0x20], 0
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x14009a9b0]
movabs rcx, 0x6a09e667f3bcc908
movaps xmm1, xmmword [0x14009a9c0]
xor edx, edx
movaps xmm2, xmmword [0x14009a9e0]
mov r8d, 0x80
mov rax, qword [rbp + 0x10]
xor rax, rcx
movaps xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [0x14009a9d0]
lea rcx, [rbp + 0x10]
xor qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
movq rax, xmm1
xor rax, qword [rbp + 0x20]
movaps xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x28]
xor qword [rsp + 0x38], rax
movq rax, xmm0
xor rax, qword [rbp + 0x30]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x38]
xor qword [rsp + 0x48], rax
movq rax, xmm2
xor rax, qword [rbp + 0x40]
movaps xmmword [rsp + 0x50], xmm2
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x48]
xor qword [rsp + 0x58], rax
movzx eax, dil
mov dword [rbp + 4], eax
call sub.VCRUNTIME140.dll_memset
mov r8, rbx
lea rcx, [rbp + 0x10]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x80
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x20]
call fcn.14007e520
jmp 0x14007dd46
lea rcx, [rsp + 0x20]
call fcn.14007e3e0
test eax, eax
js 0x14007dd6d
mov r8, r12
lea rcx, [rsp + 0x20]
mov rdx, r13
call fcn.14007e520
test eax, eax
js 0x14007dd6d
mov r8, rdi
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.14007e290
mov r14d, eax
mov rbx, qword [rsp + 0x1a8]
mov eax, r14d
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.140087840
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007e3e0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400b59e8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14007e4fc
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x14007e4e3
xor eax, eax
mov byte [rsp + 0x20], dil
xor edx, edx
mov qword [rsp + 0x32], rax
mov r8d, 0xf0
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov qword [rsp + 0x52], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov word [rsp + 0x21], 0x100
mov byte [rsp + 0x23], 1
mov dword [rsp + 0x24], 0
mov word [rsp + 0x30], 0
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x14009a9b0]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x14009a9c0]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x14009a9d0]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x14009a9e0]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x30], rax
mov rax, qword [rsp + 0x58]
xor qword [rbx + 0x38], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x14007e4ff
cmp byte [rcx + 0xe8], 0
je 0x14007e4f4
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
or eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140087840
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x14007f000
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14007b850
mov rcx, rbx
call fcn.14007ba70
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14007ead0

Function at 0x1400812b0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
lea rax, [rdx + 0x3f8]
lea r9, [rcx + 0x3f8]
mov r8d, 0x80
cmp rcx, rax
ja 0x1400812d1
cmp r9, rdx
jae 0x140081341
mov r9, rdx
lea rax, [rcx + 0x10]
sub r9, rcx
mov r11d, reloc.WS2_32.dll_recv
mov r10d, r8d
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub r11, 1
jne 0x1400812e4
mov r9d, r10d
cmp r9, r8
jae 0x140081371
sub rdx, rcx
lea rax, [rcx + r9*8]
sub r8, r9
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x140081360
ret
Function at 0x140081820
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x11f0]
mov rax, rdx
mov edx, dword [0x1400bd6f0]
mov rcx, rax
jmp 0x140081820
sub rsp, 0x28
movdqa xmm4, xmmword [0x14009b260]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x14009b210]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x14009b220]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x14009b230]
cmp r8, r10
jae 0x1400818a5
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x140081870
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x140082ce0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [0x1400bd6f4]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x140082ce0
sub rsp, 0x68
movdqa xmm4, xmmword [0x1400bd780]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x1400bd790]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400bd7a0]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x1400bd7b0]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1400bd7c0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1400bd7d0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1400bd7e0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1400bd7f0]
cmp r8, r9
jae 0x140082de9
lea rcx, [r8 + 0x20]
nop dword [rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm11
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r9
jb 0x140082d70
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret
Function at 0x140083bd0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x14009b270]
lea r9, [rcx + rdx]
movdqa xmm3, xmmword [0x14009b250]
movdqa xmm4, xmmword [0x14009b280]
movdqa xmm5, xmmword [0x14009b240]
cmp rcx, r9
jae 0x140083c24
add rcx, 0x20
nop dword [rax]
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r9
jb 0x140083c00
movdqa xmm0, xmmword [0x14009b200]
movdqa xmm1, xmmword [0x14009b290]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [r8], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [r8 + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
ret
Function at 0x140084f00
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
movdqu xmm0, xmmword [r9]
mov rbx, r8
movdqu xmm1, xmmword [r9 + 0x10]
lea r8, [rdx - 0x1000]
movdqa xmm2, xmmword [0x14009b270]
mov r11, r9
movdqa xmm3, xmmword [0x14009b250]
mov r10, rcx
movdqa xmm4, xmmword [0x14009b280]
mov rax, rcx
movdqa xmm5, xmmword [0x14009b240]
add r8, rcx
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
lea r9, [rcx + 0x1000]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x14009b260]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x14009b210]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x14009b220]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x14009b230]
cmp rax, r8
jae 0x140085002
lea rcx, [rax + 0x20]
sub r9, rax
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rcx - 0x10], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rcx], xmm6
movdqu xmmword [rcx + 0x10], xmm7
prefetcht0 byte [r9 + rax]
add rax, 0x40
lea rcx, [rcx + 0x40]
cmp rax, r8
jb 0x140084fb0
add r8, 0x1000
mov r9, r10
sub rdx, 1
jne 0x140084fa4
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r11], xmm0
movdqa xmm0, xmmword [0x14009b200]
movdqu xmmword [r11 + 0x10], xmm1
movdqa xmm1, xmmword [0x14009b290]
movdqu xmmword [r11 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r11 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [rbx], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [rbx + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [rbx + 0x20], xmm4
movdqu xmmword [rbx + 0x30], xmm5
add rsp, 0x60
pop rbx
ret

Function at 0x140085c00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rdx, rcx
mov r9d, 0x40
xor ecx, ecx
mov r8d, 0x3000
jmp qword [sym.imp.KERNEL32.dll_VirtualAlloc]
Function at 0x416280
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41642b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432a60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x4162ee
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416301
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x416325
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416339
cmp rbx, 0x1000
jae 0x4162f8
nop
jmp 0x4163a9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41634d
xor edx, edx
jmp 0x4163a0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432a60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41632f
jmp 0x416315
call fcn.00462b00
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004371c0
lea rax, [0x004d1150]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00437ac0
mov rax, qword [rsp + 0x38]
call fcn.004377c0
lea rax, [0x004d1210]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437ac0
mov rax, qword [rsp + 0x30]
call fcn.004377c0
call fcn.00437420
call fcn.00437240
lea rax, [0x004d3425]
mov ebx, 0x21
call fcn.00435900
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ef40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416280
Function at 0x416460
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41668a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432ae0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4164db
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4164ee
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416510
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x416524
cmp rbx, 0x1000
jae 0x4164e5
jmp 0x4165ae
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416536
xor esi, esi
jmp 0x4165a0
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00432ae0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41651a
jmp 0x416502
call fcn.00462b00
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416629
call fcn.004371c0
lea rax, [0x004d15c6]
mov ebx, 0x19
call fcn.00437ac0
mov rax, qword [rsp + 0x68]
call fcn.004377c0
lea rax, [0x004d1210]
mov ebx, 0x19
nop
call fcn.00437ac0
mov eax, dword [rsp + 0x34]
call fcn.004377c0
call fcn.00437420
call fcn.00437240
lea rax, [0x004ce0ec]
mov ebx, 0xd
call fcn.00435900
cmp eax, 0x5af
je 0x4165d3
call fcn.004371c0
lea rax, [0x004d15c6]
mov ebx, 0x19
call fcn.00437ac0
mov rax, qword [rsp + 0x38]
call fcn.004377c0
lea rax, [0x004d1210]
mov ebx, 0x19
nop dword [rax]
call fcn.00437ac0
mov eax, dword [rsp + 0x34]
call fcn.004377c0
call fcn.00437420
call fcn.00437240
lea rax, [0x004d2d16]
mov ebx, 0x1f
call fcn.00435900
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ef40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416460
Function at 0x41ed60
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
cmp byte [0x005d38f1], 0
jne 0x41ee4f
nop
nop
nop
nop
sub rbx, qword [rax + 0x18]
nop
mov edx, dword [rax + 0x5c]
imul rbx, rdx
mov rdx, rbx
shr rbx, 0x20
nop
shr rdx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
nop
add rdx, qword [rax + 0x50]
lock or byte [rdx], dil
nop
nop
mov rcx, qword [rax + 0x18]
nop
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rax, 0x2a
cmp rax, 0x40
jae 0x41ee45
lea rbx, [0x005a5d50]
mov rax, qword [rbx + rax*8]
shr rdx, 0x16
and edx, 0xfffff
mov rdx, qword [rax + rdx*8]
test byte [rdx], al
test byte [rax], al
mov rax, rcx
shr rcx, 0x10
and ecx, 0x3f
movzx ebx, byte [rdx + rcx + 0x21040]
lea rdx, [rdx + rcx]
lea rdx, [rdx + 0x21040]
shr rax, 0xd
and eax, 7
mov rcx, rax
mov eax, 1
shl eax, cl
nop dword [rax]
test al, bl
jne 0x41ee27
lock or byte [rdx], al
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rsi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov ecx, 0x40
call fcn.00461640
lea rax, [0x004d4de6]
mov ebx, 0x2c
nop dword [rax + rax]
call fcn.00435900
nop
int3

Function at 0x4215a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4216a1
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x4215e0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x421691
test byte [rax], al
lea rcx, [rax + 0x100c0]
mov rax, rcx
call fcn.00422100
nop dword [rax]
test rax, rax
je 0x421691
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004216e0]
mov qword [rsp + 0x10], rcx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 8]
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.0045ee00
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42167f
xor eax, eax
jmp 0x421689
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x4215d2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045ef40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004215a0