joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800781e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180078430
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800782fa
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180078244
mov rax, qword [0x1800b8008]
cmp qword [rsp + 0x20], rax
ja 0x180078244
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180078206
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x180078275
jmp 0x1800782fa
cmp dword [rsp + 0x50], 0x10000
jne 0x1800782dd
cmp qword [rsp + 0x48], 0x10000
jb 0x1800782dd
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800782bb
mov rax, qword [rsp + 0x28]
jmp 0x1800782fc
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1800782cb
xor eax, eax
jmp 0x1800782fc
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800782f5
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180078430
mov qword [rsp + 0x20], rax
jmp 0x180078206
xor eax, eax
add rsp, 0x68
ret

Function at 0x180078310
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180078470
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180078426
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18007836b
mov rax, qword [0x1800b8008]
cmp qword [rsp + 0x20], rax
ja 0x18007836b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18007832d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x18007839c
jmp 0x180078426
cmp dword [rsp + 0x50], 0x10000
jne 0x180078404
cmp qword [rsp + 0x48], 0x10000
jb 0x180078404
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800783e2
mov rax, qword [rsp + 0x28]
jmp 0x180078428
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1800783f2
xor eax, eax
jmp 0x180078428
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180078421
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180078470
mov qword [rsp + 0x20], rax
jmp 0x18007832d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800784c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180078a50
mov qword [rsp + 0x28], 0
cmp qword [0x1800b98e8], 0
jne 0x180078508
cmp qword [0x1800b98e0], 0
je 0x180078508
mov rax, qword [0x1800b98e0]
mov qword [0x1800b98e8], rax
cmp qword [0x1800b98e8], 0
je 0x1800785ae
mov rax, qword [0x1800b98e8]
cmp qword [rax + 0x10], 0
je 0x1800785ae
mov rax, qword [0x1800b98e8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800785ae
mov rax, qword [0x1800b98e8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800785ae
mov rax, qword [0x1800b98e8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180078574
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18007857b
xor eax, eax
jmp 0x180078729
mov rax, qword [0x1800b98e8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180078729
mov rax, qword [0x1800b98e0]
mov qword [0x1800b98e8], rax
jmp 0x1800785d0
mov rax, qword [0x1800b98e8]
mov rax, qword [rax + 8]
mov qword [0x1800b98e8], rax
cmp qword [0x1800b98e8], 0
je 0x18007861d
cmp qword [0x1800b98e8], 0
je 0x18007861b
mov rax, qword [0x1800b98e8]
cmp qword [rax + 0x10], 0
je 0x18007861b
mov rax, qword [0x1800b98e8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18007861b
mov rax, qword [0x1800b98e8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18007861b
jmp 0x18007854c
jmp 0x1800785be
mov rcx, qword [rsp + 0x60]
call fcn.18007a6a0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180078730
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180078727
mov rax, qword [rsp + 0x48]
mov qword [0x1800b98e8], rax
mov rax, qword [0x1800b98e8]
mov dword [rax], 0x52727464
mov rax, qword [0x1800b98e8]
mov qword [rax + 0x10], 0
mov rax, qword [0x1800b98e8]
mov rcx, qword [0x1800b98e0]
mov qword [rax + 8], rcx
mov rax, qword [0x1800b98e8]
mov qword [0x1800b98e0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1800b98e8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1800786d8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180078712
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1800786ce
mov rax, qword [0x1800b98e8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18007854c
xor eax, eax
add rsp, 0x58
ret
Function at 0x180079440
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180079487
xor al, al
jmp 0x180079529
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1800794b1
xor al, al
jmp 0x180079529
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x180079521
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x180079521
mov al, 1
jmp 0x180079529
jmp 0x180079527
xor al, al
add rsp, 0x78
ret

Function at 0x180079830
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1800b98e0]
mov qword [rsp + 0x28], rax
jmp 0x180079850
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007987f
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x18007987d
call sub.KERNEL32.dll_GetLastError
jmp 0x180079881
jmp 0x180079842
xor eax, eax
add rsp, 0x38
ret
Function at 0x180079f40
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x1800b98f8], eax
je 0x180079f5b
mov eax, 0x10dd
jmp 0x18007a080
mov rax, qword [0x1800b9910]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007a005
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x180079fd0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x180079fd0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.180078b90
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.18007bdb0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x180079f67
mov qword [0x1800b9910], 0
call fcn.1800795f0
mov rax, qword [0x1800b9908]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18007a069
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.18007bdb0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x18007a021
mov qword [0x1800b9908], 0
mov dword [0x1800b98f8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x18007a5b0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1800b98fc], 0
je 0x18007a5cd
mov eax, dword [0x1800b98fc]
jmp 0x18007a693
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x18007a5e0
xor eax, eax
jmp 0x18007a693
mov ecx, 0x10
call fcn.18007bdb8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x18007a64e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x18007a633
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.18007bdb0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1800b98fc], eax
mov qword [0x1800b9900], 0
mov eax, dword [rsp + 0x20]
jmp 0x18007a693
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x18007a668
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x18007a609
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1800b9908]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1800b9908], rax
xor eax, eax
add rsp, 0x48
ret

Function at 0x18007bb44
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18007bb7e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18007bb83
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18007bbcc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800819f0]
cmp byte [rcx + rax], 0
je 0x18007bbcc
dec r8
sub rdx, 1
jne 0x18007bbb2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62

Function at 0x14047b9b3
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 8]
jmp 0x140477dca
add rdi, 0xc
xor ebx, ebx
push 0x673bf299
test r9, r9
mov dword [rsp + 4], 0x1206781e
lea rsp, [rsp + 0x18]
je 0x14047ba2a
mov ecx, 0x323fe432
lea rcx, [0x140446ab0]
push 0xffffffffa812e636
movzx r10d, byte [rbp + riz]
rol dword [rsp + 2], 0x41
xor r10d, ebx
and word [rsp + 4], 0x9fa3
and r10d, 0xff
mov r10d, dword [rcx + r10*4]
shr ebx, 8
xor ebx, r10d
dec word [rsp + 5]
inc rbp
xor ebx, 0x91be4435
dec r9
lea rsp, [rsp + 8]
jne 0x14047b9e3
not ebx
mov dword [rdi], ebx
push 0xfffffffff082919a
jmp 0x14045a594
Function at 0x14002aef0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002aefd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002af0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002aef5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002af25
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002af12
sub eax, 3
jb 0x14002af3f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002af76
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002af66
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002af64
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002af53
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002aeb2
jmp 0x14002aefd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x16800
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002afc2
cmp rsi, rcx
jae 0x14002afca
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002afa9
cmp al, 0x8f
ja 0x14002afa9
cmp byte [rsi - 2], 0xf
je 0x14002afaf
sub al, 0xe8
cmp al, 1
ja 0x14002af93
cmp rsi, rcx
jae 0x14002afca
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002af99
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002afca
lodsb al, byte [rsi]
jmp 0x14002afa9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x28000]
mov eax, dword [rdi]
or eax, eax
je 0x14002b033
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2b1b8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002afd7
jns 0x14002b00c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14002b016
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002b02d
mov qword [rbx], rax
add rbx, 8
jmp 0x14002aff7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14002b06d
cmp al, 0xef
ja 0x14002b05f
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14002b03f
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14002b04e
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x217]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002b0c1
sub rsp, 0xffffffffffffff80
jmp 0x140009a74
Function at 0x667c00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x14a8
call fcn.00697180
sub rsp, rax
movaps xmmword [rsp + 0x1490], xmm15
movaps xmmword [rsp + 0x1480], xmm14
movaps xmmword [rsp + 0x1470], xmm13
movaps xmmword [rsp + 0x1460], xmm12
movaps xmmword [rsp + 0x1450], xmm11
movaps xmmword [rsp + 0x1440], xmm10
movaps xmmword [rsp + 0x1430], xmm9
movdqa xmmword [rsp + 0x1420], xmm8
movaps xmmword [rsp + 0x1410], xmm7
movaps xmmword [rsp + 0x1400], xmm6
movdqa xmm9, xmmword [0x0069f5e0]
xor eax, eax
movdqa xmm12, xmmword [0x0069f5f0]
pxor xmm2, xmm2
movdqa xmm4, xmmword [0x0069f610]
movdqa xmm6, xmmword [0x0069f630]
movdqa xmm13, xmmword [0x0069f670]
movdqa xmm14, xmmword [0x0069f680]
movdqa xmm15, xmmword [0x0069f690]
movdqa xmm7, xmmword [0x0069f6a0]
movdqa xmm10, xmmword [0x0069f6b0]
movdqa xmm11, xmmword [0x0069f6c0]
nop dword [rax + rax]
Function at 0x670140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub cl, byte [rdi]
test byte [rsi + rcx*2 + 0x75], dh
jmp 0x147985c
test byte [rsi + 0xf000002], dh
test dword [rax + 2], esi
add byte [rax], al
add byte [rax - 0x3f7bc3fc], cl
mov rax, qword [rcx + 0x10]
mov edx, dword [rcx + 0x3c]
jmp 0x67020a
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 8], 0x5b41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xa], 0x5a41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xc], 0x5941
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 0xe], 0x5841
je 0x6702b4
jne 0x6702b4
jmp 0x1d5eb52
ret
mov qword [rcx + 0x10], rdx
jmp 0x670385
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 6], 0x5c41
jmp 0x67014e
cmp edx, 0x8664
je 0x6702d1
cmp edx, 0x14c
jne 0x67018b
je 0x67026b
jne 0x67026b
jmp 0x678bbe
jne 0x6702c6
add byte [rax], al
add byte [rax], al
jmp 0x670193
jne 0x670342
je 0x10b08d3d
mov r9, qword [rcx + 0x10]
lea rdx, [r9 + 1]
mov qword [rcx + 0x10], rdx
je 0x670303
jne 0x670303
jmp 0x6702f4
je 0x670285
jne 0x670285
add byte [rax], al
add byte [rax], al
mov rdx, qword [rcx + 8]
mov byte [rdx + r8], 0x58
mov qword [rcx + 0x10], r9
jmp 0x67018b
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x11], 0x5e
mov rdx, qword [rcx + 8]
je 0x67028c
jne 0x67028c
je 0x2774706
mov byte [rax + rdx + 2], 0x5d
pop rbp
je 0x670342
jmp 0x6701e5
mov byte [rax + rdx + 4], 0x5a
mov rdx, qword [rcx + 8]
lea r8, [rax + 6]
je 0x6702c6
jmp 0x6701d7
mov byte [rax + rdx + 3], 0x5b
mov rdx, qword [rcx + 8]
jmp 0x67024b
mov rdx, qword [rcx + 8]
mov byte [rdx + rax], 0x5f
mov rdx, qword [rcx + 8]
mov byte [rax + rdx + 1], 0x5e
mov rdx, qword [rcx + 8]
je 0x67023c
jne 0x67023c
jmp 0x662972
jmp 0x6701b0
jne 0x6702f4
mov byte [r9 + rdx + 0x12], 0x5d
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x13], 0x5b
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x14], 0x5a
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x15], 0x59
jmp 0x6702dd
je 0x8b88e00
mov rdx, qword [rcx + 8]
mov byte [r9 + rdx + 0x10], 0x5f
jmp 0x670228
jne 0x670317
jmp 0x5774790
mov byte [rax + rdx + 5], 0x59
lea r9, [rax + 7]
jmp 0x6702e5
mov r8, qword [rcx + 8]
lea rdx, [rax + 1]
jmp 0x670339
lea r8, [r9 + 0x16]
add r9, 0x17
je 0x670212
jne 0x670212
jmp 0x6702b2
jmp 0x6701a0
je 0x670317
jmp 0x6702c3
mov byte [r8 + r9], 0x8b
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
je 0x670383
jne 0x670383
jmp 0x670317
mov qword [rcx + 0x10], rdx
mov byte [r8 + r9], 0xe5
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
lea rdx, [r9 + 1]
jmp 0x67035d
lea rdx, [r9 + 1]
jmp 0x6702f9
mov qword [rcx + 0x10], rdx
je 0x67036d
jne 0x67036d
jmp 0x8b88e8e
mov rdx, qword [rcx + 8]
je 0x67025f
jne 0x67025f
je 0x661641
inc dword [rax]
add byte [rax], al
add byte [rdi], cl
test byte [rsi - 2], bh
invalid
je 0x6701e1
jne 0x6701e1
add byte [rax], al
add byte [rax], al
mov byte [r8 + rax], 0x48
mov r8, qword [rcx + 8]
je 0x6701ed
jne 0x6701ed
jmp 0xffffffffc6aaae72
jmp 0x67032f
mov byte [r8 + r9], 0x5d
mov r8, qword [rcx + 8]
mov r9, qword [rcx + 0x10]
mov word [r8 + r9], 0x5f41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 2], 0x5e41
mov rdx, qword [rcx + 8]
mov word [r9 + rdx + 4], 0x5d41
je 0x6702f4
jmp 0x67028a
invalid
Function at 0x67a860
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
jmp 0x67aab8
mov edi, edx
jmp 0x67ab91
je 0x67aabe
jne 0x67aabe
je 0x53bd0218
push rsi
push rdi
push rbp
push rbx
jmp 0x67abba
sub rsp, 0xa8
jmp 0x67a9b8

Function at 0x688c50
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, [rdx + 0x10]
cmp r8d, 0x100
cmovne rax, rdx
lea r8, str.expand_32_byte_kexpand_16_byte_k
lea r9, [0x0069fbe0]
cmove r9, r8
mov edx, dword [rax]
mov dword [rcx + 0x20], edx
mov edx, dword [rax + 4]
mov dword [rcx + 0x24], edx
mov edx, dword [rax + 8]
mov dword [rcx + 0x28], edx
mov eax, dword [rax + 0xc]
mov dword [rcx + 0x2c], eax
mov dword [rcx], 0x61707865
mov rax, qword [r9 + 4]
mov qword [rcx + 4], rax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0xc], eax
ret

Function at 0x688d90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x50], rcx
mov eax, dword [rdx]
mov dword [rsp + 0xc], eax
mov eax, dword [rdx + 4]
mov dword [rsp + 0x10], eax
mov eax, dword [rdx + 8]
mov dword [rsp + 0x14], eax
mov r12d, dword [rdx + 0xc]
mov r13d, dword [rdx + 0x10]
mov r14d, dword [rdx + 0x14]
mov r15d, dword [rdx + 0x18]
mov r10d, dword [rdx + 0x1c]
mov edi, dword [rdx + 0x20]
mov r11d, dword [rdx + 0x24]
mov ebx, dword [rdx + 0x28]
mov ebp, dword [rdx + 0x2c]
mov ecx, dword [rdx + 0x30]
mov eax, dword [rdx + 0x34]
mov r9d, dword [rdx + 0x38]
mov r8d, dword [rdx + 0x3c]
mov dword [rsp + 0x4c], 0xfffffff8
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x44], r9d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x3c], ecx
mov edx, ecx
mov dword [rsp + 0x38], ebp
mov dword [rsp + 8], ebp
mov dword [rsp + 0x34], ebx
mov dword [rsp], ebx
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x2c], edi
mov ebp, edi
mov dword [rsp + 0x28], r10d
mov edi, r10d
mov dword [rsp + 0x24], r15d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
mov dword [rsp + 0x1c], r13d
mov dword [rsp + 0x18], r12d
mov r14d, r12d
mov r12d, dword [rsp + 0x14]
mov r10d, dword [rsp + 0x10]
mov ecx, dword [rsp + 0xc]
nop

Function at 0x68ed00
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x68ed8b
mov qword [rcx + 0x48], 0
mov qword [rcx], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x40], rax
xor eax, eax
ret
mov eax, 1
ret
Function at 0x68f7b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
mov edx, 0x20
mov rcx, r8
mov r8, rsi
call fcn.0068f520
and byte [rsi], 0xf8
mov al, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rsi
call fcn.0068c170
mov rcx, rdi
mov rdx, rbx
call fcn.0068c0f0
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
ret