joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402a1c30
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 2
mov ecx, r8d
ror ecx, 8
xor ecx, 2
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1402a1ee0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 1
mov ecx, r8d
ror ecx, 8
xor ecx, 1
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1402cefd0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
mov r8d, 0x80
lea r10, [rcx + 0x3f8]
cmp rcx, rax
ja 0x1402ceff1
xor r9d, r9d
cmp r10, rdx
jae 0x1402cf061
mov r9, rdx
lea rax, [rcx + 0x10]
sub r9, rcx
mov r10d, reloc.WS2_32.dll_recv
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub r10, 1
jne 0x1402cf001
mov r9, r8
cmp r9, r8
jae 0x1402cf081
sub rdx, rcx
lea rax, [rcx + r9*8]
sub r8, r9
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x1402cf070
ret
Function at 0x1402d0ff0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, [rdx - 1]
mov rdi, rdx
mov rbx, rcx
cmp rax, 0x3f
ja 0x1402d10ca
xor eax, eax
mov byte [rsp + 0x20], dil
xor edx, edx
mov qword [rsp + 0x32], rax
mov r8d, 0xf0
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov word [rsp + 0x21], 0x100
mov byte [rsp + 0x23], 1
mov dword [rsp + 0x24], 0
mov word [rsp + 0x30], 0
call fcn.14021d2b0
movaps xmm0, xmmword [0x140391f60]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x140391f70]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x140391f80]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x140391f90]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x1402d10e8
cmp byte [rcx + 0xe8], 0
je 0x1402d10db
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401fe5e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
Function at 0x1402d3c80
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0xc0
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, r9
movaps xmmword [rsp + 0xa0], xmm6
mov r9, r8
movaps xmmword [rsp + 0x90], xmm7
mov r8, rdx
mov rbx, rcx
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.1402d09a0
mov rax, qword [rbx]
lea rcx, [method.randomx::CompiledLightVm_0_.virtual_40]
mov edx, dword [0x14041a510]
cmp qword [rax + 0x28], rcx
jne 0x1402d3d7a
mov rcx, qword [rbx + 0x11f0]
movdqa xmm4, xmmword [0x14039c8a0]
add rdx, rcx
movdqa xmm5, xmmword [0x14039c630]
movdqa xmm6, xmmword [0x14039c670]
movdqa xmm7, xmmword [0x14039c7b0]
movdqa xmm0, xmmword [rsp + 0x40]
movdqa xmm1, xmmword [rsp + 0x50]
movdqa xmm2, xmmword [rsp + 0x60]
movdqa xmm3, xmmword [rsp + 0x70]
cmp rcx, rdx
jae 0x1402d3d60
nop dword [rax]
aesdec xmm0, xmm4
movdqu xmmword [rcx], xmm0
aesenc xmm1, xmm5
movdqu xmmword [rcx + 0x10], xmm1
aesdec xmm2, xmm6
movdqu xmmword [rcx + 0x20], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx + 0x30], xmm3
add rcx, 0x40
cmp rcx, rdx
jb 0x1402d3d30
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmmword [rsp + 0x60], xmm2
movdqa xmmword [rsp + 0x70], xmm3
jmp 0x1402d3d8b
mov r8, qword [rbx + 0x11f0]
lea rcx, [rsp + 0x40]
call fcn.14009c5d0
mov dword [rsp + 0x30], 0x9fc0
xor edi, edi
cmp dword [reloc.WS2_32.dll_htonl], 1
ldmxcsr dword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
je 0x1402d3e00
mov qword [rsp + 0xb8], rsi
nop dword [rax + rax]
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rax + 0x30]
mov r9d, 0x100
lea r8, [rbx + 0x10c0]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.1402d09a0
mov eax, dword [reloc.WS2_32.dll_htonl]
inc edi
dec eax
cmp edi, eax
jb 0x1402d3dc0
mov rsi, qword [rsp + 0xb8]
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rax + 0x30]
mov rax, qword [rbx]
mov r8d, 0x20
mov rdx, rbp
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401fe5e0
add rsp, 0xc0
pop rdi
pop rbp
pop rbx
ret

Function at 0x1402d9290
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov edx, 0x10000
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1402d92f8
movsxd r8, dword [0x1404258ac]
lea rdx, [0x140753040]
mov rcx, rax
mov qword [rbx + 0x20], rax
call fcn.14021ce50
movsxd rcx, dword [0x1404284f8]
lea rdx, [0x140753380]
add rcx, qword [rbx + 0x20]
movsxd r8, dword [0x1404284dc]
call fcn.14021ce50
mov rax, rbx
add rsp, 0x40
pop rbx
ret
lea rdx, str.Failed_to_allocate_executable_memory
lea rcx, [rsp + 0x20]
call fcn.14000fde0
lea rdx, [0x1403d7010]
lea rcx, [rsp + 0x20]
call fcn.14021da30
int3
Function at 0x1402dc9f0
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x1402dcc37
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rbp + 0x10], rax
movaps xmm0, xmmword [0x140393ea0]
movabs rax, 0x6a09e667f2bdc948
movaps xmm1, xmmword [0x140393eb0]
mov edi, r8d
movaps xmmword [rsp + 0x30], xmm0
mov rbx, rdx
movaps xmm0, xmmword [0x140393ec0]
mov rsi, rcx
movaps xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
movaps xmm1, xmmword [0x140393ed0]
mov qword [rsp + 0x30], rax
mov eax, dword [rdx + 0x54]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x120], r14
xor r14d, r14d
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], r14
lea r8d, [r14 + 4]
mov qword [rsp + 0x78], r14
mov qword [rbp], r14
mov dword [rsp + 0x20], eax
call fcn.1402e4f90
mov eax, dword [rbx + 8]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov eax, dword [rbx + 0x50]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov eax, dword [rbx + 0x4c]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov eax, dword [rbx + 0x5c]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
lea r8d, [r14 + 4]
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov eax, dword [rbx + 0x18]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x1402dcb57
mov r8d, dword [rbx + 0x18]
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
test byte [rbx + 0x70], 1
je 0x1402dcb57
mov ecx, dword [rbx + 0x18]
xor eax, eax
mov rdi, qword [rbx + 0x10]
rep stosb byte [rdi], al
mov dword [rbx + 0x18], r14d
mov eax, dword [rbx + 0x28]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x1402dcb8a
mov r8d, dword [rbx + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov eax, dword [rbx + 0x38]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x1402dcbd2
mov r8d, dword [rbx + 0x38]
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
test byte [rbx + 0x70], 2
je 0x1402dcbd2
mov ecx, dword [rbx + 0x38]
xor eax, eax
mov rdi, qword [rbx + 0x30]
rep stosb byte [rdi], al
mov dword [rbx + 0x38], r14d
mov eax, dword [rbx + 0x48]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov rdx, qword [rbx + 0x40]
mov r14, qword [rsp + 0x120]
test rdx, rdx
je 0x1402dcc0d
mov r8d, dword [rbx + 0x48]
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov r8d, 0x40
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.1402e50a0
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1401fe5e0
add rsp, 0x128
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1402dc9f9
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x1402dcc37
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rbp + 0x10], rax
movaps xmm0, xmmword [0x140393ea0]
movabs rax, 0x6a09e667f2bdc948
movaps xmm1, xmmword [0x140393eb0]
mov edi, r8d
movaps xmmword [rsp + 0x30], xmm0
mov rbx, rdx
movaps xmm0, xmmword [0x140393ec0]
mov rsi, rcx
movaps xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
movaps xmm1, xmmword [0x140393ed0]
mov qword [rsp + 0x30], rax
mov eax, dword [rdx + 0x54]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x120], r14
xor r14d, r14d
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], r14
lea r8d, [r14 + 4]
mov qword [rsp + 0x78], r14
mov qword [rbp], r14
mov dword [rsp + 0x20], eax
call fcn.1402e4f90
mov eax, dword [rbx + 8]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov eax, dword [rbx + 0x50]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov eax, dword [rbx + 0x4c]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov eax, dword [rbx + 0x5c]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
lea r8d, [r14 + 4]
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov eax, dword [rbx + 0x18]
lea r8d, [r14 + 4]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x1402dcb57
mov r8d, dword [rbx + 0x18]
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
test byte [rbx + 0x70], 1
je 0x1402dcb57
mov ecx, dword [rbx + 0x18]
xor eax, eax
mov rdi, qword [rbx + 0x10]
rep stosb byte [rdi], al
mov dword [rbx + 0x18], r14d
mov eax, dword [rbx + 0x28]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x1402dcb8a
mov r8d, dword [rbx + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov eax, dword [rbx + 0x38]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x1402dcbd2
mov r8d, dword [rbx + 0x38]
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
test byte [rbx + 0x70], 2
je 0x1402dcbd2
mov ecx, dword [rbx + 0x38]
xor eax, eax
mov rdi, qword [rbx + 0x30]
rep stosb byte [rdi], al
mov dword [rbx + 0x38], r14d
mov eax, dword [rbx + 0x48]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov rdx, qword [rbx + 0x40]
mov r14, qword [rsp + 0x120]
test rdx, rdx
je 0x1402dcc0d
mov r8d, dword [rbx + 0x48]
lea rcx, [rsp + 0x30]
call fcn.1402e4f90
mov r8d, 0x40
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.1402e50a0
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1401fe5e0
add rsp, 0x128
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1402dd740
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
mov r8d, 0x80
lea r10, [rcx + 0x3f8]
cmp rcx, rax
ja 0x1402dd761
xor r9d, r9d
cmp r10, rdx
jae 0x1402dd7d1
mov r9, rdx
lea rax, [rcx + 0x10]
sub r9, rcx
mov r10d, reloc.WS2_32.dll_recv
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub r10, 1
jne 0x1402dd771
mov r9, r8
cmp r9, r8
jae 0x1402dd7f1
sub rdx, rcx
lea rax, [rcx + r9*8]
sub r8, r9
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x1402dd7e0
ret
Function at 0x140093870
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14009387d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14009388d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140093875
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x1400938a5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140093892
sub eax, 3
jb 0x1400938bf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400938f6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x1400938e6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400938e4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400938d3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140093832
jmp 0x14009387d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xf400
mov dl, 0x39
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140093942
cmp rsi, rcx
jae 0x14009394a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140093929
cmp al, 0x8f
ja 0x140093929
cmp byte [rsi - 2], 0xf
je 0x14009392f
sub al, 0xe8
cmp al, 1
ja 0x140093913
cmp rsi, rcx
jae 0x14009394a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140093919
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14009394a
lodsb al, byte [rsi]
jmp 0x140093929
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x91000]
mov eax, dword [rdi]
or eax, eax
je 0x1400939a7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x931e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140093957
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400939a1
mov qword [rbx], rax
add rbx, 8
jmp 0x140093977
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400939e1
cmp al, 0xef
ja 0x1400939d3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400939b3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400939c2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140093a35
sub rsp, 0xffffffffffffff80
jmp 0x140001c14
Function at 0x14000f880
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14000f903
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x14000f8ce
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsi]
mov rdx, rsi
mov r9, rax
call fcn.1400146c0
mov rcx, qword [rsi]
call fcn.140014650
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x14000f8fc
mov qword [rsi], rdi
call fcn.140014640
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140014680
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
lodsd eax, dword [rsi]
lea ebp, [rcx]
sub al, 0x6b
sahf
and edx, dword [rdi + rdx*8]
pop rbp
invalid
std
invalid
hlt

Function at 0x140010e90
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x140065020]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov r8d, 0x104
mov rdx, rdi
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140010eff
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.140010e20
test al, al
jne 0x140010f0d
add rbx, 8
cmp rbx, 0x18
jne 0x140010ecd
xor esi, esi
jmp 0x140010f10
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.14002a340
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1408680b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140868237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408680e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408680c7
add dl, dl
jne 0x1408680ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14086814e
xor eax, eax
add dl, dl
jne 0x1408680fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140868205
add dl, dl
jne 0x14086810e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14086811b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140868128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140868135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140868142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408680d6
mov eax, 1
add dl, dl
jne 0x14086815e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14086816b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140868153
sub eax, ebx
mov ebx, 1
jne 0x1408681a4
mov ecx, 1
add dl, dl
jne 0x140868186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140868193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14086817b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408680d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408681c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408681cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408681b5
cmp eax, 0x7d00
jae 0x1408681f3
cmp eax, 0x500
jb 0x1408681ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408680d6
cmp eax, 0x7f
ja 0x1408681f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408680d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14086822a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408680d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20