joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400920f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret

Function at 0x14009a160
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
mov rdi, rdx
mov rsi, rcx
cmp byte [rdx + 0xb9], 0
je 0x14009a478
mov rax, qword [rdi + 0x78]
sub rax, 1
jb 0x14009aa2e
mov r12, qword [rdi + 0x70]
imul r13, rax, 0xb0
mov r8, qword [r12 + r13 + 0x40]
cmp r8, 0xffff
jbe 0x14009a1c6
lea rdx, [0x1404927c4]
mov r8d, 0x1e
mov cl, 0x15
test r8, r8
je 0x14009a462
mov rax, qword [r12 + r13 + 0x38]
mov rcx, r8
cmp rcx, 3
add ecx, dword [rdi]
invalid
invalid
invalid
add byte [rax], al
movzx r9d, word [rax]
cmp byte [rdi + 0xba], 0
je 0x14009a760
cmp dword [rdi], 1
jne 0x14009aa2e
movabs rax, 0x8000000000000000
cmp qword [rdi + 8], rax
invalid
lea rdx, str.Incomplete_extra_data_headerExtra_data_exceeds_extra_field
mov r8d, 0x1c
mov cl, 0x27
jmp 0x14009a1bc
Function at 0x1400a8e70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
movdqa xmmword [rsp + 0x150], xmm6
mov r14, r8
mov r15, rcx
movzx eax, byte [section..data]
cmp al, 1
jne 0x1400a8f1f
test r14, r14
je 0x1400a9ac9
shl r14, 4
lea rbx, [rsp + 0x60]
pxor xmm6, xmm6
nop word [rax + rax]
lea rsi, [rdx + 0x10]
mov rcx, rbx
call fcn.1400b8c10
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmm0
punpcklbw xmm1, xmm6
pshufd xmm1, xmm1, 0x4e
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
punpckhbw xmm0, xmm6
pshufd xmm0, xmm0, 0x4e
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm1
movdqa xmmword [rsp + 0x60], xmm0
mov rcx, r15
mov rdx, rbx
call fcn.1400cc550
mov rdx, rsi
add r14, 0xfffffffffffffff0
jne 0x1400a8ec0
jmp 0x1400a9ac9
test r14, r14
je 0x1400a9ac9
movabs r8, 0x4444444444444444
movabs r9, 0x2222222222222222
movabs r10, 0x1111111111111111
mov rbp, r15
mov r11, qword [r15]
mov rax, r11
bswap rax
mov rsi, qword [r15 + 8]
mov rcx, rax
shr rcx, 4
movabs rdi, 0xf0f0f0f0f0f0f0f
and rcx, rdi
and rax, rdi
shl rax, 4
or rax, rcx
movabs rbx, 0x3333333333333333
mov rcx, rax
and rcx, rbx
shr rax, 2
and rax, rbx
lea rax, [rax + rcx*4]
movabs r12, 0x5555555555555555
mov rcx, rax
and rcx, r12
shr rax, 1
and rax, r12
lea r13, [rax + rcx*2]
mov rax, rsi
bswap rax
mov rcx, rax
shr rcx, 4
and rcx, rdi
and rax, rdi
shl rax, 4
or rax, rcx
mov rcx, rax
and rcx, rbx
shr rax, 2
and rax, rbx
lea rax, [rax + rcx*4]
mov rcx, rax
and rcx, r12
shr rax, 1
and rax, r12
lea rax, [rax + rcx*2]
mov rcx, rsi
xor rcx, r11
mov rdi, rax
xor rdi, r13
mov rbx, r11
and rbx, r10
mov qword [rsp + 0xe8], rbx
mov rbx, r11
and rbx, r9
mov qword [rsp + 0xe0], rbx
mov rbx, r11
and rbx, r8
mov qword [rsp + 0xd8], rbx
movabs rbx, 0x8888888888888888
and r11, rbx
mov qword [rsp + 0x118], r11
mov r11, rsi
and r11, r10
mov qword [rsp + 0xd0], r11
mov r11, rsi
and r11, r9
mov qword [rsp + 0xc8], r11
mov r11, rsi
and r11, r8
mov qword [rsp + 0xc0], r11
and rsi, rbx
mov qword [rsp + 0x110], rsi
mov r11, rcx
and r11, r10
mov qword [rsp + 0x58], r11
mov r11, rcx
and r11, r9
mov qword [rsp + 0x50], r11
mov r11, rcx
and r11, r8
mov qword [rsp + 0xb8], r11
and rcx, rbx
mov qword [rsp + 0xf8], rcx
mov rcx, r13
and rcx, r10
mov qword [rsp + 0xb0], rcx
mov rcx, r13
and rcx, r9
mov qword [rsp + 0xa8], rcx
mov rcx, r13
and rcx, r8
mov qword [rsp + 0xa0], rcx
and r13, rbx
mov qword [rsp + 0x108], r13
mov rcx, rax
and rcx, r10
mov qword [rsp + 0x98], rcx
mov rcx, rax
and rcx, r9
mov qword [rsp + 0x90], rcx
mov rcx, rax
and rcx, r8
mov qword [rsp + 0x88], rcx
and rax, rbx
mov qword [rsp + 0x100], rax
mov rax, rdi
and rax, r10
mov qword [rsp + 0x80], rax
mov rax, rdi
and rax, r9
mov qword [rsp + 0x40], rax
mov rax, rdi
and rax, r8
mov qword [rsp + 0x78], rax
and rdi, rbx
mov qword [rsp + 0xf0], rdi
shl r14, 4
pxor xmm6, xmm6
mov rbx, qword [r15 + 0x10]
mov rdi, qword [r15 + 0x18]
mov qword [rsp + 0x120], r15
nop word cs:[rax + rax]
Function at 0x1400aa140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, r8
cmp rcx, 2
jne 0x1400aa1d6
movdqa xmm0, xmmword [rdx]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1403d7e40]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14004b120
test rdi, rdi
je 0x1400aa256
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400aa26f
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x1400aa367
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400aa3e8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r8, r9
and r8, 7
je 0x1400aa374
xor r10d, r10d
movzx r11d, byte [rcx + r10]
xor rax, r11
imul rax, rdx
inc r10
cmp r8, r10
jne 0x1400aa230
add r8, rcx
cmp r9, 8
jae 0x1400aa37d
jmp 0x1400aa3e8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14004b120
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400aa3e8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1400aa3e8
mov r8, rcx
cmp r9, 8
jb 0x1400aa3e8
add rcx, r9
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1400aa380
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400b6610
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
movdqa xmmword [rsp + 0xb0], xmm7
add byte [rsi + 0xf], ah
jg 0x1400b65db
and al, 0xa0
add byte [rax], al
add byte [rax - 0x77], cl
invalid
mov rdi, rcx
pxor xmm0, xmm0
Function at 0x1400bbbb0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rdx + 0x10]
movups xmm1, xmmword [rdx]
movups xmm0, xmmword [rdx + 4]
mov r9d, dword [rdx + 0xc]
add r9d, eax
bswap r9d
movd xmm2, r9d
shufps xmm2, xmm0, 0xd4
unpcklps xmm0, xmm1
shufps xmm0, xmm2, 0x21
xorps xmm0, xmmword [rcx]
aesenc xmm0, xmmword [rcx + 0x10]
aesenc xmm0, xmmword [rcx + 0x20]
aesenc xmm0, xmmword [rcx + 0x30]
aesenc xmm0, xmmword [rcx + 0x40]
aesenc xmm0, xmmword [rcx + 0x50]
aesenc xmm0, xmmword [rcx + 0x60]
aesenc xmm0, xmmword [rcx + 0x70]
aesenc xmm0, xmmword [rcx + 0x80]
aesenc xmm0, xmmword [rcx + 0x90]
aesenc xmm0, xmmword [rcx + 0xa0]
aesenc xmm0, xmmword [rcx + 0xb0]
inc eax
aesenc xmm0, xmmword [rcx + 0xc0]
mov dword [rdx + 0x10], eax
aesenc xmm0, xmmword [rcx + 0xd0]
aesenclast xmm0, xmmword [rcx + 0xe0]
movdqu xmmword [r8], xmm0
ret
Function at 0x1401110f0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r13, rdx
mov rbx, rcx
mov rdi, qword [rcx + 8]
jns 0x140111112

Function at 0x14011b0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov r15, r9
mov r14d, r8d

Function at 0x14011fa80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test byte [rdx + 0x13], 1
jne 0x14011fabc
mov r13d, dword [rbx + 0x10]
mov r12d, dword [rbx + 0x14]
cmp r13d, r12d
jae 0x14011fb87
inc r13d
mov dword [rbx + 0x10], r13d
jmp 0x14011fad4
mov r13d, dword [rbx + 0x10]
mov r12d, dword [rbx + 0x14]
cmp r13d, r12d
jae 0x14011fb87
dec r12d
Function at 0x1401212f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x5e8
movdqa xmmword [rsp + 0x5d0], xmm7
movdqa xmmword [rsp + 0x5c0], xmm6
mov r15, r9
cmp r9, 0x7fffffff
jbe 0x140121343
movabs rax, 0x8000000000000008
add rax, 0xfffffffffffffffb
mov qword [rcx], rax
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], 0x7fffffff
jmp 0x140124141
mov r12, r8
mov r14, rdx
test byte [rdx + 0x13], 1
je 0x14012135a
cmp byte [r14 + 0x15], 2
jne 0x1401217ec
mov qword [rsp + 0xa8], rcx
cmp qword [r14 + 0x28], 0
jne case.default.0x140123dc0
mov qword [r14 + 0x28], 0xffffffffffffffff
mov dword [r14 + 0x88], 0
mov rsi, qword [r14 + 0x48]
mov rdi, qword [r14 + 0x50]
mov qword [r14 + 0x50], 0
test rdi, rdi
je 0x1401213e3
add rsi, 0x10
mov rbx, qword [0x1403d75f8]
jmp 0x1401213b9
add rsi, 0x20
dec rdi
je 0x1401213e3
mov eax, dword [rsi - 0x10]
cmp rax, 7
je 0x1401213cc
cmp eax, 6
je 0x1401213cc
cmp eax, 2
jne 0x1401213b0
cmp qword [rsi - 8], 0
je 0x1401213b0
mov r8, qword [rsi]
mov rcx, qword [0x1404d4148]
xor edx, edx
call rbx
jmp 0x1401213b0
mov qword [rsp + 0x28], r12
mov qword [r14 + 0x68], 0
mov rsi, qword [r14 + 0x78]
mov rdi, qword [r14 + 0x80]
mov qword [rsp + 0x48], r14
mov qword [r14 + 0x80], 0
test rdi, rdi
je 0x14012148c
xor ebx, ebx
mov r12, qword [0x1403d75f8]
jmp 0x140121428
inc rbx
cmp rbx, rdi
je 0x14012148c
lea r13, [rbx + rbx*2]
mov rbp, qword [rsi + r13*8 + 0x10]
test rbp, rbp
je 0x140121470
mov r14, qword [rsi + r13*8 + 8]
jmp 0x140121449
add r14, 0x10
dec rbp
je 0x140121470
mov rax, qword [r14]
test rax, rax
je 0x140121440
lock dec qword [rax]
jne 0x140121440
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
call fcn.140107c20
jmp 0x140121440
lea rax, [rsi + r13*8]
cmp qword [rax], 0
je 0x140121420
mov r8, qword [rax + 8]
mov rcx, qword [0x1404d4148]
xor edx, edx
call r12
jmp 0x140121420
mov r14, qword [rsp + 0x48]
mov qword [r14 + 0x90], 0
inc qword [r14 + 0x28]
jne case.default.0x140123dc0
movzx eax, byte [r14 + 0x12]
cmp al, 2
mov ecx, 1
cmovne ecx, eax
mov byte [r14 + 0x98], cl
movzx eax, byte [r14 + 0x13]
and al, 1
mov byte [r14 + 0x99], al
cmp byte [r14 + 0x10], 0
movzx eax, byte [r14 + 0x11]
mov ecx, 0xa
cmovne ecx, eax
mov byte [r14 + 0x9a], cl
mov qword [r14 + 0x28], 0xffffffffffffffff
mov rax, qword [r14]
xor ecx, ecx
cmp rax, 2
cmovne rcx, rax
mov rax, qword [r14 + 8]
mov qword [r14 + 0x30], rcx
mov qword [r14 + 0x38], rax
cmp rcx, 1
mov rdi, qword [rsp + 0x28]
jne 0x140121546
mov rcx, qword [r14 + 0x50]
shl rcx, 5
cmp rcx, rax
jbe 0x140121546
movabs rcx, 0x8000000000000008
add rcx, 0xfffffffffffffffd
mov rdx, qword [rsp + 0xa8]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov qword [r14 + 0x28], 0
jmp 0x140124141
lea rbx, [r14 + 0x30]
movabs r13, 0x8000000000000008
mov qword [r14 + 0x28], 0
movabs rax, 0x8000000000000008
dec rax
mov qword [rcx], rax
jmp 0x140124141
Function at 0x14014e5e0
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
mov r14, rdx
mov rsi, rcx
mov r12, qword [rdx]
mov rbx, qword [rdx + 8]
mov rax, qword [r12 + 0xa0]
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
test rax, rax
je 0x14014e62d
mov rcx, rdi
sub rcx, rax
jbe 0x14014e627
cmp byte [rbx + rax], 0xc0
jge 0x14014e62d
jmp 0x14014fabc
jne 0x14014fabc
test rcx, rcx
je 0x14014fabc
movzx ecx, byte [rbx + rax]
mov r9d, ecx
test cl, cl
jns 0x14014e6a0
mov edx, ecx
and edx, 0x1f
movzx r9d, byte [rbx + rax + 1]
and r9d, 0x3f
cmp cl, 0xdf
jbe 0x14014e697
movzx r8d, byte [rbx + rax + 2]
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
cmp cl, 0xf0
jb 0x14014e729
movzx r9d, byte [rbx + rax + 3]
and edx, 7
shl edx, 0x12
shl r8d, 6
and r9d, 0x3f
or r9d, r8d
or r9d, edx
cmp r9d, 0x110000
jne 0x14014e6a0
jmp 0x14014fabc
shl edx, 6
or edx, r9d
mov r9d, edx
cmp r9d, 0x70
je 0x14014e74f
mov rdx, rdi
test rax, rax
je 0x14014e6ca
mov rdx, rdi
sub rdx, rax
jbe 0x14014e6c4
cmp cl, 0xc0
jge 0x14014e6ca
jmp 0x14014fabc
jne 0x14014fabc
test rdx, rdx
je 0x14014fabc
test cl, cl
jns 0x14014e746
mov edx, ecx
and edx, 0x1f
movzx r9d, byte [rbx + rax + 1]
and r9d, 0x3f
shl edx, 0xc
or r8d, edx
mov r9d, r8d
cmp r9d, 0x70
jne 0x14014e6aa
jmp 0x14014e74f

Function at 0x140164300
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r11, rcx
mov rax, qword [rcx + 8]
mov r14, qword [rcx + 0x10]
mov qword [rsp + 0x38], rax
add rax, 3
mov rcx, r14
mov qword [rsp + 0x20], r11
jmp 0x140164383
Function at 0x1401fac90
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x608
movdqa xmmword [rsp + 0x5f0], xmm6
mov r15, rdx
mov dword [rsp + 0x1e0], 0
movzx eax, byte [rdx + 0xa0]
test al, al
sete dl
mov rsi, qword [r15 + 0x98]
test rsi, rsi
sete r8b
and r8b, dl
mov qword [rsp + 0x1d8], rcx
mov byte [rsp + 0x64], r8b
je 0x1401faced
xor esi, esi
jmp 0x1401fbb62
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x170], 0
test al, al
mov qword [rsp + 0x78], r15
mov dword [rsp + 0x78], edi

Function at 0x140207930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x508
movaps xmmword [rsp + 0x4f0], xmm6
mov rbx, rdx
mov rsi, rcx
mov eax, dword [rdx + 0x10]
movq xmm6, qword [rdx + 0x40]
movzx ebp, word [rdx + 0x44]
mov dword [rdx + 0x10], 0
mov r14, qword [rdx]
cmp eax, 1
jne 0x140207992
movd eax, xmm6
cmp ax, 0x2e
jne 0x140207a4c
pextrw eax, xmm6, 1
test eax, eax
je 0x140207992
cmp ax, 0x2e
jne 0x140207a4c
test bp, bp
jne 0x140207a4c
lea rdi, [rsp + 0x80]
mov r8d, 0x250
mov rcx, rdi
xor edx, edx
call fcn.1403c4432
mov rbx, qword [rbx + 8]
mov r15, qword [0x1403d7478]
nop word cs:[rax + rax]
lock inc qword [r14]

Function at 0x14020fdc0
Capabilities:
Reference wmi statements

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov r15, qword [rdx + 0x10]
test r15, r15
je 0x14020fe97
invalid
scasd eax, dword [rdi]
add byte [rax], al
invalid
lea rcx, [0x14046d8ba]

Function at 0x140227d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
Function at 0x140228ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov r14, r9
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rsp + 0x158]
movzx ebp, byte [rsp + 0x150]
mov eax, 0x2600
mov r15, r8
nop word [rax + rax]
cmp r15, r14
je 0x14022933c
movzx ecx, byte [r15]
test cl, cl
js 0x140228f30
inc r15
cmp ecx, 0xd
jbe 0x140228fb0
jmp 0x140228fd0
mov edx, ecx
and edx, 0x1f
movzx r9d, byte [r15 + 1]
and r9d, 0x3f
cmp cl, 0xdf
jbe 0x140228f86
movzx r8d, byte [r15 + 2]
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
cmp cl, 0xf0
jb 0x140228f99
movzx ecx, byte [r15 + 3]
and edx, 7
shl edx, 0x12
shl r8d, 6
and ecx, 0x3f
or ecx, r8d
or ecx, edx
cmp ecx, 0x110000
je 0x14022933c
add r15, 4
cmp ecx, 0xd
jbe 0x140228fb0
jmp 0x140228fd0
add r15, 2
shl edx, 6
or edx, r9d
mov ecx, edx
cmp ecx, 0xd
jbe 0x140228fb0
jmp 0x140228fd0
add r15, 3
shl edx, 0xc
or r8d, edx
mov ecx, r8d
cmp ecx, 0xd
ja 0x140228fd0
nop dword [rax + rax]
mov edx, 0x110000
bt eax, ecx
jae 0x140228fd0
cmp edx, 0x110000
je 0x140228f00
jmp 0x140228fde
mov edx, ecx
cmp edx, 0x110000
je 0x140228f00
invalid
invalid
invalid
cmp edx, 0x3e
jg 0x140229011
cmp edx, 0x23
je 0x140229371
cmp edx, 0x2f
je 0x14022901f
cmp dword [rbx + 0x18], 0
mov qword [rsp + 0xd0], rsi
mov ah, 0x24
rol byte [rax], 1
add byte [rax], al
cmp edx, 0x3f
je 0x1402293cc
cmp edx, 0x5c
jne 0x140228ff1
xor eax, eax
mov ecx, 0x2600
mov qword [rsp + 0x78], r10
mov r12, r10
mov rdx, r10
mov edx, edx
cmp dword [rbx + 0x20], 0
je 0x140229406
mov r14d, dword [rbx + 0x24]
mov r15, qword [rbx + 8]
test r14, r14
je 0x14022961d
cmp qword [rbx + 0x10], r14
jbe 0x140229778
cmp byte [r15 + r14], 0xbf
jg 0x14022977e
jmp 0x14022985b
mov rax, qword [rdi + 0x40]
mov qword [rsp + 0xc0], rax
cmp dword [rbx + 0x18], 0
mov qword [rsp + 0x78], r10
je 0x14022944e
lea rax, [rbx + 0x1c]
jmp 0x14022945c
mov r15, qword [rbx + 8]
mov r14, qword [rbx + 0x10]
jmp 0x14022977e
cmp dword [rbx + 0x20], 0
je 0x140229b3a
lea rax, [rbx + 0x24]
mov eax, dword [rax]
mov r12, qword [rbx + 8]
mov r15d, ebp
test rax, rax
je 0x140229496
mov r13, qword [rbx + 0x10]
cmp r13, rax
jbe 0x140229637
cmp byte [r12 + rax], 0xbf
mov r13, rax
jg 0x140229b45
jmp 0x14022985b
mov rbp, qword [rdi + 0x10]
xor r13d, r13d
jmp 0x140229b58
mov r12, qword [rdi + 0x10]
xor r14d, r14d
jmp 0x140229791
je 0x140229b45
jmp 0x14022985b
jne 0x14022985b
mov rax, qword [rdi]
mov r12, qword [rdi + 0x10]
sub rax, r12
cmp rax, r14
jb 0x140229c7e
mov r15d, ebp
mov r12, qword [rbx + 8]
mov r13, qword [rbx + 0x10]
invalid
invalid
mov rax, qword [rdi]
mov rcx, rdi
mov rdx, r12
mov r8, r14
call fcn.1403c7970
sbb dword [rax], eax
Function at 0x14025aad0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, ecx
call fcn.14034cca0
test eax, eax
jne 0x14025ac6d
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp byte [0x1404ce0d4], bpl
mov qword [rsp + 0x38], rsi
jne 0x14025ab05
mov esi, ebp
jmp 0x14025ab21
mov ecx, 5
call qword [0x1404ce140]
mov rsi, rax
test rax, rax
je 0x14025ab21
mov rcx, rax
call qword [0x1404ce150]
test ebx, ebx
jle 0x14025ac4f
test rdi, rdi
je 0x14025ac4f
cmp dword [0x1404d43b0], ebp
jne 0x14025abd8
xor ecx, ecx
call fcn.140237ed0
movups xmm0, xmmword [str.expand_32_byte_k_yJ_]
movaps xmmword [0x1404d43b0], xmm0
test rax, rax
jne 0x14025ab78
xorps xmm0, xmm0
mov qword [0x1404d43e0], rax
movups xmmword [0x1404d43c0], xmm0
mov dword [0x1404d43e8], eax
movups xmmword [0x1404d43d0], xmm0
jmp 0x14025abbc
mov ecx, dword [0x1404ce280]
test ecx, ecx
je 0x14025abaa
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1404d43c0], xmm0
mov dword [0x1404d43c0], ecx
movups xmmword [0x1404d43d0], xmm0
mov qword [0x1404d43e0], rax
mov dword [0x1404d43e8], eax
jmp 0x14025abbc
lea r8, [0x1404d43c0]
mov edx, 0x2c
mov rcx, rax
call qword [rax + 0x68]
mov eax, dword [0x1404d43e0]
xor cl, cl
mov byte [0x1404d4430], cl
mov dword [0x1404d43ec], eax
mov dword [0x1404d43e0], ebp
jmp 0x14025abdf
movzx ecx, byte [0x1404d4430]
movzx eax, cl
lea rbp, [0x1404d43f0]
cmp ebx, eax
jle 0x14025ac31
nop dword [rax]
test cl, cl
je 0x14025ac0f
movzx r8d, cl
mov rdx, rbp
mov rcx, rdi
call fcn.1403c4426
movzx ecx, byte [0x1404d4430]
sub ebx, ecx
add rdi, rcx
inc dword [0x1404d43e0]
lea rdx, [0x1404d43b0]
mov rcx, rbp
call fcn.140269e50
mov cl, 0x40
mov byte [0x1404d4430], cl
cmp ebx, 0x40
jg 0x14025abf0
movzx eax, cl
mov rcx, rdi
sub eax, ebx
movsxd r8, ebx
movsxd rdx, eax
add rdx, rbp
call fcn.1403c4426
sub byte [0x1404d4430], bl
jmp 0x14025ac55
mov dword [0x1404d43b0], ebp
test rsi, rsi
je 0x14025ac63
mov rcx, rsi
call qword [0x1404ce160]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret