joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140044f40
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400450aa
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x140044f58
cmp edx, ecx
jne 0x140045098
nop dword [rax]
test rsi, rsi
jne 0x140045098
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x140044fb4
nop
call fcn.140066760
xorps xmm15, xmm15
mov r14, qword [0x140373e90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.140044e40
mov rcx, qword [0x1403203a8]
mov rdx, qword [0x1403203a0]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x140045093
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x140045088
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x140321150]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x140321150], rbx
nop
mov edx, 1
lea rsi, [0x140321158]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x140045077
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x140197eda]
mov ebx, 0x28
call fcn.140036700
mov rcx, rax
mov rax, rsi
call fcn.140064dc0
call fcn.140034c20
lea rax, [0x140196deb]
mov ebx, 0x23
call fcn.140036700
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140062740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140044f40
Function at 0x140059b20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140059bd9
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x140059c20]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.140062600
xorps xmm15, xmm15
mov r14, qword [0x140373e90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140062740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.140059b20
Function at 0x1400647e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400038ef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.14000a2c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140062740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x1400038c0
cmp byte [0x140373c91], 0
je 0x1400647f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x140061840
jmp 0x1400038c0

Function at 0x140064800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x140373fc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x140373c91], 0
je 0x140064835
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x140374300]
aesenc xmm0, xmmword [0x140374310]
aesenc xmm0, xmmword [0x140374320]
movq rax, xmm0
ret
jmp 0x14000a4c0

Function at 0x140064840
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x140373fc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x140373c91], 0
je 0x140064876
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x140374300]
aesenc xmm0, xmmword [0x140374310]
aesenc xmm0, xmmword [0x140374320]
movq rax, xmm0
ret
jmp 0x14000a520
Function at 0x14008b5c0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14008b80c
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x14008b66c
mov qword [rsp + 0x88], rax
lea rbx, [0x1401889c0]
mov rcx, rax
lea rax, [0x140320480]
call fcn.14006bfe0
test cl, cl
jne 0x14008b651
mov rax, qword [rsp + 0x88]
call fcn.14008a420
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x1401c9ed0]
call fcn.14004e2e0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.14008ca20
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x14008b68e
lea rdx, [0x140188c80]
cmp rax, rdx
jne 0x14008b67c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
nop
call fcn.140060100
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x14016d040]
call fcn.14000b060
inc rdx
cmp rbx, rdx
jle 0x14008b6d8
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x14008b68b
lea rax, [0x140320480]
lea rbx, [0x1401889c0]
lea rdi, [0x140188c80]
call fcn.14006c1a0
lea rdx, [0x140188c80]
nop
cmp rax, rdx
jne 0x14008b7fc
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x140166aa0]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x1401773e0]
nop
call fcn.14000ddc0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x140373f70], 0
jne 0x14008b73a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x14008b749
mov rbx, rax
lea rax, [0x1401773e0]
call fcn.140013e20
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.140089ee0
nop
call fcn.1400601c0
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x14008b797
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x14008b789
mov dword [rsi + 0x10], edx
cmp dword [0x140373f70], 0
jne 0x14008b7af
mov qword [rsi + 0x30], rcx
jmp 0x14008b7b8
lea rdi, [rsi + 0x30]
call fcn.140064a20
lea rax, [0x140320480]
lea rbx, [0x1401889c0]
lea rdi, [0x140188c80]
call fcn.14006c1a0
lea rdx, [0x140188c80]
cmp rax, rdx
jne 0x14008b7ed
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x14016d040]
call fcn.14000b060
mov rbx, rdx
lea rcx, [0x14016d040]
call fcn.14000b060
nop
mov qword [rsp + 8], rax
call fcn.140062740
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.14008b5c0
Function at 0x1400d0a20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x1400d0af5
movdqa xmm0, xmmword [0x1401cb320]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x1400d0a61
movdqa xmm0, xmmword [0x1401cb330]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x1400d0b77
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x1400d0b4b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x1401caf40]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x1401cb810]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x14011f540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14011f757
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x14011f66e
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x14011f749
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x14011f5e2
mov rax, rdx
mov rcx, rsi
call fcn.140065760
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x14011f64a
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.14011f9c0
xorps xmm15, xmm15
mov r14, qword [0x140373e90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x14011f741
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x14011f674
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x14011f6f1
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.14011f9c0
xorps xmm15, xmm15
mov r14, qword [0x140373e90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x14011f72f
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x14011f72b
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.140065760
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.140064e80
mov rax, rdx
mov ecx, 0x40
call fcn.140064e80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140062740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14011f540
Function at 0x140120400
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x14012046b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x140120424
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x140120441
cmp rdx, 0
je 0x14012048d
test rdx, 0xf
je 0x14012041d
test rdx, 7
jne 0x140120441
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x14012041d
ret
Function at 0x140123140
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x14012317f
jb 0x140123194
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x140123200
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x1401232d0
jb 0x14012332f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.1401230e0
aeskeygenassist xmm1, xmm0, 1
call fcn.140123100
aeskeygenassist xmm1, xmm2, 2
call fcn.1401230e0
aeskeygenassist xmm1, xmm0, 2
call fcn.140123100
aeskeygenassist xmm1, xmm2, 4
call fcn.1401230e0
aeskeygenassist xmm1, xmm0, 4
call fcn.140123100
aeskeygenassist xmm1, xmm2, 8
call fcn.1401230e0
aeskeygenassist xmm1, xmm0, 8
call fcn.140123100
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1401230e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140123100
aeskeygenassist xmm1, xmm2, 0x20
call fcn.1401230e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140123100
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1401230e0
jmp 0x14012339d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.140123040
aeskeygenassist xmm1, xmm2, 2
call fcn.1401230a0
aeskeygenassist xmm1, xmm2, 4
call fcn.140123040
aeskeygenassist xmm1, xmm2, 8
call fcn.1401230a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.140123040
aeskeygenassist xmm1, xmm2, 0x20
call fcn.1401230a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.140123040
aeskeygenassist xmm1, xmm2, 0x80
call fcn.1401230a0
jmp 0x14012339d
aeskeygenassist xmm1, xmm0, 1
call fcn.140123000
aeskeygenassist xmm1, xmm0, 2
call fcn.140123000
aeskeygenassist xmm1, xmm0, 4
call fcn.140123000
aeskeygenassist xmm1, xmm0, 8
call fcn.140123000
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140123000
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140123000
aeskeygenassist xmm1, xmm0, 0x40
call fcn.140123000
aeskeygenassist xmm1, xmm0, 0x80
call fcn.140123000
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.140123000
aeskeygenassist xmm1, xmm0, 0x36
call fcn.140123000
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x1401233aa
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x140127e60
Capabilities:
Parse pe header

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140127ff5
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
nop dword [rax + rax]
test rax, rax
je 0x140127fe9
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov rcx, rax
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
test rbx, rbx
je 0x140127ebf
nop
lea rdx, [rcx + rbx]
lea rsi, [rcx + 0x40]
cmp rsi, rdx
jbe 0x140127ebf
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x14016a700]
call fcn.14000ddc0
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov qword [rax + 8], 0x40
mov rdx, qword [0x14031f1c8]
mov rbx, rax
mov edi, 2
mov rax, rdx
mov rcx, rdi
call fcn.14010df00
test rax, rax
jne 0x140127fdd
mov rcx, qword [rsp + 0x28]
cmp word [rcx], 0x5a4d
jne 0x140127fd1
mov ecx, dword [rcx + 0x3c]
cmp ecx, 0x400
jg 0x140127fc5
movsxd rcx, ecx
mov rdx, qword [rsp + 0x40]
add rcx, rdx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rcx
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x140127f5b
nop
add rsi, rdx
cmp rdx, 8
ja 0x140127f4f
cmp rsi, 0x100
jae 0x140127f5b
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x14016a700]
call fcn.14000ddc0
mov rcx, qword [rsp + 0x20]
mov qword [rax], rcx
mov qword [rax + 8], 0x40
mov rcx, qword [0x14031f1c8]
mov rbx, rax
mov edi, 2
mov rax, rcx
mov rcx, rdi
call fcn.14010df00
test rax, rax
jne 0x140127fb9
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140127faf
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.140062740
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140127e60
Function at 0x140128160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140128225
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
nop dword [rax + rax]
cmp ebx, 0x10
jae 0x140128219
mov dword [rsp + 0x38], ebx
mov byte [rsp + 0x3c], cl
mov qword [rsp + 0x10], rax
xor ebx, ebx
call fcn.140127e60
nop dword [rax]
test rax, rax
je 0x14012820d
mov qword [rsp + 0x18], rax
nop
mov rax, qword [rsp + 0x10]
call fcn.140128020
cmp ax, 0x20b
jne 0x1401281d3
mov ecx, dword [rsp + 0x38]
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
lea rcx, [rdx + rcx*8]
lea rcx, [rcx + 0x88]
jmp 0x1401281e6
mov edx, dword [rsp + 0x38]
mov edx, edx
mov rbx, qword [rsp + 0x18]
lea rcx, [rbx + rdx*8]
lea rcx, [rcx + 0x78]
movzx edx, byte [rsp + 0x3c]
test dl, dl
jne 0x1401281f4
cmp dword [rcx], 0
je 0x140128201
mov rax, rcx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov byte [rsp + 0x14], cl
call fcn.140062740
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
movzx ecx, byte [rsp + 0x14]
jmp fcn.140128160

Function at 0x14012fa20
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14013abc0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.14013abc0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x14012fa90
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1403788f4]
mov r12, rcx
test ebx, ebx
jle 0x14012fbc0
mov rax, qword [0x1403788f8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x14012fadc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x14012fb63
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x14012fac0
mov rcx, r12
call fcn.140130430
mov rsi, rax
test rax, rax
je 0x14012fbe2
mov rax, qword [0x1403788f8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.140130560
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1403788f8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14012fbc7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14012fb5c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14012fb70
add dword [0x1403788f4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1403788f8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14012fb5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14012fa20
nop dword [rax]
xor ebx, ebx
jmp 0x14012fae7
mov rax, qword [0x1403788f8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14012fa20
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.14012fa20
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1401300a0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140378960]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140378940]
test rbx, rbx
je 0x1401300f4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1401300eb
test r12, r12
je 0x1401300eb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1401300d0
lea rcx, [0x140378960]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]