joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054318
Capabilities:
Get disk information via ioctl

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [r11 - 0x30], 0
mov rcx, qword [rcx + 8]
and dword [rsp + 0x40], 0
lea rax, [r11 - 0x28]
xor r9d, r9d
xor r8d, r8d
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x20]
mov edx, 0x2d1080
mov dword [rsp + 0x28], InitCommonControls
mov qword [r11 - 0x48], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e79e0
add rsp, 0x68
ret

Function at 0x14005437c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov ebx, ecx
lea rcx, [0x14015460a]
mov edx, 0xa9b5adf
mov r8d, InitCommonControls
call fcn.140001f80
lea rcx, [rsp + 0x30]
mov r8d, ebx
mov rdx, rax
call fcn.1400e8e80
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ebx, ebx
mov edi, eax
bt edi, ebx
jae 0x140054414
xor eax, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x23], al
lea eax, [rbx + 0x41]
mov r8d, 0x40
mov byte [rsp + 0x20], al
mov word [rsp + 0x21], 0x3a
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x140054414
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1400ec6b4
test eax, eax
je 0x14005443e
inc ebx
cmp ebx, 0x20
jl 0x1400543ce
mov al, 0x41
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rdi
ret
lea eax, [rbx + 0x41]
jmp 0x14005441d
Function at 0x14005af24
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov rbx, rdx
test r8, r8
jne 0x14005af57
mov al, 1
jmp 0x14005afcf
cmp qword [rdx + 0x18], 0x10
jb 0x14005af63
mov rdi, qword [rdx]
jmp 0x14005af66
mov rdi, rdx
lea rcx, [0x140158504]
mov edx, 0x32633479
mov r8d, 5
call fcn.140002108
lea rcx, [rsp + 0x20]
mov r9, rsi
mov rdx, rax
mov r8, rdi
call fcn.1400e8e80
lea rcx, [rsp + 0x20]
mov esi, 0x2f
add rcx, qword [rbx + 0x10]
jmp 0x14005afb6
mov bl, byte [rdi + 1]
xor edx, edx
mov byte [rdi + 1], 0
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [rdi + 1], bl
lea rcx, [rdi + 1]
mov edx, esi
call fcn.1400e939c
lea rcx, [rsp + 0x20]
mov rdi, rax
test rax, rax
jne 0x14005afa0
call fcn.14001f92c
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14005e7c8
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r12, qword [rsp + 0x1d0]
lea rbx, [rcx + 0x10]
xor edi, edi
cmp qword [rbx + 0x18], 0x10
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rbp, rcx
jb 0x14005e810
mov rbx, qword [rbx]
lea rcx, [0x1401584e8]
mov edx, 0x1b0a8712
mov r8d, 7
call fcn.140002108
lea rcx, [rsp + 0x50]
mov r9, rsi
mov r8, rbx
mov rdx, rax
mov qword [rsp + 0x20], r14
call fcn.1400e8e80
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x14005e87b
xor al, al
jmp 0x14005e911
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14005e8a5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14005e8a5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005e874
cmp dword [rsp + 0x44], edi
jne 0x14005e905
cmp esi, dword [rbp + 0x58]
ja 0x14005e8b6
mov rbx, qword [rbp + 0x60]
jmp 0x14005e8d8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x60]
mov r9, rsi
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [rbp + 0x58], esi
mov rbx, rax
mov qword [rbp + 0x60], rax
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005e905
cmp dword [rsp + 0x40], esi
jne 0x14005e905
mov dword [r12], esi
mov dil, 1
mov qword [r15], rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, dil
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400e79e0
add rsp, 0x170
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005f03c
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x40], rax
cmp qword [rcx + 0x30], 0
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
je 0x14005f0c1
lea rcx, [rsp + 0x40]
sub rcx, rdx
mov al, byte [rbx]
mov byte [rcx + rbx], al
inc rbx
test al, al
jne 0x14005f078
lea rcx, [rsp + 0x40]
dec rcx
inc rcx
cmp byte [rcx], 0
jne 0x14005f08c
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x14005f096
mov r9d, dword [rbp + 0xa0]
mov rcx, qword [rsi + 0x30]
lea rdx, [rsp + 0x40]
mov r8, rdi
call fcn.14002e2d4
jmp 0x14005f15f
lea rdx, [rcx + 0x38]
mov r8, rbx
call fcn.14005af24
lea rdx, [rsp + 0x20]
mov r9, r14
mov r8, rbx
mov rcx, rsi
call fcn.14005b68c
lea rcx, [0x14015850c]
mov edx, 0x9726bb17
mov r8d, 3
call fcn.140002108
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
mov rdx, rax
call fcn.1400ea62c
mov rbx, rax
test rax, rax
jne 0x14005f12e
cmp qword [rsp + 0x38], 0x10
jb 0x14005f12a
mov rcx, qword [rsp + 0x20]
call fcn.1400e810c
xor al, al
jmp 0x14005f161
mov r8d, dword [rbp + 0xa0]
mov r9, rax
mov edx, 1
mov rcx, rdi
call fcn.1400eb8d4
mov rcx, rbx
call fcn.1400e988c
cmp qword [rsp + 0x38], 0x10
jb 0x14005f15f
mov rcx, qword [rsp + 0x20]
call fcn.1400e810c
mov al, 1
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400e79e0
add rsp, 0x150
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140060808
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r12d, r9d
mov r14, r8
mov rsi, rdx
and dword [rbp - 0x1c], 0
mov edx, 0x8edcf355
mov ecx, 0xa94fe376
mov r8d, 0xa9c030ca
call fcn.1400021b0
mov r13, rax
mov qword [rbp - 0x18], rax
mov qword [rsi + 0x18], InitCommonControls
and qword [rsi + 0x10], 0
mov byte [rsi], 0
mov dword [rbp - 0x1c], 1
xor edi, edi
test r12d, r12d
je 0x1400609ce
xor ecx, ecx
lea ebx, [rdi + 3]
jmp 0x140060883
mov r14, qword [rbp + 0x50]
dec r12d
mov al, byte [r14]
mov byte [rbp + rcx + 0x58], al
inc edi
inc rcx
inc r14
mov qword [rbp + 0x50], r14
mov r13b, byte [rbp + 0x5a]
mov r14b, byte [rbp + 0x59]
mov r15b, byte [rbp + 0x58]
cmp rcx, rbx
jne 0x14006090e
mov al, r15b
shr al, 2
mov byte [rbp - 0x20], al
mov cl, r15b
and cl, bl
shl cl, 4
mov al, r14b
shr al, 4
add cl, al
mov byte [rbp - 0x1f], cl
mov cl, r14b
and cl, 0xf
shl cl, 2
mov al, r13b
shr al, 6
add cl, al
mov byte [rbp - 0x1e], cl
mov al, r13b
and al, 0x3f
mov byte [rbp - 0x1d], al
xor edi, edi
mov rbx, qword [rbp - 0x18]
movzx eax, byte [rbp + rdi - 0x20]
mov r8b, byte [rax + rbx]
mov edx, 1
mov rcx, rsi
call fcn.140061700
inc rdi
cmp rdi, 4
jl 0x1400608e8
xor edi, edi
xor ecx, ecx
lea ebx, [rdi + 3]
test r12d, r12d
jne 0x14006087f
test edi, edi
je 0x1400609ce
movsxd rax, edi
cmp rax, rbx
jge 0x14006094a
jae 0x140060944
mov byte [rbp + rax + 0x58], 0
inc rax
cmp rax, rbx
jl 0x140060927
mov r13b, byte [rbp + 0x5a]
mov r14b, byte [rbp + 0x59]
mov r15b, byte [rbp + 0x58]
jmp 0x14006094a
call fcn.1400e888c
int3
mov al, r15b
shr al, 2
mov byte [rbp - 0x20], al
and r15b, bl
shl r15b, 4
mov al, r14b
shr al, 4
add r15b, al
mov byte [rbp - 0x1f], r15b
and r14b, 0xf
shl r14b, 2
mov al, r13b
shr al, 6
add r14b, al
mov byte [rbp - 0x1e], r14b
and r13b, 0x3f
mov byte [rbp - 0x1d], r13b
lea eax, [rdi + 1]
test eax, eax
jle 0x1400609b3
lea r14, [rbp - 0x20]
mov r15d, eax
mov r13, qword [rbp - 0x18]
movzx eax, byte [r14]
mov r8b, byte [rax + r13]
mov edx, 1
mov rcx, rsi
call fcn.140061700
inc r14
dec r15
jne 0x140060996
cmp edi, ebx
jge 0x1400609ce
sub ebx, edi
mov r8b, 0x3d
mov edx, 1
mov rcx, rsi
call fcn.140061700
dec rbx
jne 0x1400609b9
mov rax, rsi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007e5dc
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [rcx]
mov r9, rcx
lea r10, [rcx + 0x18]
mov byte [rdx + 4], al
mov al, byte [rcx + 4]
mov r11d, 8
mov byte [rdx + 5], al
mov al, byte [rcx + 8]
mov byte [rdx + 6], al
mov r8b, byte [rcx + 0xc]
mov al, byte [rdx + 7]
and al, 0x3f
shl r8b, 6
or r8b, al
mov byte [rdx + 7], r8b
mov al, byte [rcx + 0x10]
xor al, r8b
and al, 0x3f
xor al, r8b
lea r8, [rdx + 0xc]
mov byte [rdx + 7], al
mov al, byte [rcx + 0x17]
mov byte [rdx + 8], al
mov al, byte [rcx + 0x16]
mov byte [rdx + 9], al
mov eax, dword [rcx + 0x14]
shr eax, 8
mov byte [rdx + 0xa], al
mov al, byte [rcx + 0x14]
mov byte [rdx + 0xb], al
mov cl, byte [r8]
mov al, byte [r10]
lea r10, [r10 + 8]
shl al, 7
and cl, 0x7f
or cl, al
mov byte [r8], cl
mov al, byte [r10 - 4]
xor al, cl
and al, 7
xor al, cl
mov byte [r8], al
lea r8, [r8 + 2]
dec r11
jne 0x14007e63b
lea r8, [rdx + 0x1e]
lea r10, [r9 + 0x60]
mov r11d, 0x20
mov cl, byte [r10 - 8]
mov al, byte [r8 - 2]
and al, 0x7f
shl cl, 7
or cl, al
mov byte [r8 - 2], cl
mov al, byte [r10 - 4]
xor al, cl
and al, 0x1f
xor al, cl
mov byte [r8 - 2], al
mov al, byte [r10]
lea r10, [r10 + 0x14]
xor al, byte [r8 - 1]
and al, 0x1f
xor byte [r8 - 1], al
mov al, byte [r10 - 0x10]
xor al, byte [r8]
and al, 0x1f
xor byte [r8], al
mov al, byte [r10 - 0xc]
lea r8, [r8 + 4]
xor al, byte [r8 - 3]
and al, 0x1f
xor byte [r8 - 3], al
dec r11
jne 0x14007e674
mov eax, dword [r9 + 0x2d8]
lea rcx, [r9 + 0x2e8]
add rdx, 0xa4
shr eax, 8
xor al, byte [rdx - 8]
and al, 0x7f
xor byte [rdx - 8], al
mov al, byte [r9 + 0x2d8]
mov byte [rdx - 7], al
mov eax, dword [r9 + 0x2dc]
shr eax, 8
xor al, byte [rdx - 6]
and al, 0x7f
xor byte [rdx - 6], al
mov al, byte [r9 + 0x2dc]
mov byte [rdx - 5], al
mov eax, dword [r9 + 0x2e0]
shr eax, 8
mov byte [rdx - 4], al
mov al, byte [r9 + 0x2e0]
mov byte [rdx - 3], al
mov al, byte [r9 + 0x2e4]
mov byte [rdx - 1], al
jmp 0x14007e7a8
add rcx, 8
mov r8d, InitCommonControls
add rdx, 2
mov al, byte [rcx - 8]
mov byte [rdx - 1], al
mov al, byte [rcx - 4]
mov byte [rdx], al
mov al, byte [rcx]
lea rdx, [rdx + 4]
mov byte [rdx - 3], al
lea rcx, [rcx + 0xc]
dec r8
jne 0x14007e7b6
ret
Function at 0x1400845d0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov edi, dword [rcx]
mov esi, dword [rcx + 4]
mov r14, rdx
mov edx, pe_nt_image_headers64
mov rbx, rcx
jmp 0x1400845f9
xor edx, edx
call fcn.1400846f0
mov eax, dword [rbx]
mov rcx, rbx
and eax, 0x1ff
cmp eax, 0x1c0
jne 0x1400845f7
mov dword [rbx + 0x60], esi
mov dword [rbx + 0x64], edi
call fcn.140084730
xor r8d, r8d
mov eax, r8d
inc r8d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sar ecx, 2
sub eax, edx
movsxd rdx, ecx
mov ecx, 3
sub ecx, eax
mov eax, dword [rbx + rdx*4 + 8]
shl ecx, 3
shr eax, cl
mov byte [r14], al
inc r14
cmp r8d, 0x14
jl 0x14008461d
lea rcx, [rbx + 0x28]
xor edx, edx
mov r8d, 0x140
call fcn.1400ea1b0
and dword [rbx + 4], 0
and dword [rbx], 0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
mov dword [rbx + 0x18], 0xc3d2e1f0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret

Function at 0x1400846a4
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor edx, edx
mov r8d, 0x140
add rcx, 0x28
call fcn.1400ea1b0
and dword [rbx + 4], 0
and dword [rbx], 0
mov dword [rbx + 8], 0x67452301
mov dword [rbx + 0xc], 0xefcdab89
mov dword [rbx + 0x10], 0x98badcfe
mov dword [rbx + 0x14], 0x10325476
mov dword [rbx + 0x18], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
Function at 0x140084730
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
lea r10, [rcx + 0x28]
mov rdx, rcx
mov r8d, 0x40
mov rcx, r10
mov eax, dword [rcx + 0x34]
xor eax, dword [rcx + 0x20]
xor eax, dword [rcx + 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
rol eax, 1
mov dword [rcx + 0x3c], eax
dec r8
jne 0x14008475b
mov r15d, dword [rdx + 8]
mov r12d, dword [rdx + 0xc]
mov r13d, dword [rdx + 0x10]
mov r11d, dword [rdx + 0x14]
mov esi, dword [rdx + 0x18]
lea edi, [r8 + 0x14]
mov ebp, r15d
mov ebx, r12d
mov r9d, r13d
mov r14d, edi
mov eax, r11d
mov ecx, ebp
lea r8d, [rsi + 0x5a827999]
xor eax, r9d
rol ecx, 5
mov esi, r11d
and eax, ebx
xor eax, r11d
mov r11d, r9d
mov r9d, ebx
add ecx, eax
ror r9d, 2
mov ebx, ebp
add ecx, dword [r10]
lea r10, [r10 + 4]
add r8d, ecx
mov ebp, r8d
dec r14
jne 0x140084797
lea rcx, [rdx + 0x78]
mov r10, rdi
rol r8d, 5
add esi, 0x6ed9eba1
mov eax, r11d
xor eax, r9d
xor eax, ebx
add r8d, eax
add r8d, dword [rcx]
lea rcx, [rcx + 4]
add r8d, esi
mov esi, r11d
mov r11d, r9d
mov r9d, ebx
mov ebx, ebp
mov ebp, r8d
ror r9d, 2
dec r10
jne 0x1400847d8
lea r10, [rdx + 0xc8]
mov r14, rdi
rol r8d, 5
mov ecx, r9d
mov eax, r9d
or ecx, ebx
and eax, ebx
add r8d, 0x8f1bbcdc
add r8d, dword [r10]
and ecx, r11d
lea r10, [r10 + 4]
or ecx, eax
add ecx, esi
mov esi, r11d
mov r11d, r9d
mov r9d, ebx
add r8d, ecx
mov ebx, ebp
mov ebp, r8d
ror r9d, 2
dec r14
jne 0x140084818
lea rcx, [rdx + 0x118]
rol r8d, 5
add esi, 0xca62c1d6
mov eax, r11d
xor eax, r9d
add r8d, esi
mov esi, r11d
xor eax, ebx
mov r11d, r9d
mov r9d, ebx
add eax, dword [rcx]
mov ebx, ebp
ror r9d, 2
add r8d, eax
lea rcx, [rcx + 4]
mov ebp, r8d
dec rdi
jne 0x14008485c
add dword [rdx + 0x14], r11d
add dword [rdx + 0x18], esi
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
lea eax, [r15 + r8]
mov dword [rdx + 8], eax
lea eax, [r12 + rbx]
mov rbx, qword [rsp + 0x28]
mov dword [rdx + 0xc], eax
lea eax, [r9 + r13]
mov dword [rdx + 0x10], eax
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x14008c624
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14008c63d
xor eax, eax
jmp 0x14008c6ab
not r9d
lea rdi, [0x140115e00]
cmp r8d, 8
jb 0x14008c681
mov r11d, r8d
shr r11, 3
mov ebx, 8
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec rbx
jne 0x14008c659
add r8d, 0xfffffff8
dec r11
jne 0x14008c654
test r8d, r8d
je 0x14008c6a5
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r8d
jne 0x14008c686
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14008f86c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov edi, r8d
movaps xmmword [rax - 0x28], xmm6
mov r14, r9
sar edi, 4
mov rbx, rdx
mov rsi, rcx
test r8b, 0xf
je 0x14008f8a7
mov eax, 1
jmp 0x14008f9ba
test dl, 3
jne 0x14008f904
test r14b, 3
jne 0x14008f904
test edi, edi
je 0x14008f9b8
mov r15, r9
sub r15, rdx
mov r8, qword [rsp + 0x70]
movups xmm6, xmmword [rsi]
mov rdx, rbx
mov rcx, rsi
dec edi
call fcn.140003100
test eax, eax
jne 0x14008f89d
lea ecx, [rax + 4]
mov eax, dword [r15 + rbx]
xor dword [rbx], eax
add rbx, 4
dec rcx
jne 0x14008f8dc
movups xmm0, xmm6
add rsi, 0x10
sub r15, 0x10
movdqu xmmword [r14], xmm0
test edi, edi
jne 0x14008f8c0
jmp 0x14008f9b8
test edi, edi
je 0x14008f9b8
lea rbp, [rdx + 2]
sub rsi, rdx
mov r8, qword [rsp + 0x70]
lea rcx, [rsi - 2]
lea rdx, [rbp - 2]
add rcx, rbp
dec edi
movups xmm6, xmmword [rcx]
call fcn.140003100
test eax, eax
jne 0x14008f89d
mov al, byte [r14]
movups xmm0, xmm6
xor byte [rbp - 2], al
mov al, byte [r14 + 1]
xor byte [rbp - 1], al
mov al, byte [r14 + 2]
xor byte [rbp], al
mov al, byte [r14 + 3]
add rbp, 0x10
xor byte [rbp - 0xf], al
mov al, byte [r14 + 4]
xor byte [rbp - 0xe], al
mov al, byte [r14 + 5]
xor byte [rbp - 0xd], al
mov al, byte [r14 + 6]
xor byte [rbp - 0xc], al
mov al, byte [r14 + 7]
xor byte [rbp - 0xb], al
mov al, byte [r14 + 8]
xor byte [rbp - 0xa], al
mov al, byte [r14 + 9]
xor byte [rbp - 9], al
mov al, byte [r14 + 0xa]
xor byte [rbp - 8], al
mov al, byte [r14 + 0xb]
xor byte [rbp - 7], al
mov al, byte [r14 + 0xc]
xor byte [rbp - 6], al
mov al, byte [r14 + 0xd]
xor byte [rbp - 5], al
mov al, byte [r14 + 0xe]
xor byte [rbp - 4], al
mov al, byte [r14 + 0xf]
xor byte [rbp - 3], al
movdqu xmmword [r14], xmm0
test edi, edi
jne 0x14008f913
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14008fb18
Capabilities:
Decrypt data using aes via x86 extensions
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x1a0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
movaps xmmword [rax - 0x88], xmm13
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r10, qword [rsp + 0x1d0]
mov r11, rdx
mov rbx, rcx
test r10b, 0xf
je 0x14008fbe6
lea rax, [rsp]
lea rcx, [rsp]
mov edx, 2
neg rax
and eax, 0xf
add rcx, rax
mov rax, rcx
movups xmm0, xmmword [r10]
movups xmm1, xmmword [r10 + 0x10]
lea r10, [r10 + 0x80]
movups xmmword [rax], xmm0
movups xmm0, xmmword [r10 - 0x60]
movups xmmword [rax + 0x10], xmm1
lea rax, [rax + 0x80]
movups xmm1, xmmword [r10 - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [r10 - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [r10 - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [r10 - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [r10 - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
dec rdx
jne 0x14008fb8b
jmp 0x14008fbe9
mov rcx, r10
movdqa xmm3, xmmword [rcx]
movdqa xmm4, xmmword [rcx + 0x10]
movdqa xmm5, xmmword [rcx + 0x20]
sar r8d, 4
movdqa xmm6, xmmword [rcx + 0x30]
movdqa xmm7, xmmword [rcx + 0x40]
movdqa xmm8, xmmword [rcx + 0x50]
movdqa xmm9, xmmword [rcx + 0x60]
movdqa xmm10, xmmword [rcx + 0x70]
movdqa xmm11, xmmword [rcx + 0x80]
movdqa xmm12, xmmword [rcx + 0x90]
movdqa xmm13, xmmword [rcx + 0xa0]
movdqu xmm2, xmmword [r9]
test r8d, r8d
jle 0x14008fc9d
sub r11, rbx
mov eax, r8d
movdqu xmm1, xmmword [rbx]
movdqa xmm0, xmm1
pxor xmm0, xmm3
aesdec xmm0, xmm4
aesdec xmm0, xmm5
aesdec xmm0, xmm6
aesdec xmm0, xmm7
aesdec xmm0, xmm8
aesdec xmm0, xmm9
aesdec xmm0, xmm10
aesdec xmm0, xmm11
aesdec xmm0, xmm12
aesdeclast xmm0, xmm13
pxor xmm0, xmm2
movdqa xmm2, xmm1
movdqu xmmword [r11 + rbx], xmm0
lea rbx, [rbx + 0x10]
dec rax
jne 0x14008fc42
movdqu xmmword [r9], xmm2
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x1a0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop rbx
ret

Function at 0x14008fd2c
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x80], rax
and dword [rsp + 0x24], 0
and dword [rsp + 0x20], 0
mov rbx, r8
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
mov dword [rsp + 0x38], 0xc3d2e1f0
call fcn.14008ff14
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.14008fdb4
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400e79e0
add rsp, 0x90
pop rbx
ret
Function at 0x14008fee8
Capabilities:
Hash data using sha1

Disassembly:
and dword [rcx + 4], 0
and dword [rcx], 0
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
ret
Function at 0x140092150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea r11, [0x140171700]
lea r10, [0x140172100]
mov ebx, 0x100
lea rdi, [0x140000000]
movzx r9d, byte [r11 + 0x100]
mov ecx, r9d
mov eax, r9d
mov edx, r9d
shr edx, 1
shr eax, 2
and ecx, 3
movzx r8d, byte [rcx + rdi + 0x160dc0]
xor edx, r9d
xor r8d, eax
movzx eax, byte [rcx + rdi + 0x160dc4]
shr edx, 1
xor edx, eax
xor r8d, r9d
xor edx, r9d
imul eax, edx, 0x10100
add eax, r8d
shl eax, 8
add eax, r9d
shl r9d, 0x10
mov dword [r10 - 0x800], eax
imul eax, edx, 0x1000100
add eax, r8d
add r9d, eax
mov dword [r10], r9d
movzx r9d, byte [r11]
inc r11
mov ecx, r9d
mov eax, r9d
mov edx, r9d
shr edx, 1
and ecx, 3
shr eax, 2
movzx r8d, byte [rcx + rdi + 0x160dc0]
xor edx, r9d
lea r10, [r10 + 4]
shr edx, 1
xor r8d, eax
movzx eax, byte [rcx + rdi + 0x160dc4]
xor edx, eax
xor r8d, r9d
mov ecx, r9d
xor edx, r9d
shl ecx, 8
add ecx, r8d
shl ecx, 0x10
imul eax, edx, 0x101
shl edx, 8
add ecx, eax
add edx, r9d
mov dword [r10 - 0x404], ecx
imul eax, r8d, 0x1000001
shl edx, 8
add edx, eax
mov dword [r10 + 0x3fc], edx
dec rbx
jne 0x140092174
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x14009225c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor ebx, ebx
lea rdi, [0x140171800]
lea rsi, [0x140000000]
mov r11b, bl
mov r10b, bl
inc ebx
shr r11b, 4
and r10b, 0xf
movzx edx, r10b
movzx ecx, r11b
mov eax, ecx
movzx ecx, byte [rcx + rsi + 0x160dd8]
xor rax, rdx
movzx r8d, byte [rax + rsi + 0x160de8]
movzx eax, byte [rdx + rsi + 0x160dc8]
xor rcx, rax
mov r9d, r8d
movzx edx, byte [rcx + rsi + 0x160e08]
movzx ecx, byte [r8 + rsi + 0x160dd8]
movzx eax, byte [rdx + rsi + 0x160dc8]
xor r9, rdx
movzx edx, r10b
xor rcx, rax
mov al, byte [rcx + rsi + 0x160e48]
movzx ecx, r11b
shl al, 4
or al, byte [r9 + rsi + 0x160e28]
mov byte [rdi - 0x100], al
mov eax, ecx
movzx ecx, byte [rcx + rsi + 0x160dd8]
xor rax, rdx
movzx r8d, byte [rax + rsi + 0x160df8]
movzx eax, byte [rdx + rsi + 0x160dc8]
xor rcx, rax
mov r9d, r8d
movzx edx, byte [rcx + rsi + 0x160e18]
movzx ecx, byte [r8 + rsi + 0x160dd8]
movzx eax, byte [rdx + rsi + 0x160dc8]
xor r9, rdx
xor rcx, rax
mov al, byte [rcx + rsi + 0x160e58]
shl al, 4
or al, byte [r9 + rsi + 0x160e38]
mov byte [rdi], al
inc rdi
cmp ebx, 0x100
jb 0x14009227b
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret