joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051fbc
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
lea rdi, [0x140051810]
mov r9, rdi
lea r8, str.SetFileInformationByHandle
lea rdx, str.kernel32.dll
lea rcx, [0x1400acad0]
call fcn.1400517a8
mov rsi, rax
cmp rax, rdi
jne 0x140052069
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edi, edi
test eax, eax
je 0x140052016
mov byte [rbp + 0x28], 1
mov dword [rbp + 0x2c], edi
mov rax, qword [rbp + 0x28]
jmp 0x14005205c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x10b
jne 0x140052036
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140052009
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rbp + 0x38], dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x140052055
cmp eax, 0x35
je 0x140052055
cmp eax, 0x7b
mov dword [rbp + 0x3c], eax
jne 0x140052058
mov dword [rbp + 0x3c], edi
mov rax, qword [rbp + 0x38]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov r9d, 0x2200000
mov r8d, 0x10000
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.140051f64
xor edi, edi
test eax, eax
je 0x1400520be
mov byte [rbp + 0x38], dil
lea ecx, [rax - 2]
cmp ecx, 1
jbe 0x1400520a0
cmp eax, 0x35
je 0x1400520a0
cmp eax, 0x7b
mov dword [rbp + 0x3c], eax
jne 0x1400520a3
mov dword [rbp + 0x3c], edi
mov rcx, qword [rbp - 0x10]
cmp rcx, 0xffffffffffffffff
je 0x140052058
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140052058
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov dword [rbp + 0x30], 3
mov r9d, 4
lea r8, [rbp + 0x30]
lea edx, [r9 + 0x11]
mov rbx, qword [rbp - 0x10]
mov rcx, rbx
mov rax, rsi
call qword [case.0x140040d62.0]
test eax, eax
je 0x1400520f0
mov byte [rbp + 0x38], 1
mov dword [rbp + 0x3c], edi
jmp 0x14005213c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 1
je 0x14005210d
sub ecx, 0x31
je 0x14005210d
cmp ecx, 0x25
je 0x14005210d
mov byte [rbp + 0x38], dil
jmp 0x140052139
mov byte [rbp + 0x28], 1
mov r9d, 1
lea r8, [rbp + 0x28]
lea edx, [r9 + 3]
mov rcx, rbx
mov rax, rsi
call qword [case.0x140040d62.0]
test eax, eax
jne 0x1400520e7
mov byte [rbp + 0x38], dil
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x3c], eax
cmp rbx, 0xffffffffffffffff
je 0x140052058
mov rcx, rbx
jmp 0x1400520ad
Function at 0x14001106e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140011a10
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a2]
call fcn.14001140b
mov rax, qword [rbp + 0x160]
mov eax, dword [rax]
mov dword [rbp + 0x24], eax
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 4]
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0x160]
add rax, 8
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x178], 0
jbe 0x140011b81
mov eax, dword [rbp + 0x24]
inc eax
xor edx, edx
mov ecx, 0x100
div ecx
mov eax, edx
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x68]
movzx eax, byte [rcx + rax]
mov ecx, dword [rbp + 0x44]
add ecx, eax
mov eax, ecx
xor edx, edx
mov ecx, 0x100
div ecx
mov eax, edx
mov dword [rbp + 0x44], eax
mov eax, dword [rbp + 0x24]
mov rcx, qword [rbp + 0x68]
movzx eax, byte [rcx + rax]
mov byte [rbp + 4], al
mov eax, dword [rbp + 0x44]
mov ecx, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x68]
mov r8, qword [rbp + 0x68]
movzx eax, byte [r8 + rax]
mov byte [rdx + rcx], al
mov eax, dword [rbp + 0x44]
mov rcx, qword [rbp + 0x68]
movzx edx, byte [rbp + 4]
mov byte [rcx + rax], dl
cmp qword [rbp + 0x168], 0
je 0x140011b6b
cmp qword [rbp + 0x170], 0
je 0x140011b6b
mov rax, qword [rbp + 0x168]
movzx eax, byte [rax]
mov dword [rbp + 0x134], eax
mov ecx, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x68]
movzx ecx, byte [rdx + rcx]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x68]
movzx edx, byte [r8 + rdx]
add ecx, edx
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
cdqe
mov rcx, qword [rbp + 0x68]
movzx eax, byte [rcx + rax]
mov ecx, dword [rbp + 0x134]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rbp + 0x170]
mov byte [rcx], al
mov rax, qword [rbp + 0x168]
inc rax
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x170]
inc rax
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x178]
dec rax
mov qword [rbp + 0x178], rax
jmp 0x140011a66
mov rax, qword [rbp + 0x160]
mov ecx, dword [rbp + 0x24]
mov dword [rax], ecx
mov rax, qword [rbp + 0x160]
mov ecx, dword [rbp + 0x44]
mov dword [rax + 4], ecx
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140011249
Capabilities:
Terminate process

Disassembly:
jmp 0x1400135d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112d5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x140011e90
push rbp
push rsi
push rdi
sub rsp, 0x760
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x140
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x738], rax
lea rcx, [0x1400230a2]
call fcn.14001140b
lea rax, [rbp + 0x10]
lea rcx, [0x14001ad70]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18b
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x368]
lea rcx, str.87fdy12mp
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x3a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x108
rep stosb byte [rdi], al
mov r8d, 0xa
lea rdx, [rbp + 0x368]
lea rcx, [rbp + 0x3a0]
call fcn.140011050
mov r9d, 0x18a
lea r8, [rbp + 0x1c0]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x3a0]
call fcn.14001106e
mov dword [rbp + 0x4c4], 0
jmp 0x140011f64
mov eax, dword [rbp + 0x4c4]
inc eax
mov dword [rbp + 0x4c4], eax
movsxd rax, dword [rbp + 0x4c4]
cmp rax, 0x18a
jae 0x140011f92
movsxd rax, dword [rbp + 0x4c4]
movzx eax, byte [rbp + rax + 0x1c0]
mov edx, eax
lea rcx, str.x_02x
call fcn.1400111e5
jmp 0x140011f56
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x18a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x4e8], rax
mov r8d, 0x18a
lea rdx, [rbp + 0x1c0]
mov rcx, qword [rbp + 0x4e8]
call fcn.140011203
call qword [rbp + 0x4e8]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad30]
call fcn.140011389
mov eax, edi
mov rcx, qword [rbp + 0x738]
xor rcx, rbp
call fcn.1400111fe
lea rsp, [rbp + 0x740]
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400112e4
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014920
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014940
xor al, al
jmp 0x1400149c1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014953
xor al, al
jmp 0x1400149c1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001497d
xor al, al
jmp 0x1400149c1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014991
xor al, al
jmp 0x1400149c1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400149a3
xor al, al
jmp 0x1400149c1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400149bf
xor al, al
jmp 0x1400149c1
mov al, 1
add rsp, 0x38
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140005450]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140005460]
mov dword [rax], 1
mov rax, qword [0x140005470]
mov dword [rax], 1
mov rax, qword [0x1400053f0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140005440]
mov dword [0x14000800c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x1400010b0
mov ecx, 1
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140005510]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400054f0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x140005380]
cmp dword [rax], 1
je 0x1400010f1
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001104
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001c00
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]
Function at 0x140001c70
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400080c4]
test esi, esi
mov rdi, rcx
mov rbp, rdx
mov rbx, r8
jle 0x140001e00
mov rax, qword [0x1400080c8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rdi, rdx
jb 0x140001cbc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rdi, rdx
jb 0x140001d45
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x140001ca0
mov rcx, rdi
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x140001e52
mov rax, qword [0x1400080c8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x1400080c8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001e35
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001d3e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001db0
add dword [0x1400080c4], 1
cmp ebx, 8
jae 0x140001d71
test bl, 4
jne 0x140001e10
test ebx, ebx
je 0x140001d66
movzx eax, byte [rbp]
test bl, 2
mov byte [rdi], al
jne 0x140001e24
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, ebx
sub ebx, 1
mov rdx, qword [rbp + rax - 8]
cmp ebx, 8
mov qword [rdi + rax - 8], rdx
jb 0x140001d66
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, ebx
mov qword [rdi + rdx], rcx
jb 0x140001d8a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov r8d, 4
mov eax, 0x40
mov rcx, qword [rsp + 0x20]
cmovne r8d, eax
mov rdx, qword [rsp + 0x38]
add rsi, qword [0x1400080c8]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001d3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
xor esi, esi
jmp 0x140001cc7
mov eax, dword [rbp]
mov ebx, ebx
mov dword [rdi], eax
mov eax, dword [rbp + rbx - 4]
mov dword [rdi + rbx - 4], eax
jmp 0x140001d66
mov ebx, ebx
movzx eax, word [rbp + rbx - 2]
mov word [rdi + rbx - 2], ax
jmp 0x140001d66
mov rax, qword [0x1400080c8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rdi
call sym.__report_error
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x140002420
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140008120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140008100]
test rbx, rbx
je 0x140002474
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14000246b
test rsi, rsi
je 0x14000246b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002450
lea rcx, [0x140008120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400026c0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x1400026d0
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x1400026e0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140002721
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x140002718
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140002723
add rax, 0x28
cmp rax, r9
jne 0x140002704
xor eax, eax
ret

Function at 0x1400027d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1400053f0]
xor edx, edx
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x14000283f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x14000283f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
lea rdx, [r9 + rax + 0x18]
movzx eax, word [r9 + 6]
test eax, eax
je 0x14000283d
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x140002834
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x14000283f
add rdx, 0x28
cmp rdx, r9
jne 0x140002820
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x140002940
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x1400053f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x1400029af
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x1400029af
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x1400029ad
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x1400029a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400029b4
add rax, 0x28
cmp rax, r9
jne 0x140002990
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x1400029d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x1400053f0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x140002a43
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140002a43
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x140002a43
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140002a43
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
mov r9d, dword [rdx + 0xc]
cmp rax, r9
mov rcx, r9
jb 0x140002a37
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140002a50
add rdx, 0x28
cmp rdx, r10
jne 0x140002a23
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jne 0x140002a68
jmp 0x140002a40
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x140002a76
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002a40
test r8d, r8d
jg 0x140002a60
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x140007930
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x140043510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14004372d
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1403d7df0]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x140043580
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x1403d7e00]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x1400436aa
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x140043680
movdqa xmm1, xmmword [0x1403d7e00]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x1403d7e10], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x14004374b
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.1400430a0
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x14004ae50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14004aee6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1403d7e40]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14004b120
test rdi, rdi
je 0x14004af75
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14004af8e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14004b086
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14004b108
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14004b093
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14004af50
cmp r9, 8
jae 0x14004b09c
jmp 0x14004b108
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14004b120
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14004b108
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14004b108
mov r8, rcx
cmp r9, 8
jb 0x14004b108
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14004b0a0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14004b120
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14004b162
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14004b16a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14004b17b
jmp 0x14004b192
xor r10d, r10d
jmp 0x14004b21d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14004b192
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14004b1a9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14004b1c9
add r11, r8
jmp 0x14004b2fa
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14004b292
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14004b240
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14004b2b0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14004b2c2
jmp 0x14004b2dc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14004b2dc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14004b2f6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret