joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009ac30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
sub rsp, 0x20
mov esi, r9d
mov r12, r8
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x14009ae5a
test rdx, rdx
je 0x14009ae5a
test r8, r8
je 0x14009ae5a
shr esi, 3
test esi, esi
je 0x14009ae4a
mov qword [rsp + 0x48], r14
sub r12, rdx
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x40], rdi
mov rax, qword [r12 + rbx]
lea rdx, [rbp + 0x188]
mov r8, rbx
mov qword [rbp + 0x188], rax
mov rcx, rbp
dec esi
call fcn.1400996e0
mov rdx, rbx
lea rcx, [rbp + 0x180]
and edx, 7
lea r8, [rbp + 0x180]
and ecx, 7
mov r9d, 8
mov rax, rbx
cmp rdx, rcx
jne 0x14009ada8
test rdx, rdx
je 0x14009ace6
nop
test r9d, r9d
je 0x14009ace6
movzx ecx, byte [r8]
inc r8
xor byte [rax], cl
inc rax
dec r9d
jmp 0x14009acd0
mov r10d, r9d
xor r11d, r11d
shr r10d, 3
test r10d, r10d
je 0x14009ada4
cmp r10d, 8
jb 0x14009ad7f
lea ecx, [r10 - 1]
lea rdi, [rax + rcx*8]
lea rcx, [r8 + rcx*8]
cmp rax, rcx
ja 0x14009ad19
cmp rdi, r8
jae 0x14009ad7f
mov ecx, r10d
and ecx, 0xfffffff8
nop
movdqu xmm0, xmmword [rax]
add r11d, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp r11d, ecx
jb 0x14009ad20
cmp r11d, r10d
jae 0x14009ada4
sub r10d, r11d
mov edx, r10d
nop word [rax + rax]
mov rcx, qword [r8]
add r8, 8
xor qword [rax], rcx
add rax, 8
sub rdx, 1
jne 0x14009ad90
and r9d, 7
xor r10d, r10d
test r9d, r9d
je 0x14009ae21
cmp r9d, 8
jb 0x14009adf4
lea ecx, [r9 - 1]
lea r11, [rcx + rax]
add rcx, r8
cmp rax, rcx
ja 0x14009adcb
cmp r11, r8
jae 0x14009adf4
mov edx, r9d
and edx, 0xfffffff8
movq xmm0, qword [r10 + rax]
movq xmm1, qword [r10 + r8]
xorps xmm1, xmm0
movq qword [r10 + rax], xmm1
add r10d, 8
cmp r10d, edx
jb 0x14009add1
cmp r10d, r9d
jae 0x14009ae21
mov edx, r10d
sub r8, rax
add rdx, rax
sub r9d, r10d
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x14009ae10
mov rax, qword [rbp + 0x188]
add rbx, 8
mov qword [rbp + 0x180], rax
test esi, esi
jne 0x14009ac81
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x58]
mov eax, 0xffffff53
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
Function at 0x14009ae70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x20
mov ebp, r9d
mov rbx, r8
mov r14, rdx
mov r15, rcx
test rcx, rcx
je 0x14009b089
test rdx, rdx
je 0x14009b089
test rbx, rbx
je 0x14009b089
shr ebp, 3
test ebp, ebp
je 0x14009b078
mov qword [rsp + 0x40], rsi
sub r14, rbx
mov qword [rsp + 0x48], rdi
nop dword [rax]
lea rdx, [r15 + 0x180]
mov rcx, rbx
and edx, 7
lea rax, [r15 + 0x180]
and ecx, 7
dec ebp
mov r9d, 8
mov r8, rbx
cmp rdx, rcx
jne 0x14009afc8
test rdx, rdx
je 0x14009af06
test r9d, r9d
je 0x14009af06
movzx ecx, byte [r8]
inc r8
xor byte [rax], cl
inc rax
dec r9d
jmp 0x14009aef0
mov r10d, r9d
xor r11d, r11d
shr r10d, 3
test r10d, r10d
je 0x14009afc4
cmp r10d, 8
jb 0x14009af9f
lea ecx, [r10 - 1]
lea rdi, [rax + rcx*8]
lea rcx, [r8 + rcx*8]
cmp rax, rcx
ja 0x14009af39
cmp rdi, r8
jae 0x14009af9f
mov ecx, r10d
and ecx, 0xfffffff8
nop
movdqu xmm0, xmmword [rax]
add r11d, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp r11d, ecx
jb 0x14009af40
cmp r11d, r10d
jae 0x14009afc4
sub r10d, r11d
mov edx, r10d
nop word [rax + rax]
mov rcx, qword [r8]
add r8, 8
xor qword [rax], rcx
add rax, 8
sub rdx, 1
jne 0x14009afb0
and r9d, 7
xor r10d, r10d
test r9d, r9d
je 0x14009b041
cmp r9d, 8
jb 0x14009b014
lea ecx, [r9 - 1]
lea r11, [rcx + rax]
add rcx, r8
cmp rax, rcx
ja 0x14009afeb
cmp r11, r8
jae 0x14009b014
mov edx, r9d
and edx, 0xfffffff8
movq xmm0, qword [r10 + rax]
movq xmm1, qword [r10 + r8]
xorps xmm1, xmm0
movq qword [r10 + rax], xmm1
add r10d, 8
cmp r10d, edx
jb 0x14009aff1
cmp r10d, r9d
jae 0x14009b041
mov edx, r10d
sub r8, rax
add rdx, rax
sub r9d, r10d
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x14009b030
lea r8, [r15 + 0x180]
mov rcx, r15
lea rdx, [r15 + 0x180]
call fcn.1400996e0
mov rax, qword [r15 + 0x180]
mov qword [r14 + rbx], rax
add rbx, 8
test ebp, ebp
jne 0x14009aec0
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0xffffff53
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
Function at 0x14009b1d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r12
push r14
sub rsp, 0x20
mov esi, r9d
mov r12, r8
shr esi, 3
mov rbx, rdx
mov r14, rcx
test esi, esi
je 0x14009b3c3
mov qword [rsp + 0x40], rbp
mov rbp, rcx
and ebp, 7
mov qword [rsp + 0x50], r15
sub r12, rdx
mov qword [rsp + 0x48], rdi
nop dword [rax]
mov rax, qword [r12 + rbx]
lea rdx, [r14 + 8]
mov r8, rbx
mov qword [r14 + 8], rax
mov rcx, r14
dec esi
call fcn.140099890
mov rcx, rbx
mov r9d, 8
and ecx, 7
mov rax, rbx
mov r8, r14
cmp rcx, rbp
jne 0x14009b328
test rcx, rcx
je 0x14009b266
nop dword [rax]
test r9d, r9d
je 0x14009b266
movzx ecx, byte [r8]
inc r8
xor byte [rax], cl
inc rax
dec r9d
jmp 0x14009b250
mov r10d, r9d
xor r11d, r11d
shr r10d, 3
test r10d, r10d
je 0x14009b324
cmp r10d, 8
jb 0x14009b2ff
lea ecx, [r10 - 1]
lea rdi, [rax + rcx*8]
lea rcx, [r8 + rcx*8]
cmp rax, rcx
ja 0x14009b299
cmp rdi, r8
jae 0x14009b2ff
mov ecx, r10d
and ecx, 0xfffffff8
nop
movdqu xmm0, xmmword [rax]
add r11d, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp r11d, ecx
jb 0x14009b2a0
cmp r11d, r10d
jae 0x14009b324
sub r10d, r11d
mov edx, r10d
nop word [rax + rax]
mov rcx, qword [r8]
add r8, 8
xor qword [rax], rcx
add rax, 8
sub rdx, 1
jne 0x14009b310
and r9d, 7
xor r10d, r10d
test r9d, r9d
je 0x14009b3a1
cmp r9d, 8
jb 0x14009b374
lea ecx, [r9 - 1]
lea r11, [rcx + rax]
add rcx, r8
cmp rax, rcx
ja 0x14009b34b
cmp r11, r8
jae 0x14009b374
mov edx, r9d
and edx, 0xfffffff8
movq xmm0, qword [r10 + rax]
movq xmm1, qword [r10 + r8]
xorps xmm1, xmm0
movq qword [r10 + rax], xmm1
add r10d, 8
cmp r10d, edx
jb 0x14009b351
cmp r10d, r9d
jae 0x14009b3a1
mov edx, r10d
sub r8, rax
add rdx, rax
sub r9d, r10d
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x14009b390
mov rax, qword [r14 + 8]
add rbx, 8
mov qword [r14], rax
test esi, esi
jne 0x14009b210
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
Function at 0x14009b3e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r15
sub rsp, 0x20
mov ebp, r9d
mov rbx, r8
shr ebp, 3
mov r15, rdx
mov rdi, rcx
test ebp, ebp
je 0x14009b5cc
mov qword [rsp + 0x48], r14
mov r14, rcx
and r14d, 7
mov qword [rsp + 0x40], rsi
sub r15, rbx
nop dword [rax + rax]
mov rcx, rbx
dec ebp
and ecx, 7
mov r9d, 8
mov rax, rdi
mov r8, rbx
cmp r14, rcx
jne 0x14009b528
test r14, r14
je 0x14009b458
test r9d, r9d
je 0x14009b458
movzx ecx, byte [r8]
inc r8
xor byte [rax], cl
inc rax
dec r9d
jmp 0x14009b442
mov r10d, r9d
xor r11d, r11d
shr r10d, 3
test r10d, r10d
je 0x14009b524
cmp r10d, 8
jb 0x14009b4ff
lea ecx, [r10 - 1]
lea rsi, [rax + rcx*8]
lea rcx, [r8 + rcx*8]
cmp rax, rcx
ja 0x14009b48b
cmp rsi, r8
jae 0x14009b4ff
mov ecx, r10d
and ecx, 0xfffffff8
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r11d, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp r11d, ecx
jb 0x14009b4a0
cmp r11d, r10d
jae 0x14009b524
sub r10d, r11d
mov edx, r10d
nop word [rax + rax]
mov rcx, qword [r8]
add r8, 8
xor qword [rax], rcx
add rax, 8
sub rdx, 1
jne 0x14009b510
and r9d, 7
xor r10d, r10d
test r9d, r9d
je 0x14009b5a1
cmp r9d, 8
jb 0x14009b574
lea ecx, [r9 - 1]
lea r11, [rcx + rax]
add rcx, r8
cmp rax, rcx
ja 0x14009b54b
cmp r11, r8
jae 0x14009b574
mov edx, r9d
and edx, 0xfffffff8
movq xmm0, qword [r10 + rax]
movq xmm1, qword [r10 + r8]
xorps xmm1, xmm0
movq qword [r10 + rax], xmm1
add r10d, 8
cmp r10d, edx
jb 0x14009b551
cmp r10d, r9d
jae 0x14009b5a1
mov edx, r10d
sub r8, rax
add rdx, rax
sub r9d, r10d
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x14009b590
mov r8, rdi
mov rdx, rdi
mov rcx, rdi
call fcn.140099890
mov rax, qword [rdi]
mov qword [r15 + rbx], rax
add rbx, 8
test ebp, ebp
jne 0x14009b420
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x20
pop r15
pop rdi
pop rbp
ret
Function at 0x14009b6d0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1403d4408]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov edi, r8d
mov r9, rdx
mov rbx, rcx
test rcx, rcx
je 0x14009b799
test rdx, rdx
je 0x14009b799
lea eax, [rdi - 0x10]
test eax, 0xffffffef
jne 0x14009b799
test dl, 3
je 0x14009b729
mov r8d, edi
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x20]
mov eax, dword [r9]
lea rcx, [r9 + 0x10]
mov dword [rbx + 0x10], eax
lea rdx, str.expand_32_byte_kexpand_16_byte_k
mov eax, dword [r9 + 4]
cmp edi, 0x20
mov dword [rbx + 0x14], eax
mov eax, dword [r9 + 8]
cmovne rcx, r9
mov dword [rbx + 0x18], eax
mov eax, dword [r9 + 0xc]
mov dword [rbx + 0x1c], eax
lea rax, [0x14020fd90]
cmovne rdx, rax
mov eax, dword [rcx]
mov dword [rbx + 0x20], eax
mov eax, dword [rcx + 4]
mov dword [rbx + 0x24], eax
mov eax, dword [rcx + 8]
mov dword [rbx + 0x28], eax
mov eax, dword [rcx + 0xc]
mov dword [rbx + 0x2c], eax
mov eax, dword [rdx]
mov dword [rbx], eax
mov eax, dword [rdx + 4]
mov dword [rbx + 4], eax
mov eax, dword [rdx + 8]
mov dword [rbx + 8], eax
mov eax, dword [rdx + 0xc]
mov dword [rbx + 0xc], eax
xor eax, eax
mov dword [rbx + 0x40], 0
jmp 0x14009b79e
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b5880
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400a1340
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r15
sub rsp, 0x20
mov r15d, edx
mov rsi, r8
neg r15d
mov rbp, rcx
test rcx, rcx
je 0x1400a1433
test r8, r8
je 0x1400a1433
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov ebx, r12d
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], r14
cmp dword [rcx], ebx
jle 0x1400a13ba
lea r14, [r8 + 8]
nop dword [rax]
mov edx, ebx
mov rcx, rbp
call fcn.1400a1300
mov edx, ebx
mov rcx, rsi
mov edi, eax
call fcn.1400a1300
xor edi, eax
lea r14, [r14 + 4]
and edi, r15d
inc ebx
xor dword [r14 - 4], edi
cmp ebx, dword [rbp]
jl 0x1400a1390
mov eax, dword [rsi]
cmp ebx, eax
jge 0x1400a13fb
movsxd r14, ebx
add r14, 2
lea r14, [rsi + r14*4]
nop dword [rax + rax]
mov edx, ebx
mov rcx, rbp
call fcn.1400a1300
mov edx, ebx
mov rcx, rsi
mov edi, eax
call fcn.1400a1300
xor edi, eax
lea r14, [r14 + 4]
and edi, r15d
inc ebx
xor dword [r14 - 4], edi
mov eax, dword [rsi]
cmp ebx, eax
jl 0x1400a13d0
mov edx, dword [rsi + 4]
mov ecx, eax
xor ecx, dword [rbp]
mov r14, qword [rsp + 0x58]
and ecx, r15d
mov rdi, qword [rsp + 0x48]
xor ecx, eax
mov rbx, qword [rsp + 0x40]
mov eax, r12d
mov r12, qword [rsp + 0x50]
mov dword [rsi], ecx
xor edx, dword [rbp + 4]
and edx, r15d
xor dword [rsi + 4], edx
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
mov eax, 0xffffff53
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret

Function at 0x1400a1600
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
mov r9d, dword [rsp + 0x30]
mov r10, rcx
shr rcx, 4
shl r10, 0x3c
je 0x1400a162d
add rcx, 1
sub rsi, 0x10
movdqa xmm1, xmmword [rdx]
pxor xmm1, xmmword [rdi]
pxor xmm1, xmmword [r8]
add rsi, 0x10
add rdi, 0x10
cmp r9d, 0xc
aesenc xmm1, xmmword [r8 + 0x10]
aesenc xmm1, xmmword [r8 + 0x20]
aesenc xmm1, xmmword [r8 + 0x30]
aesenc xmm1, xmmword [r8 + 0x40]
aesenc xmm1, xmmword [r8 + 0x50]
aesenc xmm1, xmmword [r8 + 0x60]
aesenc xmm1, xmmword [r8 + 0x70]
aesenc xmm1, xmmword [r8 + 0x80]
aesenc xmm1, xmmword [r8 + 0x90]
movdqa xmm2, xmmword [r8 + 0xa0]
jb 0x1400a16da
cmp r9d, 0xe
aesenc xmm1, xmmword [r8 + 0xa0]
aesenc xmm1, xmmword [r8 + 0xb0]
movdqa xmm2, xmmword [r8 + 0xc0]
jb 0x1400a16da
aesenc xmm1, xmmword [r8 + 0xc0]
aesenc xmm1, xmmword [r8 + 0xd0]
movdqa xmm2, xmmword [r8 + 0xe0]
dec rcx
aesenclast xmm1, xmm2
movdqu xmmword [rsi], xmm1
jne 0x1400a1635
mov rdi, rax
mov rsi, r11
ret
Function at 0x1400a2c6d
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov dword [rsi + 0xf0], 0xa
movdqu xmm1, xmmword [rdi]
movdqa xmmword [rsi], xmm1
aeskeygenassist xmm2, xmm1, 1
call fcn.1400a2d3b
movdqa xmmword [rsi + 0x10], xmm1
aeskeygenassist xmm2, xmm1, 2
call fcn.1400a2d3b
movdqa xmmword [rsi + 0x20], xmm1
aeskeygenassist xmm2, xmm1, 4
call fcn.1400a2d3b
movdqa xmmword [rsi + 0x30], xmm1
aeskeygenassist xmm2, xmm1, 8
call fcn.1400a2d3b
movdqa xmmword [rsi + 0x40], xmm1
aeskeygenassist xmm2, xmm1, 0x10
call fcn.1400a2d3b
movdqa xmmword [rsi + 0x50], xmm1
aeskeygenassist xmm2, xmm1, 0x20
call fcn.1400a2d3b
movdqa xmmword [rsi + 0x60], xmm1
aeskeygenassist xmm2, xmm1, 0x40
call fcn.1400a2d3b
movdqa xmmword [rsi + 0x70], xmm1
aeskeygenassist xmm2, xmm1, 0x80
call fcn.1400a2d3b
movdqa xmmword [rsi + 0x80], xmm1
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.1400a2d3b
movdqa xmmword [rsi + 0x90], xmm1
aeskeygenassist xmm2, xmm1, 0x36
call fcn.1400a2d3b
movdqa xmmword [rsi + 0xa0], xmm1
mov rdi, rax
mov rsi, r11
ret

Function at 0x1400a2d64
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqu xmm1, xmmword [rdi]
movq xmm3, qword [rdi + 0x10]
movdqa xmmword [rsi], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 1
call fcn.1400a2e89
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x10], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x20], xmm6
aeskeygenassist xmm2, xmm3, 2
call fcn.1400a2e89
movdqa xmmword [rsi + 0x30], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 4
call fcn.1400a2e89
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x40], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x50], xmm6
aeskeygenassist xmm2, xmm3, 8
call fcn.1400a2e89
movdqa xmmword [rsi + 0x60], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 0x10
call fcn.1400a2e89
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x70], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x80], xmm6
aeskeygenassist xmm2, xmm3, 0x20
call fcn.1400a2e89
movdqa xmmword [rsi + 0x90], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 0x40
call fcn.1400a2e89
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0xa0], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0xb0], xmm6
aeskeygenassist xmm2, xmm3, 0x80
call fcn.1400a2e89
movdqa xmmword [rsi + 0xc0], xmm1
movdqa xmmword [rsi + 0xd0], xmm3
mov rdi, rax
mov rsi, r11
movdqa xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x1400a2ec8
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
movdqu xmm1, xmmword [rdi]
movdqu xmm3, xmmword [rdi + 0x10]
movdqa xmmword [rsi], xmm1
movdqa xmmword [rsi + 0x10], xmm3
aeskeygenassist xmm2, xmm3, 1
call fcn.1400a2fd2
movdqa xmmword [rsi + 0x20], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400a2ffb
movdqa xmmword [rsi + 0x30], xmm3
aeskeygenassist xmm2, xmm3, 2
call fcn.1400a2fd2
movdqa xmmword [rsi + 0x40], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400a2ffb
movdqa xmmword [rsi + 0x50], xmm3
aeskeygenassist xmm2, xmm3, 4
call fcn.1400a2fd2
movdqa xmmword [rsi + 0x60], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400a2ffb
movdqa xmmword [rsi + 0x70], xmm3
aeskeygenassist xmm2, xmm3, 8
call fcn.1400a2fd2
movdqa xmmword [rsi + 0x80], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400a2ffb
movdqa xmmword [rsi + 0x90], xmm3
aeskeygenassist xmm2, xmm3, 0x10
call fcn.1400a2fd2
movdqa xmmword [rsi + 0xa0], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400a2ffb
movdqa xmmword [rsi + 0xb0], xmm3
aeskeygenassist xmm2, xmm3, 0x20
call fcn.1400a2fd2
movdqa xmmword [rsi + 0xc0], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400a2ffb
movdqa xmmword [rsi + 0xd0], xmm3
aeskeygenassist xmm2, xmm3, 0x40
call fcn.1400a2fd2
movdqa xmmword [rsi + 0xe0], xmm1
mov rdi, rax
mov rsi, r11
ret
Function at 0x1400b640c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b6456
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b6456
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b6456
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b6456
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b6456
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b6458
xor al, al
add rsp, 0x28
ret
Function at 0x140030120
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003016a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003016a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003016a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003016a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003016a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003016c
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14001c3d0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14001c3e0]
mov dword [rax], 1
mov rax, qword [0x14001c3f0]
mov dword [rax], 1
mov rax, qword [0x14001c3c0]
mov dword [rax], 1
mov rax, qword [0x14001c260]
cmp word [rax], 0x5a4d
jne 0x140001067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010d0
mov rax, qword [0x14001c3b0]
mov dword [0x14001f020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14001c370]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14001c350]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14001c1f0]
cmp dword [rax], 1
je 0x140001108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001120
cmp dx, 0x20b
jne 0x140001067
cmp dword [rax + 0x84], 0xe
jbe 0x140001067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x140001067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x140001067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x140001067

Function at 0x140001b20
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x140002440
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x14000248c
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x140002483
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x14000248e
add rax, 0x28
cmp rax, r9
jne 0x140002470
xor eax, eax
ret

Function at 0x140002490
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x140002520
mov rdx, qword [0x14001c260]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x14000250e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000250e
cmp word [rax + 0x18], 0x20b
jne 0x14000250e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x140002520
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x1400024f9
add r12, 0x28
cmp r12, rsi
je 0x140002520
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x1400024f0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x140002530
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14001c260]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002550
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002558
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002550
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1400025a5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000259c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002550
add rax, 0x28
cmp rax, r9
jne 0x140002588
xor eax, eax
ret

Function at 0x1400025b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14001c260]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400025d0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400025d8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400025d0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1400025f0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14001c260]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002610
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002618
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002610
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002658
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x14000264f
test rcx, rcx
je 0x140002610
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002640
xor eax, eax
ret