joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003c10
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14000af70
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x408], rax
test rax, rax
je 0x140003d96
mov qword [rbp + 0x400], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x140003cd0
jmp 0x140003cbf
jae 0x140003da8
cmp r8, 0x201
jae 0x140003cd0
mov r15d, 0x200
lea r14, [rbp - 0x60]
mov r12, r8
jmp 0x140003d28
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x140003cff
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.140019590
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x410], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3f8], r13
mov rbx, rdi
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x140003d57
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003e7b
mov r8d, esi
cmp r12, r8
jne 0x140003cb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140003ea5
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140003cbf
jmp 0x140003cd0
lea rcx, [rbp - 0x58]
call fcn.140001af0
mov byte [rsi + 0x18], 2
jmp 0x140003e3a
cmp r15, r8
jb 0x140003ebf
lea rcx, [rbp + 0x3a0]
mov rdx, r14
call fcn.1400059a0
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x140003df9
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rdi
call fcn.140001220
cmp byte [rbp + 0x3d8], 2
jne 0x140003e51
mov rsi, qword [rbp + 0x400]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.140001af0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x140003e3a
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.140001220
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x400]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x140003e25
jmp 0x140003e3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x140003de1
jmp 0x140003df9
lea rcx, str.internal_error:_entered_unreachable_code_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140019fb0
jmp 0x140003ed4
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14001a400
ud2
Function at 0x140017990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140017a0a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140017a00
cmp r11, r10
ja 0x140017aa3
cmp r10, rdx
ja 0x140017ab7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140017a02
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400179e0
jmp 0x140017a77
ja 0x140017a0a
mov r11, r10
cmp rax, r8
jne 0x1400179b2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140017a7b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140017a50
mov r8, r10
sub ecx, r9d
jns 0x140017a6e
jmp 0x140017a7d
cmp r10, rdx
je 0x140017a89
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140017a7d
xor al, 1
cmp r8, rdx
jne 0x140017a30
jmp 0x140017a7d
xor eax, eax
jmp 0x140017a7d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140019fb0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001a480
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001a400
ud2

Function at 0x140018ff8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019042
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019042
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019042
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019042
cmp dword [rcx + 0x84], 0xe
jbe 0x140019042
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140019044
xor al, al
add rsp, 0x28
ret
Function at 0x1400062c9
Capabilities:
Connect socket
Enumerate pe sections
Set socket configuration

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [rdx + 0x60]
test eax, eax
je 0x14000631c
cmp eax, 3
jne 0x140006629
lea r13, [rsi + 0x58]
movzx eax, byte [rsi + 0x58]
lea r14, [rsi + 0x20]
test eax, eax
je 0x1400063c2
cmp eax, 3
jne 0x140006629
mov rax, qword [rsi + 0x50]
jmp 0x1400064e8
mov qword [rsp + 0x38], rbx
movzx r13d, word [rsi]
mov eax, dword [rsi + 2]
mov qword [rsp + 0x30], rax
movzx r14d, word [rsi + 6]
mov ebx, dword [rsi + 8]
mov rax, qword [rsi + 0xc]
mov qword [rsp + 0x58], rax
mov eax, dword [rsi + 0x14]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi + 0x18]
mov dword [rsp + 0x2c], eax
movzx r12d, word [rsi + 0x1c]
test r13w, r13w
mov eax, 2
mov ebp, 0x17
cmove ebp, eax
mov rax, qword [0x1400e5a48]
cmp rax, 3
jne 0x1400065c4
mov r15, qword [rsi + 0x20]
mov r8, qword [rsi + 0x28]
jmp 0x1400064a3
lea rax, [rsp + 0x40]
mov byte [rax], 1
lea r8, [rsp + 0x60]
and al, 0x60

Function at 0x14000f9bb
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x14005efc3
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, rdx
mov rbx, rcx
mov ebx, ecx
Function at 0x14001dff2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
mov esi, ecx
shr esi, 8
lea r8, [rdx + r8*2]
xor edi, edi
cmp rdx, r8
je 0x14001e06e
lea rbx, [rdx + 2]
movzx r15d, byte [rdx + 1]
lea r14, [rdi + r15]
cmp byte [rdx], sil
jne 0x14001e04e
cmp r14, rdi
jb 0x14001e0ab
cmp r14, rax
ja 0x14001e0ab
add rdi, r9
xor edx, edx
cmp r15, rdx
je 0x14001e058
lea r12, [rdx + 1]
cmp byte [rdi + rdx], cl
mov rdx, r12
jne 0x14001e03b
jmp 0x14001e060
mov rdx, rbx
mov rdi, r14
jbe 0x14001e015
jmp 0x14001e06e
mov rdx, rbx
mov rdi, r14
jmp 0x14001e015
xor eax, eax
and al, 1
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
movzx ecx, cx
add r10, r11
mov al, 1
cmp r11, r10
je 0x14001e062
lea r8, [r11 + 1]
movzx edx, byte [r11]
test dl, dl
js 0x14001e08c
mov r11, r8
jmp 0x14001e0a3
cmp r8, r10
je 0x14001e0ab
and edx, 0x7f
shl edx, 8
movzx r8d, byte [r11 + 1]
add r11, 2
or edx, r8d
sub ecx, edx
js 0x14001e062
xor al, 1
jmp 0x14001e076
ud2
Function at 0x14002a7b8
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
call fcn.14002a05f
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
cmp eax, 1
je 0x14002a7ec
cmp eax, 2
jne 0x14002a7f9
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x1400684e0
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x140068880
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x140085540
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [rdi]
call fcn.140068740
call fcn.140067dc0
movdqu xmmword [rsi], xmm0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret
movups xmm2, xmmword [rcx]
mov eax, dword [r8 + 0xf0]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [r8 + 0x10]
lea r8, [r8 + 0x20]
xorps xmm2, xmm0
aesenc xmm2, xmm1
dec eax
movups xmm1, xmmword [r8]
lea r8, [r8 + 0x10]
jne 0x14006889a
aesenclast xmm2, xmm1
pxor xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rdx], xmm2
pxor xmm2, xmm2
ret
push rbx
push rsi
push rdi
sub rsp, 0x430
mov rax, qword [0x1400e5058]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rsi, rdx
mov rbx, rcx
mov rdx, r8
lea rcx, [rsp + 0x60]
mov rdi, r8
call fcn.140084600
mov r8d, 1
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140085198
mov edx, dword [rdi + 0xf0]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140084530
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rsi
call fcn.140084694
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.14008de10
add rsp, 0x430
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002f882
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1d0
mov rbx, r9
mov r14, r8
mov rsi, rcx
movups xmm0, xmmword [0x1400a2788]
lea rdi, [rsp + 0x20]
movups xmmword [rdi + 0x38], xmm0
movups xmm0, xmmword [0x1400a2778]
movups xmmword [rdi + 0x28], xmm0
movups xmm0, xmmword [0x1400a2768]
movups xmmword [rdi + 0x18], xmm0
movups xmm0, xmmword [0x1400a2758]
movups xmmword [rdi + 8], xmm0
lea rax, [0x1400a2728]
xorps xmm0, xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xc0], xmm0
mov qword [rdi], rax
and qword [rdi + 0x48], 0
mov r15, qword [rsp + 0x220]
and qword [rdi + 0xd0], 0
mov r8d, 0x20
mov rcx, rdi
call fcn.14002dc9e
mov r8d, 0x20
mov rcx, rdi
mov rdx, r14
call fcn.14002dc9e
mov rcx, rdi
mov rdx, rbx
mov r8, r15
call fcn.14002dc9e
lea rbx, [rsp + 0xf8]
mov r8d, 0xd8
mov rcx, rbx
mov rdx, rdi
call fcn.14008e8c0
mov rcx, rsi
mov rdx, rbx
call fcn.14002ddaf
nop
add rsp, 0x1d0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14003cf0a
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14003cf84
mov rdi, rdx
mov rbx, rcx
mov r12d, 0xffffffff
mov r13, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.advapi32.dll_SystemFunction036]
Function at 0x1400574f5
Capabilities:
Write file on windows

Disassembly:
mov r9, rcx
mov ecx, 0xfffffff5
jmp fcn.14005752c
Function at 0x140059404
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0xa0
sub esp, 0xa0
add byte [rax], al
invalid

Function at 0x140059ec0
Capabilities:
Resolve dns

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
lea r8, [rsp + 0x30]
movaps xmmword [r8], xmm0
movaps xmmword [r8 + 0x20], xmm0
movaps xmmword [r8 + 0x10], xmm0
mov dword [r8 + 8], 1
lea r9, [rsp + 0x28]
and qword [r9], 0
mov rcx, rax
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x140059f11
call fcn.140059f31
mov ecx, 1
jmp 0x140059f23
mov rax, qword [rsp + 0x28]
movzx ecx, word [rdi]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x140059f62
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rdi
sub rsp, 0x1b8
in al, dx
mov eax, 0x48000001
mov eax, dword [rcx]
Function at 0x14005d4bc
Capabilities:
Create thread
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f8
movdqa xmmword [rsp + 0x4e0], xmm8
movdqa xmmword [rsp + 0x4d0], xmm7
movdqa xmmword [rsp + 0x4c0], xmm6
mov r12, r8
mov rbx, rdx
mov rdi, rcx
lea rsi, [rcx + 0x40]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_AcquireSRWLockExclusive]
cmp byte [rdi + 0xc4], 0
je 0x14005d527
mov rcx, rbx
call fcn.14005b074
xor ebx, ebx
mov rcx, qword [rdi + 0x48]
mov rax, qword [rdi + 0x60]
cmp rax, rcx
jne 0x14005d545
lea rcx, [rdi + 0x48]
call fcn.14005c781
mov rcx, qword [rdi + 0x48]
mov rax, qword [rdi + 0x60]
mov rdx, qword [rdi + 0x58]
add rdx, rax
xor r8d, r8d
cmp rdx, rcx
cmovae r8, rcx
sub rdx, r8
mov rcx, qword [rdi + 0x50]
shl rdx, 4
mov qword [rcx + rdx], rbx
mov byte [rcx + rdx + 8], 1
inc rax
mov qword [rdi + 0x60], rax
lock inc qword [rdi + 0x108]
mov rax, qword [rdi + 0x100]
test rax, rax
je 0x14005d5a8
lock dec qword [rdi + 0x100]
inc dword [rdi + 0xc0]
add rdi, 0xc8
mov rcx, rdi
call qword [sym.imp.kernel32.dll_WakeConditionVariable]
jmp 0x14005dc1f
mov rax, qword [rdi + 0xf8]
cmp rax, qword [rdi + 0xf0]
je 0x14005dc1f
mov rbp, qword [rdi + 0x98]
test rbp, rbp
je 0x14005dd61
lock inc qword [rbp]
jle 0x14005dd61
mov rbx, qword [rdi + 0xb8]
mov rax, qword [rdi + 0x30]
mov r8, qword [rdi + 0x38]
mov rcx, qword [r8 + 0x10]
dec rcx
and rcx, 0xfffffffffffffff0
lea rdx, [rax + rcx]
add rdx, 0x10
lea r14, [rsp + 0xc0]
mov rcx, r14
call qword [r8 + 0x28]
mov r9, qword [r14]
mov rdx, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
cmp qword [rdi + 0x10], 0
je 0x14005d636
mov r13, qword [rdi + 0x18]
mov rax, qword [r12]
mov qword [rsp + 0x58], rax
lock inc qword [rax]
jg 0x14005d8e7
jmp 0x14005dd61
mov rax, qword [r12]
mov qword [rsp + 0x58], rax
lock inc qword [rax]
jle 0x14005dd61
mov r13, qword [0x1400e5b08]
test r13, r13
je 0x14005d65d
dec r13
jmp 0x14005d8e7
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r9
lea rdx, str.RUST_MIN_STACK
lea r14, [rsp + 0xc0]
mov r8d, 0xe
mov rcx, r14
call fcn.140058da9
mov rax, qword [r14]
mov r15, qword [r14 + 8]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x14005d6ac
invalid
mov rdx, r15
call fcn.140058ea3
jmp 0x14005d8c7
mov qword [rsp + 0x80], rax

Function at 0x14005df4c
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14005df4f
test al, 1
je 0x14005df6a
test al, 2
jne 0x14005df6a
xor rax, 3
ret
ud2

Function at 0x14005ef7e
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
cmp rcx, 0xffffffffffffffff
je 0x14005efc1
lea r9, [rsp + 0x34]
mov dword [r9], 1
ud2

Function at 0x14005efc3
Capabilities:
Receive data
Receive data on socket

Disassembly:
jmp 0x14005efc3
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, rdx
mov rbx, rcx
mov ebx, ecx
Function at 0x14005f1ae
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r13, r8
mov rdi, rdx
mov rbx, rcx
lea r14, [rsp + 0x32]
lea r12, [rsp + 0x42]
mov rsi, qword [rcx + 8]
mov r15, qword [rcx + 0x10]
mov eax, 0x7fffffff
cmp r9, rax
cmovb rax, r9
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rsi

Function at 0x14005f330
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea r14, [rsp + 0x42]
and al, 0x42
Function at 0x140066440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140066560
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1400664a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1400664a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1400664a0
Function at 0x1400685bd
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
xchg rcx, rdx
test rcx, rcx
je 0x140068731
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [r8]
movdqa xmm8, xmmword [0x1400ac320]
sub rsi, rdi
call fcn.140068740
movdqa xmm6, xmm0
pshufb xmm6, xmmword [0x1400ac310]
test rcx, 1
je 0x14006867a
movdqu xmm7, xmmword [rdi]
call fcn.140067dc0
pxor xmm0, xmm7
paddd xmm6, xmm8
movdqu xmmword [rsi + rdi], xmm0
sub rcx, 1
lea rdi, [rdi + 0x10]
je 0x1400686e6
movdqa xmm14, xmm6
movdqa xmm15, xmm6
paddd xmm15, xmm8
movdqa xmm1, xmmword [0x1400ac310]
movdqa xmm0, xmm14
movdqa xmm6, xmm15
pshufb xmm0, xmm1
pshufb xmm6, xmm1
call fcn.140067f20
movdqu xmm1, xmmword [rdi]
movdqu xmm2, xmmword [rdi + 0x10]
movdqa xmm3, xmmword [0x1400ac330]
pxor xmm0, xmm1
pxor xmm6, xmm2
paddd xmm14, xmm3
paddd xmm15, xmm3
movdqu xmmword [rsi + rdi], xmm0
movdqu xmmword [rsi + rdi + 0x10], xmm6
sub rcx, 2
lea rdi, [rdi + 0x20]
jne 0x140068689
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret

Function at 0x140068a90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.140068a90
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret
Function at 0x140068b9a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140068b70
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret
Function at 0x140069bc0
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r8, 0xd
jne 0x140069c6e
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12d, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
ret
cmp r8, 0x10
jb 0x140069d19
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
lea rcx, [rcx + 0x10]
sub r8, 0x10
jmp 0x140069c6e
cmp r8, 0
je 0x140069ddf
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r8
shld r14, r13, 8
shl r13, 8
movzx r15, byte [rcx - 1]
xor r13, r15
dec rcx
dec r8
jne 0x140069d2f
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
ret