joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ece0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm6, xmmword [rdi]
movdqu xmm7, xmmword [rdi + 0x10]
movdqu xmm8, xmmword [rdi + 0x20]
movdqu xmm9, xmmword [rdi + 0x30]
movdqu xmm10, xmmword [rdi + 0x40]
movdqu xmm11, xmmword [rdi + 0x50]
add rdi, 0x60
pand xmm6, xmm12
pand xmm7, xmm12
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm6
pxor xmm1, xmm7
pxor xmm2, xmm8
pxor xmm3, xmm9
pxor xmm4, xmm10
pxor xmm5, xmm11
dec rax
jne 0x52ed2d
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
movdqu xmmword [rdx + 0x40], xmm4
movdqu xmmword [rdx + 0x50], xmm5
ret

Function at 0x52edc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
pxor xmm15, xmm15
pcmpeqd xmm14, xmm14
psubd xmm15, xmm14
movd xmm14, eax
pshufd xmm14, xmm14, 0
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
mov rax, 0x10
movdqu xmm13, xmm15
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
movdqu xmm4, xmmword [rdi]
movdqu xmm5, xmmword [rdi + 0x10]
movdqu xmm6, xmmword [rdi + 0x20]
movdqu xmm7, xmmword [rdi + 0x30]
movdqu xmm8, xmmword [rdi + 0x40]
movdqu xmm9, xmmword [rdi + 0x50]
movdqu xmm10, xmmword [rdi + 0x60]
movdqu xmm11, xmmword [rdi + 0x70]
add rdi, 0x80
pand xmm4, xmm12
pand xmm5, xmm12
pand xmm6, xmm12
pand xmm7, xmm12
movdqu xmm12, xmm13
paddd xmm13, xmm15
pcmpeqd xmm12, xmm14
pand xmm8, xmm12
pand xmm9, xmm12
pand xmm10, xmm12
pand xmm11, xmm12
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm0, xmm8
pxor xmm1, xmm9
pxor xmm2, xmm10
pxor xmm3, xmm11
dec rax
jne 0x52ee05
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
ret
Function at 0x531f20
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x531fac
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
xorps xmm0, xmm0
movups xmmword [rax + 0xc0], xmm0
ret
cmp rcx, 0xe
jne 0x532026
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x531fa1
cmp rcx, 0xf
jne 0x5320a5
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
nop dword [rax + rax]
jmp 0x531fa1
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
jmp 0x531fa1
Function at 0x538b80
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x538cc0
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, rax
sar rax, 0x3f
shr rax, 0x3d
add rax, rcx
sar rax, 3
shl rax, 3
sub rcx, rax
lea rax, [rcx - 8]
neg rax
cmp rax, 8
je 0x538cb5
mov rdx, qword [rsp + 0x48]
nop dword [rax]
test rdx, rdx
je 0x538c92
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rax, [0x006a1460]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdx
call fcn.0044dc20
mov rcx, qword [rsp + 0x20]
cmp rcx, 8
sbb eax, eax
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x40]
movzx esi, byte [rbx]
shr sil, cl
and esi, eax
mov byte [rdx], sil
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x28]
mov r8d, 1
jmp 0x538c74
cmp rdi, 0x20
sbb r9d, r9d
movzx r10d, byte [r8 + rbx - 1]
mov r11, rcx
mov rcx, rdi
shl r10d, cl
and r10d, r9d
mov byte [rdx + r8], r10b
movzx r9d, byte [rbx + r8]
mov rcx, r11
shr r9b, cl
and r9d, eax
or r10d, r9d
mov byte [rdx + r8], r10b
inc r8
cmp rsi, r8
jg 0x538c3f
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, qword [rsp + 0x48]
jmp 0x538c92
call fcn.0046a920
jmp fcn.00538b80
Function at 0x54fe60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x550080
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
lea rax, [0x006a3fe0]
mov qword [rsp], rax
call fcn.0040e660
mov rax, qword [rsp + 8]
mov qword [rsp + 0x68], rax
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x54fefa
movzx r8d, byte [rsi + rcx]
movzx r9d, byte [rdx + rdi]
xor r8d, r9d
mov byte [rcx + rsi], r8b
inc rdi
inc rsi
cmp rdi, rax
jge 0x54fed2
cmp rbx, rsi
jle 0x54fed2
ja 0x54feaa
jmp 0x55006f
mov rax, qword [rsp + 0x68]
movzx edi, byte [rax + 3]
lea r8d, [rdi + 1]
mov byte [rax + 3], r8b
cmp dil, 0xff
je 0x550028
mov rcx, rsi
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x88]
cmp rcx, rsi
jge 0x550065
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], rbx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 0x38]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp], rdx
mov rbx, qword [rsp + 0xa8]
mov qword [rsp + 8], rbx
mov rsi, qword [rsp + 0xb0]
mov qword [rsp + 0x10], rsi
mov rdi, qword [rsp + 0xb8]
mov qword [rsp + 0x18], rdi
call rcx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 0x38]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp], rdx
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], 4
mov qword [rsp + 0x18], 4
call rcx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 0x30]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp], rdx
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], 0
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x18], rbx
call rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x50], rdx
mov rbx, qword [rsp + 0x98]
mov rsi, qword [rbx + 0x20]
mov rdi, qword [rsp + 0xa0]
mov qword [rsp], rdi
nop
call rsi
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x38]
xor edi, edi
jmp 0x54fec1
movzx edi, byte [rax + 2]
lea r8d, [rdi + 1]
mov byte [rax + 2], r8b
cmp dil, 0xff
jne 0x54feed
movzx edi, byte [rax + 1]
lea r8d, [rdi + 1]
mov byte [rax + 1], r8b
cmp dil, 0xff
jne 0x54feed
movzx edi, byte [rax]
inc edi
mov byte [rax], dil
nop dword [rax]
jmp 0x54feed
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, rsi
mov rcx, rbx
call fcn.0046cb00
nop
nop dword [rax + rax]
call fcn.0046a920
jmp fcn.0054fe60
Function at 0x57c340
Capabilities:
Parse credit card information

Disassembly:
movzx eax, byte [rsp + 8]
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x57c353
mov byte [rsp + 0x18], 0
ret
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x57c34d
lea ecx, [rax - 0x30]
nop
cmp cl, 9
jbe 0x57c34d
mov rcx, qword [rsp + 0x10]
cmp rcx, 3
jne 0x57c4e0
cmp al, 0x2c
ja 0x57c4b6
lea edx, [rax - 0x21]
nop
cmp dl, 1
ja 0x57c38b
mov byte [rsp + 0x18], 0
ret
cmp al, 0x24
je 0x57c385
cmp al, 0x26
jae 0x57c385
cmp al, 0x2f
ja 0x57c478
nop dword [rax + rax]
cmp al, 0x26
ja 0x57c451
cmp al, 0x24
jne 0x57c447
cmp rcx, 2
jg 0x57c409
cmp rcx, 1
je 0x57c401
nop dword [rax]
cmp rcx, 2
jne 0x57c3e3
cmp al, 0x2f
jne 0x57c3d4
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x3b
je 0x57c3ca
cmp al, 0x2c
je 0x57c3ca
cmp al, 0x3f
sete al
jmp 0x57c3cf
cmp rcx, 7
jne 0x57c3fa
cmp al, 0x21
jne 0x57c3f3
mov byte [rsp + 0x18], 0
ret
add eax, 0xffffffd8
cmp al, 2
jbe 0x57c3ed
mov byte [rsp + 0x18], 1
nop
ret
cmp al, 0x3f
sete byte [rsp + 0x18]
ret
cmp rcx, 5
jne 0x57c42f
cmp al, 0x40
jne 0x57c420
mov eax, 1
mov byte [rsp + 0x18], al
ret
cmp al, 0x2f
je 0x57c413
cmp al, 0x3f
je 0x57c413
cmp al, 0x3a
sete al
jmp 0x57c418
cmp rcx, 6
je 0x57c441
cmp rcx, 7
jne 0x57c3e3
mov byte [rsp + 0x18], 0
ret
mov byte [rsp + 0x18], 1
ret
cmp al, 0x26
je 0x57c3b0
jmp 0x57c3e3
lea edx, [rax - 0x2b]
cmp dl, 1
jbe 0x57c3b0
lea edx, [rax - 0x2d]
cmp dl, 1
ja 0x57c46b
mov byte [rsp + 0x18], 0
ret
cmp al, 0x2f
je 0x57c3b0
jmp 0x57c3e3
cmp al, 0x3d
ja 0x57c496
lea edx, [rax - 0x3a]
nop
cmp dl, 1
jbe 0x57c3b0
cmp al, 0x3d
je 0x57c3b0
jmp 0x57c3e3
lea edx, [rax - 0x3f]
nop dword [rax]
cmp dl, 1
jbe 0x57c3b0
cmp al, 0x5f
je 0x57c465
cmp al, 0x7e
je 0x57c465
jmp 0x57c3e3
lea edx, [rax - 0x3a]
nop dword [rax]
cmp dl, 4
jbe 0x57c385
cmp al, 0x5b
je 0x57c385
cmp al, 0x5d
je 0x57c385
jmp 0x57c393
cmp rcx, 4
je 0x57c374
jmp 0x57c393
Function at 0x596760
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x596827
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x59678c
test r15, r15
je 0x59686a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x59683c
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x59679b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x598300
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x5983a7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x59844a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x5983a7
cmp r9, 0
je 0x598503
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x598460
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x5f5fe0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5f60b5
movdqa xmm0, xmmword [0x00752d70]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5f6021
movdqa xmm0, xmmword [0x00752d80]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5f6137
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5f610b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00752150]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x007531a0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x662aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x662bd1
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
xor eax, eax
xor ecx, ecx
jmp 0x662aef
add rax, 2
lea ecx, [r10 + 1]
cmp rax, rdx
jge 0x662b63
jae 0x662bc8
mov r9d, dword [rbx + rax*4]
lea r10, [rax + 1]
cmp r10, rdx
jae 0x662bbd
mov r10d, dword [rbx + rax*4 + 4]
dec r9d
cmp r9d, ecx
jl 0x662ae7
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], r10d
mov qword [rsp], rsi
mov qword [rsp + 8], r8
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], r9d
call fcn.00662440
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r10d, dword [rsp + 0x3c]
jmp 0x662ae7
cmp ecx, 0x10ffff
jle 0x662b8d
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], r8
mov qword [rsp + 0x98], rdi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rsi
mov qword [rsp + 8], r8
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], 0x10ffff
call fcn.00662440
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
jmp 0x662b6b
mov rax, r10
mov rcx, rdx
call fcn.0046cb00
mov rcx, rdx
call fcn.0046cb00
nop
call fcn.0046a920
jmp fcn.00662aa0
Function at 0x662be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x662e59
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax + 8]
mov rdx, qword [rax]
nop word [rax + rax]
test rcx, rcx
jle 0x662e3c
mov qword [rsp + 0x58], rcx
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
xor r8d, r8d
jmp 0x662cb6
mov dword [rsp + 0x3c], r11d
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r11d
call fcn.00662440
mov eax, dword [rsp + 0x3c]
mov r10d, dword [rsp + 0x48]
lea r11d, [r10 + rax]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x4c]
cmp r11d, r9d
jle 0x662c4b
inc r8
cmp r8, rcx
jge 0x662ce4
add rdx, 6
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x68], rdx
movzx r9d, word [rdx + 2]
movzx r10d, word [rdx + 4]
movzx r11d, word [rdx]
cmp r10d, 1
je 0x662df4
mov dword [rsp + 0x4c], r9d
mov dword [rsp + 0x48], r10d
jmp 0x662ca5
mov rcx, qword [rax + 0x20]
mov rax, qword [rax + 0x18]
test rcx, rcx
jle 0x662d92
mov qword [rsp + 0x58], rcx
xor edx, edx
jmp 0x662d69
mov dword [rsp + 0x38], r10d
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r10d
nop dword [rax + rax]
call fcn.00662440
mov r9d, dword [rsp + 0x40]
mov eax, dword [rsp + 0x38]
lea r10d, [rax + r9]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x44]
cmp r8d, r10d
jge 0x662cfe
inc rdx
nop dword [rax]
cmp rdx, rcx
jge 0x662d92
add rax, 0xc
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x60], rax
mov r8d, dword [rax + 4]
mov r9d, dword [rax + 8]
mov r10d, dword [rax]
nop
cmp r9d, 1
je 0x662db4
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x40], r9d
jmp 0x662d55
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rdi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r8d
call fcn.00662440
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
jmp 0x662d5a
mov qword [rsp], rbx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r9d
call fcn.00662440
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
jmp 0x662caa
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
jmp 0x662ce4
call fcn.0046a920
nop
jmp fcn.00662be0
Function at 0x1400011a0
Capabilities:
Create directory

Disassembly:
and al, 0x3c
xor eax, 0x8b02fe61
inc byte [rdx]
invalid
push rsp

Function at 0x1400011bc
Capabilities:
Create directory

Disassembly:
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
and al, 0x40
invalid
invalid

Function at 0x1400011c4
Capabilities:
Create directory

Disassembly:
add bh, bh
ror byte [rax - 0x73], 1
lea ecx, str.:

Function at 0x1400011cc
Capabilities:
Create directory

Disassembly:
add bh, bh
ror byte [rax - 0x73], 1
lea ecx, str.:

Function at 0x140001224
Capabilities:
Create directory

Disassembly:
push rbx
mov ebp, ebp
sub dword [rax - 0x75], ecx
invalid
invalid
push rsp
invalid

Function at 0x140001238
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]

Function at 0x14000123c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]

Function at 0x140001240
Capabilities:
Create directory

Disassembly:
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
and al, 0x40
invalid
invalid

Function at 0x14000124c
Capabilities:
Create directory

Disassembly:
cmp byte [0x18169b633], ah
mov dword [rsp + 0x54], eax
mov r8, qword [rsp + 0x20]
and al, 0x20

Function at 0x140001250
Capabilities:
Create directory

Disassembly:
imul eax, dword [rcx - 0x77], 0x4c542444
mov eax, dword [rsp + 0x20]
and al, 0x20
cmp r8, rdx
invalid
invalid

Function at 0x140001280
Capabilities:
Terminate process

Disassembly:
rol byte [rbx + 0x107304f8], 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140001288
Capabilities:
Terminate process

Disassembly:
rol byte [rbx + 0x107304f8], 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14000129c
Capabilities:
Terminate process

Disassembly:
sub bl, al
nop word [rax + rax]
nop dword [rax + rax]

Function at 0x1400012a4
Capabilities:
Terminate process

Disassembly:
in al, dx
test al, 2
add byte [rax], al
add byte [rcx], dh
ror byte [rcx - 0x6b72b73f], 0x24
ror dword [rax - 0x73], 0x94
and al, 0x80
add byte [rax], al
add byte [rbp + rcx*4 + 0x44], cl
and al, 0x7c
mov dword [rsp + 0x2a4], 0x5610dee9
and al, 0xa4
add al, byte [rax]
add cl, ch
ficom word [rax]
push rsi

Function at 0x1400012c4
Capabilities:
Terminate process

Disassembly:
push rsi
mov qword [rsp + 0x288], 0x943ca17
mov r9, rdx

Function at 0x1400012d0
Capabilities:
Terminate process

Disassembly:
or dword [rcx - 0x77], ecx
rol edi, 1
invalid
and al, 0x7c

Function at 0x1400012e4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x298], 0x2921e42d

Function at 0x14000131c
Capabilities:
Terminate process

Disassembly:
add al, byte [rax]
add byte [rax - 0x75], cl
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]

Function at 0x140001324
Capabilities:
Terminate process

Disassembly:
add al, byte [rax]
add byte [rax - 0x75], cl
mov ecx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]

Function at 0x140001344
Capabilities:
Terminate process

Disassembly:
lea rcx, [rsp + 0x7c]
mov rdx, qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
invalid
add byte [rax], r8b
Function at 0x14000134c
Capabilities:
Terminate process

Disassembly:
jl 0x140001392
mov edx, dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
mov word [rax + rcx*4], fs
add al, byte [rax]
add byte [rcx - 0x7f], cl
sub r9, 0x496d631d

Function at 0x140001350
Capabilities:
Terminate process

Disassembly:
lea r9, [rsp + 0x7c]
mov r10, qword [rsp + 0x60]

Function at 0x1400013dc
Capabilities:
Terminate process

Disassembly:
add byte [rax], al
and byte [rbx - 0x74b7c247], cl
invalid
invalid
invalid
invalid

Function at 0x1400013e4
Capabilities:
Terminate process

Disassembly:
add eax, 0x4c47
mov ecx, 7
add byte [rax], al
call rax

Function at 0x1400013ec
Capabilities:
Terminate process

Disassembly:
add eax, 0x4c47
mov ecx, 7
add byte [rax], al
call rax