joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069788
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140091208]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14005aa58
xor ebx, ebx
cmp qword [0x1400956c8], rbx
mov rdi, rax
jne 0x14006989b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140069972
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140069972
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400956c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400956d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400956d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400956e8], rax
test rax, rax
je 0x140069892
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400956e0], rax
jmp 0x1400698a2
mov rax, qword [0x1400956e0]
jmp 0x1400698a9
mov rax, qword [0x1400956e0]
mov r11, qword [0x1400956e8]
cmp rax, rdi
je 0x140069910
cmp r11, rdi
je 0x140069910
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400956e8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140069910
test rax, rax
je 0x140069910
call rsi
test rax, rax
je 0x14006990a
lea rcx, [rsp + 0x30]
mov r9d, recv
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14006990a
test byte [rsp + 0x40], 1
jne 0x140069910
bts ebp, 0x15
jmp 0x140069950
mov rcx, qword [0x1400956d0]
cmp rcx, rdi
je 0x140069950
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140069950
call rax
mov rbx, rax
test rax, rax
je 0x140069950
mov rcx, qword [0x1400956d8]
cmp rcx, rdi
je 0x140069950
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140069950
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400956c8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140069972
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140069974
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140051c70
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140011208
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140011a10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x14001e018]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x1400240f7]
call fcn.1400113e8
xor edx, edx
mov ecx, 2
call fcn.1400111cc
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140011a92
mov eax, dword [section..data]
add eax, 2
mov r8d, eax
lea rdx, [0x14001af20]
lea rcx, str.hProcSnap___INVALID_HANDLE_VALUE
call qword [sym.imp.ucrtbased.dll__wassert]
xor eax, eax
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011280
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0
je 0x140011aee
mov rdx, qword [rbp + 0x440]
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140011ad9
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x38]
jmp 0x140011b06
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001139d
mov dword [rbp + 0x284], eax
jmp 0x140011aac
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14001b018]
call fcn.1400111c2
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad00]
call fcn.140011375
mov rax, rdi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret

Function at 0x140011244
Capabilities:
Terminate process

Disassembly:
jmp 0x140013660
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011249
Capabilities:
Acquire debug privileges

Disassembly:
jmp 0x1400118a0
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e018]
xor rax, rbp
mov qword [rbp + 0x128], rax
lea rcx, [0x1400240f7]
call fcn.1400113e8
mov dword [rbp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 8]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140011997
mov dword [rbp + 0x48], 1
mov eax, 0xc
imul rax, rax, 0
lea rax, [rbp + rax + 0x4c]
mov r8, rax
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, 0xc
imul rax, rax, 0
mov dword [rbp + rax + 0x54], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001197a
mov dword [rbp + 0x124], 1
jmp 0x140011984
mov dword [rbp + 0x124], 0
mov eax, dword [rbp + 0x124]
mov dword [rbp + 0x24], eax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x24]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001adc0]
call fcn.140011375
mov eax, edi
mov rcx, qword [rbp + 0x128]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400112d0
Capabilities:
Allocate or change rwx memory
Create thread
Execute command
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140011da0
push rbp
push rdi
sub rsp, 0x4c8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xc2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e018]
xor rax, rbp
mov qword [rbp + 0x478], rax
lea rcx, [0x1400240f7]
call fcn.1400113e8
call fcn.140011249
lea rcx, [0x14001b058]
call fcn.1400111c2
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rbp + 0x10]
lea rcx, [0x14001af10]
call fcn.140011253
lea rcx, [0x14001b078]
call fcn.1400111c2
mov r8d, 0x104
lea rdx, [rbp + 0x140]
lea rcx, [0x14001af10]
call fcn.140011253
mov dword [rbp + 0x264], 0
lea rcx, [rbp + 0x10]
call fcn.140011208
mov dword [rbp + 0x264], eax
mov r8d, dword [rbp + 0x264]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x288], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x100
xor edx, edx
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x2a8], rax
mov dword [rbp + 0x2c4], 0
lea rcx, [rbp + 0x140]
call fcn.140011195
inc rax
lea rcx, [rbp + 0x2c4]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [rbp + 0x140]
mov rdx, qword [rbp + 0x2a8]
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x2a8]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x2e8], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x2a8]
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov rcx, qword [rbp + 0x2e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001aed0]
call fcn.140011375
mov eax, edi
mov rcx, qword [rbp + 0x478]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x488]
pop rdi
pop rbp
ret
Function at 0x1400112da
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400149a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400149c0
xor al, al
jmp 0x140014a41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400149d3
xor al, al
jmp 0x140014a41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400149fd
xor al, al
jmp 0x140014a41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014a11
xor al, al
jmp 0x140014a41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014a23
xor al, al
jmp 0x140014a41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014a3f
xor al, al
jmp 0x140014a41
mov al, 1
add rsp, 0x38
ret
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or bh, bh
pop rcx
cmp eax, 0x578758ff
dec dword [rax + 0x7d]
dec dword [rsi + r15*2 + 0x49]
dec dword [rsp + rdi*2 + 0x48]
dec dword [rbx + rdi*2 + 0x48]
dec qword [rdx + 0x7a]
dec qword [rdx + 0x7a]
dec dword [rdx + 0x79]
dec dword [rax + 0x77]
dec dword [rax + 0x77]
dec dword [rax + 0x76]
inc dword [rdi + 0x75]
dec dword [rcx + 0x77]
dec qword [rdx + 0x78]
dec qword [r10 + 0x77]
dec qword [rcx + 0x77]
dec qword [rdx + 0x78]
dec qword [rbx + 0x78]
dec qword [rax + rdi*2 + 0x48]
js 0x14003f713
js 0x14003f713
dec dword [rdx + 0x75]
inc dword [r15 + 0x72]
dec dword [rdi - 0x7b]
dec qword [rdi - 0x7b]
call qword [rcx - 0x79]
call qword [rbx - 0x77]
call qword [rbx - 0x77]
call qword [rdx + r9*4 + 0x4e]
call qword [rdx + r9*4 + 0x4d]
call qword [rdx + r9*4 + 0x4d]
call qword [rdx + rcx*4 + 0x4d]
call qword [rdx + rcx*4 + 0x4d]
call qword [r10 + rcx*4 + 0x4d]
call qword [rsi - 0x74]
call qword [r14 - 0x73]
call qword [r10 - 0x74]
call qword [rcx - 0x77]
call qword [r8 - 0x7c]
push rax
test byte [rcx - 1], cl
or byte [rax - 1], 0x4e
invalid
push rax
test byte [rcx - 1], cl
or byte [rax - 1], 0x4e
jge 0x14003f75b
invalid
dec qword [rdi + 0x7c]
dec dword [rdi + 0x7c]
jl 0x14003f75f
dec qword [rdi + 0x7d]
dec dword [rdi + 0x7d]
call qword [r8 + 0x7f]
call qword [r8 - 0x80]
dec qword [rdi - 0x80]
dec qword [rdi - 0x80]
dec qword [rbp - 0x7f]
dec qword [r14 - 0x7e]
call qword [r9 - 0x7d]
call qword [rcx - 0x7c]
call qword [r11 - 0x7a]
call qword [r10 - 0x7c]
call qword [rbp - 0x7a]
call qword [rdx - 0x7b]
call qword [rcx - 0x7b]
call qword [r9 - 0x79]
dec qword [rdi - 0x78]
call qword [rdx - 0x77]
call qword [rdx - 0x78]
call qword [rdx - 0x78]
call qword [r10 - 0x79]
call qword [rdx - 0x79]
call qword [rax - 0x7b]
dec qword [r9 + rax*4 + 0x4a]
call qword [rbp - 0x79]
push rsp
jmp [rbx]
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140388f10]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140388f20]
mov dword [rax], 1
mov rax, qword [0x140388f30]
mov dword [rax], 1
mov rax, qword [0x140388e70]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140388f00]
mov dword [0x14042a00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140389000]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140388fe0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x140387d00]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140019c60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
cmp rcx, rdx
je 0x140019e30
mov rbp, qword [rcx + 0x18]
mov rsi, qword [rdx + 0x18]
mov rcx, qword [rcx + 0x20]
cmp rbp, rsi
jb 0x140019cd8
mov rdx, qword [rdx + 0x20]
test rsi, rsi
je 0x140019cc1
lea rax, [rsi - 1]
cmp rax, 1
jbe 0x140019e20
lea r8, [rdx + 8]
xor eax, eax
cmp rcx, r8
jne 0x140019d78
nop
mov r8, qword [rdx + rax*8]
xor qword [rcx + rax*8], r8
add rax, 1
cmp rsi, rax
jne 0x140019cb0
mov rax, rbx
mov dword [rbx + 0x28], 0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rdx, rbp
mov r9d, 1
mov r8, rsi
call method.CryptoPP::AllocatorWithCleanup_unsigned_long_long__true_::pointer_CryptoPP::StandardReallocate_unsigned_long_long__CryptoPP.AllocatorWithCleanup_unsigned_long_long__true____CryptoPP::AllocatorWithCleanup_unsigned_long_long__true___unsigned_long_lo
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rax
mov rcx, rax
mov rdx, qword [rdi + 0x20]
movabs rax, 0x1fffffffffffffff
mov qword [rbx + 0x10], rax
test rbp, rbp
je 0x140019d48
lea rax, [rbp - 1]
cmp rax, 1
jbe 0x140019e10
lea r8, [rdx + 8]
xor eax, eax
cmp rcx, r8
jne 0x140019dc0
nop dword [rax + rax]
mov r8, qword [rdx + rax*8]
xor qword [rcx + rax*8], r8
add rax, 1
cmp rbp, rax
jne 0x140019d30
nop dword [rax]
lea rax, [rbp*8]
add rdx, rax
add rcx, rax
cmp rdx, rcx
je 0x140019cc1
sub rsi, rbp
lea r8, [rsi*8]
call sym.memcpy
jmp 0x140019cc1
mov r8, rsi
shr r8, 1
shl r8, 4
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + rax]
movdqu xmm1, xmmword [rdx + rax]
pxor xmm0, xmm1
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp r8, rax
jne 0x140019d88
mov rax, rsi
and rax, 0xfffffffffffffffe
and esi, 1
je 0x140019cc1
mov rdx, qword [rdx + rax*8]
xor qword [rcx + rax*8], rdx
jmp 0x140019cc1
mov r8, rbp
shr r8, 1
shl r8, 4
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + rax]
movdqu xmm2, xmmword [rdx + rax]
pxor xmm0, xmm2
movups xmmword [rcx + rax], xmm0
add rax, 0x10
cmp r8, rax
jne 0x140019dd0
mov rax, rbp
and rax, 0xfffffffffffffffe
test bpl, 1
je 0x140019d48
mov r8, qword [rdx + rax*8]
xor qword [rcx + rax*8], r8
jmp 0x140019d48
xor eax, eax
jmp 0x140019d30
xor eax, eax
jmp 0x140019cb0
lea rdx, [0x14042a140]
call fcn.140017c40
jmp 0x140019cc1
Function at 0x140044860
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x50]
mov rbx, rcx
test eax, eax
jne 0x1400448d8
mov rdi, qword [0x140387e50]
mov rsi, qword [0x140387e00]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 0x30]
shl rax, 3
bswap rax
test rdx, rdx
je 0x140044897
mov qword [rdx], rax
mov rax, qword [rbx + 0x40]
shl rax, 3
bswap rax
cmp byte [rdi], 0
mov qword [rdx + 8], rax
mov rbp, qword [rbx + 0x30]
je 0x140044958
cmp byte [rsi], 0
jne 0x140044930
mov r8d, 0x10
mov rdx, rbp
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp method.CryptoPP::GCM_Base.AuthenticateBlocks_unsigned_char_const__unsigned_long_long___clone_.part.0_
mov r8d, 0x10
mov ecx, eax
xor edx, edx
add rcx, qword [rbx + 0x30]
sub r8d, eax
call sym.memset
mov rdi, qword [0x140387e50]
mov dword [rbx + 0x50], 0
mov rbp, qword [rbx + 0x30]
cmp byte [rdi], 0
je 0x140044968
mov rsi, qword [0x140387e00]
cmp byte [rsi], 0
jne 0x140044979
mov r8d, 0x10
mov rdx, rbp
mov rcx, rbx
call method.CryptoPP::GCM_Base.AuthenticateBlocks_unsigned_char_const__unsigned_long_long___clone_.part.0_
jmp 0x140044880
mov rax, qword [rbx + 0x30]
mov edx, 0x10
mov rcx, rbp
lea r9, [rax + 0x10]
lea r8, [rax + 0x30]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp method.CryptoPP.GCM_AuthenticateBlocks_CLMUL_unsigned_char_const__unsigned_long_long__unsigned_char_const__unsigned_char_
call method.CryptoPP.DetectX86Features__
jmp 0x1400448b3
call method.CryptoPP.DetectX86Features__
mov rsi, qword [0x140387e00]
cmp byte [rsi], 0
je 0x140044911
mov rax, qword [rbx + 0x30]
mov edx, 0x10
mov rcx, rbp
lea r9, [rax + 0x10]
lea r8, [rax + 0x30]
call method.CryptoPP.GCM_AuthenticateBlocks_CLMUL_unsigned_char_const__unsigned_long_long__unsigned_char_const__unsigned_char_
jmp 0x140044880
Function at 0x140045d60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
movups xmmword [rsp], xmm6
movups xmmword [rsp + 0x10], xmm7
movups xmmword [rsp + 0x20], xmm8
movups xmmword [rsp + 0x30], xmm9
movdqu xmm5, xmmword [rcx]
pshufb xmm5, xmmword [0x140366db0]
movdqa xmm3, xmm5
lea r9d, [r8 - 0x20]
cmp r8d, 0x20
je 0x140045f90
movdqu xmm4, xmmword [0x140366dc0]
movdqa xmm1, xmm5
xor eax, eax
nop word cs:[rax + rax]
movdqa xmm6, xmm1
movdqa xmm8, xmm1
movdqa xmm7, xmm1
mov ecx, eax
pclmulqdq xmm6, xmm3, 0
pclmulqdq xmm8, xmm3, 0x10
pclmulqdq xmm7, xmm3, 1
add eax, 0x20
movdqa xmm9, xmm6
movdqa xmm2, xmm6
pxor xmm7, xmm8
movq qword [rdx + rcx], xmm1
pslldq xmm9, 8
pclmulqdq xmm2, xmm4, 0x10
movdqa xmm0, xmm1
pxor xmm2, xmm9
psrldq xmm6, 8
pclmulqdq xmm0, xmm3, 0x11
pxor xmm2, xmm7
pxor xmm6, xmm2
movdqa xmm7, xmm2
psllq xmm6, 1
psrldq xmm7, 8
pclmulqdq xmm6, xmm4, 0
pxor xmm0, xmm6
pxor xmm0, xmm7
punpcklqdq xmm2, xmm0
psllq xmm0, 1
psrlq xmm2, 0x3f
pxor xmm0, xmm2
movdqa xmm2, xmm0
movups xmmword [rdx + rcx + 0x10], xmm0
lea rcx, [rdx + rcx + 8]
movdqa xmm8, xmm0
pclmulqdq xmm2, xmm3, 0
movups xmmword [rcx], xmm1
movdqa xmm1, xmm0
pclmulqdq xmm8, xmm3, 0x10
movdqa xmm7, xmm2
movdqa xmm6, xmm2
pclmulqdq xmm1, xmm3, 1
movq qword [rcx], xmm0
pslldq xmm7, 8
pclmulqdq xmm6, xmm4, 0x10
pxor xmm1, xmm8
pxor xmm6, xmm7
psrldq xmm2, 8
pclmulqdq xmm0, xmm3, 0x11
pxor xmm1, xmm6
pxor xmm2, xmm1
movdqa xmm6, xmm1
psllq xmm2, 1
psrldq xmm6, 8
pclmulqdq xmm2, xmm4, 0
pxor xmm0, xmm2
pxor xmm0, xmm6
punpcklqdq xmm1, xmm0
psllq xmm0, 1
psrlq xmm1, 0x3f
pxor xmm1, xmm0
cmp eax, r9d
jb 0x140045db0
lea r9, [rdx + rax]
lea r8, [rax + 0x10]
add rax, 8
movdqa xmm3, xmm1
movdqa xmm7, xmm1
movdqa xmm2, xmm1
movq qword [r9], xmm1
pclmulqdq xmm3, xmm5, 0
movdqa xmm0, xmm1
pclmulqdq xmm7, xmm5, 0x10
pclmulqdq xmm2, xmm5, 1
pclmulqdq xmm0, xmm5, 0x11
movdqa xmm6, xmm3
movdqa xmm5, xmm3
pslldq xmm6, 8
pxor xmm2, xmm7
pclmulqdq xmm5, xmm4, 0x10
psrldq xmm3, 8
pxor xmm5, xmm6
pxor xmm2, xmm5
pxor xmm3, xmm2
psllq xmm3, 1
pclmulqdq xmm3, xmm4, 0
movdqa xmm4, xmm2
psrldq xmm4, 8
pxor xmm0, xmm3
pxor xmm0, xmm4
punpcklqdq xmm2, xmm0
psllq xmm0, 1
psrlq xmm2, 0x3f
pxor xmm0, xmm2
movups xmmword [rdx + r8], xmm0
add rdx, rax
movups xmmword [rdx], xmm1
movq qword [rdx], xmm0
movups xmm6, xmmword [rsp]
movups xmm7, xmmword [rsp + 0x10]
movups xmm8, xmmword [rsp + 0x20]
movups xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movdqu xmm4, xmmword [0x140366dc0]
mov r9, rdx
movdqa xmm1, xmm5
mov eax, 8
mov r8d, 0x10
jmp 0x140045ee1
Function at 0x1400468a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x140387e50]
cmp byte [rax], 0
mov rbx, rcx
mov rsi, rdx
je 0x140046900
mov rax, qword [0x140387e00]
cmp byte [rax], 0
jne 0x1400468d8
mov rdx, rsi
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp method.CryptoPP::GF2NT.Multiply_CryptoPP::PolynomialMod2_const__CryptoPP::PolynomialMod2_const__const
mov rdx, qword [r8 + 0x18]
mov rcx, qword [rsi + 0x18]
mov r8, qword [rbx + 0xb8]
call method.CryptoPP.GF2NT_233_Multiply_Reduce_CLMUL_unsigned_long_long_const__unsigned_long_long_const__unsigned_long_long_
lea rax, [rbx + 0xa0]
add rsp, 0x38
pop rbx
pop rsi
ret
mov qword [rsp + 0x28], r8
call method.CryptoPP.DetectX86Features__
mov r8, qword [rsp + 0x28]
jmp 0x1400468b8
Function at 0x140047c70
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx + 0x10]
test r8, r8
je 0x140047ce0
mov r9, qword [rcx + 0x18]
xor edx, edx
xor ecx, ecx
xor eax, eax
nop dword [rax + rax]
xor rcx, qword [r9 + rax*8]
lea eax, [rdx + 1]
mov rdx, rax
cmp rax, r8
jb 0x140047c88
mov rdx, rcx
shr rdx, 0x20
xor rdx, rcx
mov rax, rdx
shr rax, 0x10
xor rax, rdx
mov rdx, rax
shr rdx, 8
xor rdx, rax
mov rax, rdx
shr rax, 4
xor rdx, rax
mov rax, rdx
shr rax, 2
xor rdx, rax
mov rax, rdx
shr rax, 1
xor rax, rdx
and eax, 1
ret
xor ecx, ecx
jmp 0x140047c97