joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140044140
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400e0818]
mov dword [rsp + 0x88], edi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140044171
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400e0718]
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov r9d, 0x28
mov eax, dword [0x1400e0710]
mov edx, 0x3b2c22c
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x61], edi
mov word [rsp + 0x65], di
mov byte [rsp + 0x67], dil
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], 4
mov byte [rsp + 0x60], dil
mov qword [rsp + 0x20], rdi
call qword [0x1400e0b38]
mov eax, dword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x1400453e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140045441
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140045400
mov ecx, dword [r9]
jmp 0x140045528
cmp ecx, 0x4e0
jb 0x140045528
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140045460
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400454b0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400461fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140046246
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140046246
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140046246
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140046246
cmp dword [rcx + 0x84], 0xe
jbe 0x140046246
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140046248
xor al, al
add rsp, 0x28
ret
Function at 0x140270510
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10088
call fcn.1402a4e30
sub rsp, rax
mov rax, qword [0x1402ea9a8]
xor rax, rsp
mov qword [rsp + 0x10070], rax
xor eax, eax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.14029f8a0
mov r8d, 0x10000
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14027058d
lea rcx, [rsp + 0x70]
call fcn.1402b7024
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.1402a4e00
add rsp, 0x10088
ret
xor eax, eax
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.1402a4e00
add rsp, 0x10088
ret

Function at 0x140270640
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1402ea9a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [0x1402c6858]
call fcn.140270510
xor edi, edi
mov qword [0x140300d98], rax
lea rdx, [0x1402c6858]
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x20]
lea r8d, [rdi + 0x28]
call fcn.14029f8a0
lea rdx, [0x1402c6860]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.PYTHONHOME
call fcn.140270510
mov cl, 1
mov qword [0x140300da0], rax
call fcn.1402a0a50
lea r8d, [rdi + 0x28]
mov word [rsp + 0x20], di
lea rdx, str.PYTHONHOME
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14029f8a0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov cl, 1
call fcn.1402a0a50
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402a4e00
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x140270bd0
Capabilities:
Set environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1402ea9a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rsi, rdx
mov rbp, rcx
call fcn.140287c50
lea rdx, str.environ
mov rcx, rax
call qword [sym.imp.python311.dll_PyObject_GetAttrString]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.python311.dll_PyUnicode_FromString]
mov rdx, rsi
lea rcx, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.14029f8a0
lea rcx, [rsp + 0x20]
test r14, r14
je 0x140270c93
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, r14
call sub.python311.dll_PyUnicode_FromWideChar
mov r8, rax
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.python311.dll_PyObject_SetItem]
test eax, eax
je 0x140270c81
mov ecx, 1
call qword [sym.imp.python311.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python311.dll_Py_Exit]
int3
sub qword [rsi], 1
jne 0x140270cb3
mov rax, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140270cb3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.python311.dll_PyObject_DelItem]
test eax, eax
je 0x140270cb3
mov rcx, rbp
call fcn.140001510
sub qword [rdi], 1
jne 0x140270cc3
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
sub qword [rbx], 1
jne 0x140270cd3
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402a4e00
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14029f950
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
test edx, edx
je 0x14029fa14
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub r9, 1
jne 0x14029f970
not eax
ret
Function at 0x1402a5844
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402a588e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402a588e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402a588e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402a588e
cmp dword [rcx + 0x84], 0xe
jbe 0x1402a588e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1402a5890
xor al, al
add rsp, 0x28
ret

Function at 0x1402aa828
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1402aa693
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402aa693
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402aa693
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402aa693
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402aa693
cmp dword [rcx + 0x84], 0xe
jbe 0x1402aa693
cmp dword [rcx + 0xf8], 0
je 0x1402aa693
mov ecx, ebx
call fcn.1402aa744
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1402aa520
nop
cmp dword [rbp + 0x20], 0
je 0x1402aa6e1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1402aa6ec
int3
xor r8d, r8d
xor edx, edx
jmp 0x1402aa624
Function at 0x1402bc290
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1402bc317
mov rsi, rbx
cmp word [rax], bp
je 0x1402bc2d6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1402bc2c0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1402bc2bc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1402b7810
mov rdi, rax
test rax, rax
je 0x1402bc304
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1402a5b70
mov rbp, rdi
xor ecx, ecx
call fcn.1402b8358
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1402bfe8c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1402bfea2
mov al, 1
jmp 0x1402bff02
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1402bfeb3
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1402bff00
mov ecx, dword [rcx + 0x18]
nop
call fcn.1402bca34
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1402bff00
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1402bff00
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1402bff00
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1402bff02
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140001da0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140001de2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x140001dea
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140001dfb
jmp 0x140001e12
xor r10d, r10d
jmp 0x140001e9d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140001e12
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140001e29
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140001e49
add r11, r8
jmp 0x140001f7a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140001f12
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140001ec0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140001f30
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140001f42
jmp 0x140001f5c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140001f5c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140001f76
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400140c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
mov r11, qword [rdx + 0x20]
mov r10, qword [rdx + 0x28]
lea rcx, [r10 + 1]
mov qword [rdx + 0x28], rcx
mov al, 1
cmp rcx, r11
jae 0x140014102
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + rcx]
mov al, 1
cmp edi, 0x2b
je 0x1400140f7
cmp edi, 0x2d
jne 0x140014102
xor eax, eax
add r10, 2
mov qword [rdx + 0x28], r10
mov rcx, r10
cmp rcx, r11
jae 0x1400142aa
mov rdi, qword [rdx + 0x18]
movzx r10d, byte [rdi + rcx]
lea rbx, [rcx + 1]
mov qword [rdx + 0x28], rbx
add r10b, 0xd0
cmp r10b, 0xa
jae 0x1400142b5
movzx r10d, r10b
cmp rbx, r11
jae 0x1400141b0
mov ebx, 1
sub rbx, r11
add rcx, 2
jmp 0x14001416c
movzx r11d, r11b
lea r10d, [r10 + r10*4]
lea r10d, [r11 + r10*2]
lea r11, [rbx + rcx]
inc r11
inc rcx
cmp r11, 2
je 0x1400141b0
movzx r11d, byte [rdi + rcx - 1]
add r11b, 0xd0
cmp r11b, 0xa
jae 0x1400141b0
mov qword [rdx + 0x28], rcx
cmp r10d, 0xccccccb
jle 0x140014150
cmp r10d, 0xccccccc
jne 0x140014198
cmp r11b, 7
jbe 0x140014150
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
mov rcx, rsi
call fcn.1402685a0
jmp 0x140014297
mov ecx, dword [rsp + 0x80]
test al, al
je 0x1400141cc
lea eax, [rcx + r10]
sar eax, 0x1f
add eax, 0x80000000
add ecx, r10d
jmp 0x1400141dc
xor eax, eax
cmp ecx, r10d
setns al
add eax, 0x7fffffff
sub ecx, r10d
cmovo ecx, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x140277c10]
subpd xmm1, xmmword [0x140277c20]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x135
jb 0x140014248
xorpd xmm1, xmm1
movsd xmm2, qword [0x140277c30]
nop word [rax + rax]
ucomisd xmm0, xmm1
jne 0x140014228
jnp 0x140014280
test ecx, ecx
jns 0x1400142db
divsd xmm0, xmm2
add ecx, 0x134
mov eax, ecx
neg eax
cmovs eax, ecx
cmp eax, 0x134
ja 0x140014220
mov eax, eax
mov r9, qword [0x14031b5d8]
movsd xmm1, qword [r9 + rax*8]
test ecx, ecx
js 0x14001429f
mulsd xmm0, xmm1
movq rax, xmm0
movabs rcx, 0x7fffffffffffffff
and rcx, rax
movabs rax, 0x7ff0000000000000
cmp rcx, rax
je 0x1400142db
test r8b, r8b
jne 0x14001428d
xorpd xmm0, xmmword [0x140277c40]
movsd qword [rsi + 8], xmm0
xor eax, eax
mov qword [rsi], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x140014285
jmp 0x14001428d
mov qword [rsp + 0x28], 5
jmp 0x1400142be
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.140268640
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140014297
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rcx, rdx
mov rdx, rax
call fcn.140268640
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140014294
Function at 0x140018620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x1400191d0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0xb8
movdqa xmmword [rsp + 0xa0], xmm15
movdqa xmmword [rsp + 0x90], xmm14
movdqa xmmword [rsp + 0x80], xmm13
movdqa xmmword [rsp + 0x70], xmm12
movdqa xmmword [rsp + 0x60], xmm11
movdqa xmmword [rsp + 0x50], xmm10
movdqa xmmword [rsp + 0x40], xmm9
movdqa xmmword [rsp + 0x30], xmm8
movdqa xmmword [rsp + 0x20], xmm7
movdqa xmmword [rsp + 0x10], xmm6
mov rax, qword [rdx + 0x18]
test rax, rax
je 0x140019330
mov r8, qword [rdx]
mov r9, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
movdqa xmm0, xmmword [rcx]
movdqa xmmword [rsp], xmm0
movdqa xmm1, xmmword [rcx + 0x10]
movdqa xmm2, xmmword [rcx + 0x20]
movdqa xmm3, xmmword [rcx + 0x30]
movdqa xmm4, xmmword [rcx + 0x40]
movdqa xmm5, xmmword [rcx + 0x50]
movdqa xmm6, xmmword [rcx + 0x60]
movdqa xmm7, xmmword [rcx + 0x70]
movdqa xmm8, xmmword [rcx + 0x80]
movdqa xmm9, xmmword [rcx + 0x90]
movdqa xmm10, xmmword [rcx + 0xa0]
movdqa xmm11, xmmword [rcx + 0xb0]
movdqa xmm12, xmmword [rcx + 0xc0]
movdqa xmm13, xmmword [rcx + 0xd0]
movdqa xmm14, xmmword [rcx + 0xe0]
nop word [rax + rax]
movdqu xmm0, xmmword [r9]
movdqu xmm15, xmmword [r8]
pxor xmm15, xmm0
pxor xmm15, xmmword [rsp]
aesenc xmm15, xmm1
aesenc xmm15, xmm2
aesenc xmm15, xmm3
aesenc xmm15, xmm4
aesenc xmm15, xmm5
aesenc xmm15, xmm6
aesenc xmm15, xmm7
aesenc xmm15, xmm8
aesenc xmm15, xmm9
aesenc xmm15, xmm10
aesenc xmm15, xmm11
aesenc xmm15, xmm12
aesenc xmm15, xmm13
aesenclast xmm15, xmm14
movdqu xmmword [r8], xmm15
movdqu xmmword [rdx], xmm15
add rdx, 0x10
add r9, 0x10
dec rax
jne 0x1400192b0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
add rsp, 0xb8
ret
Function at 0x140019830
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rcx
lea rax, [rcx + 0x3c0]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x88], xmm0
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x98], rax
mov rax, qword [0x14031b5c8]
movzx eax, byte [rax]
cmp al, 1
jne 0x140019897
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1400191d0
jmp 0x140019a7c
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x140019a7c
mov rcx, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
xorps xmm6, xmm6
nop dword [rax + rax]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rax
movups xmm0, xmmword [rcx]
xorps xmm0, xmmword [rsi + 0x3c0]
lea rax, [rsp + 0xb0]
movaps xmmword [rax + 0x20], xmm6
movaps xmmword [rax + 0x10], xmm6
movaps xmmword [rax], xmm6
movaps xmmword [rsp + 0xa0], xmm0
lea rcx, [rsp + 0x30]
mov rdx, rsi
lea r8, [rsp + 0xa0]
call fcn.140147740
movzx ecx, byte [rsp + 0x30]
movzx r14d, byte [rsp + 0x31]
movzx edx, byte [rsp + 0x32]
mov byte [rsp + 0x2d], dl
movzx r8d, byte [rsp + 0x33]
mov byte [rsp + 0x2b], r8b
movzx r9d, byte [rsp + 0x34]
mov byte [rsp + 0x29], r9b
movzx eax, byte [rsp + 0x35]
mov byte [rsp + 0x2e], al
movzx r11d, byte [rsp + 0x36]
movzx ebp, byte [rsp + 0x37]
movzx edi, byte [rsp + 0x38]
movzx ebx, byte [rsp + 0x39]
movzx r13d, byte [rsp + 0x3a]
movzx eax, byte [rsp + 0x3b]
movzx r15d, byte [rsp + 0x3c]
movzx r10d, byte [rsp + 0x3d]
mov byte [rsp + 0x2f], r10b
movzx r10d, byte [rsp + 0x3e]
mov byte [rsp + 0x2c], r10b
movzx r10d, byte [rsp + 0x3f]
mov byte [rsp + 0x2a], r10b
mov byte [rsi + 0x3c0], cl
mov byte [rsi + 0x3c1], r14b
mov byte [rsi + 0x3c2], dl
mov byte [rsi + 0x3c3], r8b
mov byte [rsi + 0x3c4], r9b
movzx r10d, byte [rsp + 0x2e]
mov byte [rsi + 0x3c5], r10b
mov byte [rsi + 0x3c6], r11b
mov byte [rsi + 0x3c7], bpl
mov byte [rsi + 0x3c8], dil
mov byte [rsi + 0x3c9], bl
mov byte [rsi + 0x3ca], r13b
mov byte [rsi + 0x3cb], al
mov byte [rsi + 0x3cc], r15b
movzx edx, byte [rsp + 0x2f]
mov byte [rsi + 0x3cd], dl
movzx r8d, byte [rsp + 0x2c]
mov byte [rsi + 0x3ce], r8b
movzx r9d, byte [rsp + 0x2a]
mov byte [rsi + 0x3cf], r9b
mov byte [r12], cl
mov rcx, qword [rsp + 0x70]
mov byte [r12 + 1], r14b
movzx r14d, byte [rsp + 0x2d]
mov byte [r12 + 2], r14b
movzx r14d, byte [rsp + 0x2b]
mov byte [r12 + 3], r14b
movzx r14d, byte [rsp + 0x29]
mov byte [r12 + 4], r14b
mov byte [r12 + 5], r10b
mov byte [r12 + 6], r11b
mov byte [r12 + 7], bpl
mov byte [r12 + 8], dil
mov byte [r12 + 9], bl
mov byte [r12 + 0xa], r13b
mov byte [r12 + 0xb], al
mov rax, qword [rsp + 0x78]
mov byte [r12 + 0xc], r15b
mov byte [r12 + 0xd], dl
mov byte [r12 + 0xe], r8b
mov byte [r12 + 0xf], r9b
add r12, 0x10
add rcx, 0x10
dec rax
jne 0x1400198c0
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret