joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001111d
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x140014950
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x158]
mov rax, qword [0x140025028]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x14002b0f5]
call fcn.140011591
mov dword [rbp + 4], 0
xor eax, eax
mov word [rbp + 0xe4], ax
xor eax, eax
mov word [rbp + 0xe6], ax
mov eax, dword [rbp + 0x130]
imul eax, dword [rbp + 0x138]
lea rcx, [rbp + 4]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0xe4]
mov r8d, eax
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
lea rcx, [rbp - 0x30]
lea rdx, [0x140020f90]
call fcn.1400114d8
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.1400112da
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x14001133e
Capabilities:
Terminate process

Disassembly:
jmp 0x140019600
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011406
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400184b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400184d0
xor al, al
jmp 0x140018551
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400184e3
xor al, al
jmp 0x140018551
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001850d
xor al, al
jmp 0x140018551
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018521
xor al, al
jmp 0x140018551
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018533
xor al, al
jmp 0x140018551
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001854f
xor al, al
jmp 0x140018551
mov al, 1
add rsp, 0x38
ret
Function at 0x140025cb0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.14002a700
sub rsp, rax
mov rax, qword [0x140069380]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140025d72
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.1400395dc
cmp rax, 1
jne 0x140025dce
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x140025d4f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140025d43
cmp rcx, 1
jb 0x140025dce
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140025d10
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140025da3
lea rcx, [rsp + 0x80]
call fcn.14003c208
jmp 0x140025da5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.14002a430
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140039388
int3
Function at 0x140027050
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14006af96], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x1400270d5
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x14006af60], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x14006af60], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x14006af60], rdx
call fcn.140024a10
cmp eax, ebx
jne 0x14002723d
mov byte [0x14006af96], 1
lea rdx, [0x14004b480]
mov rcx, rsi
call fcn.14003b080
test eax, eax
je 0x140027160
cmp byte [0x14006af95], 1
je 0x140027160
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14006bd00], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14006bd08], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14006bd10], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14006bd18], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14006bd20], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14006bd28], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14006bd30], rax
call qword [sym.imp.python312.dll_PyDict_New]
mov qword [0x14006bd38], rax
mov byte [0x14006af95], 1
mov r8, qword [0x14006af60]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x140027187
inc rax
test cl, cl
jne 0x140027170
mov ecx, r9d
jmp 0x14002718c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x140027193
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x1400271f8
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x1400271d5
inc rax
test cl, cl
jne 0x1400271c0
mov ecx, r9d
jmp 0x1400271da
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x1400271e1
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x1400271b0
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x140027228
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1400230e0
add rdi, 8
sub rbx, 1
jne 0x140027210
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.140035dc4
call fcn.140039388
int3
Function at 0x140029fa0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140069380]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x14002a051
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.1400395dc
cmp rax, 1
jne 0x14002a087
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14002a02d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14002a020
cmp rcx, 1
jb 0x14002a087
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140029ff0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14002a430
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140039388
int3

Function at 0x14002a2b0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140069380]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x14002a35f
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.1400395dc
cmp rax, 1
jne 0x14002a395
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14002a33c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x14002a330
cmp rcx, 1
jb 0x14002a395
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14002a300
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14002a430
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140039388
int3

Function at 0x14002ae64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002aeae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002aeae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002aeae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002aeae
cmp dword [rcx + 0x84], 0xe
jbe 0x14002aeae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002aeb0
xor al, al
add rsp, 0x28
ret
Function at 0x14002f1d4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002f243
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002f243
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002f243
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002f243
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002f243
cmp dword [rcx + 0x84], 0xe
jbe 0x14002f243
cmp dword [rcx + 0xf8], 0
je 0x14002f243
mov ecx, ebx
call fcn.14002f2f4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002f0d0
nop
cmp dword [rbp + 0x20], 0
je 0x14002f291
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002f29c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002f1d4

Function at 0x14002f3d8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002f243
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002f243
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002f243
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002f243
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002f243
cmp dword [rcx + 0x84], 0xe
jbe 0x14002f243
cmp dword [rcx + 0xf8], 0
je 0x14002f243
mov ecx, ebx
call fcn.14002f2f4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002f0d0
nop
cmp dword [rbp + 0x20], 0
je 0x14002f291
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14002f29c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002f1d4
Function at 0x140041160
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400411e7
mov rsi, rbx
cmp word [rax], bp
je 0x1400411a6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140041190
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14004118c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14003c2f4
mov rdi, rax
test rax, rax
je 0x1400411d4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400474e0
mov rbp, rdi
xor ecx, ecx
call fcn.14003d228
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400438ec
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140043902
mov al, 1
jmp 0x140043962
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140043913
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140043960
mov ecx, dword [rcx + 0x18]
nop
call fcn.140041904
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140043960
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140043960
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140043960
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140043962
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400472c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400472e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400472e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000d300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x14004d7d0]
aeskeygenassist xmm1, xmm0, 1
pshufd xmm1, xmm1, 0xff
pxor xmm1, xmmword [0x14004d7e0]
aeskeygenassist xmm2, xmm1, 2
pshufd xmm3, xmm2, 0xff
movdqa xmm4, xmm1
pslldq xmm4, 4
movdqa xmm5, xmm1
pslldq xmm5, 8
movdqa xmm2, xmm1
pslldq xmm2, 0xc
pxor xmm2, xmm4
pxor xmm2, xmm5
pxor xmm2, xmm1
pxor xmm2, xmm3
aeskeygenassist xmm3, xmm2, 4
pshufd xmm4, xmm3, 0xff
movdqa xmm5, xmm2
pslldq xmm5, 4
movdqa xmm6, xmm2
pslldq xmm6, 8
movdqa xmm3, xmm2
pslldq xmm3, 0xc
pxor xmm3, xmm5
pxor xmm3, xmm6
pxor xmm3, xmm2
pxor xmm3, xmm4
aeskeygenassist xmm4, xmm3, 8
pshufd xmm5, xmm4, 0xff
movdqa xmm6, xmm3
pslldq xmm6, 4
movdqa xmm7, xmm3
pslldq xmm7, 8
movdqa xmm4, xmm3
pslldq xmm4, 0xc
pxor xmm4, xmm6
pxor xmm4, xmm7
pxor xmm4, xmm3
pxor xmm4, xmm5
aeskeygenassist xmm5, xmm4, 0x10
pshufd xmm6, xmm5, 0xff
movdqa xmm7, xmm4
pslldq xmm7, 4
movdqa xmm8, xmm4
pslldq xmm8, 8
movdqa xmm5, xmm4
pslldq xmm5, 0xc
pxor xmm5, xmm7
pxor xmm5, xmm8
pxor xmm5, xmm4
pxor xmm5, xmm6
aeskeygenassist xmm6, xmm5, 0x20
pshufd xmm7, xmm6, 0xff
movdqa xmm8, xmm5
pslldq xmm8, 4
movdqa xmm9, xmm5
pslldq xmm9, 8
movdqa xmm6, xmm5
pslldq xmm6, 0xc
pxor xmm6, xmm8
pxor xmm6, xmm9
pxor xmm6, xmm5
pxor xmm6, xmm7
aeskeygenassist xmm7, xmm6, 0x40
pshufd xmm8, xmm7, 0xff
movdqa xmm9, xmm6
pslldq xmm9, 4
movdqa xmm10, xmm6
pslldq xmm10, 8
movdqa xmm7, xmm6
pslldq xmm7, 0xc
pxor xmm7, xmm9
pxor xmm7, xmm10
pxor xmm7, xmm6
pxor xmm7, xmm8
aeskeygenassist xmm8, xmm7, 0x80
pshufd xmm9, xmm8, 0xff
movdqa xmm10, xmm7
pslldq xmm10, 4
movdqa xmm11, xmm7
pslldq xmm11, 8
movdqa xmm8, xmm7
pslldq xmm8, 0xc
pxor xmm8, xmm10
pxor xmm8, xmm11
pxor xmm8, xmm7
pxor xmm8, xmm9
aeskeygenassist xmm9, xmm8, 0x1b
pshufd xmm10, xmm9, 0xff
movdqa xmm11, xmm8
pslldq xmm11, 4
movdqa xmm12, xmm8
pslldq xmm12, 8
movdqa xmm9, xmm8
pslldq xmm9, 0xc
pxor xmm9, xmm11
pxor xmm9, xmm12
pxor xmm9, xmm8
pxor xmm9, xmm10
aeskeygenassist xmm10, xmm9, 0x36
pshufd xmm10, xmm10, 0xff
movdqa xmm11, xmm9
pslldq xmm11, 4
movdqa xmm12, xmm9
pslldq xmm12, 8
movdqa xmm13, xmm9
pslldq xmm13, 0xc
pxor xmm13, xmm11
pxor xmm13, xmm12
pxor xmm13, xmm9
pxor xmm13, xmm10
movdqa xmmword [rcx], xmm0
movdqa xmmword [rcx + 0x10], xmm1
movdqa xmmword [rcx + 0x20], xmm2
movdqa xmmword [rcx + 0x30], xmm3
movdqa xmmword [rcx + 0x40], xmm4
movdqa xmmword [rcx + 0x50], xmm5
movdqa xmmword [rcx + 0x60], xmm6
movdqa xmmword [rcx + 0x70], xmm7
movdqa xmmword [rcx + 0x80], xmm8
movdqa xmmword [rcx + 0x90], xmm9
movdqa xmmword [rcx + 0xa0], xmm13
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000db90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14000dbd2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14000dbda
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000dbeb
jmp 0x14000dc02
xor r10d, r10d
jmp 0x14000dc8d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14000dc02
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14000dc19
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14000dc39
add r11, r8
jmp 0x14000dd6b
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14000dd02
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14000dcb0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14000dd20
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14000dd32
jmp 0x14000dd4d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000dd4d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14000dd67
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000df10
Capabilities:
Encrypt data using salsa20 or chacha
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x14000df63
mov ebx, eax
lea rcx, [rsp + 0x20]
mov edx, 0x20
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x14000dfb3
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [0x1400ddbe0]
test rax, rax
je 0x14000dfe9
lea rbx, [rsp + 0x70]
test eax, 0x4000
jne 0x14000dffa
movaps xmm0, xmmword [rsp + 0x40]
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
jmp 0x14000e00e
and ebx, 0x7fffffff
je 0x14000df63
movzx eax, byte [0x1400ddbf0]
mov edx, 4
xor ecx, ecx
call fcn.1400360e0
test rax, rax
je 0x14000e050
mov dword [rax], ebx
mov rcx, qword [0x1400ddb68]
xor edx, edx
mov r8, rax
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14000e024
call fcn.14004bc20
lea rbx, [rsp + 0x70]
test eax, 0x4000
je 0x14000df8f
lea r8, [0x1400c86e0]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400160e0
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.140013e40
mov ecx, 4
mov edx, 4
call fcn.1400493b0
int3
Function at 0x140010f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140010f90
cmp r10, r11
jb 0x140011007
cmp r10, rdx
ja 0x140011019
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140010f92
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140010f70
jmp 0x140010ff4
ja 0x140010f9a
mov r11, r10
cmp rax, r8
jne 0x140010f3e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140010fd0
mov rdi, r8
sub ecx, edx
jns 0x140010feb
jmp 0x140010ff6
cmp r8, rsi
je 0x140011028
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140010ff6
xor al, 1
cmp rdi, rsi
jne 0x140010fb0
jmp 0x140010ff6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.0B_f_
mov rcx, r11
mov rdx, r10
call fcn.14004a1c0
lea r8, str.0B_f_
mov rcx, r10
call fcn.140049e80
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14004a230
int3
Function at 0x140012410
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
movaps xmm9, xmmword [rdx]
movaps xmm10, xmmword [rdx + 0xa0]
movaps xmmword [rcx], xmm9
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movaps xmmword [rcx + 0xa0], xmm10
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret