joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006b480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140005783
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.14000b2c0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x140005760
cmp byte [0x14023c92d], 0
je 0x14006b495
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x1400686c0
jmp 0x140005760

Function at 0x14006b4a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14000b721
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.14000b7e0
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x14023cc20]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.14000b7c0
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
call fcn.14000b7c0
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x14000b6c0
cmp byte [0x14023c92d], 0
je 0x14006b4d5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x14023cf40]
aesenc xmm0, xmmword [0x14023cf50]
aesenc xmm0, xmmword [0x14023cf60]
movq rax, xmm0
ret
jmp 0x14000b6c0

Function at 0x14006b4e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14000b7a1
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.14000b820
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x14023cc20]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.14000b7c0
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
call fcn.14000b7c0
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140069680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x14000b740
cmp byte [0x14023c92d], 0
je 0x14006b516
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x14023cf40]
aesenc xmm0, xmmword [0x14023cf50]
aesenc xmm0, xmmword [0x14023cf60]
movq rax, xmm0
ret
jmp 0x14000b740
Function at 0x140097de0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x140097f92
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
nop dword [rax]
call fcn.140004c00
xorps xmm15, xmm15
mov r14, qword [0x14023cb48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x140097e69
jmp 0x140097eb2
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x140127fe8]
mov qword [rsp + 0x48], rdx
lea rdx, [0x1401277c8]
mov qword [rsp + 0x50], rdx
mov rdi, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
add rsp, 0xa0
pop rbp
ret
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rcx
inc rcx
lea rax, [0x1400fbba0]
xor ebx, ebx
call fcn.1400508a0
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
inc rsi
mov qword [rsp + 0x80], rsi
mov rdx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xb8]
mov rcx, rax
xor edi, edi
mov rax, rdx
call fcn.140099be0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
inc rbx
cmp rcx, rbx
jae 0x140097f27
jmp 0x140097f29
jmp 0x140097f3c
mov edi, 1
lea rsi, [0x1400fbba0]
call fcn.140050960
jmp 0x140097f3c
lea rdx, [rax + rbx*2]
lea rdx, [rdx - 2]
mov word [rdx], 0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor edi, edi
xor esi, esi
add rsp, 0xa0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call fcn.140069680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140097de0
Function at 0x1400cbc20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400cbd4e
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x98], r10
mov qword [rsp + 0xa0], r11
mov qword [rsp + 0x20], 0
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], r10
cmp r10, rcx
jl 0x1400cbc90
jmp 0x1400cbca0
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x28], rcx
jmp 0x1400cbca2
jmp 0x1400cbca2
cmp qword [rsp + 0x28], 0
je 0x1400cbcac
jmp 0x1400cbcbd
mov qword [rsp + 0x20], 0
xor eax, eax
add rsp, 0x50
pop rbp
ret
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x30], rcx
cmp qword [rsp + 0x28], rcx
jg 0x1400cbd3a
jmp 0x1400cbcd0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov qword [rsp], rbx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rcx
call fcn.1400cbdc0
xorps xmm15, xmm15
mov r14, qword [0x14023cb48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
add rsp, 0x50
pop rbp
ret
lea rax, [0x1400fbaa0]
lea rbx, [0x140127ef0]
call fcn.14003be40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
nop dword [rax + rax]
call fcn.140069680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.1400cbc20

Function at 0x1400cbdc0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x1400cbe3a
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x1400cbdf0
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x1400cbe10
cmp rdx, 0
je 0x1400cbe5c
test rdx, 0xf
je 0x1400cbddd
test rdx, 7
jne 0x1400cbe10
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x1400cbddd
ret
Function at 0x1400cd2c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov dword [rsp + 0x18], eax
mov dword [rsp + 4], 0
mov ecx, eax
shr eax, 0x18
lea rdx, str.cw
add rdx, rax
movzx eax, byte [rdx]
shl eax, 0x18
mov edx, ecx
shr ecx, 0x10
movzx ecx, cl
lea rbx, str.cw
add rcx, rbx
movzx ecx, byte [rcx]
shl ecx, 0x10
or eax, ecx
mov ecx, edx
shr edx, 8
movzx edx, dl
lea rbx, str.cw
add rdx, rbx
movzx edx, byte [rdx]
shl edx, 8
or eax, edx
movzx ecx, cl
lea rdx, str.cw
add rcx, rdx
movzx ecx, byte [rcx]
or eax, ecx
mov dword [rsp + 4], eax
add rsp, 8
pop rbp
ret
Function at 0x1400ce760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x1400ce79f
jb 0x1400ce7b4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x1400ce820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x1400ce8f4
jb 0x1400ce953
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.1400ce700
aeskeygenassist xmm1, xmm0, 1
call fcn.1400ce720
aeskeygenassist xmm1, xmm2, 2
call fcn.1400ce700
aeskeygenassist xmm1, xmm0, 2
call fcn.1400ce720
aeskeygenassist xmm1, xmm2, 4
call fcn.1400ce700
aeskeygenassist xmm1, xmm0, 4
call fcn.1400ce720
aeskeygenassist xmm1, xmm2, 8
call fcn.1400ce700
aeskeygenassist xmm1, xmm0, 8
call fcn.1400ce720
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1400ce700
aeskeygenassist xmm1, xmm0, 0x10
call fcn.1400ce720
aeskeygenassist xmm1, xmm2, 0x20
call fcn.1400ce700
aeskeygenassist xmm1, xmm0, 0x20
call fcn.1400ce720
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1400ce700
jmp 0x1400ce9c1
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.1400ce660
aeskeygenassist xmm1, xmm2, 2
call fcn.1400ce6c0
aeskeygenassist xmm1, xmm2, 4
call fcn.1400ce660
aeskeygenassist xmm1, xmm2, 8
call fcn.1400ce6c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1400ce660
aeskeygenassist xmm1, xmm2, 0x20
call fcn.1400ce6c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1400ce660
aeskeygenassist xmm1, xmm2, 0x80
call fcn.1400ce6c0
jmp 0x1400ce9c1
aeskeygenassist xmm1, xmm0, 1
call fcn.1400ce620
aeskeygenassist xmm1, xmm0, 2
call fcn.1400ce620
aeskeygenassist xmm1, xmm0, 4
call fcn.1400ce620
aeskeygenassist xmm1, xmm0, 8
call fcn.1400ce620
aeskeygenassist xmm1, xmm0, 0x10
call fcn.1400ce620
aeskeygenassist xmm1, xmm0, 0x20
call fcn.1400ce620
aeskeygenassist xmm1, xmm0, 0x40
call fcn.1400ce620
aeskeygenassist xmm1, xmm0, 0x80
call fcn.1400ce620
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.1400ce620
aeskeygenassist xmm1, xmm0, 0x36
call fcn.1400ce620
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x1400ce9ce
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x1400cf3e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400cf51b
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x1400cf41b
jmp 0x1400cf43d
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.1400773e0
mov qword [rsp + 0x48], rax
inc rax
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x48], rdi
cmp rdi, 1
je 0x1400cf44a
jmp 0x1400cf499
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax]
mov byte [rsp + 0x27], al
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], al
call fcn.140004580
xorps xmm15, xmm15
mov r14, qword [0x14023cb48]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x30], 0
jmp 0x1400cf4a4
jmp 0x1400cf4a6
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
call fcn.1400d0340
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x1400cf4cc
jmp 0x1400cf4dc
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
inc qword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rdx
add rdx, rax
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x68]
sub rsi, rdx
mov r8, rsi
neg rsi
sar rsi, 0x3f
and rdx, rsi
add rdx, qword [rsp + 0x60]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
jmp 0x1400cf519
jmp 0x1400cf4a4
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140069680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.1400cf3e0
Function at 0x1400d48e0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x18], rax
mov byte [rsp + 0x20], bl
mov qword [rsp], 0
movzx ecx, byte [rsp + 0x20]
xor rax, rcx
mov qword [rsp + 0x18], rax
movabs rcx, 0x100000001b3
imul rax, rcx
mov qword [rsp + 0x18], rax
mov qword [rsp], rax
add rsp, 8
pop rbp
ret

Function at 0x1400d4940
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x18
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov qword [rsp], 0
mov qword [rsp + 8], 0
jmp 0x1400d496a
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x10], rcx
cmp qword [rsp + 8], rcx
jl 0x1400d497d
jmp 0x1400d49b0
mov rcx, qword [rsp + 0x30]
add rcx, qword [rsp + 8]
movzx ecx, byte [rcx]
xor rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rcx
movabs rdx, 0x100000001b3
imul rcx, rdx
mov qword [rsp + 0x28], rcx
jmp 0x1400d49a9
inc qword [rsp + 8]
jmp 0x1400d496a
mov rax, qword [rsp + 0x28]
mov qword [rsp], rax
add rsp, 0x18
pop rbp
ret

Function at 0x1400d49c0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp], 0
mov qword [rsp + 8], 0
jmp 0x1400d49e5
cmp qword [rsp + 8], 8
jl 0x1400d49ef
jmp 0x1400d4a29
movzx ecx, byte [rsp + 0x28]
xor rcx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x28]
shr rdx, 8
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100000001b3
imul rcx, rdx
mov qword [rsp + 0x20], rcx
nop
jmp 0x1400d4a22
inc qword [rsp + 8]
jmp 0x1400d49e5
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
add rsp, 0x10
pop rbp
ret

Function at 0x1400d4a40
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp], 0
mov qword [rsp + 8], 0
jmp 0x1400d4a64
cmp qword [rsp + 8], 4
jl 0x1400d4a6e
jmp 0x1400d4aa4
movzx ecx, byte [rsp + 0x28]
xor qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x28]
shr ecx, 8
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x20]
movabs rdx, 0x100000001b3
imul rcx, rdx
mov qword [rsp + 0x20], rcx
jmp 0x1400d4a9d
inc qword [rsp + 8]
jmp 0x1400d4a64
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
add rsp, 0x10
pop rbp
ret
Function at 0x1400d9780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400d990a
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0xe], 0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rdi
cmp rdi, rcx
jg 0x1400d97c2
nop
jmp 0x1400d97cf
mov byte [rsp + 0xe], 0
xor eax, eax
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 0x18], 0
jmp 0x1400d97da
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rcx
cmp qword [rsp + 0x18], rcx
jl 0x1400d97f0
jmp 0x1400d9896
mov rcx, qword [rsp + 0x58]
add rcx, qword [rsp + 0x18]
movzx eax, byte [rcx]
mov byte [rsp + 0x16], al
call fcn.1400d9300
mov byte [rsp + 0x11], al
test al, al
jne 0x1400d9810
jmp 0x1400d983f
mov rcx, qword [rsp + 0x48]
add rcx, qword [rsp + 0x18]
movzx eax, byte [rcx]
mov byte [rsp + 0x15], al
call fcn.1400d9300
mov byte [rsp + 0x11], al
test al, al
jne 0x1400d9830
jmp 0x1400d9832
jmp 0x1400d988a
mov byte [rsp + 0xe], 0
xor eax, eax
add rsp, 0x38
pop rbp
ret
mov rcx, qword [rsp + 0x58]
add rcx, qword [rsp + 0x18]
movzx eax, byte [rcx]
mov byte [rsp + 0x14], al
call fcn.1400d9340
mov byte [rsp + 0x10], al
mov rcx, qword [rsp + 0x48]
add rcx, qword [rsp + 0x18]
movzx eax, byte [rcx]
mov byte [rsp + 0x13], al
call fcn.1400d9340
mov byte [rsp + 0xf], al
cmp byte [rsp + 0x10], al
jne 0x1400d987b
jmp 0x1400d9888
mov byte [rsp + 0xe], 0
xor eax, eax
add rsp, 0x38
pop rbp
ret
jmp 0x1400d988a
jmp 0x1400d988c
inc qword [rsp + 0x18]
jmp 0x1400d97da
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
cmp rcx, rdx
setg byte [rsp + 0x11]
jg 0x1400d98b6
jmp 0x1400d98e2
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x48]
add rcx, rdx
movzx eax, byte [rcx]
mov byte [rsp + 0x12], al
call fcn.1400d9300
mov byte [rsp + 0x17], al
xor eax, 1
mov byte [rsp + 0x11], al
nop
jmp 0x1400d98e4
jmp 0x1400d98e4
cmp byte [rsp + 0x11], 0
jne 0x1400d98ed
jmp 0x1400d98fa
mov byte [rsp + 0xe], 0
xor eax, eax
add rsp, 0x38
pop rbp
ret
mov byte [rsp + 0xe], 1
mov eax, 1
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.140069680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.1400d9780

Function at 0x1400e2560
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400e3640
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400e3640
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1400e25d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140241114]
mov rbx, rcx
test esi, esi
jle 0x1400e2700
mov rax, qword [0x140241118]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400e261b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400e26a5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400e2600
mov rcx, rbx
call fcn.1400e3040
mov rdi, rax
test rax, rax
je 0x1400e2722
mov rax, qword [0x140241118]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400e3180
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140241118]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400e2707
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400e269e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400e26b0
add dword [0x140241114], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140241118]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400e269e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400e2560
nop dword [rax]
xor esi, esi
jmp 0x1400e2628
mov rax, qword [0x140241118]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400e2560
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400e2560
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400e2cb0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140241180]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140241160]
test rbx, rbx
je 0x1400e2d0c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x1400e2d03
test eax, eax
jne 0x1400e2d03
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400e2ce8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400e3040
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401aa530]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400e3060
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400e3068
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400e3060
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400e30bd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400e30b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400e3060
add rax, 0x28
cmp rax, r9
jne 0x1400e30a0
xor eax, eax
ret

Function at 0x1400e30c0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401aa530]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400e30df
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400e30e8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400e30df
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400e3180
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401aa530]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400e319f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400e31a8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x4024c7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x00412040]
jne 0x401c7a
rol rcx, 0x10
test cx, 0xffff
jne 0x401c76
repz ret
ror rcx, 0x10
jmp 0x402420
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x00413300]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x004133f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x4024a5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x00413300]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x4024c7
mov rax, qword [rsp + 0x88]
mov qword [0x004133f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00413398], rax
mov rax, qword [0x004133f8]
mov qword [0x00413270], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00413380], rax
mov dword [0x00413260], 0xc0000409
mov dword [0x00413264], 1
mov rax, qword [0x00412040]
mov qword [rsp + 0x68], rax
mov rax, qword [0x00412048]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004132f8], eax
mov ecx, 1
call fcn.00404e60
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0040d318]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004132f8], 0
jne 0x40254e
mov ecx, 1
call fcn.00404e60
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret