joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140034ed0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x118
mov rdi, r9
mov rbx, rcx
mov rax, qword [0x140048030]
xor rax, rsp
mov qword [rsp + 0x110], rax
lea rsi, [rsp + 0x78]
mov rcx, rsi
call fcn.140001090
mov rsi, qword [rsi]
test rsi, rsi
je 0x14003504f
lea r14, [rsp + 0x60]
mov dword [r14], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
test eax, eax
je 0x140034f95
cmp dword [rsp + 0x60], 0
je 0x140034f95
xor r12d, r12d
lea r15, [rsp + 0x80]
mov r8d, 0x90
mov rcx, r15
xor edx, edx
call fcn.140015060
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 9
mov r8, r15
mov r9d, 0x90
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
test eax, eax
je 0x140034f95
mov eax, dword [rsp + 0x90]
bt eax, 0xd
jae 0x140034f95
shl eax, 0xd
and eax, 0x1000000
mov r12d, eax
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
movaps xmmword [rax], xmm0
movaps xmmword [rax + 0x10], xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
xor ecx, ecx
mov qword [rax + 0x60], rcx
mov dword [rax], 0x68
lea rdx, str.winsta0Default
mov qword [rax + 0x10], rdx
mov qword [rsp + 0x70], rcx
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test eax, eax
je 0x14003505b
mov rcx, qword [rsp + 0x60]
test rdi, rdi
je 0x140035053
mov qword [rdi], rcx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.14001341c
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140025ef0
mov eax, ebx
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x14003502c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140035019
xor edi, edi
lea r14, [rsp + 0x58]
mov qword [r14], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x28], 0
mov ecx, 0x1300
xor edx, edx
mov r8d, eax
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rax, qword [r14]
test rax, rax
lea rdx, [0x140040596]
cmovne rdx, rax
call fcn.1400350c0
mov rcx, qword [r14]
test rcx, rcx
je 0x140035024
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140035024
Function at 0x140035340
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push rsi
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140048030]
xor rax, rsp
mov qword [rsp + 0x278], rax
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400353b4
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400353e6
lea rdx, [rsp + 0x54]
lea rsi, [0x14004ba68]
mov r8d, 0x105
mov rcx, rsi
call fcn.140013424
mov word [0x14004bc70], 0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140025ef0
mov rax, rsi
add rsp, 0x280
pop rsi
ret
lea rcx, [rsi + 8]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jne 0x140035375
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.14001a840
cmp esi, 2
je 0x1400353f6
mov dword [rax], 9
jmp 0x1400353fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1400353fc
call fcn.14001a840
mov dword [rax], 2
xor esi, esi
jmp 0x140035398
Function at 0x140009fe0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r13d, r13d
cmp r8, 0x201
jae 0x14000a080
jmp 0x14000a06f
jae 0x14000a140
cmp r8, 0x201
jae 0x14000a080
lea r12, [rbp - 0x58]
mov esi, 0x200
mov r15, r8
jmp 0x14000a0d8
sub r8, r13
sub rdi, r13
cmp rdi, r8
jae 0x14000a0af
lea rcx, [rbp + 0x3c8]
mov rdx, r13
call fcn.140038010
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r13d, 0xffffffff
cmovb r13, rbx
mov qword [rbp + 0x3d8], r13
mov rdi, rbx
mov r12, qword [rbp + 0x3e8]
mov rsi, r13
mov r15, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r12
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14000a101
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14000a1a8
mov r8d, r14d
cmp r15, r8
jne 0x14000a060
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000a1cb
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000a06f
jmp 0x14000a080
cmp rsi, r8
jb 0x14000a1e5
lea rcx, [rbp + 0x3a8]
mov rdx, r12
call fcn.14000c8c0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x14000a191
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140001380
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rbx, rbx
jne 0x14000a179
jmp 0x14000a191
lea rcx, [0x14004c7eb]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140038c50
jmp 0x14000a1fa
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140039040
ud2
Function at 0x14000d2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14000d310
test ecx, ecx
jne 0x14000d360
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x14000d31c
test ecx, ecx
jne 0x14000d360
mov rcx, rdi
call fcn.14000d1c0
movzx eax, al
test bpl, bpl
jne 0x14000d367
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x14000d353.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x14000d4d8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x14000d353.2
xor eax, eax
test bpl, bpl
je 0x14000d32c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14000d4b9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x14000d39a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x14000d419
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x14000d3e0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x14000d3fb
inc rax
dec rdi
cmp rax, 1
jne 0x14000d3c0
jmp 0x14000d419
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x14000d3fb
cmp ebx, 0x5c
je 0x14000d3fb
inc rax
dec rdi
cmp rax, 1
jne 0x14000d3e0
jmp 0x14000d419
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x14000d4c7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x14000d443
mov al, 9
cmp rdx, 2
je 0x14000d447
cmp rdx, 1
jne 0x14000d457
cmp byte [r8], 0x2e
jne 0x14000d457
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14000d457
mov al, 0xa
jmp 0x14000d457
cmp byte [r8], 0x2e
jne 0x14000d457
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x14000d353.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x14000d353.2
mov ecx, 2
jmp case.0x14000d353.2
lea r8, str.library_std_srcpath.rs
call fcn.140039030
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140039030
ud2
Function at 0x140011b90
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x58], 0x103
mov qword [rsp + 0x60], 0
mov edx, 0xffffffff
cmp r9, rdx
cmovb rdx, r9
mov qword [rsp + 0x78], rcx
lea r9, [rsp + 0x80]
mov qword [rsp + 0x80], rax
test rcx, rcx
cmove r9, rcx
mov qword [rsp + 0x38], r9
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140011c3b
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x58]
cmp eax, 0x103
je 0x140011c72
test eax, eax
js 0x140011c4c
mov rax, qword [rsp + 0x60]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140011c65
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xd8
pop rdi
pop rsi
ret
mov byte [rsp + 0x54], 0
mov dword [rsp + 0x50], 0
lea rax, str.I_O_error:_operation_failed_to_complete_synchronously
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 1
mov qword [rsp + 0x78], 0
lea rax, [0x14004c548]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
lea rax, [0x14001dc50]
mov qword [rsp + 0x70], rax
lea rax, [0x14004c990]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 2
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 1
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa8]
call fcn.14000c420
mov rcx, rax
call fcn.140007ae0
mov ecx, 7
int 0x29
ud2
Function at 0x1400209d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140020a4a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140020a40
cmp r10, r11
jb 0x140020ae3
cmp r10, rdx
ja 0x140020af7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140020a42
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140020a20
jmp 0x140020ab7
ja 0x140020a4a
mov r11, r10
cmp rax, r8
jne 0x1400209f2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140020abb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140020a90
mov r8, r10
sub ecx, r9d
jns 0x140020aae
jmp 0x140020abd
cmp r10, rdx
je 0x140020ac9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140020abd
xor al, 1
cmp r8, rdx
jne 0x140020a70
jmp 0x140020abd
xor eax, eax
jmp 0x140020abd
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140038c50
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140039050
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140039040
ud2

Function at 0x140023130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx r9d, byte [rcx + rax]
inc rax
mov ecx, dword [rsp + 8]
xor r9d, edx
or ecx, r9d
mov dword [rsp + 8], ecx
cmp rax, 0x10
jl 0x140023140
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret

Function at 0x140023180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rcx
xor eax, eax
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], eax
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x18]
movzx r9d, byte [rcx + rax]
inc rax
mov ecx, dword [rsp + 8]
xor r9d, edx
or ecx, r9d
mov dword [rsp + 8], ecx
cmp rax, 0x20
jl 0x140023190
mov eax, dword [rsp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
ret

Function at 0x140023210
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140023290
mov eax, 0xffffffff
cmp rbx, rax
jbe 0x140023234
call fcn.140023100
mov edx, ebx
mov rcx, rdi
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x140023247
call fcn.140023100
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400253f0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x3c], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x38], eax
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
ret
Function at 0x14002a840
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x1400586f8]
xor rax, rsp
mov qword [rsp + 8], rax
xor edx, edx
lea r15, [0x140044300]
mov dword [rsp], edx
mov r8, rcx
movzx edi, byte [rsp + 3]
xor eax, eax
movzx esi, byte [rsp + 2]
movzx ebx, dl
movzx ebp, byte [rsp + 1]
movzx r14d, dl
mov word [rsp + 4], dx
movzx r11d, byte [rsp + 5]
nop dword [rax]
movzx r10d, byte [r8 + rax]
movzx ecx, r10b
xor cl, byte [rax + r15]
or cl, r14b
movzx r14d, cl
movzx ecx, r10b
xor cl, byte [rax + r15 + 0x20]
or cl, bpl
movzx ebp, cl
movzx ecx, r10b
xor cl, byte [rax + r15 + 0x40]
or cl, sil
movzx esi, cl
movzx ecx, r10b
xor cl, byte [rax + r15 + 0x60]
or cl, dil
movzx edi, cl
movzx ecx, r10b
xor cl, byte [rax + r15 + 0x80]
or cl, bl
movzx ebx, cl
movzx ecx, r10b
xor cl, byte [rax + r15 + 0xa0]
xor r10b, byte [rax + r15 + 0xc0]
or cl, r11b
or r10b, dl
movzx r11d, cl
inc rax
movzx edx, r10b
cmp rax, 0x1f
jb 0x14002a8a0
movzx ecx, byte [rax + r8]
movzx r9d, byte [rax + r15]
and cl, 0x7f
movzx edx, byte [rax + r15 + 0xa0]
movzx r8d, cl
xor edx, r8d
movzx ecx, r10b
or edx, r11d
xor r9d, r8d
dec edx
or r9d, r14d
dec r9d
or r9d, edx
movzx edx, byte [rax + r15 + 0x80]
xor edx, r8d
or edx, ebx
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x60]
xor edx, r8d
or edx, edi
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x20]
xor edx, r8d
or edx, ebp
dec edx
or r9d, edx
movzx edx, byte [rax + r15 + 0x40]
movzx eax, byte [rax + r15 + 0xc0]
xor edx, r8d
xor eax, r8d
or edx, esi
or eax, ecx
dec edx
dec eax
or r9d, edx
or eax, r9d
shr eax, 8
and eax, 1
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140036bb0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x10
pop r15
pop r14
pop rdi
ret
Function at 0x14002b240
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [rcx], 0x61707865
mov dword [rcx + 4], 0x3320646e
mov dword [rcx + 8], 0x79622d32
mov dword [rcx + 0xc], 0x6b206574
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x20], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x24], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x2c], eax
ret
Function at 0x14002fb20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x38
movdqu xmm0, xmmword [rdx]
movdqu xmm2, xmmword [r8 + 0x60]
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x10], xmm7
movdqu xmm7, xmmword [rdx + 0x10]
movaps xmmword [rsp], xmm8
movdqa xmm8, xmm2
pxor xmm7, xmmword [r8 + 0x50]
pxor xmm8, xmm0
pxor xmm7, xmmword [r8 + 0x20]
pxor xmm8, xmmword [r8 + 0x10]
movdqu xmm0, xmmword [r8 + 0x20]
pand xmm0, xmmword [r8 + 0x30]
pand xmm2, xmmword [r8 + 0x70]
pxor xmm8, xmm0
movdqu xmmword [rcx], xmm8
pxor xmm7, xmm2
movdqu xmmword [rcx + 0x10], xmm7
movdqu xmm6, xmmword [r8 + 0x70]
movdqu xmm5, xmmword [r8 + 0x30]
movdqu xmm0, xmmword [r8 + 0x60]
movdqu xmm1, xmmword [r8 + 0x50]
aesenc xmm1, xmmword [r8 + 0x60]
aesenc xmm0, xmm6
aesenc xmm6, xmmword [r8]
movdqu xmmword [r8 + 0x70], xmm0
pxor xmm6, xmm8
movdqu xmm0, xmmword [r8 + 0x40]
aesenc xmm0, xmmword [r8 + 0x50]
movaps xmm8, xmmword [rsp]
movdqu xmmword [r8 + 0x50], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
aesenc xmm0, xmm5
aesenc xmm5, xmmword [r8 + 0x40]
movdqu xmmword [r8 + 0x30], xmm0
pxor xmm5, xmm7
movdqu xmm0, xmmword [r8]
aesenc xmm0, xmmword [r8 + 0x10]
movaps xmm7, xmmword [rsp + 0x10]
movdqu xmmword [r8 + 0x60], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
aesenc xmm1, xmmword [r8 + 0x20]
movdqu xmmword [r8], xmm6
movaps xmm6, xmmword [rsp + 0x20]
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmmword [r8 + 0x20], xmm1
movdqu xmmword [r8 + 0x40], xmm5
add rsp, 0x38
ret
Function at 0x14002fc40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x1400586f8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov rsi, r9
movups xmmword [rsp + 0x20], xmm0
mov rdi, r8
movups xmmword [rsp + 0x30], xmm0
call sub.VCRUNTIME140.dll_memcpy
movdqu xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov r8d, 0x20
movdqu xmm3, xmmword [rsi + 0x60]
sub r8, rdi
movdqa xmm1, xmm3
add rcx, rdi
pand xmm3, xmmword [rsi + 0x70]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rsi + 0x20]
xor edx, edx
pand xmm0, xmmword [rsi + 0x30]
pxor xmm1, xmmword [rsi + 0x10]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rsp + 0x20], xmm1
pxor xmm0, xmmword [rsi + 0x50]
pxor xmm0, xmmword [rsi + 0x20]
pxor xmm0, xmm3
movdqu xmmword [rsp + 0x30], xmm0
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movdqu xmm6, xmmword [rsi + 0x70]
movdqu xmm5, xmmword [rsi + 0x30]
movdqu xmm0, xmmword [rsi + 0x60]
movdqu xmm1, xmmword [rsi + 0x50]
aesenc xmm1, xmmword [rsi + 0x60]
aesenc xmm0, xmm6
aesenc xmm6, xmmword [rsi]
movdqu xmmword [rsi + 0x70], xmm0
movdqu xmm0, xmmword [rsi + 0x40]
aesenc xmm0, xmmword [rsi + 0x50]
movdqu xmmword [rsi + 0x50], xmm0
movdqu xmm0, xmmword [rsi + 0x20]
aesenc xmm0, xmm5
aesenc xmm5, xmmword [rsi + 0x40]
movdqu xmmword [rsi + 0x30], xmm0
movdqu xmm0, xmmword [rsi]
aesenc xmm0, xmmword [rsi + 0x10]
movdqu xmmword [rsi + 0x60], xmm1
movdqu xmm1, xmmword [rsi + 0x10]
aesenc xmm1, xmmword [rsi + 0x20]
movdqu xmmword [rsi + 0x10], xmm0
movdqu xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rsi + 0x20], xmm1
pxor xmm6, xmm0
movdqu xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rsi], xmm6
pxor xmm5, xmm0
movdqu xmmword [rsi + 0x40], xmm5
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140036bb0
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002fda0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x38
movdqu xmm2, xmmword [r8 + 0x60]
movdqu xmm3, xmmword [r8 + 0x20]
movdqa xmm0, xmm2
pand xmm0, xmmword [r8 + 0x70]
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x10], xmm7
movdqu xmm7, xmmword [rdx]
movaps xmmword [rsp], xmm8
movdqu xmm8, xmmword [rdx + 0x10]
pxor xmm2, xmm7
pxor xmm2, xmmword [r8 + 0x10]
movdqa xmm1, xmm8
pxor xmm1, xmmword [r8 + 0x50]
pxor xmm1, xmm3
pand xmm3, xmmword [r8 + 0x30]
pxor xmm1, xmm0
pxor xmm2, xmm3
movdqu xmmword [rcx], xmm2
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm6, xmmword [r8 + 0x70]
movdqu xmm5, xmmword [r8 + 0x30]
movdqu xmm0, xmmword [r8 + 0x60]
movdqu xmm1, xmmword [r8 + 0x50]
aesenc xmm1, xmmword [r8 + 0x60]
aesenc xmm0, xmm6
aesenc xmm6, xmmword [r8]
movdqu xmmword [r8 + 0x70], xmm0
pxor xmm6, xmm7
movdqu xmm0, xmmword [r8 + 0x40]
aesenc xmm0, xmmword [r8 + 0x50]
movaps xmm7, xmmword [rsp + 0x10]
movdqu xmmword [r8 + 0x50], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
aesenc xmm0, xmm5
aesenc xmm5, xmmword [r8 + 0x40]
movdqu xmmword [r8 + 0x30], xmm0
pxor xmm5, xmm8
movdqu xmm0, xmmword [r8]
aesenc xmm0, xmmword [r8 + 0x10]
movaps xmm8, xmmword [rsp]
movdqu xmmword [r8 + 0x60], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
aesenc xmm1, xmmword [r8 + 0x20]
movdqu xmmword [r8], xmm6
movaps xmm6, xmmword [rsp + 0x20]
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmmword [r8 + 0x20], xmm1
movdqu xmmword [r8 + 0x40], xmm5
add rsp, 0x38
ret
Function at 0x14002fec0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
sub rsp, 0xc8
movdqu xmm0, xmmword [rdx]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmm0
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x140044450]
movaps xmmword [rax - 0x68], xmm11
movaps xmmword [rax - 0x78], xmm12
mov eax, 5
movdqu xmm12, xmmword [rcx]
movaps xmmword [rsp + 0x40], xmm13
movdqa xmm13, xmmword [0x140044440]
pxor xmm9, xmm12
movaps xmmword [rsp + 0x30], xmm14
movdqa xmm8, xmm12
pxor xmm8, xmm13
movaps xmmword [rsp + 0x20], xmm15
movdqa xmm5, xmm9
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm11, xmm12
movdqa xmmword [rsp], xmm5
movdqa xmm14, xmm8
pxor xmm11, xmm10
movdqa xmm15, xmm10
nop word [rax + rax]
movdqa xmm3, xmm9
movdqa xmm7, xmm11
movdqa xmm6, xmm13
movdqa xmm4, xmm15
movdqa xmm1, xmm14
aesenc xmm5, xmm15
aesenc xmm6, xmm10
aesenc xmm10, xmm9
pxor xmm10, xmm12
movdqa xmm9, xmm6
movdqa xmm2, xmm10
aesenc xmm7, xmm8
aesenc xmm8, xmmword [rsp]
pxor xmm0, xmm8
movdqa xmm15, xmm0
aesenc xmm4, xmm13
movdqa xmm13, xmm5
movdqa xmm10, xmm4
aesenc xmm15, xmm5
movdqa xmm5, xmm7
aesenc xmm1, xmm11
movdqa xmm8, xmm1
aesenc xmm3, xmm14
movdqa xmm11, xmm3
movdqa xmm14, xmm2
aesenc xmm5, xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pxor xmm5, xmm0
movdqa xmmword [rsp], xmm5
movdqu xmmword [r8], xmm5
aesenc xmm9, xmm2
pxor xmm9, xmm12
aesenc xmm8, xmm7
aesenc xmm11, xmm1
aesenc xmm14, xmm3
aesenc xmm10, xmm6
aesenc xmm13, xmm4
sub rax, 1
jne 0x14002ff60
lea r11, [rsp + 0xc8]
movdqu xmmword [r8 + 0x10], xmm15
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm12, xmmword [r11 - 0x78]
movaps xmm15, xmmword [rsp + 0x20]
movdqu xmmword [r8 + 0x20], xmm13
movaps xmm13, xmmword [rsp + 0x40]
movdqu xmmword [r8 + 0x30], xmm10
movaps xmm10, xmmword [r11 - 0x58]
movdqu xmmword [r8 + 0x40], xmm9
movaps xmm9, xmmword [r11 - 0x48]
movdqu xmmword [r8 + 0x50], xmm14
movaps xmm14, xmmword [rsp + 0x30]
movdqu xmmword [r8 + 0x60], xmm11
movaps xmm11, xmmword [r11 - 0x68]
movdqu xmmword [r8 + 0x70], xmm8
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
ret