joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400084c0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rsi, r8
mov ecx, 0x2000
mov r14, rdx
xor r13d, r13d
call fcn.140015780
mov r15, rax
test rax, rax
je 0x1400085d3
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, r12
call fcn.140011004
test eax, eax
js 0x1400085d3
mov rcx, r12
mov qword [rsp + 0x50], rbx
call fcn.140019894
mov rbx, rax
cmp rax, rsi
jb 0x1400085ce
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
nop dword [rax]
cmp rbx, 0x2000
lea rbp, [rbx - 0x2000]
cmovb rbp, r13
sub rbx, rbp
cmp rbx, rsi
jb 0x1400085c4
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
call fcn.140011004
test eax, eax
js 0x1400085c4
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.140010ccc
cmp rax, rbx
jne 0x1400085c4
sub rbx, rsi
add rbx, 1
je 0x1400085ab
lea rdi, [r15 - 1]
add rdi, rbx
nop dword [rax]
nop dword [rax + rax]
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14002b920
test eax, eax
je 0x1400085bd
dec rdi
sub rbx, 1
jne 0x140008590
lea rbx, [rsi - 1]
add rbx, rbp
test rbp, rbp
jne 0x140008530
jmp 0x1400085c4
lea r13, [rbp - 1]
add r13, rbx
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
call fcn.14001576c
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14002ac80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002aca8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002aca8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140109d48
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r11d, dword [rcx]
mov rsi, r8
mov ebx, dword [rcx + 4]
mov rdi, rdx
movsxd rbp, r9d
mov r10, rcx
test r9d, r9d
jle 0x140109daf
sub rdi, r8
inc r11b
movzx r11d, r11b
mov r8b, byte [r11 + r10 + 8]
add bl, r8b
movzx ebx, bl
mov cl, byte [rbx + r10 + 8]
mov byte [r11 + r10 + 8], cl
add cl, r8b
mov byte [rbx + r10 + 8], r8b
movzx eax, cl
mov cl, byte [rax + r10 + 8]
xor cl, byte [rdi + rsi]
mov byte [rsi], cl
inc rsi
sub rbp, 1
jne 0x140109d75
mov rbp, qword [rsp + 0x10]
mov eax, r9d
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov dword [r10 + 4], ebx
mov rbx, qword [rsp + 8]
mov dword [r10], r11d
ret

Function at 0x14010e398
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x140122180
call fcn.1401afd18
imul ebx, ebp, 0x90511012
stosd dword [rdi], eax
lea eax, [rax + rcx*2]
lea edi, [0x1401d4de0]
call fcn.1400f1c00
xchg byte [rax + 0x2f67], ah
pushfq
push rcx
mov rcx, qword [rsp + 8]
lea rcx, [rcx + 0x1c]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
call 0x1401221c3
pushfq
add rbp, 4
popfq
lea rbp, [rbp - 4]
add qword [rsp], 0x99c8a
xchg qword [rsp], rax
pushfq
add rbp, 0
popfq
lea rbp, [rbp]
xchg qword [rsp + 8], rax
pushfq
add rbp, 0x1e
popfq
lea rbp, [rbp - 0x1e]
xchg qword [rsp], rax
pushfq
add rbp, 0x69
popfq
lea rbp, [rbp - 0x69]
popfq
push rdx
mov rdx, qword [rsp + 7]
pop rdx
jmp 0x1401bbe4d
call fcn.1400f5a10
invalid

Function at 0x1401120d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rdi, [0x1401d7f38]
call fcn.1401bd158
mov edx, 0x8aaf7
add byte [rax - 0x6e], cl
mov rax, qword [rsp + 0x70]
push rdx
xchg rdx, rax
pop rax
jmp 0x1401c06f0
jmp 0x140112dc0
call 0x10bf92ea5
imul edi, ecx, 0x3977f9ff
call 0x1400a9790
stc
ja 0x140112e01
and al, 0x33
and cl, byte [rbx - 0x72b7b2fe]
cmp eax, 0xc72b3
call fcn.1401029a8
jnp 0x140112dbd
cdq
imul eax, dword [rax], 0
add byte [rdx], cl
add byte [rax], al
add al, ah
invalid
mov dword [rsp], esi
mov rsi, rdi
mov rdi, qword [rsp]
xchg rdi, rax
mov rax, qword [rsp + 8]
push rdi
xchg rdi, rax
pop rax
lea rdi, [rdi]
push rax
mov rax, qword [rsp + 8]
lea rax, [rax + 0x3e]
xchg qword [rsp + 8], rax
mov qword [rsp + 8], rax
mov rax, qword [rsp]
lea rsp, [rsp + 8]
mov qword [rsp + 8], rdi
push rdx
mov rdx, qword [rsp + 8]
lea rdx, [rdx + 0x55]
xchg qword [rsp + 8], rdx
mov qword [rsp + 8], rdx
mov rdx, qword [rsp]
lea rsp, [rsp + 8]
jmp 0x14009f1f6
Function at 0x1401b9bc0
Capabilities:
Execute anti-debugging instructions

Disassembly:
add byte [rax], al
call fcn.1400971f0
cmp dh, byte [rbp - 0x14]
xor dl, byte [rax - 0x31]
mov dword [rcx + 0x21], ebx
lea rdi, [0x1401d8950]
call fcn.14010ef28
or esi, eax
js 0x140145b25
add byte [rax], al
popfq
pushfq
add rbp, 0x6f
popfq
lea rbp, [rbp - 0x6f]
je 0x1400974c0
jne 0x1400974c0
jmp 0x1400974be
and al, 8
lea rcx, [rcx + 0x5d]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
call 0x140145b43
push rax
mov rax, qword [rsp + 8]
lea rax, [rax + 0x3c]
xchg qword [rsp + 8], rax
mov qword [rsp + 8], rax
mov rax, qword [rsp]
lea rsp, [rsp + 8]
add qword [rsp], 0xfffffffffffcb44d
xchg qword [rsp], rbx
push rbp
mov rbp, rsp
leave
xchg qword [rsp + 8], rbx
push rcx
mov rcx, qword [rsp + 8]
lea rcx, [rcx + 0x1b]
xchg qword [rsp + 8], rcx
mov qword [rsp + 8], rcx
mov rcx, qword [rsp]
lea rsp, [rsp + 8]
xchg qword [rsp], rbx
push rax
mov rax, qword [rsp + 8]
lea rax, [rax + 0x11]
xchg qword [rsp + 8], rax
mov qword [rsp + 8], rax
mov rax, qword [rsp]
lea rsp, [rsp + 8]
popfq
push rax
mov rax, qword [rsp + 8]
lea rax, [rax + 1]
xchg qword [rsp + 8], rax
mov qword [rsp + 8], rax
mov rax, qword [rsp]
lea rsp, [rsp + 8]
ret
jmp 0x140145ad8

Function at 0x36b49a0f0
Capabilities:
Encode data using xor

Disassembly:
sbb dword [rax - 0x76ab6623], 0xffffffc1
sar dword [rax], 0x4a
fisttp word gs:[rsi]
jge 0x36b49a0d3
jbe 0x36b49a0cd
scasb al, byte [rdi]
or ah, byte [rax]
movsb byte [rdi], byte [rsi]
cli
wait
invalid

Function at 0x36c4d1788
Capabilities:
Encode data using xor

Disassembly:
jmp 0x36c4d1792
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x36c4d17bb
pop rbp
sub rbp, 0x33
sub rbp, 0x1061788
cmp edx, 1
je 0x36c4d17fe
ldmxcsr dword [rsp]
add rsp, 8
popfq
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax
xor rax, rax
ret
sub rsp, 0x20
jmp 0x36c4d180e
mov rax, 0x1061788
add rax, rbp
add rax, 0xb8
mov rcx, 0x60b
mov rdx, 0xffffffffcdc4577f
xor byte [rax], dl
inc rax
dec rcx
jne 0x36c4d182d
jmp 0x36c4d1844
invalid
Function at 0x140151790
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14015179d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401517ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140151795
lea eax, [rcx + 1]
jmp 0x1401517bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401517ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401517b4
sub eax, 3
jb 0x1401517ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14015183d
sar eax, 1
movsxd rbp, eax
jb 0x140151824
jmp 0x1401517fc
add ebx, ebx
jne 0x1401517fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140151824
inc ecx
add ebx, ebx
jne 0x14015180a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140151824
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14015181d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14015180c
add ecx, 2
jmp 0x140151829
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140151752
jmp 0x14015179d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xde400
mov dl, 0x16
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140151889
cmp rsi, rcx
jae 0x140151891
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140151870
cmp al, 0x8f
ja 0x140151870
cmp byte [rsi - 2], 0xf
je 0x140151876
sub al, 0xe8
cmp al, 1
ja 0x14015185a
cmp rsi, rcx
jae 0x140151891
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140151860
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140151891
lodsb al, byte [rsi]
jmp 0x140151870
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x14e000]
mov eax, dword [rdi]
or eax, eax
je 0x1401518fa
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1540d4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14015189e
jns 0x1401518d3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1401518dd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401518f4
mov qword [rbx], rax
add rbx, 8
jmp 0x1401518be
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140151952
sub rsp, 0xffffffffffffff80
jmp 0x1400cdb10
Function at 0x40d8c2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov r13, rcx
movsxd r14, dword [r13 + 0x3c]
mov eax, dword [r13 + r14 + 0x88]
mov dword [rsp + 0x24], eax
mov eax, 0x3be35476
mov r8d, 0xd832f69e
xor edx, edx
mov esi, 0x4964725e
mov r9d, 0x9e3ec3ae
mov r10d, 0xa351437b
mov r11d, 0xff7c9338
mov qword [rsp + 0x28], rcx
jmp 0x40d922
cmove r15, rdx
cmove eax, esi
nop word [rax + rax]
cmp eax, 0xd8375532
jge 0x40d952
cmp eax, 0xc8ad633a
jge 0x40d992
cmp eax, 0x9e3ec3ae
jge 0x40da7e
cmp eax, 0x929e2130
cmove eax, r8d
jmp 0x40d922
cmp eax, 0x1508adcd
jge 0x40d9d2
cmp eax, 0xea8e6a7f
jge 0x40daaa
cmp eax, 0xd8375532
jne 0x40d922
mov eax, dword [r13 + r14 + 0x88]
lea rbx, [r13 + rax]
cmp dword [r13 + rax + 0x18], 0
mov eax, 0xc8ad633a
cmove eax, r10d
jmp 0x40d922
cmp eax, 0xcba3b7f1
jge 0x40dad7
cmp eax, 0xc8ad633a
jne 0x40d922
mov edi, dword [rbx + 0x1c]
mov ebp, dword [rbx + 0x20]
add rbp, r13
add rdi, r13
mov eax, dword [rbx + 0x24]
add rax, r13
mov qword [rsp + 0x28], rax
mov eax, 0x9e3ec3ae
xor r12d, r12d
jmp 0x40d922
cmp eax, 0x3be35476
jge 0x40db06
cmp eax, 0x1aa581e9
jge 0x40d915
cmp eax, 0x1508adcd
jne 0x40d922
mov eax, r12d
mov ecx, dword [rbp + rax*4]
add rcx, r13
mov rax, qword [0x00450a62]
movabs rdx, 0xc19b9a805c8e150b
mov r8, rdx
lea rsi, [r8 + 0x39e2caea]
and rsi, rax
not rax
movabs rdx, 0x3e64657f698f200a
and rax, rdx
or rsi, rax
mov rax, rsi
not rax
lea rdx, [rdx + 0x39e2caea]
and rdx, rax
and rsi, r8
or rsi, rdx
mov rdx, qword [rsp + 0x30]
call rsi
mov r11d, 0xff7c9338
mov r10d, 0xa351437b
mov r9d, 0x9e3ec3ae
mov esi, 0x4964725e
xor edx, edx
mov r8d, 0xd832f69e
test eax, eax
mov eax, 0x929e2130
mov ecx, 0xcba3b7f1
cmove eax, ecx
jmp 0x40d922
cmp eax, 0xa351437b
jge 0x40d915
cmp eax, 0x9e3ec3ae
jne 0x40d922
cmp r12d, dword [rbx + 0x18]
mov eax, 0x1aa581e9
mov ecx, 0x1508adcd
cmovb eax, ecx
jmp 0x40d922
cmp eax, 0xff7c9338
jge 0x40d915
cmp eax, 0xea8e6a7f
jne 0x40d922
cmp dword [r13 + r14 + 0x8c], 0
mov eax, 0xd8375532
cmove eax, r11d
jmp 0x40d922
cmp eax, 0xd832f69e
jge 0x40db2b
cmp eax, 0xcba3b7f1
jne 0x40d922
mov eax, r12d
mov rcx, qword [rsp + 0x28]
movzx eax, word [rcx + rax*2]
mov r15d, dword [rdi + rax*4]
add r15, r13
mov eax, 0x4964725e
jmp 0x40d922
cmp eax, 0x4964725e
jge 0x40db3d
cmp eax, 0x3be35476
jne 0x40d922
cmp dword [rsp + 0x24], 0
mov eax, 0xea8e6a7f
cmove eax, r11d
jmp 0x40d922
sete cl
movzx ecx, cl
cmove eax, r9d
add r12d, ecx
jmp 0x40d922
jne 0x40d922
mov rax, r15
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x42b522
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov dword [rsp + 0x2c], edx
mov rbx, rcx
movsxd rax, dword [rbx + 0x3c]
mov qword [rsp + 0x48], rax
mov eax, dword [rbx + rax + 0x88]
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x50], r8
test r8, r8
mov eax, 0x1ab98022
mov ecx, 0x314ad117
cmove ecx, eax
mov dword [rsp + 0x30], ecx
mov eax, 0xaa78a8eb
xor edx, edx
mov ebp, 0x2e73e35a
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rcx
jmp 0x42b592
cmove rdi, rdx
cmove eax, ebp
nop word cs:[rax + rax]
cmp eax, 0x2e73e35a
jge 0x42b5d2
cmp eax, 0xfda38e13
jge 0x42b602
cmp eax, 0xdb346355
jge 0x42b662
cmp eax, 0xd47a292c
jge 0x42b57e
cmp eax, 0xaa78a8eb
jne 0x42b592
cmp dword [rsp + 0x34], 0
mov eax, 0x5ae20d7a
jmp 0x42b655
cmp eax, 0x5ae20d7a
jge 0x42b622
cmp eax, 0x31aca578
jge 0x42b69f
cmp eax, 0x314ad117
jge 0x42b749
cmp eax, 0x2e73e35a
jne 0x42b592
jmp 0x42b7e3
cmp eax, 0x1ab98022
jge 0x42b6cc
cmp eax, 0xdc5c140
jge 0x42b76d
cmp eax, 0xfda38e13
jmp 0x42b57e
cmp eax, 0x66f98ac8
jge 0x42b6ff
cmp eax, 0x66d814e0
jge 0x42b777
cmp eax, 0x5ae20d7a
jne 0x42b592
mov rax, qword [rsp + 0x48]
cmp dword [rbx + rax + 0x8c], 0
mov eax, 0xdb346355
mov ecx, 0xfda38e13
cmove eax, ecx
jmp 0x42b592
cmp eax, 0xe2726e33
jge 0x42b784
cmp eax, 0xdb346355
jne 0x42b592
mov rax, qword [rsp + 0x48]
mov eax, dword [rbx + rax + 0x88]
lea r12, [rbx + rax]
cmp dword [rbx + rax + 0x18], 0
mov eax, 0x6fea581c
mov ecx, 0x3bb64cdf
cmove eax, ecx
jmp 0x42b592
cmp eax, 0x3bb64cdf
jge 0x42b57e
cmp eax, 0x31aca578
jne 0x42b592
cmp r14d, dword [r12 + 0x18]
mov eax, 0xd47a292c
mov ecx, 0x66f98ac8
cmovb eax, ecx
jmp 0x42b592
cmp eax, 0x258c3182
jge 0x42b7a2
cmp eax, 0x1ab98022
jne 0x42b592
mov eax, r14d
movzx eax, word [r15 + rax*2]
mov rcx, qword [rsp + 0x38]
mov esi, dword [rcx + rax*4]
add rsi, rbx
mov eax, 0x258c3182
jmp 0x42b592
cmp eax, 0x6fea581c
jge 0x42b7ae
cmp eax, 0x66f98ac8
jne 0x42b592
mov eax, r14d
mov rcx, qword [rsp + 0x40]
mov r13d, dword [rcx + rax*4]
add r13, rbx
mov rcx, r13
call fcn.0042b4b2
mov ebp, 0x2e73e35a
xor edx, edx
cmp eax, dword [rsp + 0x2c]
mov eax, 0xdc5c140
mov ecx, 0x66d814e0
cmovne eax, ecx
jmp 0x42b592
jne 0x42b592
mov rcx, rbx
mov rdx, r13
call qword [rsp + 0x50]
mov ebp, 0x2e73e35a
xor edx, edx
mov rsi, rax
mov eax, 0x258c3182
jmp 0x42b592
cmove eax, dword [rsp + 0x30]
jmp 0x42b592
mov ecx, 0xe2726e33
cmove eax, ecx
jmp 0x42b592
jne 0x42b592
neg r14d
mov ecx, 1
sub ecx, r14d
mov eax, 0x31aca578
mov r14d, ecx
jmp 0x42b592
cmove rdi, rsi
cmove eax, ebp
jmp 0x42b592
jne 0x42b592
mov ecx, dword [r12 + 0x1c]
mov eax, dword [r12 + 0x20]
add rax, rbx
mov qword [rsp + 0x40], rax
add rcx, rbx
mov qword [rsp + 0x38], rcx
mov r15d, dword [r12 + 0x24]
add r15, rbx
mov eax, 0x31aca578
xor r14d, r14d
jmp 0x42b592
mov rax, rdi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x445bc2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov esi, ecx
xor eax, eax
test esi, esi
setne al
mov dword [rsp + 0x24], eax
mov ebx, 0xffffffff
xor ebp, ebp
mov r15d, 0xf7507d24
mov r12d, 0xf48d0117
mov r13d, 0x634c7199
mov r14d, 0x39721291
xor edi, edi
mov eax, 0x1450ec7
jmp 0x445c12
cmove edi, ebx
cmove eax, r14d
nop dword [rax]
cmp eax, 0x19d235c
jge 0x445c52
cmp eax, 0xf487ef47
jge 0x445cb2
cmp eax, 0xdee524c4
jge 0x445d11
cmp eax, 0xddf7eadb
jge 0x445db3
cmp eax, 0xadea4cf6
jne 0x445c12
lea rcx, [rsp + 0x28]
call fcn.004477f2
mov eax, 0xf487ef47
jmp 0x445c12
cmp eax, 0x634c7199
jge 0x445ce2
cmp eax, 0x39721291
jge 0x445d2e
cmp eax, 0x298e4ba
jge 0x445dc0
cmp eax, 0x19d235c
jne 0x445c12
mov eax, edi
mov rcx, qword [0x004501c2]
mov rcx, qword [rcx + 0xf0]
imul rax, rax, 0x38
movzx eax, byte [rcx + rax + 0x20]
shr al, 1
and al, 1
movzx eax, al
cmp eax, esi
mov eax, 0x44184425
mov ecx, 0x298e4ba
cmovne eax, ecx
jmp 0x445c12
cmp eax, 0xf7507d24
jge 0x445d63
cmp eax, 0xf48d0117
jge 0x445dcc
cmp eax, 0xf487ef47
cmove eax, r15d
jmp 0x445c12
cmp eax, 0x682315ca
jge 0x445d7e
cmp eax, 0x66d10a51
jge 0x445c07
xor ecx, ecx
cmp eax, 0x634c7199
sete cl
mov edx, 0x1450ec7
cmove eax, edx
add edi, ecx
jmp 0x445c12
cmp eax, 0xefc2c377
jge 0x445de7
cmp eax, 0xdee524c4
mov ecx, 0xadea4cf6
cmove eax, ecx
jmp 0x445c12
cmp eax, 0x44184425
jge 0x445e02
cmp eax, 0x39721291
jne 0x445c12
mov rax, qword [0x004501c2]
cmp edi, dword [rax + 0xfc]
mov eax, 0xadea4cf6
mov ecx, 0xff1af275
cmovb eax, ecx
jmp 0x445c12
cmp eax, 0xff1af275
jge 0x445e0b
cmp eax, 0xf7507d24
jne 0x445c12
jmp 0x445ec8
cmp eax, 0x70750fbe
jge 0x445e5a
cmp eax, 0x682315ca
jne 0x445c12
mov ecx, edi
mov edx, esi
call fcn.00447292
mov ebp, eax
test ebp, ebp
mov eax, 0x7b056be6
mov ecx, 0xdee524c4
cmovne eax, ecx
jmp 0x445c12
mov ecx, 0xefc2c377
cmove eax, ecx
jmp 0x445c12
cmove ebx, edi
cmove eax, r12d
jmp 0x445c12
jne 0x445c12
cmp ebx, 0xffffffff
mov eax, 0xf7507d24
mov ecx, 0x70750fbe
cmovne eax, ecx
jmp 0x445c12
jne 0x445c12
neg edi
mov ecx, 1
sub ecx, edi
mov eax, 0x39721291
mov edi, ecx
jmp 0x445c12
cmove eax, r13d
jmp 0x445c12
cmp eax, 0x1450ec7
jge 0x445e96
cmp eax, 0xff1af275
jne 0x445c12
mov eax, edi
mov rcx, qword [0x004501c2]
mov rcx, qword [rcx + 0xf0]
imul rax, rax, 0x38
movzx eax, byte [rcx + rax + 0x20]
shr al, 1
mov ecx, eax
xor cl, 0x7e
and cl, al
movzx eax, cl
cmp eax, esi
mov eax, 0xddf7eadb
mov ecx, 0x682315ca
cmovne eax, ecx
jmp 0x445c12
cmp eax, 0x7b056be6
jge 0x445ebb
cmp eax, 0x70750fbe
jne 0x445c12
mov edx, 0xffffffff
lea rcx, [rsp + 0x28]
mov r8d, dword [rsp + 0x24]
call fcn.00445ee2
mov ebp, eax
test ebp, ebp
mov eax, 0xf487ef47
mov ecx, 0x66d10a51
cmove eax, ecx
jmp 0x445c12
jne 0x445c12
mov rax, qword [0x004501c2]
cmp edi, dword [rax + 0xfc]
mov eax, 0xf48d0117
mov ecx, 0x19d235c
cmovb eax, ecx
jmp 0x445c12
mov ecx, 0xddf7eadb
cmove eax, ecx
jmp 0x445c12
mov eax, ebp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4495c2
Capabilities:
Check for software breakpoints

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
push rax
mov dword [rsp], edx
movzx r8d, byte [rcx]
cmp r8d, 0xcc
mov r9d, 0x34b72419
mov eax, 0x1bdd7f05
cmove r9d, eax
cmp r8d, 0x90
mov dword [rsp + 4], r8d
mov r10d, 0x201226b
cmove r10d, eax
mov ebx, 0x63027319
mov r11d, 0x11a40660
mov r15d, 0xdac0488
mov r12d, 1
xor ebp, ebp
mov esi, 0x72073ee4
mov edx, 0x4f7392b0
jmp 0x449632
cmove eax, ebp
cmove ebx, esi
nop dword [rax + rax]
cmp ebx, 0x3a665502
jge 0x449662
cmp ebx, 0x11a40660
jge 0x449682
cmp ebx, 0x201226b
jge 0x4496c4
cmp ebx, 0xafc19426
cmove ebx, r11d
jmp 0x449632
cmp ebx, 0x63027319
jge 0x4496a2
cmp ebx, 0x4f7392b0
jge 0x4496db
cmp ebx, 0x3a665502
jmp 0x449627
cmp ebx, 0x1bdd7f05
jge 0x4496f2
xor r13d, r13d
cmp ebx, 0x11a40660
sete r13b
cmove ebx, r15d
add r14d, r13d
jmp 0x449632
cmp ebx, 0x72073ee4
jge 0x449711
cmp ebx, 0x63027319
jne 0x449632
cmp dword [rsp + 4], 0
mov ebx, 0x1bdd7f05
cmovne ebx, edx
jmp 0x449632
cmp ebx, 0xdac0488
jge 0x449727
cmp ebx, 0x201226b
cmove ebx, r9d
jmp 0x449632
cmp ebx, 0x57b9fc61
jge 0x449743
cmp ebx, 0x4f7392b0
cmove ebx, r10d
jmp 0x449632
cmp ebx, 0x34b72419
jge 0x449627
cmp ebx, 0x1bdd7f05
cmove r14d, r12d
cmove ebx, r15d
jmp 0x449632
cmp ebx, 0x789f137f
jge 0x44974f
cmp ebx, 0x72073ee4
jne 0x449632
jmp 0x44976e
jne 0x449632
cmp r14d, dword [rsp]
mov ebx, 0x57b9fc61
mov edi, 0x789f137f
cmovb ebx, edi
jmp 0x449632
cmove eax, r12d
cmove ebx, esi
jmp 0x449632
jne 0x449632
mov ebx, r14d
cmp byte [rcx + rbx], r8b
mov ebx, 0xafc19426
mov edi, 0x3a665502
cmovne ebx, edi
jmp 0x449632
add rsp, 8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14001dc70
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, r8
mov rax, rcx
mov rcx, qword [0x14020e078]
movzx ecx, byte [rcx]
cmp cl, 1
jne 0x14001dca0
mov rcx, rax
mov r8, rsi
add rsp, 0xa0
pop rsi
jmp 0x14001dd80
mov ecx, dword [rdx + 8]
mov r8d, dword [rdx + 0x10]
lea r9d, [r8 + 1]
mov dword [rdx + 0x10], r9d
add r8d, dword [rdx + 0xc]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x30], xmm0
bswap r8d
mov rdx, qword [rdx]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], r8d
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x20]
mov rdx, rax
call fcn.14005a1a0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
add rsp, 0xa0
pop rsi
ret
mov eax, dword [rdx + 0x10]
movups xmm0, xmmword [rdx]
mov r9d, dword [rdx + 0xc]
add r9d, eax
bswap r9d
movd xmm1, r9d
shufps xmm1, xmm0, 0xe4
shufps xmm0, xmm1, 0x24
xorps xmm0, xmmword [rcx]
aesenc xmm0, xmmword [rcx + 0x10]
aesenc xmm0, xmmword [rcx + 0x20]
aesenc xmm0, xmmword [rcx + 0x30]
aesenc xmm0, xmmword [rcx + 0x40]
aesenc xmm0, xmmword [rcx + 0x50]
aesenc xmm0, xmmword [rcx + 0x60]
aesenc xmm0, xmmword [rcx + 0x70]
aesenc xmm0, xmmword [rcx + 0x80]
aesenc xmm0, xmmword [rcx + 0x90]
aesenc xmm0, xmmword [rcx + 0xa0]
aesenc xmm0, xmmword [rcx + 0xb0]
inc eax
aesenc xmm0, xmmword [rcx + 0xc0]
mov dword [rdx + 0x10], eax
aesenc xmm0, xmmword [rcx + 0xd0]
aesenclast xmm0, xmmword [rcx + 0xe0]
movdqu xmmword [r8], xmm0
ret
Function at 0x14002de50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14002de92
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14002de9a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14002deab
jmp 0x14002dec2
xor r10d, r10d
jmp 0x14002df4d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14002dec2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14002ded9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14002def9
add r11, r8
jmp 0x14002e02a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14002dfc2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14002df70
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14002dfe0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14002dff2
jmp 0x14002e00c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14002e00c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14002e026
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret