joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b888
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x80
test rcx, rcx
mov rdi, r8
mov r12, rcx
mov qword [rsp + 0x40], 0
jne 0x40b8b6
lea eax, [rcx + 0x57]
jmp 0x40ba3f
lea rcx, str.PROGRAMDATA
call fcn.0041b6b0
lea rdx, [rsp + 0x48]
lea rcx, str.S_1_5_32_545
xor esi, esi
mov qword [rsp + 0x48], 0
mov rbx, rax
mov dword [rsp + 0xc0], esi
call sub.ADVAPI32.dll_ConvertStringSidToSidA
test eax, eax
je 0x40b90d
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.0040b684
mov esi, dword [rsp + 0xc0]
mov rbx, rax
jmp 0x40b91b
lea rcx, str._Utils__Unable_to_convert_SID_n
call fcn.0040bf40
xor ebx, ebx
test rbx, rbx
jne 0x40b928
lea eax, [rbx + 0x65]
jmp 0x40ba3f
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x30]
call fcn.00419160
lea r14d, [rsi + 1]
mov dword [rsp + 0x50], 0x1200a9
lea rcx, [r14 + r14*2]
mov dword [rsp + 0x54], 1
mov dword [rsp + 0x58], 3
shl rcx, 4
mov dword [rsp + 0x6c], 0
mov qword [rsp + 0x78], rdi
call fcn.00417180
test esi, esi
mov rdi, rax
je 0x40b99a
mov rbp, rax
sub rbx, rax
mov r13d, esi
lea rdx, [rbx + rbp]
mov rcx, rbp
mov r8d, 0x30
call fcn.00417ce0
add rbp, 0x30
sub r13, 1
jne 0x40b97e
mov eax, esi
lea rdx, [rsp + 0x50]
mov r8d, 0x30
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, rdi
call fcn.00417ce0
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov ecx, r14d
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclA]
test eax, eax
mov ebx, eax
je 0x40b9da
lea rcx, str.SetEntriesInAcl_Error__u_n
jmp 0x40ba19
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea edx, [r9 + 1]
mov r8d, 0x80000004
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoA]
test eax, eax
mov ebx, eax
je 0x40ba20
lea rcx, str.SetNamedSecurityInfo_Error__u_n
mov edx, eax
call fcn.0040bf40
test rdi, rdi
je 0x40ba2d
mov rcx, rdi
call fcn.00417140
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x40ba3d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
add rsp, 0x80
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40ba54
Capabilities:
Encode data using xor
Get session user name
Hash data using fnv
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x100
lea rcx, str.ALLUSERSPROFILE
call fcn.0041b6b0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r12, rax
mov dword [rsp + 0x130], 0x64
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rsp + 0x20]
call fcn.00417390
xor esi, esi
xor edi, edi
test eax, eax
mov ebx, 0x811c9dc5
movsxd rbp, eax
jle 0x40bad7
movzx ecx, byte [rsp + rdi + 0x20]
mov edx, esi
xor ebx, ecx
movsx r8d, cl
lea rcx, str.__d___d__d_n
imul ebx, ebx, 0x1000193
mov r9d, ebx
call fcn.0040bf40
add rdi, 1
add esi, 1
cmp rdi, rbp
jl 0x40baa9
test ebx, ebx
jns 0x40badd
neg ebx
xor edx, edx
lea rcx, [rsp + 0x90]
lea r8d, [rdx + 0x64]
call fcn.00419160
lea rdx, [0x0044d954]
lea rcx, [rsp + 0x90]
mov r8d, ebx
call fcn.00418320
lea rcx, [rsp + 0x20]
xor ebx, ebx
call fcn.00417390
test rax, rax
je 0x40bb37
cmp byte [rsp + rbx + 0x20], 0x80
jb 0x40bb24
mov byte [rsp + rbx + 0x20], 0x5f
lea rcx, [rsp + 0x20]
add rbx, 1
call fcn.00417390
cmp rbx, rax
jb 0x40bb18
mov ecx, 0x1388
call fcn.00417180
mov rdx, r12
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call fcn.00417450
lea rdx, str.JWUser_
mov rcx, rbx
call fcn.0040bea0
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.00417450
lea rdx, [0x0044cb48]
mov rcx, rbx
call fcn.00417450
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.00417450
mov rcx, rbx
call fcn.0040be58
mov rax, rbx
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40bba8
Capabilities:
Check os version
Query environment variable

Disassembly:
push rbx
push rdi
sub rsp, 0xc8
lea rcx, str.APPDATA
mov dword [rsp + 0x20], 0x94
call fcn.0041b6b0
test rax, rax
mov rdi, rax
je 0x40bc83
mov rcx, rax
call fcn.00417390
cmp rax, 2
jbe 0x40bc83
cmp byte [rdi], 0x5c
jne 0x40bc83
cmp byte [rdi + 1], 0x5c
jne 0x40bc83
lea rcx, str._Extractor__Roaming_AppData_directory_detected_n
call fcn.0040bf40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40bc8f
cmp dword [rsp + 0x24], 5
jbe 0x40bc39
lea rcx, str.LOCALAPPDATA
call fcn.0041b6b0
lea rcx, str._Extractor__Local_AppData_directory_resolved_to__s_n
mov rdx, rax
mov rdi, rax
call fcn.0040bf40
jmp 0x40bc8f
lea rcx, str.USERPROFILE
call fcn.0041b6b0
mov ecx, 0x1388
mov rbx, rax
call fcn.00417180
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.00417450
lea rdx, str.Local_Settings
mov rcx, rdi
call fcn.0040bea0
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.0040bea0
jmp 0x40bc8f
lea rcx, str._Extractor__Local_AppData_directory_detected_n
call fcn.0040bf40
lea rcx, str.Validating_directory..._n
call fcn.0040bf40
lea rcx, str.Shared_dir_detected_is__s_n
mov rdx, rdi
call fcn.0040bf40
lea rcx, str._Utils__Checking_if__s_exists_n
mov rdx, rdi
call fcn.0040bf40
mov edx, 6
mov rcx, rdi
call fcn.0041d780
test eax, eax
jne 0x40bd45
lea rcx, str.Checking_if_string_is_cAscii__s_n
mov rdx, rdi
call fcn.0040bf40
mov rcx, rdi
xor ebx, ebx
call fcn.00417390
test rax, rax
je 0x40bcff
cmp byte [rbx + rdi], 0x80
jae 0x40bd45
mov rcx, rdi
add rbx, 1
call fcn.00417390
cmp rbx, rax
jb 0x40bce8
lea rcx, str.Checking_if__s_contains_a___n
mov rdx, rdi
call fcn.0040bf40
mov rcx, rdi
xor ebx, ebx
call fcn.00417390
test rax, rax
je 0x40bd34
cmp byte [rbx + rdi], 0x21
je 0x40bd45
mov rcx, rdi
add rbx, 1
call fcn.00417390
cmp rbx, rax
jb 0x40bd1d
lea rcx, str.Shared_directory_appears_valid._n
call fcn.0040bf40
jmp 0x40bdca
lea rcx, str.The_directory__s_appears_invalid._n
mov rdx, rdi
call fcn.0040bf40
lea rcx, str.Trying_the_short_path_instead._n
mov rdx, rdi
call fcn.0040bf40
mov ecx, 0x1388
call fcn.00417180
mov r8d, 0x400
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40bdba
lea rcx, str.Got_short_path_of__s_n
mov rdx, rbx
call fcn.0040bf40
lea rcx, str._Utils__Checking_if__s_exists_n
mov rdx, rdi
call fcn.0040bf40
mov edx, 6
mov rcx, rdi
call fcn.0041d780
test eax, eax
jne 0x40bdba
mov rax, rbx
jmp 0x40bdcd
mov rcx, rbx
call fcn.00417140
call fcn.0040ba54
mov rdi, rax
mov rax, rdi
add rsp, 0xc8
pop rdi
pop rbx
ret
Function at 0x40e280
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40e2a7
lea rdx, str.._srchashes_sha2_sha256.c
lea rcx, str.md___NULL
mov r8d, 0xd0
call fcn.00410a80
xor eax, eax
mov dword [rbx + 0x280], 0x6a09e667
mov dword [rbx + 0x284], 0xbb67ae85
mov dword [rbx + 0x288], 0x3c6ef372
mov dword [rbx + 0x28c], 0xa54ff53a
mov dword [rbx + 0x290], 0x510e527f
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x9b05688c
mov dword [rbx + 0x298], 0x1f83d9ab
mov dword [rbx + 0x29c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret

Function at 0x40e840
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40e865
lea r8d, [rcx + 0x2a]
lea rdx, str.c:users_simplehelpworkspace_runner_nativelibtomlibtomcrypt_srchashes_sha2_sha224.c
lea rcx, str.md___NULL
call fcn.00410a80
xor eax, eax
mov dword [rbx + 0x280], 0xc1059ed8
mov dword [rbx + 0x284], 0x367cd507
mov dword [rbx + 0x288], 0x3070dd17
mov dword [rbx + 0x28c], 0xf70e5939
mov dword [rbx + 0x290], 0xffc00b31
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x68581511
mov dword [rbx + 0x298], 0x64f98fa7
mov dword [rbx + 0x29c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret
Function at 0x411f00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0xc8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
test eax, eax
mov qword [rsp + 0x48], rdi
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
js 0x41207e
cdq
and edx, 7
add eax, edx
and eax, 7
cmp eax, edx
jne 0x41207e
cmp r8, 8
mov qword [rsp + 0x38], rbp
jb 0x411fa1
xor ebp, ebp
nop
nop
mov eax, dword [rbx + 0xc8]
test eax, eax
je 0x411fa1
cdq
add rsi, 1
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
cmp dword [rbx + 0xc8], 0x440
jne 0x411f97
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.00411b60
mov dword [rbx + 0xc8], ebp
sub rdi, 8
cmp rdi, 8
jae 0x411f50
cmp rdi, 0x440
jb 0x411fee
movabs rax, 0xf0f0f0f0f0f0f0f1
mul rdi
mov rbp, rdx
shr rbp, 0xa
mov rax, rbp
imul rax, rax, 0xfffffffffffffbc0
add rdi, rax
nop
nop
mov r8d, 0x11
mov rdx, rsi
mov rcx, rbx
call fcn.00411b60
add rsi, 0x88
sub rbp, 1
jne 0x411fd0
cmp rdi, 8
mov rbp, qword [rsp + 0x38]
jb 0x41203a
mov r8, rdi
shr r8, 3
mov rax, r8
imul rax, rax, 0xfffffffffffffff8
add rdi, rax
nop
nop
mov eax, dword [rbx + 0xc8]
add rsi, 1
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
sub r8, 1
jne 0x412010
test rdi, rdi
je 0x412068
mov eax, dword [rbx + 0xc8]
mov ecx, 8
cdq
sub cl, dil
and edx, 7
add eax, edx
movzx edx, byte [rsi]
sar eax, 3
shr dl, cl
movsxd r8, eax
xor byte [r8 + rbx], dl
add dword [rbx + 0xc8], edi
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x28
ret

Function at 0x4182f0
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x418319
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x418319
mov ecx, eax
call fcn.00417690
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x418dc0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x418de9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x418de9
mov ecx, eax
call fcn.00417690
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x41d780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x41d7c6
call fcn.00417660
mov dword [rax], 0
call fcn.00417630
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
mov qword [rsp + 0x20], 0
call fcn.0041f8c0
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test edx, 0xfffffff9
jne 0x41d78d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41d7f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00417690
call fcn.00417630
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test al, 0x10
jne 0x41d82b
test al, 1
je 0x41d82b
test bl, 2
je 0x41d82b
call fcn.00417660
mov dword [rax], 5
call fcn.00417630
mov dword [rax], 0xd
call fcn.00417630
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x41d840
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41d86b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d86b
mov ecx, eax
call fcn.00417690
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x41d880
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x41d8a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d8a9
mov ecx, eax
call fcn.00417690
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x429d27
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004586e8]
jne 0x41e01a
rol rcx, 0x10
test cx, 0xffff
jne 0x41e016
repz ret
ror rcx, 0x10
jmp 0x429c80
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0045c740]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0045c838]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x429d05
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0045c740]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x429d27
mov rax, qword [rsp + 0x88]
mov qword [0x0045c838], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0045c7d8], rax
mov rax, qword [0x0045c838]
mov qword [0x0045c6b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0045c7c0], rax
mov dword [0x0045c6a0], 0xc0000409
mov dword [0x0045c6a4], 1
mov rax, qword [0x004586e8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004586f0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0045c738], eax
mov ecx, 1
call fcn.0042a500
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0044ab40]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0045c738], 0
jne 0x429dae
mov ecx, 1
call fcn.0042a500
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x429dd0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0041fa50
xor ebx, ebx
cmp qword [0x0045cc10], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x429f01
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x429e33
xor eax, eax
jmp 0x429fe1
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x429e2c
mov rcx, rax
call fcn.0041f9e0
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0045cc10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041f9e0
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0045cc18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041f9e0
lea rcx, [rsp + 0x30]
mov qword [0x0045cc20], rax
call fcn.004185c0
test eax, eax
je 0x429eb7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041f820
cmp dword [rsp + 0x30], 2
jne 0x429f01
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041f9e0
test rax, rax
mov qword [0x0045cc30], rax
je 0x429f01
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041f9e0
mov qword [0x0045cc28], rax
mov rcx, qword [0x0045cc28]
cmp rcx, rsi
je 0x429f93
cmp qword [0x0045cc30], rsi
je 0x429f93
call fcn.0041fab0
call rax
test rax, rax
mov rbp, rax
je 0x429f5e
mov rcx, qword [0x0045cc30]
call fcn.0041fab0
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x429f5e
test byte [rsp + 0x48], 1
jne 0x429f93
lea rcx, [rsp + 0x34]
call fcn.00418610
test eax, eax
je 0x429f80
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041f820
cmp dword [rsp + 0x34], 4
jb 0x429f8d
bts edi, 0x15
jmp 0x429fc7
bts edi, 0x12
jmp 0x429fc7
mov rcx, qword [0x0045cc18]
cmp rcx, rsi
je 0x429fc7
call fcn.0041fab0
call rax
test rax, rax
mov rbx, rax
je 0x429fc7
mov rcx, qword [0x0045cc20]
cmp rcx, rsi
je 0x429fc7
call fcn.0041fab0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0045cc10]
call fcn.0041fab0
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x440160
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, [0x00446160]
mov rbx, rdx
mov r11, rcx
not r8d
cmp rdx, 8
jbe 0x440266
mov qword [rsp + 0x10], rdi
test cl, 7
je 0x4401b4
nop word [rax + rax]
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
test r11b, 7
jne 0x440190
mov rdi, rbx
and ebx, 7
and rdi, 0xfffffffffffffff8
add rdi, r11
cmp r11, rdi
jae 0x440261
nop word [rax + rax]
xor r8d, dword [r11]
mov r10d, dword [r11 + 4]
add r11, 8
mov r9d, r8d
mov eax, r8d
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 8
movzx ecx, al
mov eax, r10d
mov r8d, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rax*4]
movzx eax, r9b
xor r8d, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor r8d, dword [rsi + rax*4 + 0xc00]
cmp r11, rdi
jb 0x4401d0
mov rdi, qword [rsp + 0x10]
test rbx, rbx
je 0x440292
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub rbx, 1
jne 0x440270
mov rbx, qword [rsp + 0x18]
not r8d
mov eax, r8d
pop rsi
ret

Function at 0x4402a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
lea r14, [0x00448160]
mov rbx, rdx
mov r11, rcx
not r8
cmp rdx, 4
jbe 0x440387
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
test cl, 3
je 0x4402f5
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [r14 + rcx*8]
xor r8, rax
test r11b, 3
jne 0x4402d0
xor esi, esi
mov rcx, rbx
and rcx, 0xfffffffffffffffc
and ebx, 3
lea rdi, [rcx + 3]
shr rdi, 2
lea rax, [rcx + r11]
cmp r11, rax
cmova rdi, rsi
test rdi, rdi
je 0x44037d
nop dword [rax]
mov r10d, dword [r11]
inc rsi
mov eax, r8d
add r11, 4
xor r10, rax
mov rax, r10
shr rax, 0x10
movzx edx, al
mov rax, r10
shr rax, 8
movzx ecx, al
mov rax, r10
shr rax, 0x18
mov r9, qword [r14 + rdx*8 + 0x800]
xor r9, qword [r14 + rcx*8 + 0x1000]
xor r9, qword [r14 + rax*8]
movzx eax, r10b
xor r9, qword [r14 + rax*8 + 0x1800]
mov rax, r8
shr rax, 0x20
mov r8, r9
xor r8, rax
cmp rsi, rdi
jb 0x440320
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
test rbx, rbx
je 0x4403b3
nop dword [rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [r14 + rcx*8]
xor r8, rax
sub rbx, 1
jne 0x440390
mov rbx, qword [rsp + 0x20]
not r8
mov rax, r8
pop r14
ret
Function at 0x14002df20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14002df40
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x14002df80
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14002dfa0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x14002dfe0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14002e003
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x14002e060
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14002e083
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x14002e0e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14002e109
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret