joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fd78
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x28], rax
mov dword [rcx + 0x24], eax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov qword [rcx + 0x1c], 0x5be0cd19
ret

Function at 0x14002fed0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1400b5528]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r8, rdx
lea rax, [rsp + 0x20]
sub r8, rax
mov r9, rcx
lea rax, [rsp + 0x20]
mov rdi, rcx
sub r9, rax
xor ebx, ebx
mov edx, ebx
lea r10d, [rbx + 0x10]
lea rax, [rsp + 0x20]
add rax, rdx
mov ecx, dword [r8 + rax]
mov dword [rax], ecx
mov eax, dword [r9 + rax]
xor eax, ecx
mov dword [rbp + rdx - 0x60], eax
add rdx, 4
sub r10, 1
jne 0x14002ff16
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140030d4c
mov r8d, 0x1000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140030d4c
mov r8d, 0x2000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140030d4c
mov r8d, 0x3000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140030d4c
mov r8d, 0x4000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140030d4c
mov r8d, 0x5000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140030d4c
mov r8d, 0x6000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140030d4c
mov r8d, 0x7000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140030d4c
mov r8d, 0x8000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140030d4c
mov r8d, 0x9000000
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.140030d4c
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.1400303f8
mov r8d, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400303f8
mov r8d, 2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400303f8
mov r8d, 3
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400303f8
mov r8d, 4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400303f8
mov r8d, 5
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400303f8
mov r8d, 6
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400303f8
mov r8d, 7
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400303f8
mov r8d, 8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400303f8
mov r8d, 9
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400303f8
mov eax, dword [rbp + rbx - 0x20]
xor eax, dword [rbp + rbx - 0x60]
xor dword [rbx + rdi], eax
add rbx, 4
cmp rbx, 0x40
jl 0x1400300d3
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140099bf0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400302d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1400b5528]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov rdx, rcx
lea rcx, [rbp + 7]
mov r8d, 0x40
call sub.VCRUNTIME140.dll_memcpy
xor r8d, r8d
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.1400303f8
mov r8d, 1
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x79]
call fcn.1400303f8
mov r8d, 2
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.1400303f8
mov r8d, 3
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x79]
call fcn.1400303f8
mov r8d, 4
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.1400303f8
mov r8d, 5
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x79]
call fcn.1400303f8
mov r8d, 6
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.1400303f8
mov r8d, 7
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x79]
call fcn.1400303f8
mov r8d, 8
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.1400303f8
mov r8d, 9
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.1400303f8
lea rdx, [rbp + 7]
mov ecx, select
sub rdx, rbx
mov eax, dword [rdx + rbx]
xor dword [rbx], eax
lea rbx, [rbx + 4]
sub rcx, 1
jne 0x1400303cc
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140099bf0
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rbp
ret

Function at 0x140032658
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor edi, edi
lea rsi, [rcx + 0xa0]
mov r8d, edi
mov r9, rsi
mov rbx, rcx
mov rax, r8
mov rdx, r8
and eax, 1
shr rdx, 1
inc r8
lea rcx, [rax + rdx*2]
mov rax, qword [r9]
xor qword [rbx + rcx*8 + 0x20], rax
lea r9, [r9 + 8]
cmp r8, 8
jb 0x140032679
mov rcx, rbx
call fcn.140031890
mov rax, rdi
lea rcx, [rdi + 8]
and eax, 1
shr rcx, 1
inc rdi
lea rcx, [rax + rcx*2]
mov rax, qword [rsi]
xor qword [rbx + rcx*8 + 0x20], rax
lea rsi, [rsi + 8]
cmp rdi, 8
jb 0x1400326a6
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140034438
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
mov rax, qword [rsp + 0x28]
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
movdqu xmmword [r8], xmm3
pxor xmm1, xmm0
pslldq xmm2, 4
movdqa xmm4, xmm2
pslldq xmm2, 4
pxor xmm4, xmm1
pxor xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [r9], xmm4
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm2
mov rax, qword [rsp + 0x30]
pxor xmm0, xmm4
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm3
mov rax, qword [rsp + 0x38]
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm2
pxor xmm0, xmm3
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm2, xmm1
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
mov rax, qword [rsp + 0x40]
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqu xmmword [rax], xmm3
movdqa xmm0, xmm1
mov rax, qword [rsp + 0x48]
pxor xmm0, xmm3
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
movdqu xmmword [rax], xmm2
pxor xmm3, xmm1
mov rax, qword [rsp + 0x50]
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm3
mov rax, qword [rsp + 0x58]
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqu xmmword [rax], xmm2
ret
Function at 0x14007ece0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1400a4420]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 1
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 1
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
pxor xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.14007f320
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
pxor xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x14007ee70
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1400a4420]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 2
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 2
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
pxor xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.14007f320
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
pxor xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x14007f000
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1400a4420]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 4
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 4
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
pxor xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.14007f320
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
pxor xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x14007f190
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
pshufd xmm0, xmmword [rdx], 0x55
lea r10, [0x1400a4420]
mov rbp, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov r14, rdx
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
movzx esi, byte [r8 + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or esi, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl esi, 8
movzx eax, byte [rcx + r10]
or esi, eax
movzx eax, r9b
shl esi, 8
movzx ecx, byte [rax + r10]
or esi, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r10]
movzx eax, byte [rax + r10]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r10]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r10]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov ebx, eax
mov edx, 8
mov ecx, esi
xor ebx, 8
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm1, ebx
lea rcx, [rsp + 0x20]
xor eax, 8
movd xmm2, edi
punpckldq xmm2, xmm1
movd xmm3, esi
movd xmm0, eax
punpckldq xmm3, xmm0
punpcklqdq xmm3, xmm2
movdqu xmm2, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm0, xmm2
pshufd xmm4, xmm3, 0xff
pxor xmm0, xmmword [rbp]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm4
movdqu xmmword [rbp], xmm1
movdqa xmmword [rsp + 0x20], xmm1
call fcn.14007f320
movdqu xmm2, xmmword [r14]
pshufd xmm3, xmm0, 0xaa
pslldq xmm2, 4
movdqa xmm0, xmm2
pxor xmm0, xmmword [r14]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
pxor xmm1, xmm2
pxor xmm1, xmm3
movdqu xmmword [r14], xmm1
add rsp, 0x30
pop r14
ret
Function at 0x14007f320
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
pshufd xmm0, xmmword [rcx], 0x55
lea r9, [0x1400a4420]
movd eax, xmm0
pshufd xmm0, xmmword [rcx], 0xff
mov r8d, eax
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 0x18
movzx esi, byte [rdx + r9]
movzx eax, byte [rax + r9]
shl eax, 8
or esi, eax
mov eax, r8d
shr rax, 8
movzx edx, al
shl esi, 8
movzx eax, byte [rdx + r9]
or esi, eax
movzx eax, r8b
shl esi, 8
movzx edx, byte [rax + r9]
movd eax, xmm0
or esi, edx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx edi, byte [rcx + r9]
movzx eax, byte [rax + r9]
shl eax, 8
or edi, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl edi, 8
movzx eax, byte [rcx + r9]
or edi, eax
movzx eax, dl
shl edi, 8
mov edx, 8
movzx ecx, byte [rax + r9]
or edi, ecx
mov ecx, edi
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
mov edx, 8
mov ecx, esi
mov ebx, eax
call sub.api_ms_win_crt_utility_l1_1_0.dll__rotr
movd xmm2, ebx
mov rbx, qword [rsp + 0x30]
movd xmm0, esi
mov rsi, qword [rsp + 0x38]
movd xmm1, eax
movd xmm3, edi
punpckldq xmm0, xmm1
punpckldq xmm3, xmm2
punpcklqdq xmm0, xmm3
add rsp, 0x20
pop rdi
ret
Function at 0x140083dec
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x198
mov rax, qword [0x1400b5528]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov eax, 0x88
movsxd r12, r9d
mov r13, r8
mov esi, edx
mov r15, rcx
mov ebp, 0x64
sub ebp, r12d
lea rcx, [rsp + 0x20]
lea r8d, [rax + 0x40]
add ebp, ebp
cmp r12d, r8d
cmove ebp, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov eax, ebp
xor edi, edi
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd r14, eax
cmp esi, ebp
jl 0x140083e8a
movsxd rbx, ebp
mov rcx, rdi
test r14, r14
jle 0x140083e72
mov rax, qword [r15 + rcx*8]
xor qword [rsp + rcx*8 + 0x20], rax
inc rcx
cmp rcx, r14
jl 0x140083e61
mov edx, 0x18
lea rcx, [rsp + 0x20]
call fcn.140083f30
sub esi, ebp
add r15, rbx
cmp esi, ebp
jge 0x140083e59
movsxd rbx, esi
lea rcx, [rsp + 0xf0]
mov r8, rbx
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov eax, ebp
mov byte [rsp + rbx + 0xf0], 1
inc esi
lea rcx, [rsp + 0xf0]
sub eax, esi
xor edx, edx
movsxd r8, eax
movsxd rax, esi
add rcx, rax
call sub.VCRUNTIME140.dll_memset
movsxd rax, ebp
or byte [rsp + rax + 0xef], 0x80
test r14, r14
jle 0x140083eeb
mov rax, qword [rsp + rdi*8 + 0xf0]
xor qword [rsp + rdi*8 + 0x20], rax
inc rdi
cmp rdi, r14
jl 0x140083ed6
mov edx, 0x18
lea rcx, [rsp + 0x20]
call fcn.140083f30
mov r8, r12
lea rdx, [rsp + 0x20]
mov rcx, r13
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.140099bf0
add rsp, 0x198
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400876dc
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1400b76f4], 0
jne 0x140087714
lea rcx, str.HWLOC_HIDE_ERRORS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14008770a
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x1400b76f0], eax
mov dword [0x1400b76f4], 1
mov eax, dword [0x1400b76f0]
add rsp, 0x28
ret

Function at 0x140088358
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
sub rsp, 0x40
xor esi, esi
mov rbx, rcx
cmp dword [rcx + 0xb8], esi
je 0x140088388
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], select
or eax, 0xffffffff
jmp 0x140088545
call fcn.140092640
lea rcx, str.HWLOC_XML_USERDATA_NOT_DECODED
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ebp, 1
test rax, rax
je 0x1400883aa
mov dword [rbx + 0x280], ebp
lea rcx, str.HWLOC_COMPONENTS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400884c2
cmp qword [rbx + 0x2c0], rsi
jne 0x1400884c2
lea rcx, str.HWLOC_FSROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140088402
mov qword [rsp + 0x30], rsi
lea r9, str.linux
mov qword [rsp + 0x28], rsi
mov r8d, ebp
mov edx, ebp
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call fcn.140090854
cmp qword [rbx + 0x2c0], rsi
jne 0x1400884c2
lea rcx, str.HWLOC_CPUID_PATH
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140088444
mov qword [rsp + 0x30], rsi
lea r9, [0x1400a5e4c]
mov qword [rsp + 0x28], rsi
mov r8d, ebp
mov edx, ebp
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call fcn.140090854
cmp qword [rbx + 0x2c0], rsi
jne 0x1400884c2
lea rcx, str.HWLOC_SYNTHETIC
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140088483
mov qword [rsp + 0x30], rsi
lea r9, str.synthetic
mov qword [rsp + 0x28], rsi
or r8d, 0xffffffff
mov edx, ebp
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140090854
cmp qword [rbx + 0x2c0], rsi
jne 0x1400884c2
lea rcx, str.HWLOC_XMLFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400884c2
mov qword [rsp + 0x30], rsi
lea r9, [0x1400a5dc4]
mov qword [rsp + 0x28], rsi
or r8d, 0xffffffff
mov edx, ebp
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140090854
mov rcx, rbx
call fcn.140090c58
mov rcx, rbx
call fcn.140090518
mov rcx, rbx
call fcn.1400904dc
mov rcx, rbx
call fcn.14008fe18
mov rcx, rbx
call fcn.140091268
mov rcx, rbx
call fcn.140086960
mov rcx, rbx
test eax, eax
jns 0x14008851b
call fcn.1400911f8
mov rcx, rbx
call fcn.140088194
mov rcx, rbx
call fcn.1400885b4
mov rcx, rbx
call fcn.140090438
jmp 0x140088380
call fcn.1400911f8
lea rcx, str.HWLOC_DEBUG_CHECK
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rcx, rbx
call fcn.140092628
mov rcx, rbx
call fcn.14009276c
xor eax, eax
mov dword [rbx + 0xb8], ebp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
Function at 0x14008d6d4
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x1400b7714], 0
jne 0x14008d70c
lea rcx, str.HWLOC_XML_VERBOSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14008d702
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x1400b7718], eax
mov dword [0x1400b7714], 1
mov eax, dword [0x1400b7718]
add rsp, 0x28
ret

Function at 0x14008d718
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
mov rax, qword [0x1400b5528]
xor rax, rsp
mov qword [rsp + 0x40], rax
movss xmm7, dword [0x1400a7618]
mov r13, rcx
lea rcx, str.HWLOC_XML_V1DIST_SCALE
mov r14, r9
mov rsi, r8
mov ebx, edx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14008d853
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm7, xmm7
cvtsd2ss xmm7, xmm0
imul ebx, ebx
test ebx, ebx
je 0x14008d7d9
movss xmm1, dword [0x1400a761c]
mov edx, ebx
movaps xmm0, xmm7
xor ecx, ecx
mulss xmm0, dword [rsi]
comiss xmm0, xmm1
jb 0x14008d7c0
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x14008d7c0
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rsi, 4
add rax, rcx
mov qword [r14], rax
add r14, 8
sub rdx, 1
jne 0x14008d79c
xorps xmm2, xmm2
lea rdx, [0x1400a7278]
cvtss2sd xmm2, xmm7
lea rcx, [rsp + 0x28]
movq r8, xmm2
call fcn.14000ba20
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.14008e028
mov rcx, rax
lea r8, [rsp + 0x28]
lea rdx, str.xmlv1DistancesScale
call fcn.140087b3c
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140099bf0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edi, ebx
xor r15d, r15d
imul edi, ebx
test edi, edi
je 0x14008d817
movss xmm9, dword [0x1400a7614]
mov r12, r14
mov rbp, rsi
xorps xmm8, xmm8
movss xmm6, dword [rbp]
comiss xmm8, xmm6
ja 0x14008d78b
lea rdx, [rsp + 0x20]
movaps xmm0, xmm6
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_modff]
comiss xmm0, dword [0x1400a760c]
jbe 0x14008d8a2
comiss xmm9, xmm0
ja 0x14008d78b
addss xmm6, dword [0x1400a7610]
inc r15d
add rbp, 4
cvttss2si eax, xmm6
movsxd rcx, eax
mov qword [r12], rcx
add r12, 8
cmp r15d, edi
jb 0x14008d872
jmp 0x14008d817