joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402f057c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r14, qword [rbp + 0x77]
mov rdi, rdx
xor edx, edx
mov r12, r9
and dword [rbp + 0x67], edx
mov r15d, r8d
and dword [rbp - 0x39], edx
mov rsi, rcx
mov qword [rbp - 0x29], rdx
cmp dword [r14], r8d
jae 0x1402f05c5
mov edi, 0x80049e19
jmp 0x1402f0729
mov rax, qword [rdi]
and qword [rbp - 0x21], rdx
and qword [rbp - 0x31], rdx
and qword [rbp - 0x19], rdx
mov rbx, qword [rax]
mov rcx, rbx
call qword [0x1403af620]
lea r8, [rbp - 0x31]
mov rcx, rdi
lea rdx, [0x140400020]
call rbx
test eax, eax
je 0x1402f05fe
mov edi, 0x80049e2f
jmp 0x1402f0686
mov rdi, qword [rbp - 0x31]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x30]
mov rcx, rbx
call qword [0x1403af620]
lea rdx, [rbp - 0x21]
mov rcx, rdi
call rbx
mov edi, eax
test eax, eax
js 0x1402f0686
mov rdx, qword [rbp - 0x21]
lea r8, [rbp - 0x19]
mov rcx, rsi
call fcn.1402efcd4
mov edi, eax
test eax, eax
js 0x1402f0686
lea rax, [0x14004f7f8]
mov qword [rbp - 0x11], 3
mov qword [rbp - 9], rax
lea rdx, [rbp - 0x11]
lea rax, [rbp + 0x77]
mov qword [rbp + 7], rsi
mov qword [rbp - 1], rax
xor r9d, r9d
mov rax, qword [rbp - 0x31]
mov ecx, 0xb9
mov qword [rbp + 0xf], rax
mov rax, qword [rbp - 0x19]
mov qword [rbp + 0x17], rax
lea r8d, [r9 + 0x38]
lea rax, [rbp - 0x29]
mov qword [rbp + 0x1f], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, dword [rbp + 0x77]
mov rsi, qword [rbp - 0x21]
test rsi, rsi
je 0x1402f06a9
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [0x1403af620]
mov rcx, rsi
call rbx
and qword [rbp - 0x21], 0
mov rsi, qword [rbp - 0x31]
test rsi, rsi
je 0x1402f06cc
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [0x1403af620]
mov rcx, rsi
call rbx
and qword [rbp - 0x31], 0
test edi, edi
js 0x1402f0725
mov eax, dword [r14]
mov r8d, r15d
mov r9, qword [rbp + 0x7f]
mov rdx, r12
mov rcx, qword [rbp - 0x29]
mov dword [rbp + 0x67], eax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
call fcn.1401619cc
mov edi, eax
test eax, eax
js 0x1402f0725
mov eax, dword [r14]
lea r9, [rbp - 0x39]
mov r8d, dword [rbp + 0x67]
sub eax, r8d
mov rdx, qword [rbp + 0x7f]
mov rcx, qword [rbp - 0x29]
mov dword [rbp - 0x39], eax
call fcn.140161cf0
mov edi, eax
test eax, eax
js 0x1402f0725
mov ecx, dword [rbp + 0x67]
add ecx, dword [rbp - 0x39]
mov dword [r14], ecx
mov rdx, qword [rbp - 0x29]
cmp dword [0x14042f560], 0
je 0x1402f073c
test rdx, rdx
je 0x1402f073c
call fcn.1401648ac
lea r11, [rsp + 0x90]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140365dc8
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rsi, r8
mov ebp, edx
mov rdi, rcx
test r8, r8
je 0x140365f72
cmp edx, 0x14
jbe 0x140365f72
mov rbx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rdi + 0x20], 0
mov rbx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rdi + 0x10], 0
lea r15, [rdi + 0x30]
mov rcx, qword [r15]
and dword [rdi + 0x18], 0
test rcx, rcx
je 0x140365e4e
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
and qword [r15], 0
mov ecx, dword [rsi + 0xc]
lea r14, [rdi + 0x2c]
shr ecx, 3
mov dword [rdi + 0x28], ecx
mov eax, dword [rsi + 0x10]
mov dword [r14], eax
mov eax, ecx
shr eax, 1
add eax, 4
lea eax, [rax + rax*4]
lea ecx, [rax + rcx*2]
cmp ebp, ecx
jne 0x140365f72
mov rbx, qword [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rdi + 0x20], 0
mov ebx, dword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi + 0x20], rax
test rax, rax
jne 0x140365ebd
mov ebx, 0x8007000e
jmp 0x140365f77
mov r8d, dword [rdi + 0x28]
lea rdx, [rsi + 0x14]
mov rcx, rax
call sub.msvcrt.dll_memcpy
test r14, r14
je 0x140365f72
mov edx, 4
mov rcx, r14
call fcn.140366d94
mov ebx, eax
test eax, eax
jne 0x140365f77
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140365f72
mov edx, dword [rdi + 0x28]
call fcn.140366d94
mov ebx, eax
test eax, eax
jne 0x140365f77
lea r14, [rdi + 0x38]
cmp qword [r14], 0
jne 0x140365f46
lea r9d, [rax + 0x18]
mov dword [rsp + 0x20], 0xf0000000
lea r8, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140365f46
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140365f77
mov rcx, qword [r14]
xor r9d, r9d
mov qword [rsp + 0x28], r15
mov r8d, ebp
mov rdx, rsi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x140365f30
mov dword [rdi + 0xc], 4
jmp 0x140365f77
mov ebx, 0x80070057
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1403672d8
Capabilities:
Encrypt or decrypt via wincrypt
Generate random numbers via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
mov r12, r9
mov dword [rax + 0x10], r15d
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
mov edi, r15d
test rdx, rdx
je 0x1403674f3
test r9, r9
je 0x1403674f3
mov r14, qword [rsp + 0xa0]
test r14, r14
je 0x1403674f3
cmp qword [rcx + 0x30], r15
jne 0x14036733b
mov ebx, 0x80049e51
jmp 0x1403674f8
mov r13d, dword [r14]
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes128_cbc
mov rcx, rsi
mov dword [r14], r15d
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140367367
cmp dword [rbx + 0xc], 1
lea esi, [rax + 0x10]
je 0x1403673a3
mov ebx, 0x80049e2e
jmp 0x1403674f8
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes192_cbc
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140367383
cmp dword [rbx + 0xc], 2
lea esi, [rax + 0x18]
jmp 0x14036735b
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes256_cbc
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1403674ec
cmp dword [rbx + 0xc], 3
lea esi, [rax + 0x20]
jmp 0x14036735b
mov rcx, qword [rbx + 0x30]
lea r15d, [rsi + rbp]
xor r9d, r9d
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0x88]
mov dword [rsp + 0x88], r15d
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], rdi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1403673f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1403674f8
mov ebp, dword [rsp + 0x88]
mov dword [r14], ebp
mov r14, qword [rsp + 0xa8]
test r14, r14
je 0x1403674e8
cmp r13d, ebp
jae 0x140367420
mov ebx, 0x80049e19
jmp 0x1403674f8
mov dword [rsp + 0x88], r15d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14036744e
mov ebx, 0x8007000e
jmp 0x1403674f8
mov r8, rbp
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
mov r8d, dword [rsp + 0x90]
mov rdx, r12
mov ecx, esi
add rcx, rdi
call sub.msvcrt.dll_memcpy
mov r15d, 2
mov r8d, esi
mov r9d, r15d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
je 0x1403674a4
mov r9d, r15d
mov r8d, esi
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov ebx, eax
bts ebx, 0x1c
jmp 0x1403674f8
mov rcx, qword [rbx + 0x30]
lea rax, [rsp + 0x88]
xor r9d, r9d
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x1403673dd
mov r8d, dword [rsp + 0x88]
mov rdx, rdi
mov rcx, r14
call sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x1403674f8
mov ebx, 0x80049e5b
jmp 0x1403674f8
mov ebx, 0x80070057
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14036752c
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov r12d, r8d
mov dword [rax + 0x10], edi
mov r15, r9
mov rbp, rdx
mov rsi, rcx
mov ebx, edi
test rdx, rdx
je 0x14036769c
test r9, r9
je 0x14036769c
mov r14, qword [rsp + 0x80]
test r14, r14
je 0x14036769c
cmp qword [rcx + 0x30], rdi
jne 0x14036758e
mov edi, 0x80049e51
jmp 0x1403676a1
mov r13d, dword [r14]
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes128_cbc
mov rcx, rbp
mov dword [r14], edi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1403675b7
cmp dword [rsi + 0xc], 1
je 0x1403675ed
mov edi, 0x80049e2e
jmp 0x1403676a1
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes192_cbc
mov rcx, rbp
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x1403675d0
cmp dword [rsi + 0xc], 2
jmp 0x1403675ab
lea rdx, str.http:__www.w3.org_2001_04_xmlencaes256_cbc
mov rcx, rbp
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140367695
cmp dword [rsi + 0xc], 3
jmp 0x1403675ab
mov dword [rsp + 0x68], r12d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140367618
mov edi, 0x8007000e
jmp 0x1403676a1
mov r8d, dword [rsp + 0x68]
mov rdx, r15
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsi + 0x30]
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rbx
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x140367664
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x1403676a1
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
add eax, 0xfffffff0
mov dword [r14], eax
test rcx, rcx
je 0x1403676a1
cmp r13d, eax
jae 0x140367687
mov edi, 0x80049e19
jmp 0x1403676a1
mov r8d, eax
lea rdx, [rbx + 0x10]
call sub.msvcrt.dll_memcpy
jmp 0x1403676a1
mov edi, 0x80049e5b
jmp 0x1403676a1
mov edi, 0x80070057
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140368c1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140368c68
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140368c60
cmp dword [rcx + 0x3c], edx
jl 0x140368c60
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140368c60
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140368c68
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140019a40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140019bd0
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x1400a3bd0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.14003a080
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x140019aa5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x140019ac0
add rsp, 0x48
pop rbp
ret
call fcn.140054c60
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x140019adf
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140019aef
cmp rbx, 0x1000
jae 0x140019aab
jmp 0x140019b5a
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140019b02
xor edx, edx
nop
jmp 0x140019b51
mov rcx, qword [0x1400a3bd0]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.14003a080
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x140019ae5
jmp 0x140019ad4
call fcn.14006c1c0
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003de80
lea rax, [0x1400ccd60]
mov ebx, 0x18
call fcn.14003e6c0
mov rax, qword [rsp + 0x38]
call fcn.14003e420
lea rax, [0x1400cd0cf]
mov ebx, 0x19
call fcn.14003e6c0
mov rax, qword [rsp + 0x30]
call fcn.14003e420
call fcn.14003e0a0
call fcn.14003dee0
lea rax, [0x1400cee7d]
mov ebx, 0x21
call fcn.14003c4e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140068be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140019a40
Function at 0x140019c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140019e2a
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x1400a3bc8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.14003a120
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x140019c73
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x140019c9a
add rsp, 0x50
pop rbp
ret
mov rax, rcx
nop dword [rax]
call fcn.140054c60
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x140019cbc
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x140019ccc
cmp rbx, 0x1000
jae 0x140019c79
jmp 0x140019d4e
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140019cde
xor esi, esi
jmp 0x140019d40
mov rax, qword [0x1400a3bc8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.14003a120
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x140019cc2
jmp 0x140019cae
call fcn.14006c1c0
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x140019dc9
call fcn.14003de80
lea rax, [0x1400cd0e8]
mov ebx, 0x19
call fcn.14003e6c0
mov rax, qword [rsp + 0x68]
call fcn.14003e420
lea rax, [0x1400cd0cf]
mov ebx, 0x19
nop dword [rax]
call fcn.14003e6c0
mov eax, dword [rsp + 0x34]
call fcn.14003e420
call fcn.14003e0a0
call fcn.14003dee0
lea rax, [0x1400ca320]
mov ebx, 0xd
call fcn.14003c4e0
cmp eax, 0x5af
je 0x140019d71
call fcn.14003de80
lea rax, [0x1400cd0e8]
mov ebx, 0x19
call fcn.14003e6c0
mov rax, qword [rsp + 0x38]
call fcn.14003e420
lea rax, [0x1400cd0cf]
mov ebx, 0x19
nop dword [rax]
call fcn.14003e6c0
mov eax, dword [rsp + 0x34]
call fcn.14003e420
call fcn.14003e0a0
call fcn.14003dee0
lea rax, [0x1400ce806]
mov ebx, 0x1f
call fcn.14003c4e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140068be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140019c00
Function at 0x140026bc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140026cc6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x140026c03
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x140026cbb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.1400278e0
test rax, rax
je 0x140026cbb
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x140026d00]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.140068ac0
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x140026ca9
xor eax, eax
jmp 0x140026cb3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x140026bf1
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.140068be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.140026bc0
Function at 0x14004f820
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x78
mov rcx, r14
test rcx, rcx
je 0x14004f86b
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x14004f86b
mov qword [rsp + 0x70], rcx
mov rax, rdi
call fcn.1400094c0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], 0
jmp 0x14004f87b
mov eax, 1
add rsp, 0x78
pop rbp
ret
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.140008e80
mov rcx, qword [0x1400a3b78]
lea rdx, [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.14003a080
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14004f95f
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x68]
call fcn.140008e80
mov rcx, qword [rsp + 0x60]
mov rdx, qword [0x1400a3b80]
mov rbx, qword [rsp + 0x68]
lea rdi, [rsp + 0x50]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.14003a3a0
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x70]
cmp qword [rdx], rcx
ja 0x14004f95f
cmp qword [rdx + 8], rcx
ja 0x14004f876
mov eax, 1
add rsp, 0x78
pop rbp
ret

Function at 0x14005d860
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14005d922
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x68]
call fcn.1400545a0
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
lea rdx, [rcx + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
mov rax, rdx
mov rcx, rsi
call fcn.14005aec0
test bl, bl
je 0x14005d91c
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x14005d960]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.140068ac0
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140068be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14005d860
Function at 0x140060820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400608cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x140060920]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.140068ac0
xorps xmm15, xmm15
mov r14, qword [0x1401d9a40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140068be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.140060820
Function at 0x14006a9e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140005263
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.14000ade0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140068be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x140005240
cmp byte [0x1401d9828], 0
je 0x14006a9f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x140067c20
jmp 0x140005240

Function at 0x14006aa00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14000b241
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.14000b300
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x1401d9b00]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.14000b2e0
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
call fcn.14000b2e0
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140068be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x14000b1e0
cmp byte [0x1401d9828], 0
je 0x14006aa35
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x1401d9e20]
aesenc xmm0, xmmword [0x1401d9e30]
aesenc xmm0, xmmword [0x1401d9e40]
movq rax, xmm0
ret
jmp 0x14000b1e0

Function at 0x14006aa40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14000b2c1
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.14000b340
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x1401d9b00]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.14000b2e0
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
call fcn.14000b2e0
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140068be0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x14000b260
cmp byte [0x1401d9828], 0
je 0x14006aa76
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x1401d9e20]
aesenc xmm0, xmmword [0x1401d9e30]
aesenc xmm0, xmmword [0x1401d9e40]
movq rax, xmm0
ret
jmp 0x14000b260