joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ac6c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x1400ac790
jb 0x1400ac7ef
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.1400ac4e0
aeskeygenassist xmm1, xmm0, 1
call fcn.1400ac500
aeskeygenassist xmm1, xmm2, 2
call fcn.1400ac4e0
aeskeygenassist xmm1, xmm0, 2
call fcn.1400ac500
aeskeygenassist xmm1, xmm2, 4
call fcn.1400ac4e0
aeskeygenassist xmm1, xmm0, 4
call fcn.1400ac500
aeskeygenassist xmm1, xmm2, 8
call fcn.1400ac4e0
aeskeygenassist xmm1, xmm0, 8
call fcn.1400ac500
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1400ac4e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.1400ac500
aeskeygenassist xmm1, xmm2, 0x20
call fcn.1400ac4e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.1400ac500
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1400ac4e0
jmp 0x1400ac85d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.1400ac440
aeskeygenassist xmm1, xmm2, 2
call fcn.1400ac4a0
aeskeygenassist xmm1, xmm2, 4
call fcn.1400ac440
aeskeygenassist xmm1, xmm2, 8
call fcn.1400ac4a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1400ac440
aeskeygenassist xmm1, xmm2, 0x20
call fcn.1400ac4a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1400ac440
aeskeygenassist xmm1, xmm2, 0x80
call fcn.1400ac4a0
jmp 0x1400ac85d
aeskeygenassist xmm1, xmm0, 1
call fcn.1400ac400
aeskeygenassist xmm1, xmm0, 2
call fcn.1400ac400
aeskeygenassist xmm1, xmm0, 4
call fcn.1400ac400
aeskeygenassist xmm1, xmm0, 8
call fcn.1400ac400
aeskeygenassist xmm1, xmm0, 0x10
call fcn.1400ac400
aeskeygenassist xmm1, xmm0, 0x20
call fcn.1400ac400
aeskeygenassist xmm1, xmm0, 0x40
call fcn.1400ac400
aeskeygenassist xmm1, xmm0, 0x80
call fcn.1400ac400
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.1400ac400
aeskeygenassist xmm1, xmm0, 0x36
call fcn.1400ac400
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x1400ac86a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x14012c380
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14012c5bc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.1400a9e00
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x14012c4ca
nop
cmp rdx, 0x40
ja 0x14012c5ae
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rcx + rdi]
lea rdx, [rdx + 0x20]
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x14012c439
mov rax, rdx
mov rcx, rsi
nop
call fcn.140067120
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x14012c4a1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.14012cb00
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x14012c5a3
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x14012c4d7
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x14012c557
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.14012cb00
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x14012c592
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x14012c58e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.140067120
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.140066820
mov rax, rdx
mov ecx, 0x40
call fcn.140066820
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.1400640e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14012c380
Function at 0x140130560
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x1401305e5
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x140130746
cmp rcx, 0xe
jne 0x140130660
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x140130746
cmp rcx, 0xf
jne 0x1401306d7
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x140130746
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x140136c40
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x140136c58
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x140136c58
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x140136c60
xor eax, eax
ret
cmp rbx, 3
je 0x140136c6c
cmp rbx, 4
jne 0x140136c99
cmp al, 0x2c
ja 0x140136c86
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x140136c96
cmp al, 0x24
je 0x140136c96
nop dword [rax]
cmp al, 0x26
jae 0x140136c96
jmp 0x140136c99
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x140136c96
cmp al, 0x5b
je 0x140136c96
cmp al, 0x5d
jne 0x140136c99
xor eax, eax
ret
cmp al, 0x2f
ja 0x140136cd2
nop dword [rax]
cmp al, 0x26
ja 0x140136cb1
cmp al, 0x24
je 0x140136cf1
cmp al, 0x26
je 0x140136cf1
jmp 0x140136d6b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x140136cf1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x140136d68
cmp al, 0x2f
je 0x140136cf1
jmp 0x140136d6b
cmp al, 0x3d
ja 0x140136ce9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x140136cf1
nop
cmp al, 0x3d
je 0x140136cf1
jmp 0x140136d6b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x140136d60
cmp rbx, 2
jg 0x140136d27
cmp rbx, 1
je 0x140136d21
nop dword [rax]
cmp rbx, 2
jne 0x140136d6b
cmp al, 0x2f
je 0x140136d12
cmp al, 0x3b
je 0x140136d12
cmp al, 0x2c
jne 0x140136d19
mov ecx, 1
jmp 0x140136d1e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x140136d4a
cmp al, 0x40
je 0x140136d39
cmp al, 0x2f
je 0x140136d39
cmp al, 0x3f
jne 0x140136d42
mov ecx, 1
nop
jmp 0x140136d47
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x140136d59
cmp rbx, 7
jne 0x140136d6b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x140136d68
cmp al, 0x7e
jne 0x140136d6b
xor eax, eax
ret
cmp rbx, 7
jne 0x140136d81
cmp al, 0x21
je 0x140136d7d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x140136d81
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x140138aa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140138b99
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
test rcx, rcx
jle 0x140138b85
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call fcn.14013d060
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x18]
cmp rcx, rdx
mov rbx, rdx
cmovl rdx, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
cmp rdi, rsi
jne 0x140138b33
cmp rcx, rbx
jmp 0x140138b68
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov rax, rsi
mov rbx, rdi
mov rcx, rdx
call fcn.140067120
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rbx, rcx
mov rsi, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x20]
jae 0x140138b78
mov byte [rsi + rcx], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rcx
mov rcx, rbx
nop
call fcn.140066760
lea rax, [0x14027d480]
lea rbx, [0x1402e0700]
call fcn.140037040
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.1400640e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140138aa0
Function at 0x140138e80
Capabilities:
Access peb ldr_data

Disassembly:
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp rsp, qword [r14 + 0x10]
jbe 0x140139079
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov dword [rsp + 0x60], 0
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x10], rbx
mov rax, qword [0x1402605c8]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.140004d80
cmp byte [0x140433f2c], 0
nop dword [rax]
je 0x14013906f
mov rax, qword [rsp + 0x28]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
nop dword [rax]
call fcn.14000bf00
mov rbx, rax
lea rax, [0x1402778a0]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.140004d40
lea rax, [0x1402777a0]
mov rbx, qword [rsp + 0x30]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.140004d40
mov eax, dword [rsp + 0x38]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
nop
call fcn.14000be80
mov rbx, rax
lea rax, [0x14027cc40]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.140004d40
mov eax, dword [rsp + 0x3c]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
nop dword [rax]
call fcn.14000be80
mov rbx, rax
lea rax, [0x14027cc40]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.140004d40
mov rax, qword [rsp + 0x40]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
nop dword [rax]
call fcn.14000bf00
mov rbx, rax
lea rax, [0x14027cd40]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.140004d40
lea rax, [0x1402762a0]
mov rbx, qword [rsp + 0x48]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.140004d40
lea rax, [0x1402762a0]
mov rbx, qword [rsp + 0x50]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.140004d40
lea rax, [0x1402762a0]
mov rbx, qword [rsp + 0x58]
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
call fcn.140004d40
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
call fcn.1400640e0
nop
jmp fcn.140138e80
Function at 0x140143900
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1401439cc
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], rsi
call fcn.14000bf00
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x1402778a0]
call fcn.140005540
mov rcx, qword [rsp + 0x80]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 8], rcx
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x10], ecx
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x14], ecx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x18], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
call fcn.140138e80
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x38]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], edi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
call fcn.1400640e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov edi, dword [rsp + 0x1c]
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x30]
mov r10, qword [rsp + 0x38]
nop dword [rax]
jmp fcn.140143900

Function at 0x14014b340
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14014b3d2
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov dword [rsp + 0x60], ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
lea rax, [0x140276220]
lea rcx, [0x14027b600]
lea rdi, [0x140259ce8]
call fcn.140005540
mov rdx, qword [rsp + 0x38]
mov qword [rsp], rdx
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 8], rdx
mov edx, dword [rsp + 0x60]
or edx, 6
mov dword [rsp + 0x10], edx
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x18], rdx
call fcn.1401391e0
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], ecx
mov qword [rsp + 0x20], rdi
call fcn.1400640e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov ecx, dword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.14014b340
Function at 0x14014cf80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14014d026
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 0x10]
test rdi, rdi
jbe 0x14014d01a
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x58], rcx
call fcn.14000bf00
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x140277960]
call fcn.140005540
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
mov ecx, dword [rsp + 0x2c]
mov dword [rsp + 8], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x18], ecx
call fcn.140138d20
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
mov rcx, rax
nop
call fcn.140066760
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.1400640e0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop dword [rax]
jmp fcn.14014cf80

Function at 0x14014d080
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14014d15e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov rdx, qword [rcx]
cmp qword [rcx + 8], 0
jbe 0x14014d153
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
call fcn.14000bf00
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x140277960]
call fcn.140005540
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov rbx, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.14000c020
mov rbx, qword [rsp + 0x38]
lea rcx, [0x14027b220]
mov rdi, rax
lea rax, [0x14027d680]
call fcn.140005540
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
mov ecx, dword [rsp + 0x2c]
mov dword [rsp + 8], ecx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x18], ecx
call fcn.140138bc0
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
xor eax, eax
mov rcx, rax
call fcn.140066760
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.1400640e0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14014d080
Function at 0x14014d500
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14014d5a6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax + 0x10]
test rdi, rdi
jbe 0x14014d59a
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x2c], ebx
mov qword [rsp + 0x58], rcx
call fcn.14000bf00
mov rbx, rax
xor ecx, ecx
xor edi, edi
lea rax, [0x140277960]
call fcn.140005540
mov rcx, qword [rsp + 0x30]
mov qword [rsp], rcx
mov ecx, dword [rsp + 0x2c]
mov dword [rsp + 8], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x18], ecx
call fcn.140138d20
xorps xmm15, xmm15
mov r14, qword [0x1404342c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
xor eax, eax
mov rcx, rax
nop
call fcn.140066760
nop
mov qword [rsp + 8], rax
mov dword [rsp + 0x10], ebx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
nop
call fcn.1400640e0
mov rax, qword [rsp + 8]
mov ebx, dword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
nop dword [rax]
jmp fcn.14014d500

Function at 0x14015e9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
movsxd r12, dword [rdx]
mov rbp, rdx
movzx edx, byte [r8]
mov rdi, rcx
mov rbx, r8
test dl, dl
je 0x14015e9fc
mov rsi, r8
mov eax, edx
lea r8, [0x1403cfaa0]
xor r9d, r9d
nop dword [rax]
movzx ecx, al
test byte [r8 + rcx], 6
jne 0x14015e9de
cmp al, 0x5f
jne 0x14015e9ee
movzx eax, byte [rsi + 1]
add rsi, 1
add r9d, 1
test al, al
jne 0x14015e9d0
movzx eax, dl
test byte [r8 + rax], 4
je 0x14015ea78
mov byte [rdi + r12], 0x22
movzx edx, byte [rbx]
lea eax, [r12 + 1]
mov r9d, 1
test dl, dl
jne 0x14015ea26
jmp 0x14015ea68
movzx edx, byte [rbx + 1]
add rbx, 1
mov eax, ecx
test dl, dl
je 0x14015ea4a
movsxd r8, eax
lea ecx, [rax + 1]
mov byte [rdi + r8], dl
cmp byte [rbx], 0x22
jne 0x14015ea18
movsxd rcx, ecx
add rbx, 1
add eax, 2
mov byte [rdi + rcx], 0x22
movzx edx, byte [rbx]
test dl, dl
jne 0x14015ea26
test r9d, r9d
jne 0x14015ea68
movsxd rdx, eax
mov byte [rdi + rdx], 0
mov dword [rbp], eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movsxd rdx, eax
add eax, 1
mov byte [rdi + rdx], 0x22
jmp 0x14015ea4f
mov dword [rsp + 0x2c], 0x3b
cmp r9d, 1
jle 0x14015eac0
lea r8, [rsp + 0x2c]
mov edx, r9d
mov rcx, rbx
call fcn.14015e880
cmp dword [rsp + 0x2c], 0x3b
jne 0x14015e9fc
cmp byte [rsi], 0
jne 0x14015e9fc
movzx edx, byte [rbx]
mov eax, r12d
test dl, dl
je 0x14015ea4f
xor r9d, r9d
jmp 0x14015ea26
cmp byte [rsi], 0
setne al
xor r9d, 1
and r9d, 1
or al, r9b
jne 0x14015e9fc
mov eax, r12d
xor r9d, r9d
jmp 0x14015ea26
Function at 0x14016a840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13d, dword [rcx + 0x80]
movsxd rax, edx
mov r12, rcx
mov rcx, qword [rcx + 0x78]
lea rdx, [rax*8]
mov rsi, rax
sub rdx, rax
shl rdx, 3
test rcx, rcx
je 0x14016a9f8
test rdx, rdx
je 0x14016aa10
cmp rdx, 0x7ffffeff
ja 0x14016a9b8
call fcn.140160320
mov rdi, rax
test rdi, rdi
je 0x14016a9b8
movsxd rdx, r13d
xor ebp, ebp
lea rax, [rdx*8]
sub rax, rdx
xor edx, edx
lea rbx, [rdi + rax*8]
mov eax, esi
sub eax, r13d
mov rcx, rbx
cdqe
lea r8, [rax*8]
sub r8, rax
shl r8, 3
call sub.msvcrt.dll_memset
mov qword [r12 + 0x78], rdi
cmp r13d, esi
jl 0x14016a96a
jmp 0x14016a9e0
lea rdi, [rax + 8]
mov rcx, rax
mov qword [rax], 0
mov qword [rax + 0x1f8], 0
and rdi, 0xfffffffffffffff8
mov rax, rbp
sub rcx, rdi
add ecx, 0x200
shr ecx, 3
rep stosq qword [rdi], rax
mov dword [rdx], r14d
mov qword [rbx + 0x10], rdx
mov rax, qword [r12 + 0x128]
mov dword [rbx + 0x20], 1
test rax, rax
je 0x14016a955
mov edx, dword [rax + 0x58]
mov dword [rbx + 0x24], edx
mov edx, dword [rax + 0x60]
mov dword [rbx + 0x28], edx
mov edx, dword [rax + 0x64]
mov dword [rbx + 0x2c], edx
mov eax, dword [rax + 0x88]
mov dword [rbx + 0x30], eax
add r13d, 1
add rbx, 0x38
mov dword [r12 + 0x80], r13d
cmp r13d, esi
je 0x14016a9e0
mov rax, qword [r12 + 0x50]
mov r14d, dword [r12 + 0x20]
cmp qword [rax], 0
mov dword [rbx + 0x18], r14d
je 0x14016a9d0
mov rax, qword [r12 + 0x60]
test rax, rax
jle 0x14016a9d0
mov qword [rbx], rax
mov eax, dword [r12 + 0x3c]
mov ecx, 0x200
mov dword [rbx + 0x1c], eax
call fcn.140160470
mov rdx, rax
test rax, rax
jne 0x14016a8f0
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x20], 1
mov eax, 7
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [r12 + 0xb8]
jmp 0x14016a988
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rdx
call fcn.140160470
mov rdi, rax
jmp 0x14016a898
call fcn.14015d2f0
mov eax, 7
jmp 0x14016a9bd