joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401092c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov ebx, dword [rcx + 0x14]
mov rsi, rcx
call fcn.140108ff0
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140108ff0
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
je 0x14010944b
xor eax, eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r14
cmp ebx, 2
mov qword [rsp + 0x20], r15
lea r14, [rsp + 0x40]
setne al
lea r15, [rsp + 0x40]
add r14, rax
xor rax, 1
add r15, rax
movzx edi, byte [r14]
movzx eax, byte [r15]
shl edi, 8
or edi, eax
lea eax, [rdi - 0xdc00]
cmp eax, 0x3ff
ja 0x140109355
lea rcx, [rsi + 0x18]
mov edx, 0xfffd
call fcn.140109090
jmp 0x14010943c
lea eax, [rdi - 0xd800]
mov qword [rsp + 0x48], rbp
cmp eax, 0x3ff
ja 0x140109429
mov rcx, rsi
call fcn.140108ff0
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140108ff0
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
lea rbp, [rsi + 0x18]
test al, al
je 0x140109409
nop
movzx eax, byte [r15]
movzx ebx, byte [r14]
shl ebx, 8
or ebx, eax
lea eax, [rbx - 0xdc00]
cmp eax, 0x3ff
jbe 0x140109410
lea rbp, [rsi + 0x18]
mov edx, 0xfffd
mov rcx, rbp
call fcn.140109090
lea eax, [rbx - 0xd800]
cmp eax, 0x7ff
ja 0x14010942d
mov rcx, rsi
mov edi, ebx
call fcn.140108ff0
mov rcx, rsi
mov byte [rsp + 0x40], al
call fcn.140108ff0
mov rdx, qword [rsi]
mov byte [rsp + 0x41], al
mov rax, qword [rdx]
movsxd rcx, dword [rax + 4]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::good_void_const___ptr64]
test al, al
jne 0x1401093a0
mov edx, 0xfffd
jmp 0x14010942f
and edi, 0x3ff
and ebx, 0x3ff
shl edi, 0xa
or edi, ebx
add edi, 0x10000
jmp 0x14010942d
lea rbp, [rsi + 0x18]
mov edx, edi
mov rcx, rbp
call fcn.140109090
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x140111800
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14011183a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14011183f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140111888
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14011eff0]
cmp byte [rcx + rax], 0
je 0x140111888
dec r8
sub rdx, 1
jne 0x14011186e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140113070
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401130ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401130ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401130ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401130ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1401130ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401130bc
xor al, al
add rsp, 0x28
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000b008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000b008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000b008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000b008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x14000176c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400017b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400017b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400017b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400017b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400017b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400017b8
xor al, al
add rsp, 0x28
ret

Function at 0x140005eec
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005ce8
Function at 0x140008fac
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140008fdc
xor eax, eax
jmp 0x14000909f
mov rbp, rbx
cmp word [rax], si
je 0x140009001
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140008fe8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140008fe4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140008ecc
movsxd r14, eax
test eax, eax
jne 0x14000903f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140008fd5
mov rcx, r14
call fcn.140009e88
mov rdi, rax
test rax, rax
jne 0x140009058
xor ecx, ecx
call fcn.14000752c
jmp 0x140009034
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140008ecc
test eax, eax
jne 0x140009089
mov rcx, rdi
call fcn.14000752c
jmp 0x140009093
xor ecx, ecx
call fcn.14000752c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14000c590
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140007f9c
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14000c61a
cmp byte [rbp - 0x21], r15b
je 0x14000c615
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14000c650
call fcn.14000a698
test eax, eax
jne 0x14000c63c
cmp byte [rbp - 0x21], r15b
je 0x14000c634
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14000c650
cmp byte [rbp - 0x21], r15b
je 0x14000c64d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14000757c
test eax, eax
jne 0x14000c6f0
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140007f9c
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14000c68f
cmp byte [rbp - 0x21], r15b
je 0x14000c6c4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14000c6c4
call fcn.14000a698
test eax, eax
jne 0x14000c6b0
cmp byte [rbp - 0x21], r15b
je 0x14000c6a9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14000c6c4
cmp byte [rbp - 0x21], r15b
je 0x14000c6c1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14000757c
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14000c6f0
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14000c6f3
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14000c701
mov rcx, rdi
call fcn.14000752c
cmp byte [rbp + 0x3f], r15b
je 0x14000c710
mov rcx, qword [rbp + 0x27]
call fcn.14000752c
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000f540
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000f568
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000f568
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x2a3ec1370
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x70
movzx esi, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rbx, r8
movq xmm1, rcx
mov rcx, rdx
mov rax, qword [rax + 0x20]
mov rdi, qword [rax]
mov r8, qword [rdi - 0x10]
lea r11, [rdi - 0x10]
cmp rdi, r8
je 0x2a3ec13f5
nop
mov rax, qword [r11 + 0x60]
lea r9, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x2a3ec13ea
mov edx, 0x2108
nop dword [rax]
mov r10d, edx
add r9, 2
shl r10d, 6
add edx, r10d
add edx, eax
movzx eax, word [r9 - 2]
test ax, ax
jne 0x2a3ec13c8
cmp edx, 0xfcdfbd0e
je 0x2a3ec1452
mov r11, r8
mov r8, qword [r11]
cmp rdi, r8
jne 0x2a3ec13b0
xor eax, eax
movq xmm0, rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov rdx, rbx
punpcklqdq xmm0, xmm1
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], 0
movaps xmmword [rsp + 0x50], xmm0
call fcn.2a3ec2560
add rsp, 0x70
pop rbx
pop rsi
pop rdi
ret
mov edx, dword [r11 + 0x40]
mov rax, qword [r11 + 0x30]
cmp edx, 2
je 0x2a3ec13f5
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word [rax + rax]
cmp word [rax], si
je 0x2a3ec13f7
add rax, 1
cmp rax, rdx
jne 0x2a3ec1470
jmp 0x2a3ec13f5

Function at 0x2a3ec1490
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx edi, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rbx, rcx
mov rsi, rdx
mov r8d, r8d
mov dword [rsp + 0x5c], 0
mov rax, qword [rax + 0x20]
mov rbp, qword [rax]
mov r11, qword [rbp - 0x10]
lea r10, [rbp - 0x10]
cmp rbp, r11
je 0x2a3ec1524
nop dword [rax + rax]
mov rax, qword [r10 + 0x60]
lea rcx, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x2a3ec1519
mov edx, 0x2108
nop dword [rax]
mov r9d, edx
add rcx, 2
shl r9d, 6
add edx, r9d
add edx, eax
movzx eax, word [rcx - 2]
test ax, ax
jne 0x2a3ec14f8
cmp edx, 0xfcdfbd0e
je 0x2a3ec1597
mov r10, r11
mov r11, qword [r10]
cmp rbp, r11
jne 0x2a3ec14e0
xor eax, eax
mov qword [rsp + 0x60], rax
lea r9, [rsp + 0x5c]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x40], 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], 0
call fcn.2a3ec2560
mov rdx, rax
xor eax, eax
test edx, edx
je 0x2a3ec158b
mov eax, dword [rsp + 0x5c]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, dword [r10 + 0x40]
mov rax, qword [r10 + 0x30]
cmp edx, 2
je 0x2a3ec1524
sub edx, 3
lea rdx, [rax + rdx + 1]
nop dword [rax]
cmp word [rax], di
je 0x2a3ec1526
add rax, 1
cmp rdx, rax
jne 0x2a3ec15b0
jmp 0x2a3ec1524
Function at 0x2a3ec17b0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
movzx edi, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rsi, r8
mov r8, r9
movq xmm1, rcx
mov rcx, rdx
mov rax, qword [rax + 0x20]
mov rbp, qword [rax]
mov rbx, qword [rbp - 0x10]
lea r9, [rbp - 0x10]
cmp rbp, rbx
je 0x2a3ec183d
nop word [rax + rax]
mov rax, qword [r9 + 0x60]
lea r10, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x2a3ec1832
mov edx, 0x2108
nop dword [rax]
mov r11d, edx
add r10, 2
shl r11d, 6
add edx, r11d
add edx, eax
movzx eax, word [r10 - 2]
test ax, ax
jne 0x2a3ec1810
cmp edx, 0xfcdfbd0e
je 0x2a3ec18ad
mov r9, rbx
mov rbx, qword [r9]
cmp rbp, rbx
jne 0x2a3ec17f8
xor eax, eax
movq xmm0, rax
mov rdx, rsi
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x60], 0
mov r9, qword [rsp + 0xc0]
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.2a3ec2560
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, dword [r9 + 0x40]
mov rax, qword [r9 + 0x30]
cmp edx, 2
je 0x2a3ec183d
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word [rax + rax]
cmp word [rax], di
je 0x2a3ec183f
add rax, 1
cmp rax, rdx
jne 0x2a3ec18c8
jmp 0x2a3ec183d
Function at 0x2a3ec2d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [str.kernel32LoadLibrGetProcALocalAll_not_found_]
lea rdi, [rsp + 0x20]
mov byte [rsp + 0x2c], 0
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x6c6c642e
call fcn.2a3ec2860
mov byte [rsp + 0x2c], 0
mov rbx, rax
mov rax, qword [0x2a3f820a8]
mov dword [rsp + 0x28], 0x41797261
mov qword [rsp + 0x20], rax
movsxd rax, dword [rbx + 0x3c]
mov r12d, dword [rbx + rax + 0x88]
test r12d, r12d
je 0x2a3ec2f50
lea r13, [rbx + r12]
mov esi, dword [r13 + 0x20]
mov ebp, dword [r13 + 0x18]
add rsi, rbx
test ebp, ebp
je 0x2a3ec2f6a
mov r15, rsi
xor r14d, r14d
jmp 0x2a3ec2e01
add r14, 1
add r15, 4
cmp rbp, r14
je 0x2a3ec2f80
mov ecx, dword [r15]
mov rdx, rdi
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x2a3ec2df0
mov edx, dword [r13 + 0x24]
lea rcx, [rbx + r14*2]
mov eax, dword [r13 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
mov byte [rsp + 0x2e], 0
add rax, rbx
mov qword [0x2a3fa7030], rax
mov rax, qword [0x2a3f820b0]
mov edx, 0x7373
mov dword [rsp + 0x28], 0x65726464
xor r14d, r14d
mov word [rsp + 0x2c], dx
mov qword [rsp + 0x20], rax
jmp 0x2a3ec2e71
add r14, 1
add rsi, 4
cmp rbp, r14
je 0x2a3ec2f78
mov ecx, dword [rsi]
mov rdx, rdi
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x2a3ec2e60
mov edx, dword [r13 + 0x24]
lea rcx, [rbx + r14*2]
mov eax, dword [r13 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
mov qword [0x2a3fa7038], rax
mov rax, qword [0x2a3f820b8]
add r12, rbx
xor ebp, ebp
mov byte [rsp + 0x2a], 0
mov qword [rsp + 0x20], rax
mov eax, 0x636f
mov word [rsp + 0x28], ax
mov esi, dword [r12 + 0x20]
mov r13d, dword [r12 + 0x18]
add rsi, rbx
test r13d, r13d
jne 0x2a3ec2eed
jmp 0x2a3ec2f66
add rbp, 1
add rsi, 4
cmp r13, rbp
je 0x2a3ec2f66
mov ecx, dword [rsi]
mov rdx, rdi
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x2a3ec2ee0
mov edx, dword [r12 + 0x24]
lea rcx, [rbx + rbp*2]
mov eax, dword [r12 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
mov ecx, 0x4098
mov qword [0x2a3fa7028], rax
call fcn.2a3ec2cd0
test rax, rax
mov qword [0x2a3fa7020], rax
setne al
movzx eax, al
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [0x2a3fa7030], 0
mov qword [0x2a3fa7038], 0
xor eax, eax
jmp 0x2a3ec2f1a
mov qword [0x2a3fa7030], 0
nop dword [rax]
xor eax, eax
jmp 0x2a3ec2e9c
mov qword [0x2a3fa7030], 0
mov byte [rsp + 0x2e], 0
jmp 0x2a3ec2e39
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
jmp 0x2a3ec2d60
Function at 0x2a3ec2fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [str.kernel32LoadLibrGetProcALocalAll_not_found_]
lea rdi, [rsp + 0x20]
mov byte [rsp + 0x2c], 0
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x6c6c642e
call fcn.2a3ec2860
mov byte [rsp + 0x2c], 0
mov rbx, rax
mov rax, qword [0x2a3f820a8]
mov dword [rsp + 0x28], 0x41797261
mov qword [rsp + 0x20], rax
movsxd rax, dword [rbx + 0x3c]
mov r12d, dword [rbx + rax + 0x88]
test r12d, r12d
je 0x2a3ec2f50
lea r13, [rbx + r12]
mov esi, dword [r13 + 0x20]
mov ebp, dword [r13 + 0x18]
add rsi, rbx
test ebp, ebp
je 0x2a3ec2f6a
mov r15, rsi
xor r14d, r14d
jmp 0x2a3ec2e01
add r14, 1
add r15, 4
cmp rbp, r14
je 0x2a3ec2f80
mov ecx, dword [r15]
mov rdx, rdi
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x2a3ec2df0
mov edx, dword [r13 + 0x24]
lea rcx, [rbx + r14*2]
mov eax, dword [r13 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
mov byte [rsp + 0x2e], 0
add rax, rbx
mov qword [0x2a3fa7030], rax
mov rax, qword [0x2a3f820b0]
mov edx, 0x7373
mov dword [rsp + 0x28], 0x65726464
xor r14d, r14d
mov word [rsp + 0x2c], dx
mov qword [rsp + 0x20], rax
jmp 0x2a3ec2e71
add r14, 1
add rsi, 4
cmp rbp, r14
je 0x2a3ec2f78
mov ecx, dword [rsi]
mov rdx, rdi
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x2a3ec2e60
mov edx, dword [r13 + 0x24]
lea rcx, [rbx + r14*2]
mov eax, dword [r13 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
mov qword [0x2a3fa7038], rax
mov rax, qword [0x2a3f820b8]
add r12, rbx
xor ebp, ebp
mov byte [rsp + 0x2a], 0
mov qword [rsp + 0x20], rax
mov eax, 0x636f
mov word [rsp + 0x28], ax
mov esi, dword [r12 + 0x20]
mov r13d, dword [r12 + 0x18]
add rsi, rbx
test r13d, r13d
jne 0x2a3ec2eed
jmp 0x2a3ec2f66
add rbp, 1
add rsi, 4
cmp r13, rbp
je 0x2a3ec2f66
mov ecx, dword [rsi]
mov rdx, rdi
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x2a3ec2ee0
mov edx, dword [r12 + 0x24]
lea rcx, [rbx + rbp*2]
mov eax, dword [r12 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
mov ecx, 0x4098
mov qword [0x2a3fa7028], rax
call fcn.2a3ec2cd0
test rax, rax
mov qword [0x2a3fa7020], rax
setne al
movzx eax, al
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov qword [0x2a3fa7030], 0
mov qword [0x2a3fa7038], 0
xor eax, eax
jmp 0x2a3ec2f1a
mov qword [0x2a3fa7030], 0
nop dword [rax]
xor eax, eax
jmp 0x2a3ec2e9c
mov qword [0x2a3fa7030], 0
mov byte [rsp + 0x2e], 0
jmp 0x2a3ec2e39
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
jmp 0x2a3ec2d60
Function at 0x2a3ec6050
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rdi
push rsi
push rbx
mov rax, rcx
lea rcx, [rcx + 0xf]
sub rcx, rdx
cmp rcx, 0x1e
jbe 0x2a3ec6134
movdqu xmm1, xmmword [rdx]
movups xmmword [rax], xmm1
movdqu xmm0, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm0
movzx edi, byte [rax + 0x1f]
mov r10d, 8
movzx r9d, byte [rax + 0x1e]
lea r11, [0x2a3f82380]
movzx r8d, byte [rax + 0x1d]
lea rbx, [0x2a3f82260]
movzx edx, byte [rax + 0x1c]
jmp 0x2a3ec60f9
movzx r8d, r8b
movzx edx, dl
movzx ecx, byte [r11 + r8]
movzx r8d, r9b
movzx r9d, dil
movzx edi, byte [r11 + rdx]
mov edx, r10d
shr edx, 3
movzx r8d, byte [r11 + r8]
xor cl, byte [rbx + rdx]
movzx r9d, byte [r11 + r9]
mov edx, ecx
xor dl, byte [rax]
add r10d, 1
add rax, 4
xor r8b, byte [rax - 3]
xor r9b, byte [rax - 2]
xor dil, byte [rax - 1]
mov byte [rax + 0x1c], dl
mov byte [rax + 0x1d], r8b
mov byte [rax + 0x1e], r9b
mov byte [rax + 0x1f], dil
cmp r10d, 0x3c
je 0x2a3ec6130
mov ecx, r10d
and ecx, 7
je 0x2a3ec60a0
cmp ecx, 4
jne 0x2a3ec60ce
movzx edx, dl
movzx r8d, r8b
movzx esi, r9b
movzx ecx, dil
movzx edx, byte [r11 + rdx]
movzx r8d, byte [r11 + r8]
movzx r9d, byte [r11 + rsi]
movzx edi, byte [r11 + rcx]
jmp 0x2a3ec60ce
pop rbx
pop rsi
pop rdi
ret
movzx ecx, byte [rdx]
mov byte [rax], cl
movzx ecx, byte [rdx + 1]
mov byte [rax + 1], cl
movzx ecx, byte [rdx + 2]
mov byte [rax + 2], cl
movzx ecx, byte [rdx + 3]
mov byte [rax + 3], cl
movzx ecx, byte [rdx + 4]
mov byte [rax + 4], cl
movzx ecx, byte [rdx + 5]
mov byte [rax + 5], cl
movzx ecx, byte [rdx + 6]
mov byte [rax + 6], cl
movzx ecx, byte [rdx + 7]
mov byte [rax + 7], cl
movzx ecx, byte [rdx + 8]
mov byte [rax + 8], cl
movzx ecx, byte [rdx + 9]
mov byte [rax + 9], cl
movzx ecx, byte [rdx + 0xa]
mov byte [rax + 0xa], cl
movzx ecx, byte [rdx + 0xb]
mov byte [rax + 0xb], cl
movzx ecx, byte [rdx + 0xc]
mov byte [rax + 0xc], cl
movzx ecx, byte [rdx + 0xd]
mov byte [rax + 0xd], cl
movzx ecx, byte [rdx + 0xe]
mov byte [rax + 0xe], cl
movzx ecx, byte [rdx + 0xf]
mov byte [rax + 0xf], cl
movzx ecx, byte [rdx + 0x10]
mov byte [rax + 0x10], cl
movzx ecx, byte [rdx + 0x11]
mov byte [rax + 0x11], cl
movzx ecx, byte [rdx + 0x12]
mov byte [rax + 0x12], cl
movzx ecx, byte [rdx + 0x13]
mov byte [rax + 0x13], cl
movzx ecx, byte [rdx + 0x14]
mov byte [rax + 0x14], cl
movzx ecx, byte [rdx + 0x15]
mov byte [rax + 0x15], cl
movzx ecx, byte [rdx + 0x16]
mov byte [rax + 0x16], cl
movzx ecx, byte [rdx + 0x17]
mov byte [rax + 0x17], cl
movzx ecx, byte [rdx + 0x18]
mov byte [rax + 0x18], cl
movzx ecx, byte [rdx + 0x19]
mov byte [rax + 0x19], cl
movzx ecx, byte [rdx + 0x1a]
mov byte [rax + 0x1a], cl
movzx ecx, byte [rdx + 0x1b]
mov byte [rax + 0x1b], cl
movzx ecx, byte [rdx + 0x1c]
mov byte [rax + 0x1c], cl
movzx ecx, byte [rdx + 0x1d]
mov byte [rax + 0x1d], cl
movzx ecx, byte [rdx + 0x1e]
mov byte [rax + 0x1e], cl
movzx edx, byte [rdx + 0x1f]
mov byte [rax + 0x1f], dl
jmp 0x2a3ec6077
Function at 0x2a3ed0fc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
cmp r8, 3
mov r9, rdx
not eax
jbe 0x2a3ed1090
lea rdx, [r8 - 4]
lea r10, [0x2a3f82ca0]
shr rdx, 2
lea rcx, [r9 + rdx*4 + 4]
nop dword [rax]
mov edx, eax
xor al, byte [r9]
add r9, 4
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
xor dl, byte [r9 - 3]
shr eax, 8
movzx edx, dl
xor eax, dword [r10 + rdx*4]
mov edx, eax
xor al, byte [r9 - 2]
shr edx, 8
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
xor dl, byte [r9 - 1]
shr eax, 8
movzx edx, dl
xor eax, dword [r10 + rdx*4]
cmp r9, rcx
jne 0x2a3ed0fe8
and r8d, 3
test r8, r8
je 0x2a3ed1084
lea rdx, [0x2a3f82ca0]
mov r9d, eax
xor al, byte [rcx]
shr r9d, 8
movzx eax, al
xor r9d, dword [rdx + rax*4]
cmp r8, 1
mov eax, r9d
je 0x2a3ed1084
xor al, byte [rcx + 1]
shr r9d, 8
movzx eax, al
xor r9d, dword [rdx + rax*4]
cmp r8, 2
mov eax, r9d
je 0x2a3ed1084
xor al, byte [rcx + 2]
mov r8d, r9d
shr r8d, 8
movzx eax, al
xor r8d, dword [rdx + rax*4]
mov eax, r8d
not eax
ret
mov rcx, rdx
jmp 0x2a3ed1034