joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401082f0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, rdx
mov rsi, rcx
lea rdx, [rbp - 0x24]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
test rax, rax
je 0x1401083fd
mov rdi, rax
mov qword [rbp - 0x30], rsi
movsxd rax, dword [rbp - 0x24]
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 8
mov qword [rbp - 0x10], 0
lea r13, [rdi + rax*8]
lea rbx, [rbp - 0x60]
lea r14, [rbp - 0x48]
lea r15, [rbp - 0x20]
mov r12, rdi
jmp 0x140108394
add r12, 8
mov rax, qword [rbp - 0x18]
lea rcx, [rsi + rsi*2]
mov rdx, qword [rbp - 0x50]
mov qword [rax + rcx*8 + 0x10], rdx
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rax + rcx*8], xmm0
inc rsi
mov qword [rbp - 0x10], rsi
cmp r12, r13
je 0x1401083da
mov byte [rbp - 1], 1
mov rcx, r12
call fcn.14010c1f0
lea rcx, [rax + rdx*2]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rcx
mov word [rbp - 0x38], 0
mov byte [rbp - 1], 1
mov rcx, rbx
mov rdx, r14
call fcn.140100160
mov rsi, qword [rbp - 0x10]
cmp rsi, qword [rbp - 0x20]
jne 0x140108370
mov rcx, r15
call fcn.140009090
jmp 0x140108370
mov rcx, rdi
call qword [sym.imp.kernel32.dll_LocalFree]
test rax, rax
je 0x140108416
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x30]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rcx], xmm0
jmp 0x140108453
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
jmp 0x140108453
mov byte [rbp - 1], 1
call fcn.14010bd10
mov dword [rbp - 0x38], edx
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], 1
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x30]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rdx], xmm0
test rax, rax
je 0x140108453
lea rcx, [rbp - 0x40]
mov byte [rbp - 1], 0
call fcn.14010c210
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140114af0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r14, qword [rcx + 0x10]
test r14, r14
je 0x140114b33
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, r14
mov r8, r14
cmovb r8, rdi
mov rcx, qword [rcx]
mov rax, qword [rsi + 8]
call qword [rax + 0x18]
test rax, rax
je 0x140114b3c
mov eax, 1
jmp 0x140114bf0
xor eax, eax
xor edx, edx
jmp 0x140114bf0
sub r14, rdx
jb 0x140114bff
mov qword [rsi + 0x10], r14
xor eax, eax
test rdi, rdi
je 0x140114bf0
test rdx, rdx
je 0x140114bf0
mov r8d, dword [rsi + 0x20]
mov ecx, dword [rsi + 0x18]
mov r9d, dword [rsi + 0x1c]
dec rdi
mov r10, rdx
dec r10
xor r11d, r11d
lea r14, [0x1403278d8]
nop dword [rax + rax]
mov r15d, r8d
or r15d, 3
mov ebp, r15d
and ebp, 0xfffffffe
imul ebp, r15d
shr ebp, 8
xor bpl, byte [rbx + r11]
mov r15d, ecx
xor r15b, bpl
shr ecx, 8
movzx r15d, r15b
xor ecx, dword [r14 + r15*4]
movzx r15d, cl
add r15d, r9d
imul r9d, r15d, 0x8088405
inc r9d
mov r15d, r9d
shr r15d, 0x18
movzx r12d, r8b
xor r12d, r15d
shr r8d, 8
xor r8d, dword [r14 + r12*4]
mov byte [rbx + r11], bpl
cmp r10, r11
je 0x140114be5
lea r15, [r11 + 1]
cmp rdi, r11
mov r11, r15
jne 0x140114b80
mov dword [rsi + 0x20], r8d
mov dword [rsi + 0x18], ecx
mov dword [rsi + 0x1c], r9d
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str.number_of_read_bytes_exceeds_limit
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x30], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rdx, [0x1403277f0]
lea rcx, [rsp + 0x20]
call fcn.14029d7b0
int3
Function at 0x1401167e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
movaps xmm9, xmmword [rdx]
movaps xmm10, xmmword [rdx + 0xa0]
movaps xmmword [rcx], xmm9
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movaps xmmword [rcx + 0xa0], xmm10
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x1401168b0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
movaps xmm11, xmmword [rdx]
movaps xmm12, xmmword [rdx + 0xc0]
movaps xmmword [rcx], xmm11
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movaps xmmword [rcx + 0xc0], xmm12
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x14011c310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov r14d, 0
test r8, r8
je 0x14011c47a
mov rdi, qword [rsp + 0x98]
mov r15, qword [rdx]
mov r13d, dword [rdx + 8]
mov eax, dword [rdx + 0xc]
mov r12d, 1
xor r14d, r14d
xor ecx, ecx
jmp 0x14011c384
xor r11d, r11d
lea r10, [rcx + 1]
movzx r11d, r11b
lea r12, [r11 + r12*2]
shl r11d, cl
xor r14d, r11d
mov r13d, esi
mov rcx, r10
cmp r8, r10
je 0x14011c47a
lea r11, [r12 + rdi]
cmp r11, qword [rsp + 0x90]
jae 0x14011c4b9
mov esi, r13d
shr esi, 0xb
movzx r10d, word [r9 + r11*2]
imul esi, r10d
mov ebp, eax
sub ebp, esi
jae 0x14011c400
cmp byte [rsp + 0xa0], 0
je 0x14011c3cb
mov ebx, 0x800
sub ebx, r10d
movzx ebx, bx
shr ebx, 5
add ebx, r10d
mov word [r9 + r11*2], bx
mov dword [rdx + 8], esi
cmp esi, 0x1000000
jae 0x14011c360
shl esi, 8
mov dword [rdx + 8], esi
mov r10, qword [r15]
mov r11, qword [r10 + 8]
mov rbx, qword [r10 + 0x10]
cmp r11, rbx
jbe 0x14011c48d
xor r11d, r11d
jmp 0x14011c44f
cmp byte [rsp + 0xa0], 0
je 0x14011c419
movzx eax, r10w
shr eax, 5
sub r10d, eax
mov word [r9 + r11*2], r10w
mov dword [rdx + 0xc], ebp
sub r13d, esi
mov dword [rdx + 8], r13d
mov r11b, 1
cmp r13d, 0x1000000
jae 0x14011c470
shl r13d, 8
mov dword [rdx + 8], r13d
mov r10, qword [r15]
mov rax, qword [r10 + 8]
mov rbx, qword [r10 + 0x10]
mov r11b, 1
cmp rax, rbx
jbe 0x14011c487
mov eax, ebp
mov esi, r13d
mov r13, qword [r10]
movzx ebp, byte [r13 + rbx]
inc rbx
mov qword [r10 + 0x10], rbx
shl eax, 8
or eax, ebp
mov dword [rdx + 0xc], eax
jmp 0x14011c363
mov eax, ebp
mov esi, r13d
jmp 0x14011c363
mov rax, qword [rsp + 0x20]
mov dword [rax + 4], r14d
xor ecx, ecx
jmp 0x14011c4a6
mov qword [r10 + 0x10], rax
jmp 0x14011c491
mov qword [r10 + 0x10], r11
lea rcx, [0x140326e10]
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], rcx
mov ecx, 1
mov dword [rax], ecx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x140328ad8]
mov rcx, r11
mov rdx, qword [rsp + 0x90]
call fcn.14029d940
int3
Function at 0x14011c4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x28], rcx
mov r15d, 0
test r8, r8
je 0x14011c69a
mov r14, rdx
movzx r11d, byte [rsp + 0xc0]
mov rdx, qword [rsp + 0xb0]
mov rax, qword [r14]
mov qword [rsp + 0x38], rax
mov ebx, dword [r14 + 8]
mov edi, dword [r14 + 0xc]
mov ebp, 1
xor r15d, r15d
xor r13d, r13d
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x30], r8
jmp 0x14011c564
xor eax, eax
lea r10, [r13 + 1]
movzx eax, al
lea rbp, [rax + rbp*2]
mov ecx, r13d
shl eax, cl
xor r15d, eax
mov ebx, r12d
mov r13, r10
cmp r8, r10
je 0x14011c69a
mov rax, qword [rsp + 0xb8]
lea rcx, [rax + rbp]
cmp rcx, rdx
jae 0x14011c6cb
mov r12d, ebx
shr r12d, 0xb
movzx eax, word [r9 + rcx*2]
imul r12d, eax
mov esi, edi
sub esi, r12d
jae 0x14011c600
test r11b, r11b
je 0x14011c5ae
mov r10d, 0x800
sub r10d, eax
movzx r10d, r10w
shr r10d, 5
add r10d, eax
mov word [r9 + rcx*2], r10w
mov dword [r14 + 8], r12d
cmp r12d, 0x1000000
jae 0x14011c540
shl r12d, 8
mov dword [r14 + 8], r12d
mov byte [rsp + 0x27], 0
mov r8d, 1
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x27]
call fcn.140113fa0
test rax, rax
jne 0x14011c6a7
movzx ecx, byte [rsp + 0x27]
xor eax, eax
mov esi, edi
jmp 0x14011c65a
test r11b, r11b
je 0x14011c615
movzx r10d, ax
shr r10d, 5
sub eax, r10d
mov word [r9 + rcx*2], ax
mov dword [r14 + 0xc], esi
sub ebx, r12d
mov dword [r14 + 8], ebx
mov al, 1
cmp ebx, 0x1000000
jae 0x14011c690
shl ebx, 8
mov dword [r14 + 8], ebx
mov byte [rsp + 0x26], 0
mov r8d, 1
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x26]
call fcn.140113fa0
test rax, rax
jne 0x14011c6a7
movzx ecx, byte [rsp + 0x26]
mov al, 1
mov r12d, ebx
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0xb0]
shl esi, 8
movzx edi, cl
or edi, esi
mov dword [r14 + 0xc], edi
mov r9, qword [rsp + 0x40]
movzx r11d, byte [rsp + 0xc0]
jmp 0x14011c542
mov edi, esi
mov r12d, ebx
jmp 0x14011c542
mov rax, qword [rsp + 0x28]
mov dword [rax + 4], r15d
xor ecx, ecx
jmp 0x14011c6b8
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, rcx
mov ecx, 1
mov dword [rax], ecx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x140328ad8]
call fcn.14029d940
int3
Function at 0x14011c6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov r15d, 0
test r8, r8
je 0x14011c83a
mov r14, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rdx]
mov esi, dword [rdx + 8]
mov eax, dword [rdx + 0xc]
mov r12d, 1
xor r15d, r15d
xor ecx, ecx
jmp 0x14011c753
xor r11d, r11d
lea r10, [rcx + 1]
movzx r11d, r11b
lea r12, [r11 + r12*2]
shl r11d, cl
xor r15d, r11d
mov esi, ebp
mov rcx, r10
cmp r8, r10
je 0x14011c83a
lea r11, [r12 + r14]
cmp r11, rbx
jae 0x14011c873
mov ebp, esi
shr ebp, 0xb
movzx r10d, word [r9 + r11*2]
imul ebp, r10d
mov r13d, eax
sub r13d, ebp
jae 0x14011c7c0
cmp byte [rsp + 0xa0], 0
je 0x14011c796
mov esi, 0x800
sub esi, r10d
movzx esi, si
shr esi, 5
add esi, r10d
mov word [r9 + r11*2], si
mov dword [rdx + 8], ebp
cmp ebp, 0x1000000
jae 0x14011c730
shl ebp, 8
mov dword [rdx + 8], ebp
mov rbx, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
cmp rbx, r10
jbe 0x14011c847
xor r11d, r11d
mov r13d, eax
jmp 0x14011c805
cmp byte [rsp + 0xa0], 0
je 0x14011c7d9
movzx eax, r10w
shr eax, 5
sub r10d, eax
mov word [r9 + r11*2], r10w
mov dword [rdx + 0xc], r13d
sub esi, ebp
mov dword [rdx + 8], esi
mov r11b, 1
cmp esi, 0x1000000
jae 0x14011c830
shl esi, 8
mov dword [rdx + 8], esi
mov rbx, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11b, 1
mov ebp, esi
cmp rbx, r10
jbe 0x14011c847
mov rax, qword [rdi]
movzx eax, byte [rax + r10]
inc r10
mov qword [rdi + 0x10], r10
shl r13d, 8
or r13d, eax
mov dword [rdx + 0xc], r13d
mov eax, r13d
mov rbx, qword [rsp + 0x90]
jmp 0x14011c733
mov eax, r13d
mov ebp, esi
jmp 0x14011c733
mov rax, qword [rsp + 0x20]
mov dword [rax + 4], r15d
xor ecx, ecx
jmp 0x14011c860
mov qword [rdi + 0x10], rbx
lea rcx, [0x140326e10]
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], rcx
mov ecx, 1
mov dword [rax], ecx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x140328ad8]
mov rcx, r11
mov rdx, rbx
call fcn.14029d940
int3
Function at 0x14012f2e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x1401315a0
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, r9
jne 0x1401315ba
test rdx, rdx
je 0x1401315bd
cmp rdx, 8
jae 0x1401315c7
xor r9d, r9d
xor eax, eax
jmp 0x1401316d0
xor eax, eax
ret
xor r9d, r9d
test r9b, r9b
sete al
ret
cmp rdx, 0x20
jae 0x1401315d7
xor r9d, r9d
xor eax, eax
jmp 0x140131666
mov rax, rdx
and rax, 0xffffffffffffffe0
pxor xmm0, xmm0
xor r9d, r9d
pxor xmm1, xmm1
nop dword [rax]
movdqu xmm2, xmmword [rcx + r9]
movdqu xmm3, xmmword [rcx + r9 + 0x10]
movdqu xmm4, xmmword [r8 + r9]
pxor xmm4, xmm2
por xmm0, xmm4
movdqu xmm2, xmmword [r8 + r9 + 0x10]
pxor xmm2, xmm3
por xmm1, xmm2
add r9, 0x20
cmp rax, r9
jne 0x1401315f0
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r9d, xmm1
cmp rax, rdx
je 0x1401316e8
test dl, 0x18
je 0x1401316d0
mov r10, rax
mov rax, rdx
and rax, 0xfffffffffffffff8
movzx r9d, r9b
movd xmm0, r9d
nop dword [rax]
mov r9, qword [r8 + r10]
xor r9, qword [rcx + r10]
movq xmm1, r9
por xmm0, xmm1
add r10, 8
cmp rax, r10
jne 0x140131680
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r9d, xmm1
cmp rax, rdx
je 0x1401316e8
nop word [rax + rax]
movzx r10d, byte [r8 + rax]
xor r10b, byte [rcx + rax]
lea r11, [rax + 1]
or r9b, r10b
mov rax, r11
cmp rdx, r11
jne 0x1401316d0
test r9b, r9b
sete al
ret
Function at 0x1401323a0
Capabilities:
Get local ipv4 addresses

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov ebx, edx
mov rsi, rcx
mov dword [rsp + 0x34], 0x3a98
mov edi, 0x3a98
mov ecx, 0x3a98
mov edx, 8
call fcn.14023caa0
test al, al
je 0x140132449
movzx ebx, bx
lea r15, [rsp + 0x34]
mov r12, qword [sym.imp.iphlpapi.dll_GetAdaptersAddresses]
nop word cs:[rax + rax]
movzx eax, byte [0x1403d2ea1]
mov edx, 8
mov rcx, rdi
call fcn.1400fcbc0
test rax, rax
je 0x140132449
mov r14, rax
mov qword [rsp + 0x20], r15
mov ecx, ebx
xor edx, edx
xor r8d, r8d
mov r9, rax
call r12
cmp eax, 0x6f
jne 0x140132465
mov r8d, 8
mov rcx, r14
mov rdx, rdi
call fcn.1400fcbd0
mov edi, dword [rsp + 0x34]
mov edx, 8
mov rcx, rdi
call fcn.14023caa0
test al, al
jne 0x1401323f0
mov dword [rsi + 8], 8
mov qword [rsi], 0
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
test eax, eax
jne 0x14013247a
mov qword [rsi], 8
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x140132457
mov dword [rsi + 8], eax
mov qword [rsi], 0
mov r8d, 8
mov rcx, r14
mov rdx, rdi
call fcn.1400fcbd0
jmp 0x140132457
Function at 0x14013a600
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp - 0x38], rcx
mov rax, r9
shr rax, 0x20
jne 0x14013a858
mov r10, rdx
mov eax, r9d
and eax, 7
mov r14d, 8
mov r15d, 8
sub r15d, eax
test eax, eax
cmove r15d, eax
add r15d, r9d
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 1
mov qword [rbp - 0x18], 0
add r8, rdx
mov ecx, 1
xor r11d, r11d
xor edi, edi
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x10], r15
jmp 0x14013a688
mov r10, qword [rbp - 8]
mov r8, qword [rbp - 0x30]
cmp r10, r8
je 0x14013a757
lea rax, [r10 + 1]
mov qword [rbp - 8], rax
mov r8b, 1
xor ebx, ebx
jmp 0x14013a6c8
mov rcx, qword [rbp - 0x20]
mov r11, r12
mov byte [rcx + r11], r13b
inc r11
mov qword [rbp - 0x18], r11
mov r10, r15
mov r9, r14
mov r14d, 8
mov r15, qword [rbp - 0x10]
inc rdi
mov r8d, esi
test bl, 1
jne 0x14013a680
cmp r8b, 8
ja 0x14013a680
lea eax, [r8 + 1]
cmp r8b, 8
setae bl
movzx esi, al
cmovae esi, r14d
test r15d, r15d
je 0x14013a84a
mov rax, rdi
shr rax, 0x20
je 0x14013a710
mov rax, rdi
xor edx, edx
div r15
cmp rdx, r9
jae 0x14013a6c2
jmp 0x14013a71c
mov eax, edi
xor edx, edx
div r15d
cmp rdx, r9
jae 0x14013a6c2
mov r14, r9
neg r8b
mov r15, r10
movzx eax, byte [r10]
movzx edx, r8b
and edx, 7
bt eax, edx
mov r13d, 0
sbb r13d, r13d
cmp r11, qword [rbp - 0x28]
jne 0x14013a6a7
mov r12, r11
lea rcx, [rbp - 0x28]
call fcn.140009950
jmp 0x14013a6a0
mov rdi, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x20]
test r11, r11
je 0x14013a7fa
mov rcx, rbx
cmp r11, 8
jb 0x14013a7ea
cmp r11, 0x20
jae 0x14013a77b
xor eax, eax
jmp 0x14013a7c2
mov rax, r11
and rax, 0xffffffffffffffe0
xor ecx, ecx
pcmpeqd xmm0, xmm0
nop dword [rax + rax]
movdqu xmm1, xmmword [rbx + rcx]
movdqu xmm2, xmmword [rbx + rcx + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rbx + rcx], xmm1
movdqu xmmword [rbx + rcx + 0x10], xmm2
add rcx, 0x20
cmp rax, rcx
jne 0x14013a790
cmp r11, rax
je 0x14013a7fa
test r11b, 0x18
je 0x14013a7e4
mov rdx, r11
and rdx, 0xfffffffffffffff8
lea rcx, [rbx + rdx]
nop dword [rax]
not qword [rbx + rax]
add rax, 8
cmp rdx, rax
jne 0x14013a7d0
cmp r11, rdx
jne 0x14013a7ea
jmp 0x14013a7fa
add rax, rbx
mov rcx, rax
lea rax, [rbx + r11]
nop
not byte [rcx]
inc rcx
cmp rcx, rax
jne 0x14013a7f0
mov r8, qword [rbp + 0x78]
cmp r11, r8
jne 0x14013a880
mov rcx, qword [rbp + 0x70]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
movabs rax, 0x800000000000000a
mov rsi, qword [rbp - 0x38]
mov qword [rsi], rax
test rdi, rdi
je 0x14013a836
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.1400fcbd0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.C:UsersWDAGUtilityAccount.cargo_registry_srcindex.crates.io_6f17d22bba15001fimage_0.25.5_srcutilsmod.rs
call fcn.14029df90
jmp 0x14013a89a
lea rax, [0x140333af8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1403316a8]
lea r9, [0x140331688]
lea r8, [rbp - 0x28]
mov edx, 0x2b
call fcn.14029dbe0
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], rdi
mov rcx, r8
lea r8, [0x140333b10]
mov rdx, r11
call fcn.14029de40
ud2
Function at 0x140143bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r11, rdx
mov qword [rsp + 0x28], rcx
mov r10, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov rax, qword [r11 + 8]
mov qword [rsp + 0x30], rax
mov r14, qword [r11 + 0x10]
mov r15d, dword [r11 + 0x20]
mov eax, dword [r11 + 0x24]
movzx ebx, byte [r11 + 0x29]
mov r13, qword [r11 + 0x18]
movzx ecx, byte [r11 + 0x28]
mov byte [rsp + 0x27], cl
nop word [rax + rax]
mov rcx, r10
shr rcx, 1
cmp rcx, rdx
jae 0x140143d94
movzx edi, byte [rsi + rcx]
lea ecx, [r15 - 1]
imul ecx, edi
shr ecx, 8
inc ecx
mov edi, ecx
shl edi, 8
mov ebp, eax
sub ebp, edi
jb 0x140143c90
sub r15d, ecx
mov dword [r11 + 0x24], ebp
mov dword [r11 + 0x20], r15d
cmp r15d, 0x7f
jbe 0x140143c9f
jmp 0x140143d00
mov ebp, eax
mov r15d, ecx
mov dword [r11 + 0x20], r15d
cmp r15d, 0x7f
ja 0x140143d00
test r15d, r15d
je 0x140143cad
bsr ecx, r15d
xor ecx, 0x1f
jmp 0x140143cb2
mov ecx, 0x20
add cl, 0xe8
shl ebp, cl
mov dword [r11 + 0x24], ebp
shl r15d, cl
mov dword [r11 + 0x20], r15d
add bl, cl
mov byte [r11 + 0x29], bl
cmp bl, 8
jb 0x140143d00
and bl, 7
mov byte [r11 + 0x29], bl
cmp r14, r13
jbe 0x140143d23
mov rcx, qword [rsp + 0x30]
movzx r12d, byte [rcx + r13]
mov ecx, ebx
shl r12d, cl
inc r13
mov qword [r11 + 0x18], r13
or ebp, r12d
mov dword [r11 + 0x24], ebp
nop word cs:[rax + rax]
cmp eax, edi
sbb r10, 0xffffffffffffffff
cmp r10, r9
jae 0x140143d46
cmp eax, edi
setae r12b
movsx r10, byte [r8 + r10]
mov eax, ebp
test r10, r10
jg 0x140143c50
jmp 0x140143d58
mov qword [r11 + 0x18], r14
test byte [rsp + 0x27], 1
jne 0x140143d78
mov byte [r11 + 0x28], 1
mov byte [rsp + 0x27], 1
mov r13, r14
cmp eax, edi
sbb r10, 0xffffffffffffffff
cmp r10, r9
jb 0x140143d0b
lea r8, str.C:UsersWDAGUtilityAccount.cargo_registry_srcindex.crates.io_6f17d22bba15001fimage_webp_0.2.0_src_vp8.rs
mov rcx, r10
mov rdx, r9
call fcn.14029d940
neg r10b
mov rax, qword [rsp + 0x28]
mov byte [rax + 1], r10b
mov byte [rax], 0x1d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [0x140339c70]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, rcx
mov byte [rcx], 0
mov byte [rcx + 1], r12b
jmp 0x140143d67
lea r8, str.C:UsersWDAGUtilityAccount.cargo_registry_srcindex.crates.io_6f17d22bba15001fimage_webp_0.2.0_src_vp8.rs
call fcn.14029d940
int3
Function at 0x14017f020
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov rsi, rcx
movups xmm0, xmmword [rdx + 0x38]
movups xmm1, xmmword [rdx + 0x48]
movaps xmmword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov rax, qword [rdx + 0x28]
movzx ebx, byte [rdx + 0x30]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], bl
movzx eax, byte [0x1403d2ea1]
mov ecx, 0x5f0
mov edx, 8
call fcn.1400fcbc0
test rax, rax
mov qword [rbp - 8], r14
je 0x14017f289
mov rdi, rax
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [r14 + 0x60]
mov qword [rbp - 0x18], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
movabs r11, 0x800000000000000
mov r13d, 1
lock xadd qword [0x1403d2eb8], r13
mov r14, r13
xor r14, rcx
mov rax, r14
rol rax, 0x10
lea r15, [r14 + rdx]
xor rax, r15
lea r12, [rax + r8]
xor r13, r12
add r14, r9
mov r15, r14
rol r15, 0x20
rol rax, 0x15
xor r14, r10
xor r12, r11
xor r12, rax
add r13, r14
rol r14, 0xd
add r15, r12
xor r14, r13
rol r12, 0x10
xor r12, r15
rol r13, 0x20
add r15, r14
add r13, r12
rol r14, 0x11
xor r14, r15
rol r12, 0x15
rol r15, 0x20
xor r12, r13
xor r13, r11
xor r15, 0xff
add r13, r14
add r15, r12
rol r14, 0xd
xor r14, r13
rol r12, 0x10
rol r13, 0x20
xor r12, r15
add r15, r14
rol r14, 0x11
add r13, r12
xor r14, r15
rol r12, 0x15
xor r12, r13
rol r15, 0x20
add r13, r14
add r15, r12
rol r14, 0xd
xor r14, r13
rol r12, 0x10
rol r13, 0x20
xor r12, r15
add r15, r14
rol r14, 0x11
add r13, r12
xor r14, r15
rol r12, 0x15
xor r12, r13
rol r15, 0x20
add r13, r14
add r15, r12
rol r14, 0xd
xor r14, r13
rol r12, 0x10
xor r12, r15
add r15, r14
rol r14, 0x11
rol r12, 0x15
mov r13, r15
rol r13, 0x20
xor r13, r14
xor r13, r12
cmp r13, r15
je 0x14017f0e0
xor r13, r15
mov rcx, qword [rbp - 8]
mov rax, qword [rcx + 0x58]
movaps xmm0, xmmword [rbp - 0x40]
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x128], xmm1
movups xmmword [rsi + 0x118], xmm0
mov rdx, qword [rbp - 0x10]
mov qword [rsi + 0x138], rdx
mov byte [rsi + 0x140], bl
mov qword [rsi], 0
mov qword [rsi + 8], rdi
mov qword [rsi + 0x80], 0
mov qword [rsi + 0x88], rdi
mov rdx, qword [rbp - 0x18]
mov qword [rsi + 0x100], rdx
mov qword [rsi + 0x108], r13
mov qword [rsi + 0x110], rax
mov rdx, qword [rcx + 0x10]
mov rax, rdx
neg rax
jo 0x14017f275
jae 0x14017f275
mov rcx, qword [rcx + 0x18]
mov r8d, 1
call fcn.1400fcbd0
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x5f0
call fcn.14029d5b0
ud2