joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002980
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006d40]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400029a0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400029a8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400029a0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400029fd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400029f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400029a0
add rax, 0x28
cmp rax, r9
jne 0x1400029e0
xor eax, eax
ret

Function at 0x140002a00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006d40]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140002a1f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002a28
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140002a1f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002ac0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006d40]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140002adf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002ae8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400010d0
Capabilities:
Encode data using xor
Read file on windows
Write file on windows

Disassembly:
push rdi
sub rsp, 0x240
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x140003280]
lea rcx, str.C:Users_vmDesktop_beacon.bin
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x14000111c
lea rdx, str.C:Users_vmDesktop_beacon.bin
lea rcx, str.Could_not_open_file:__s_n
call fcn.140001010
jmp 0x140001190
lea r9, str.C:Users_vmDesktop_beacon.bin
mov edx, 0x200
lea r8, str._s.enc
lea rcx, [rsp + 0x30]
call fcn.140001070
test eax, eax
js 0x140001278
cmp eax, 0x200
jae 0x140001278
lea rdx, [0x1400032d4]
mov qword [rsp + 0x260], rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
test rax, rax
jne 0x1400011ab
lea rdx, [rsp + 0x30]
lea rcx, str.Failed_to_create_output_file:__s_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x260]
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400012b0
add rsp, 0x240
pop rdi
ret
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
je 0x140001250
mov qword [rsp + 0x250], rbx
mov qword [rsp + 0x258], rbp
xor ebp, ebp
mov qword [rsp + 0x268], r14
lea r14, [0x140003348]
nop dword [rax + rax]
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov edx, 1
cmp rbp, 4
mov r9, rsi
mov r8d, edx
cmovl rbx, rbp
movzx eax, byte [rbx + r14]
xor byte [rsp + 0x20], al
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
lea rbp, [rbx + 1]
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
test rax, rax
jne 0x1400011f0
mov r14, qword [rsp + 0x268]
mov rbp, qword [rsp + 0x258]
mov rbx, qword [rsp + 0x250]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [rsp + 0x30]
lea rcx, str.File_encrypted_successfully:__s_n
call fcn.140001010
jmp 0x140001188
lea rcx, str.Failed_to_create_output_filename_n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140001190

Function at 0x140001b70
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001bba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001bba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001bba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001bba
cmp dword [rcx + 0x84], 0xe
jbe 0x140001bba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001bbc
xor al, al
add rsp, 0x28
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140013410
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001128a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014760
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014780
xor al, al
jmp 0x140014801
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014793
xor al, al
jmp 0x140014801
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400147bd
xor al, al
jmp 0x140014801
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400147d1
xor al, al
jmp 0x140014801
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400147e3
xor al, al
jmp 0x140014801
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400147ff
xor al, al
jmp 0x140014801
mov al, 1
add rsp, 0x38
ret
Function at 0x140012650
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113cf
movzx eax, al
test eax, eax
jne 0x140012670
mov ecx, 7
call fcn.140011343
nop
mov byte [rsp + 0x20], 0
call fcn.140011357
mov byte [rsp + 0x21], al
cmp dword [0x14001d868], 1
jne 0x140012694
mov ecx, 7
call fcn.140011343
nop
jmp 0x1400126ec
cmp dword [0x14001d868], 0
jne 0x1400126e7
mov dword [0x14001d868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111a9
test eax, eax
je 0x1400126c8
mov eax, 0xff
jmp 0x1400127f1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.14001134d
mov dword [0x14001d868], 2
jmp 0x1400126ec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001132f
call fcn.1400112b7
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012749
mov rcx, qword [rsp + 0x30]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x140012749
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140024020]
nop
call fcn.1400112e9
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001277d
mov rcx, qword [rsp + 0x38]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x14001277d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001138e
nop
call fcn.1400128a0
mov dword [rsp + 0x28], eax
call fcn.14001128a
movzx eax, al
test eax, eax
jne 0x14001279c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400127ab
call fcn.140011398
nop
xor edx, edx
mov cl, 1
call fcn.14001114f
mov eax, dword [rsp + 0x28]
jmp 0x1400127f1
add rsp, 0x68
ret
Function at 0x140a30058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140a301df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a30089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a3006f
add dl, dl
jne 0x140a30096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a300f6
xor eax, eax
add dl, dl
jne 0x140a300a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a301ad
add dl, dl
jne 0x140a300b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a300c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a300d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a300dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a300ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a3007e
mov eax, 1
add dl, dl
jne 0x140a30106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a30113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a300fb
sub eax, ebx
mov ebx, 1
jne 0x140a3014c
mov ecx, 1
add dl, dl
jne 0x140a3012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a3013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a30123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a3007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a30168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a30175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a3015d
cmp eax, 0x7d00
jae 0x140a3019b
cmp eax, 0x500
jb 0x140a30196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a3007e
cmp eax, 0x7f
ja 0x140a3019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a3007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a301d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a3007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000a8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
mov qword [rsp + 0x28], r8
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14000ab30
mov rbx, rdx
mov rsi, qword [rcx + 0x10]
shl rax, 4
lea rbp, [rax + rax*4]
jmp 0x14000a8fe
add rsi, 0x50
add rbp, 0xffffffffffffffb0
je 0x14000ab30
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x70]
call fcn.14003ba50
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, qword [rsp + 0x28]
call fcn.14003ba50
mov r15, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
cmp r12, r13
jne 0x14000a980
movzx edi, byte [rsp + 0x80]
movzx eax, byte [rsp + 0xa8]
cmp al, byte [rsp + 0x68]
jne 0x14000a988
cmp byte [rsp + 0xa9], 2
jne 0x14000a988
cmp byte [rsp + 0x69], 2
jne 0x14000a988
cmp dil, 6
jne 0x14000aaef
cmp byte [rsp + 0x40], 2
ja 0x14000ab18
mov al, 6
jmp 0x14000a9bd
movzx edi, byte [rsp + 0x80]
mov al, 6
cmp dil, 6
je 0x14000a9bd
lea rcx, [rsp + 0x81]
mov rax, qword [rcx + 0x1f]
mov qword [rsp + 0xcf], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
mov eax, edi
movzx ecx, byte [rsp + 0xaa]
movzx edx, word [rsp + 0xa8]
mov qword [rsp + 0x108], r15
mov qword [rsp + 0x110], r12
mov byte [rsp + 0x118], al
mov rax, qword [rsp + 0xcf]
lea r8, [rsp + 0x119]
mov qword [r8 + 0x1f], rax
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
mov word [rsp + 0x140], dx
mov byte [rsp + 0x142], cl
movzx eax, byte [rsp + 0x40]
cmp al, 6
je 0x14000aa51
lea rdx, [rsp + 0x41]
mov rcx, qword [rdx + 0x1f]
mov qword [rsp + 0xff], rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
movzx ecx, byte [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x150], r13
mov byte [rsp + 0x158], al
mov rax, qword [rsp + 0xff]
lea r8, [rsp + 0x159]
mov qword [r8 + 0x1f], rax
movaps xmm0, xmmword [rsp + 0xe0]
movaps xmm1, xmmword [rsp + 0xf0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
mov word [rsp + 0x180], dx
mov byte [rsp + 0x182], cl
lea rcx, [rsp + 0x108]
lea rdx, [rsp + 0x148]
call fcn.14000b110
test al, al
jne 0x14000ab37
cmp dword [rsi + 0x48], 0x3b9aca01
jne 0x14000a8f0
mov rcx, rsi
mov rdx, rbx
mov r8, qword [rsp + 0x28]
call fcn.14000ab60
test rax, rax
je 0x14000a8f0
jmp 0x14000ab34
movzx eax, byte [rsp + 0x40]
cmp al, 6
jne 0x14000ab04
cmp dil, 3
jb 0x14000a990
jmp 0x14000ab18
cmp dil, 3
setb cl
cmp al, 3
setb al
xor al, cl
jne 0x14000a990
mov rcx, r15
mov rdx, r14
mov r8, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000a988
jmp 0x14000ab37
xor eax, eax
jmp 0x14000ab44
mov rsi, rax
xor eax, eax
cmp dword [rsi + 0x48], 0x3b9aca01
cmovne rax, rsi
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000ab60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
mov qword [rsp + 0x28], r8
mov rax, qword [rcx + 0x18]
test rax, rax
je 0x14000ade0
mov rbx, rdx
mov rsi, qword [rcx + 0x10]
shl rax, 4
lea r13, [rax + rax*4]
jmp 0x14000abae
add rsi, 0x50
add r13, 0xffffffffffffffb0
je 0x14000ade0
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x70]
call fcn.14003ba50
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, qword [rsp + 0x28]
call fcn.14003ba50
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
cmp r15, r12
jne 0x14000ac30
movzx edi, byte [rsp + 0x80]
movzx eax, byte [rsp + 0xa8]
cmp al, byte [rsp + 0x68]
jne 0x14000ac38
cmp byte [rsp + 0xa9], 2
jne 0x14000ac38
cmp byte [rsp + 0x69], 2
jne 0x14000ac38
cmp dil, 6
jne 0x14000ad9f
cmp byte [rsp + 0x40], 2
ja 0x14000adc8
mov al, 6
jmp 0x14000ac6d
movzx edi, byte [rsp + 0x80]
mov al, 6
cmp dil, 6
je 0x14000ac6d
lea rcx, [rsp + 0x81]
mov rax, qword [rcx + 0x1f]
mov qword [rsp + 0xcf], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rsp + 0xc0], xmm1
movaps xmmword [rsp + 0xb0], xmm0
mov eax, edi
movzx ecx, byte [rsp + 0xaa]
movzx edx, word [rsp + 0xa8]
mov qword [rsp + 0x108], r14
mov qword [rsp + 0x110], r15
mov byte [rsp + 0x118], al
mov rax, qword [rsp + 0xcf]
lea r8, [rsp + 0x119]
mov qword [r8 + 0x1f], rax
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
mov word [rsp + 0x140], dx
mov byte [rsp + 0x142], cl
movzx eax, byte [rsp + 0x40]
cmp al, 6
je 0x14000ad01
lea rdx, [rsp + 0x41]
mov rcx, qword [rdx + 0x1f]
mov qword [rsp + 0xff], rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
movzx ecx, byte [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
mov qword [rsp + 0x148], rbp
mov qword [rsp + 0x150], r12
mov byte [rsp + 0x158], al
mov rax, qword [rsp + 0xff]
lea r8, [rsp + 0x159]
mov qword [r8 + 0x1f], rax
movaps xmm0, xmmword [rsp + 0xe0]
movaps xmm1, xmmword [rsp + 0xf0]
movups xmmword [r8 + 0x10], xmm1
movups xmmword [r8], xmm0
mov word [rsp + 0x180], dx
mov byte [rsp + 0x182], cl
lea rcx, [rsp + 0x108]
lea rdx, [rsp + 0x148]
call fcn.14000b110
test al, al
jne 0x14000ade2
cmp dword [rsi + 0x48], 0x3b9aca01
jne 0x14000aba0
mov rcx, rsi
mov rdx, rbx
mov r8, qword [rsp + 0x28]
call fcn.14000ab60
test rax, rax
je 0x14000aba0
jmp 0x14000adf9
movzx eax, byte [rsp + 0x40]
cmp al, 6
jne 0x14000adb4
cmp dil, 3
jb 0x14000ac40
jmp 0x14000adc8
cmp dil, 3
setb cl
cmp al, 3
setb al
xor al, cl
jne 0x14000ac40
mov rcx, r14
mov rdx, rbp
mov r8, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000ac38
jmp 0x14000ade2
xor esi, esi
mov rax, rsi
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, rax
jmp 0x14000ade2
Function at 0x14000c2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
cmp r9, 8
jb 0x14000c362
shr r9, 3
imul rbx, r9, 0xe0
lea rdx, [rcx + rbx]
imul r14, r9, 0x188
lea r8, [rcx + r14]
mov r15, r9
call fcn.14000c2f0
mov r12, rax
lea rdx, [rdi + rbx]
lea r8, [rdi + r14]
mov rcx, rdi
mov r9, r15
call fcn.14000c2f0
mov rdi, rax
add rbx, rsi
add r14, rsi
mov rcx, rsi
mov rdx, rbx
mov r8, r14
mov r9, r15
call fcn.14000c2f0
mov rsi, rax
mov rcx, r12
mov r11, qword [rcx + 0x18]
mov rax, qword [rdi + 0x18]
movzx r8d, byte [rdi + 0x30]
cmp byte [rcx + 0x30], 0
setne bl
test r8b, r8b
sete dl
and dl, bl
xor r9d, r9d
cmp r11, rax
seta r9b
movzx edx, dl
cmovne edx, r9d
mov r9, qword [rsi + 0x18]
movzx r10d, byte [rsi + 0x30]
test r10b, r10b
sete bpl
and bpl, bl
xor ebx, ebx
cmp r11, r9
seta bl
movzx r11d, bpl
cmovne r11d, ebx
cmp dl, r11b
jne 0x14000c3df
test r10b, r10b
sete cl
test r8b, r8b
setne r8b
and r8b, cl
xor ecx, ecx
cmp rax, r9
seta cl
movzx eax, r8b
cmovne eax, ecx
xor dl, al
cmovne rdi, rsi
mov rcx, rdi
mov rax, rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14000d790
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14000d7d2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14000d7da
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000d7eb
jmp 0x14000d802
xor r10d, r10d
jmp 0x14000d88d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14000d802
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14000d819
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14000d839
add r11, r8
jmp 0x14000d96b
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14000d902
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14000d8b0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14000d920
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14000d932
jmp 0x14000d94d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000d94d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14000d967
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140011420
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r14, qword [rcx + 0x10]
test r14, r14
je 0x140011463
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, r14
mov r8, r14
cmovb r8, rdi
mov rcx, qword [rcx]
mov rax, qword [rsi + 8]
call qword [rax + 0x18]
test rax, rax
je 0x14001146c
mov eax, 1
jmp 0x140011520
xor eax, eax
xor edx, edx
jmp 0x140011520
sub r14, rdx
jb 0x14001152f
mov qword [rsi + 0x10], r14
xor eax, eax
test rdi, rdi
je 0x140011520
test rdx, rdx
je 0x140011520
mov r8d, dword [rsi + 0x20]
mov ecx, dword [rsi + 0x18]
mov r9d, dword [rsi + 0x1c]
dec rdi
mov r10, rdx
dec r10
xor r11d, r11d
lea r14, [0x1400e41e0]
nop dword [rax + rax]
mov r15d, r8d
or r15d, 3
mov ebp, r15d
and ebp, 0xfffffffe
imul ebp, r15d
shr ebp, 8
xor bpl, byte [rbx + r11]
mov r15d, ecx
xor r15b, bpl
shr ecx, 8
movzx r15d, r15b
xor ecx, dword [r14 + r15*4]
movzx r15d, cl
add r15d, r9d
imul r9d, r15d, 0x8088405
inc r9d
mov r15d, r9d
shr r15d, 0x18
movzx r12d, r8b
xor r12d, r15d
shr r8d, 8
xor r8d, dword [r14 + r12*4]
mov byte [rbx + r11], bpl
cmp r10, r11
je 0x140011515
lea r15, [r11 + 1]
cmp rdi, r11
mov r11, r15
jne 0x1400114b0
mov dword [rsi + 0x20], r8d
mov dword [rsi + 0x18], ecx
mov dword [rsi + 0x1c], r9d
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str.number_of_read_bytes_exceeds_limit
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x30], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rdx, [0x1400e4ec0]
lea rcx, [rsp + 0x20]
call fcn.1400a2420
int3

Function at 0x140011690
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
movaps xmm9, xmmword [rdx]
movaps xmm10, xmmword [rdx + 0xa0]
movaps xmmword [rcx], xmm9
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movaps xmmword [rcx + 0xa0], xmm10
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140011760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
movaps xmm11, xmmword [rdx]
movaps xmm12, xmmword [rdx + 0xc0]
movaps xmmword [rcx], xmm11
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movaps xmmword [rcx + 0xc0], xmm12
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
ret