joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x1400052e8
Capabilities:
Attach user process memory

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [0x140003020]
mov rsi, rdx
test rcx, rcx
je 0x14000538d
and qword [r11 - 0x48], rbx
lea rax, [r11 - 0x48]
xor r9d, r9d
mov qword [r11 - 0x58], rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
test eax, eax
jne 0x140005340
mov eax, 0xc000010a
jmp 0x14000538f
mov rcx, qword [0x140003020]
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov rcx, qword [0x140003020]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov rcx, qword [0x140003020]
mov r9, rsi
test rax, rax
mov r8, rdi
setne dl
call fcn.14000513c
lea rcx, [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, 0xc0000225
test ebx, ebx
js 0x14000538f
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400011f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400053d0
Capabilities:
Find process by pid

Disassembly:
sub rsp, 0x38
mov ecx, dword [rcx]
lea rdx, [0x140003020]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x20], eax
jmp 0x1400053f2
add rsp, 0x38
ret

Function at 0x140006000
Capabilities:
Create device object

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x60
and qword [rax + 0x18], 0
lea rdx, [0x140006140]
mov rbx, rcx
lea rcx, [rax - 0x28]
call fcn.140001164
lea rax, [rsp + 0x80]
mov r9d, 0x4506
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], 0
xor edx, edx
and dword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
js 0x1400060cd
lea rax, [0x140005470]
mov qword [rbx + 0x68], rax
lea rdx, [0x140006160]
lea rax, [0x1400053b0]
mov qword [rbx + 0x70], rax
lea rcx, [rsp + 0x50]
lea rax, [0x1400053b0]
mov qword [rbx + 0x80], rax
lea rax, [0x1400053b0]
mov qword [rbx + 0x88], rax
mov qword [rbx + 0x90], rax
lea rax, section.PAGE
mov qword [rbx + 0xe0], rax
call fcn.140001164
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
test eax, eax
jns 0x1400060cb
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
xor eax, eax
add rsp, 0x60
pop rbx
ret
Function at 0x40aea0
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x38], edx
inc ecx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x40de70
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x40aea0

Function at 0x40aef0
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov rsi, rcx
mov rcx, rdx
mov rbp, rdx
call sub.msvcrt.dll_strlen
lea ebx, [rax + 1]
cdqe
mov byte [rbp + rax], 0xa
test ebx, ebx
jle 0x40af9a
mov r12, qword [sym.imp.WS2_32.dll_select]
xor edi, edi
lea r14, [rsp + 0x40]
lea r13, [rsp + 0x38]
lea r15, [rsp + 0x34]
nop word [rax + rax]
mov rcx, qword [rsi + 0x118]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x20], r13
mov r8, r14
mov qword [rsp + 0x48], rcx
inc ecx
call r12
test eax, eax
jle 0x40afb5
mov rcx, qword [rsi + 8]
lea rdx, [rbp + rdi]
mov r9, r15
movsxd r8, ebx
call qword [sym.imp.libcurl_4.dll_curl_easy_send]
test eax, eax
jne 0x40afb0
movsxd rdx, dword [rsp + 0x34]
sub ebx, edx
add rdi, rdx
test ebx, ebx
jg 0x40af40
mov eax, 1
jmp 0x40afb7
cmp eax, 0x51
je 0x40af40
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x40c4b0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x138
mov r8d, 0xf0
mov rbx, rcx
mov r13, rdx
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.msvcrt.dll_memset
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.libcurl_4.dll_curl_easy_init]
mov r12, rax
test rax, rax
je 0x40c690
lea rsi, [rsp + 0x30]
mov r8, rbx
mov edx, 0x2712
mov rbx, qword [sym.imp.libcurl_4.dll_curl_easy_setopt]
mov rcx, rax
call rbx
mov r8d, 1
mov edx, 0x4a
mov rcx, r12
call rbx
mov r8d, 0xf
mov edx, 0x4e
mov rcx, r12
call rbx
mov r8, rsi
mov edx, 0x271a
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x63
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x79
mov rcx, r12
call rbx
lea r8, [0x0040ae30]
mov edx, 0x4e2b
mov rcx, r12
call rbx
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, r12
call rbx
mov rax, qword [0x007257a0]
mov r8, qword [rax]
test r8, r8
je 0x40c620
mov edx, 0x2714
mov rcx, r12
call rbx
mov rax, qword [0x007257b0]
mov edx, 0x65
mov rcx, r12
mov r8d, dword [rax]
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
jne 0x40c670
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x40c5e5
cmp qword [rsp + 0x28], 0
jne 0x40c610
lea rdx, str.Empty_data_received_for_config
xor ecx, ecx
xor r13d, r13d
call fcn.0040b000
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_cleanup]
mov rax, r13
add rsp, 0x138
pop rbx
pop rsi
pop r12
pop r13
ret
mov r8, r13
xor edx, edx
call fcn.00672680
mov r13, rax
jmp 0x40c5f6
lea rcx, str.http_proxy
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c5c2
lea rcx, str.all_proxy
call sub.msvcrt.dll_getenv
lea rcx, str.all_proxy
test rax, rax
je 0x40c6b0
call sub.msvcrt.dll_getenv
mov rcx, r12
mov edx, 0x2714
mov r8, rax
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
je 0x40c5d3
nop dword [rax]
mov r8, rsi
lea rdx, str.Remote_config_read_failed:__s
xor ecx, ecx
xor r13d, r13d
call fcn.0040b000
jmp 0x40c5f6
lea rdx, str.Remote_config_init_failed_
xor ecx, ecx
xor r13d, r13d
call fcn.0040b000
jmp 0x40c5ff
lea rcx, str.ALL_PROXY
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c6d0
lea rcx, str.ALL_PROXY
jmp 0x40c649
lea r8, [0x006bac74]
mov edx, 0x2714
mov rcx, r12
call rbx
jmp 0x40c5c2
Function at 0x40de50
Capabilities:
Get socket status

Disassembly:
sub rsp, 0x258
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x38], edx
inc ecx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x3c], 0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
setg al
add rsp, 0x258
ret
mov rax, qword [rcx + 0x128]
cmp byte [rax], 0
je 0x40de70
mov eax, 1
ret
mov rcx, qword [rcx + 0x118]
jmp 0x40aea0
Function at 0x40de80
Capabilities:
Get socket status

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa98
vmovups xmmword [rsp + 0xa80], xmm6
mov edx, 0xa
mov rdi, qword [rcx + 0x128]
mov rbx, rcx
mov rcx, rdi
call sub.msvcrt.dll_strchr
mov r12, rax
test rax, rax
je 0x40df40
mov rcx, rdi
call sub.msvcrt.dll_strlen
lea rdx, [0x006bb1da]
mov rcx, rdi
mov rsi, rax
call sub.msvcrt.dll_strtok
mov r12, rax
test rax, rax
je 0x40e170
mov rcx, rax
call sub.msvcrt.dll__strdup
mov rcx, rax
mov r12, rax
call sub.msvcrt.dll_strlen
mov rcx, qword [rbx + 0x128]
lea rdx, [rax + 1]
cmp rdx, rsi
jl 0x40dfe0
mov byte [rcx], 0
mov rax, qword [0x00725790]
cmp byte [rax], 0
jne 0x40dfc0
vmovups xmm6, xmmword [rsp + 0xa80]
mov rax, r12
add rsp, 0xa98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x58]
mov rbp, qword [sym.imp.msvcrt.dll__time64]
call rbp
lea rsi, [rsp + 0x280]
mov rax, qword [0x006bc048]
mov rcx, qword [rbx + 0x118]
lea r15, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x280], 1
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov qword [rsp + 0x70], rax
mov rax, qword [sym.imp.WS2_32.dll_select]
mov qword [rsp + 0x288], rcx
inc ecx
mov qword [rsp + 0x38], rax
call rax
test eax, eax
jg 0x40e000
lea rdx, str.stratum_recv_line_timed_out
mov ecx, 1
call fcn.0040b2f0
jmp 0x40df1f
mov r8, r12
lea rdx, str.___s
mov ecx, 4
call fcn.0040b2f0
jmp 0x40df1f
sub rsi, rax
add rdx, rcx
lea r8, [rsi + 1]
call sub.msvcrt.dll_memmove
jmp 0x40df0f
lea rax, [rsp + 0x68]
mov r13, qword [sym.imp.libcurl_4.dll_curl_easy_recv]
lea r14, [rsp + 0x60]
vmovq xmm6, qword [0x006bc050]
mov qword [rsp + 0x40], rax
jmp 0x40e09e
cmp qword [rsp + 0x60], 0
je 0x40e10c
mov r8, qword [rbx + 0x128]
mov rcx, r8
mov qword [rsp + 0x48], r8
call sub.msvcrt.dll_strlen
mov rcx, rsi
mov rdi, rax
call sub.msvcrt.dll_strlen
mov r8, qword [rsp + 0x48]
lea rdx, [rdi + rax + 1]
cmp rdx, qword [rbx + 0x120]
jae 0x40e130
lea rcx, [r8 + rdi]
mov rdx, rsi
call sub.msvcrt.dll_strcpy
xor ecx, ecx
call rbp
sub rax, qword [rsp + 0x58]
cmp rax, 0x3b
jg 0x40e160
mov rdi, qword [rbx + 0x128]
mov edx, 0xa
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x40debf
xor edx, edx
mov r8d, 0x800
mov rcx, rsi
call sub.msvcrt.dll_memset
mov rcx, qword [rbx + 8]
mov r9, r14
mov r8d, 0x7fc
mov rdx, rsi
call r13
test eax, eax
je 0x40e020
cmp eax, 0x51
jne 0x40e10c
mov rcx, qword [rbx + 0x118]
mov rax, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x70], 1
mov rdx, r15
vmovq qword [rsp + 0x68], xmm6
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x20], rax
inc ecx
mov rax, qword [rsp + 0x38]
call rax
test eax, eax
jg 0x40e06e
lea rdx, str.stratum_recv_line_failed
mov ecx, 1
call fcn.0040b2f0
jmp 0x40df1f
and rdx, 0xfffffffffffff800
mov rcx, r8
add rdx, 0x800
mov qword [rbx + 0x120], rdx
call sub.msvcrt.dll_realloc
mov r8, rax
mov qword [rbx + 0x128], rax
jmp 0x40e062
mov rdi, qword [rbx + 0x128]
jmp 0x40debf
lea rdx, str.stratum_recv_line_failed_to_parse_a_newline_terminated_string
xor ecx, ecx
call fcn.0040b000
jmp 0x40df1f
Function at 0x414210
Capabilities:
Manipulate user privileges

Disassembly:
push r13
push r12
push rbx
add rsp, 0xffffffffffffff80
call fcn.004140d0
mov r8d, eax
mov eax, 1
test r8d, r8d
je 0x414240
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4142b2
lea r12, [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x30]
mov rbx, qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
call rbx
mov edx, dword [rsp + 0x50]
test edx, edx
jne 0x4142d0
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
mov edx, 1
call rbx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Huge_Pages:_Failed_token_query.
mov ecx, 2
call fcn.0040b2f0
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], r12
mov r13, rax
mov r9d, dword [rsp + 0x50]
mov r8, rax
mov edx, 1
call rbx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x4142b2
xor ecx, ecx
lea r9, [rsp + 0x38]
mov r8d, 0xf0fff
mov rdx, r12
mov qword [r12], 0
mov qword [r12 + 8], 0
mov qword [r12 + 0x10], 0
mov qword [r12 + 0x18], 0
mov qword [r12 + 0x20], 0
mov qword [r12 + 0x28], 0
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
je 0x414370
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
lea rcx, str.SeLockMemoryPrivilege
call sub.msvcrt.dll_wcslen
lea r8, str.SeLockMemoryPrivilege
mov ecx, 2
lea edx, [rax + rax]
lea eax, [rax + rax + 2]
mov qword [rsp + 0x48], r8
mov word [rsp + 0x40], dx
lea rdx, str.LSA:__s
mov word [rsp + 0x42], ax
call fcn.0040b2f0
mov rcx, qword [rsp + 0x38]
mov r9d, 1
lea r8, [rsp + 0x40]
mov rdx, qword [r13]
call sub.ADVAPI32.dll_LsaAddAccountRights
mov ecx, eax
test eax, eax
jne 0x414410
lea rdx, str.Huge_pages_support_was_successfully_enabled__but_reboot_is_required_to_use_it
mov ecx, 2
call fcn.0040b2f0
mov rcx, qword [rsp + 0x38]
call sub.ADVAPI32.dll_LsaClose
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.004140d0
test eax, eax
setne al
sub rsp, 0xffffffffffffff80
pop rbx
pop r12
pop r13
ret
call sub.ADVAPI32.dll_LsaNtStatusToWinError
lea rdx, str.Huge_pages:_Failed_to_add_account_rights__lu
mov ecx, 2
mov r8d, eax
call fcn.0040b2f0
mov rcx, qword [rsp + 0x38]
call sub.ADVAPI32.dll_LsaClose
jmp 0x414355
Function at 0x414540
Capabilities:
Delete service
Stop service

Disassembly:
push r12
push rbx
sub rsp, 0x48
mov rcx, qword [0x006b3100]
cmp rcx, 0xffffffffffffffff
je 0x41455a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x0073ae48]
test rcx, rcx
je 0x414600
movzx r12d, byte [0x0073ae40]
test r12b, r12b
je 0x4145a0
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, r12d
mov qword [0x0073ae48], 0
add rsp, 0x48
pop rbx
pop r12
ret
lea r8, [rsp + 0x20]
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [0x0073ae48]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x4145e0
test ebx, ebx
setne r12b
mov rcx, qword [0x0073ae48]
jmp 0x414577
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_remove_WinRing0_driver__error__u
xor ecx, ecx
mov r8d, eax
call fcn.0040b2f0
jmp 0x4145c9
mov r12d, 1
mov eax, r12d
add rsp, 0x48
pop rbx
pop r12
ret
Function at 0x4149a0
Capabilities:
Create service
Query service configuration
Query service status
Start service

Disassembly:
push rbx
sub rsp, 0x50
xor r8d, r8d
mov eax, r8d
mov ecx, r8d
mov byte [rsp + 0x3f], 0
cpuid
mov eax, 1
mov dword [rsp + 0x3b], ecx
mov dword [rsp + 0x33], ebx
mov ecx, r8d
mov dword [rsp + 0x37], edx
cpuid
mov dword [rsp + 0x4c], edx
mov dword [rsp + 0x40], eax
movabs rdx, 0x69746e6568747541
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x48], ecx
cmp qword [rsp + 0x33], rdx
je 0x414a20
movabs rax, 0x49656e69756e6547
cmp qword [rsp + 0x33], rax
je 0x414a60
call fcn.00414620
test al, al
je 0x414a17
lea rdx, str.Unrecognised_CPU__skipping_MSR_setup.
mov ecx, 2
call fcn.0040b2f0
xor eax, eax
add rsp, 0x50
pop rbx
ret
cmp dword [rsp + 0x3b], 0x444d4163
jne 0x4149ec
mov edx, eax
mov ecx, eax
sar edx, 8
sar ecx, 0x14
and edx, 0xf
movzx ecx, cl
add edx, ecx
cmp edx, 0x16
jle 0x4149fd
cmp edx, 0x17
je 0x414ab0
cmp edx, 0x19
je 0x414a80
lea rdx, str.MSR_None
mov ecx, 2
call fcn.0040b2f0
jmp 0x4149fd
cmp dword [rsp + 0x3b], 0x6c65746e
jne 0x4149fd
add rsp, 0x50
pop rbx
jmp fcn.00414620
lea rdx, str.MSR_Ryzen_v2
mov ecx, 2
call fcn.0040b2f0
lea rdx, str.Arch_Zen2
mov ecx, 2
call fcn.0040b2f0
nop
add rsp, 0x50
pop rbx
jmp fcn.00414620
lea rdx, str.MSR_Ryzen_v1
mov ecx, 2
mov dword [rsp + 0x2c], eax
call fcn.0040b2f0
mov eax, dword [rsp + 0x2c]
mov edx, eax
sar eax, 4
shr edx, 0xc
and eax, 0xf
and edx, 0xf0
or eax, edx
cmp eax, 0x20
jg 0x414b00
test eax, eax
je case.0x414af8.0
cmp eax, 0x20
ja case.0x414af8.0
lea rdx, [0x006bd578]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
cmp eax, 0x31
je 0x414a91
sub eax, 0x60
cmp eax, 0x30
ja case.0x414af8.0
movabs rdx, 0x1000000020001
bt rdx, rax
jae case.0x414af8.0
jmp 0x414a91
lea rdx, [0x006bd509]
jmp 0x414a98
lea rdx, str.Arch_Zen
jmp 0x414a98
Function at 0x414b50
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov eax, 2
mov rdx, qword [rcx]
shrx rax, qword [rdx], rax
mov qword [rdx + 0x28], rax
mov rdx, qword [rcx]
mov rsi, rcx
mov rax, qword [rdx + 0x28]
add rax, 7
mov qword [rdx + 0x20], rax
mov rdx, qword [rcx]
mov eax, 4
shlx rax, qword [rdx + 0x20], rax
mov qword [rdx + 0x10], rax
mov rbx, qword [rcx]
mov edx, 1
mov rcx, qword [rbx + 0x10]
call sub.msvcrt.dll_calloc
mov qword [rbx + 0x18], rax
mov rax, qword [rsi]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rax + 8]
mov r8, qword [rax]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
mov rdi, qword [rax + 0x20]
mov rcx, qword [rax + 0x28]
lea rdx, [rdi*4]
cmp rdx, rcx
jbe 0x414d50
lea r8, [rcx*4 - 4]
mov r9, rcx
lea r11, [0x006bdd20]
lea rdi, [0x006bde20]
jmp 0x414caf
mov r15d, ebx
mov r14d, ebx
movzx ebp, bh
shr r15d, 0x10
shr r14d, 0x18
mov r12d, ebp
mov r13d, r15d
mov ebp, r14d
cmp r9, 6
jbe 0x414c2a
cmp rdx, 4
je 0x414d70
mov rdx, rcx
sub rdx, r9
movzx ebx, byte [r10 + rdx*4]
xor ebx, eax
mov byte [r10 + rcx*4], bl
mov rdx, qword [rsi]
mov rbx, rcx
sub rbx, qword [rdx + 0x28]
mov rax, qword [rdx + 0x18]
movzx r9d, byte [rax + rbx*4 + 1]
mov rbx, rcx
xor r9d, r12d
mov byte [rax + r8 + 5], r9b
mov rdx, qword [rsi]
sub rbx, qword [rdx + 0x28]
mov rax, qword [rdx + 0x18]
movzx edx, byte [rax + rbx*4 + 2]
mov rbx, rcx
inc rcx
xor edx, r13d
mov byte [rax + r8 + 6], dl
mov rax, qword [rsi]
sub rbx, qword [rax + 0x28]
mov rdx, qword [rax + 0x18]
movzx eax, byte [rdx + rbx*4 + 3]
xor eax, ebp
mov byte [rdx + r8 + 7], al
mov rax, qword [rsi]
add r8, 4
mov rbx, qword [rax + 0x20]
lea rdx, [rbx*4]
cmp rdx, rcx
jbe 0x414d50
mov r9, qword [rax + 0x28]
mov r10, qword [rax + 0x18]
xor edx, edx
mov rax, rcx
div r9
mov ebx, dword [r10 + r8]
mov dword [rsp + 0x28], ebx
mov r14, rax
mov eax, ebx
test rdx, rdx
jne 0x414c00
movzx eax, word [rsp + 0x29]
mov byte [rsp + 0x2f], bl
mov word [rsp + 0x2c], ax
movzx eax, byte [rsp + 0x2b]
mov byte [rsp + 0x2e], al
mov eax, dword [rsp + 0x2c]
movzx edx, ah
movzx ebx, ah
and edx, 0xf0
and ebx, 0xf
add rdx, r11
movzx r12d, byte [rdx + rbx]
mov edx, eax
shr edx, 0x10
mov ebx, edx
and edx, 0xf0
and ebx, 0xf
add rdx, r11
movzx r13d, byte [rdx + rbx]
mov edx, eax
shr edx, 0x18
mov ebx, edx
and edx, 0xf0
and ebx, 0xf
add rdx, r11
movzx ebp, byte [rdx + rbx]
mov edx, eax
and eax, 0xf0
add rax, r11
and edx, 0xf
movzx ebx, byte [rax + rdx]
movzx eax, byte [rdi + r14 - 1]
xor eax, ebx
jmp 0x414c2a
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, ebx
and ebx, 0xf0
and edx, 0xf
lea rax, [r11 + rbx]
mov rbx, r12
and r12d, 0xf0
and ebx, 0xf
movzx eax, byte [rax + rdx]
lea rdx, [r11 + r12]
movzx r12d, byte [rdx + rbx]
mov ebx, r15d
and r15d, 0xf0
and ebx, 0xf
lea rdx, [r11 + r15]
movzx r13d, byte [rdx + rbx]
mov ebx, r14d
and r14d, 0xf0
and ebx, 0xf
lea rdx, [r11 + r14]
movzx ebp, byte [rdx + rbx]
jmp 0x414c2a
Function at 0x418840
Capabilities:
Encode data using add xor sub operations

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x180
lea r13, [rsp + 0xb0]
mov ebx, edx
mov r12, rcx
mov r14, r8
xor edx, edx
mov r8d, 0xc8
mov rcx, r13
call sub.msvcrt.dll_memset
cmp ebx, 0x87
jle 0x418975
nop dword [rax + rax]
vmovdqu xmm1, xmmword [r12]
vmovdqu xmm2, xmmword [r12 + 0x10]
mov rcx, r13
sub ebx, 0x88
vpxor xmm0, xmm1, xmmword [rsp + 0xb0]
vmovdqu xmm3, xmmword [r12 + 0x20]
add r12, 0x88
vmovdqu xmm4, xmmword [r12 - 0x58]
vmovdqu xmm5, xmmword [r12 - 0x48]
vmovdqu xmm1, xmmword [r12 - 0x38]
mov rax, qword [r12 - 8]
xor qword [rsp + 0x130], rax
vmovdqu xmmword [rsp + 0xb0], xmm0
vpxor xmm0, xmm2, xmmword [rsp + 0xc0]
vmovdqu xmm2, xmmword [r12 - 0x28]
vmovdqu xmmword [rsp + 0xc0], xmm0
vpxor xmm0, xmm3, xmmword [rsp + 0xd0]
vmovdqu xmm3, xmmword [r12 - 0x18]
vmovdqu xmmword [rsp + 0xd0], xmm0
vpxor xmm0, xmm4, xmmword [rsp + 0xe0]
vmovdqu xmmword [rsp + 0xe0], xmm0
vpxor xmm0, xmm5, xmmword [rsp + 0xf0]
vmovdqu xmmword [rsp + 0xf0], xmm0
vpxor xmm0, xmm1, xmmword [rsp + 0x100]
vmovdqu xmmword [rsp + 0x100], xmm0
vpxor xmm0, xmm2, xmmword [rsp + 0x110]
vmovdqu xmmword [rsp + 0x110], xmm0
vpxor xmm0, xmm3, xmmword [rsp + 0x120]
vmovdqu xmmword [rsp + 0x120], xmm0
call fcn.004182c0
cmp ebx, 0x87
jg 0x418880
movsxd rsi, ebx
lea rcx, [rsp + 0x20]
mov rdx, r12
mov r8, rsi
inc ebx
call sub.msvcrt.dll_memcpy
mov r8d, 0x88
xor edx, edx
mov byte [rsp + rsi + 0x20], 1
sub r8d, ebx
mov rcx, rax
movsxd rbx, ebx
add rcx, rbx
movsxd r8, r8d
call sub.msvcrt.dll_memset
vmovdqu xmm4, xmmword [rsp + 0xb0]
mov rcx, r13
vpxor xmm0, xmm4, xmmword [rsp + 0x20]
vmovdqu xmm5, xmmword [rsp + 0xc0]
vmovdqu xmm4, xmmword [rsp + 0xd0]
movzx eax, byte [rsp + 0xa7]
or eax, 0xffffff80
mov byte [rsp + 0xa7], al
mov rax, qword [rsp + 0xa0]
xor qword [rsp + 0x130], rax
vmovdqu xmmword [rsp + 0xb0], xmm0
vpxor xmm0, xmm5, xmmword [rsp + 0x30]
vmovdqu xmm5, xmmword [rsp + 0xe0]
vmovdqu xmmword [rsp + 0xc0], xmm0
vpxor xmm0, xmm4, xmmword [rsp + 0x40]
vmovdqu xmm4, xmmword [rsp + 0xf0]
vmovdqu xmmword [rsp + 0xd0], xmm0
vpxor xmm0, xmm5, xmmword [rsp + 0x50]
vmovdqu xmm5, xmmword [rsp + 0x100]
vmovdqu xmmword [rsp + 0xe0], xmm0
vpxor xmm0, xmm4, xmmword [rsp + 0x60]
vmovdqu xmm4, xmmword [rsp + 0x110]
vmovdqu xmmword [rsp + 0xf0], xmm0
vpxor xmm0, xmm5, xmmword [rsp + 0x70]
vmovdqu xmm5, xmmword [rsp + 0x120]
vmovdqu xmmword [rsp + 0x100], xmm0
vpxor xmm0, xmm4, xmmword [rsp + 0x80]
vmovdqu xmmword [rsp + 0x110], xmm0
vpxor xmm0, xmm5, xmmword [rsp + 0x90]
vmovdqu xmmword [rsp + 0x120], xmm0
call fcn.004182c0
mov r8d, 0xc8
mov rdx, r13
mov rcx, r14
call sub.msvcrt.dll_memcpy
nop
add rsp, 0x180
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
jmp 0x418840
Function at 0x419560
Capabilities:
Encode data using add xor sub operations

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x180
lea r13, [rsp + 0xb0]
mov ebx, edx
mov r12, rcx
mov r14, r8
xor edx, edx
mov r8d, 0xc8
mov rcx, r13
call sub.msvcrt.dll_memset
cmp ebx, 0x87
jle 0x418975
nop dword [rax + rax]
vmovdqu xmm1, xmmword [r12]
vmovdqu xmm2, xmmword [r12 + 0x10]
mov rcx, r13
sub ebx, 0x88
vpxor xmm0, xmm1, xmmword [rsp + 0xb0]
vmovdqu xmm3, xmmword [r12 + 0x20]
add r12, 0x88
vmovdqu xmm4, xmmword [r12 - 0x58]
vmovdqu xmm5, xmmword [r12 - 0x48]
vmovdqu xmm1, xmmword [r12 - 0x38]
mov rax, qword [r12 - 8]
xor qword [rsp + 0x130], rax
vmovdqu xmmword [rsp + 0xb0], xmm0
vpxor xmm0, xmm2, xmmword [rsp + 0xc0]
vmovdqu xmm2, xmmword [r12 - 0x28]
vmovdqu xmmword [rsp + 0xc0], xmm0
vpxor xmm0, xmm3, xmmword [rsp + 0xd0]
vmovdqu xmm3, xmmword [r12 - 0x18]
vmovdqu xmmword [rsp + 0xd0], xmm0
vpxor xmm0, xmm4, xmmword [rsp + 0xe0]
vmovdqu xmmword [rsp + 0xe0], xmm0
vpxor xmm0, xmm5, xmmword [rsp + 0xf0]
vmovdqu xmmword [rsp + 0xf0], xmm0
vpxor xmm0, xmm1, xmmword [rsp + 0x100]
vmovdqu xmmword [rsp + 0x100], xmm0
vpxor xmm0, xmm2, xmmword [rsp + 0x110]
vmovdqu xmmword [rsp + 0x110], xmm0
vpxor xmm0, xmm3, xmmword [rsp + 0x120]
vmovdqu xmmword [rsp + 0x120], xmm0
call fcn.004182c0
cmp ebx, 0x87
jg 0x418880
movsxd rsi, ebx
lea rcx, [rsp + 0x20]
mov rdx, r12
mov r8, rsi
inc ebx
call sub.msvcrt.dll_memcpy
mov r8d, 0x88
xor edx, edx
mov byte [rsp + rsi + 0x20], 1
sub r8d, ebx
mov rcx, rax
movsxd rbx, ebx
add rcx, rbx
movsxd r8, r8d
call sub.msvcrt.dll_memset
vmovdqu xmm4, xmmword [rsp + 0xb0]
mov rcx, r13
vpxor xmm0, xmm4, xmmword [rsp + 0x20]
vmovdqu xmm5, xmmword [rsp + 0xc0]
vmovdqu xmm4, xmmword [rsp + 0xd0]
movzx eax, byte [rsp + 0xa7]
or eax, 0xffffff80
mov byte [rsp + 0xa7], al
mov rax, qword [rsp + 0xa0]
xor qword [rsp + 0x130], rax
vmovdqu xmmword [rsp + 0xb0], xmm0
vpxor xmm0, xmm5, xmmword [rsp + 0x30]
vmovdqu xmm5, xmmword [rsp + 0xe0]
vmovdqu xmmword [rsp + 0xc0], xmm0
vpxor xmm0, xmm4, xmmword [rsp + 0x40]
vmovdqu xmm4, xmmword [rsp + 0xf0]
vmovdqu xmmword [rsp + 0xd0], xmm0
vpxor xmm0, xmm5, xmmword [rsp + 0x50]
vmovdqu xmm5, xmmword [rsp + 0x100]
vmovdqu xmmword [rsp + 0xe0], xmm0
vpxor xmm0, xmm4, xmmword [rsp + 0x60]
vmovdqu xmm4, xmmword [rsp + 0x110]
vmovdqu xmmword [rsp + 0xf0], xmm0
vpxor xmm0, xmm5, xmmword [rsp + 0x70]
vmovdqu xmm5, xmmword [rsp + 0x120]
vmovdqu xmmword [rsp + 0x100], xmm0
vpxor xmm0, xmm4, xmmword [rsp + 0x80]
vmovdqu xmmword [rsp + 0x110], xmm0
vpxor xmm0, xmm5, xmmword [rsp + 0x90]
vmovdqu xmmword [rsp + 0x120], xmm0
call fcn.004182c0
mov r8d, 0xc8
mov rdx, r13
mov rcx, r14
call sub.msvcrt.dll_memcpy
nop
add rsp, 0x180
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
jmp 0x418840