joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400306e0
Capabilities:
Accept command line arguments
Check os version
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1818
call fcn.1400ed980
sub rsp, rax
movdqa xmmword [rsp + 0x1800], xmm6
call qword [sym.imp.kernel32.dll_GetCommandLineW]
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 8
mov qword [rsp + 0xb0], 0
test rax, rax
je 0x140030ca4
movzx ebx, word [rax]
test bx, bx
je 0x140030ca4
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x68], 0
add rax, 2
mov ecx, 2
xor r8d, r8d
lea rsi, [rsp + 0x58]
xor edi, edi
jmp 0x14003079b
mov word [rcx + r8*2], bx
inc r8
mov qword [rsp + 0x68], r8
movzx ebx, word [r13]
lea rax, [r13 + 2]
test bx, bx
je 0x140030804
mov r13, rax
cmp bx, 9
je 0x1400307d0
movzx eax, bx
cmp eax, 0x20
je 0x1400307d0
cmp eax, 0x22
jne 0x1400307d6
not dil
and dil, 1
movzx ebx, word [r13]
lea rax, [r13 + 2]
test bx, bx
jne 0x14003079b
jmp 0x140030804
test dil, 1
je 0x140030804
cmp r8, qword [rsp + 0x58]
jne 0x140030780
mov rcx, rsi
mov rdx, r8
call fcn.1400a6ad0
mov rcx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
jmp 0x140030780
add r13, 2
movzx eax, word [r13]
cmp eax, 0x20
je 0x140030800
cmp eax, 9
je 0x140030800
mov rsi, qword [rsp + 0x60]
lea rcx, [rsp + 0x1a0]
mov rdx, rsi
call fcn.1400a8cb0
xor r15d, r15d
lea rcx, [rsp + 0xa0]
xor edx, edx
call fcn.140065200
mov rax, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rcx, rdi
shl rcx, 5
movups xmm0, xmmword [rsp + 0x1a0]
add byte [rax], al
lea rcx, [rsp + 0x1a0]
call fcn.1400acd60
mov rsi, qword [rsp + 0x1a0]
movabs rax, 0x8000000000000000
cmp rsi, rax
jne 0x140030d3e
mov rax, qword [rsp + 0x1a8]
mov ecx, eax
and ecx, 3
mov r14d, 1
mov bpl, 1
xor r15d, r15d
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x140030d3a
test rcx, rcx
je 0x140030d3a
lea rsi, [rax - 1]
mov rdi, qword [rax - 1]
mov rbx, qword [rax + 7]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x140030d25
cmp qword [rbx + 0x10], 0x11
jb 0x140030d13
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401521d8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1401521d8]
xor r15d, r15d
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
xor esi, esi
jmp 0x140030d72
mov r14, qword [rsp + 0x1a8]
mov r15, qword [rsp + 0x1b0]
movzx ebp, byte [rsp + 0x1b8]
mov eax, dword [rsp + 0x1b9]
mov dword [rsp + 0x740], eax
mov eax, dword [rsp + 0x1bc]
mov dword [rsp + 0x743], eax
lea rcx, [rsp + 0xa0]
xor edx, edx
call fcn.140065200
mov rbx, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rax, rdi
shl rax, 5
mov qword [rbx + rax], rsi
mov qword [rbx + rax + 8], r14
mov qword [rbx + rax + 0x10], r15
mov byte [rbx + rax + 0x18], bpl
mov ecx, dword [rsp + 0x740]
mov edx, dword [rsp + 0x743]
mov dword [rbx + rax + 0x1c], edx
mov dword [rbx + rax + 0x19], ecx
inc rdi
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x40], rax
jmp 0x140030edf
Function at 0x14003e350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14003e3e0
cmp r11, r10
ja 0x14003e456
cmp r10, rdx
ja 0x14003e468
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14003e3e2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14003e3c0
jmp 0x14003e444
ja 0x14003e3ea
mov r11, r10
cmp rax, r8
jne 0x14003e384
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14003e420
mov rdi, r8
sub ecx, edx
jns 0x14003e43b
jmp 0x14003e446
cmp r8, rsi
je 0x14003e477
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14003e446
xor al, 1
cmp rdi, rsi
jne 0x14003e400
jmp 0x14003e446
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, [0x1400fad58]
mov rcx, r11
mov rdx, r10
call fcn.1400efdc0
lea r8, [0x1400fad58]
mov rcx, r10
call fcn.1400efbb0
lea rcx, [0x1400fad40]
call fcn.1400efed0
int3

Function at 0x140040f60
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, ecx
not eax
cmp r8, 0x40
jb 0x14004132b
lea r9, [0x140101148]
nop word cs:[rax + rax]

Function at 0x1400413b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movq qword [rsp + 0x30], mm1

Function at 0x140041610
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140041652
xor r10d, r10d
jmp 0x14004170d
Function at 0x140055420
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rbx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r8
cmp rax, r8
jne 0x140055500
mov rsi, r8
test r8, r8
je 0x140055524
mov rdi, rdx
mov r14, rsi
shl r14, 6
cmp rsi, 4
jae 0x140055463
xor eax, eax
jmp 0x1400554a0
mov rax, rsi
and rax, 0xfffffffffffffffc
xor edx, edx
pcmpeqd xmm0, xmm0
movdqu xmm1, xmmword [rbx + rdx*8]
movdqu xmm2, xmmword [rbx + rdx*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdi + rdx*8], xmm1
movdqu xmmword [rdi + rdx*8 + 0x10], xmm2
add rdx, 4
cmp rax, rdx
jne 0x140055470
cmp rax, rsi
je 0x1400554b7
nop dword [rax]
mov rdx, qword [rbx + rax*8]
not rdx
mov qword [rdi + rax*8], rdx
lea rdx, [rax + 1]
mov rax, rdx
cmp rsi, rdx
jne 0x1400554a0
or byte [rdi], 1
sub r14, qword [rcx + 0x20]
je 0x1400554f6
mov rax, qword [rdi + rsi*8 - 8]
mov ecx, r14d
shl rax, cl
shr rax, cl
mov qword [rdi + rsi*8 - 8], rax
cmp r14, 1
adc r14, 0
nop dword [rax + rax]
mov rcx, rdi
mov rdx, rdi
mov r8, rbx
mov r9, rsi
call fcn.1400eb970
dec r14
jne 0x1400554e0
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x38], 0
lea r9, [0x140106e78]
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x38]
call fcn.1400f0130
lea r8, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_ring_0.17.8_srclimb.rs
xor ecx, ecx
xor edx, edx
call fcn.1400efb30
int3

Function at 0x14005b700
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140039df0
cmp rax, rcx
je 0x14005b725
cmp rdx, 4
jae 0x14005b728
xor eax, eax
xor r8d, r8d
jmp 0x14005b7b6
xor eax, eax
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400f3150]
movdqa xmm3, xmmword [0x1400f3160]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x14005b750
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
jmp 0x14005b7c8
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x14005b7b6
ret

Function at 0x14005ef70
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test r8, r8
je 0x14005efe5
mov rsi, r8
mov rdi, rdx
mov r14d, 0xffffffff
mov esi, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.advapi32.dll_SystemFunction036]
and eax, 0x930a3

Function at 0x14006dd90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
Function at 0x140074320
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x448
mov rsi, rcx
mov rcx, qword [rdx + 0x28]
test rcx, rcx
je 0x1400744b6
mov rdi, rdx
mov eax, 0x38
lea rdx, str.Once_panickedC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_spin_0.9.8_srconce.rs
nop
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
adc dword [rsi], eax

Function at 0x14007e140
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
Function at 0x140080db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x140080df4
cmp qword [rbx + 0x10], 0x11
jb 0x140080de2
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401521d8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdi, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x140080e25
cmp qword [rbx + 0x10], 0x11
jb 0x140080e13
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401521d8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
movabs rdi, 0x8000000000000001
mov rax, qword [rsi + 0x2d8]
shl rax, 1
test rax, rax
jne 0x140080e52
mov rbx, qword [rsi + 0x2f0]
dec rdi
cmp rbx, rdi
jne 0x140080e77
jmp 0x140080edd
mov r8, qword [rsi + 0x2e0]
mov rcx, qword [0x1401521d8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, qword [rsi + 0x2f0]
dec rdi
cmp rbx, rdi
je 0x140080edd
mov rdi, qword [rsi + 0x2f8]
mov r14, qword [rsi + 0x300]
test r14, r14
je 0x140080ec6
lea r15, [rdi + 8]
mov r12, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140080ea9
add r15, 0x18
dec r14
je 0x140080ec6
mov rax, qword [r15 - 8]
shl rax, 1
test rax, rax
je 0x140080ea0
mov r8, qword [r15]
mov rcx, qword [0x1401521d8]
xor edx, edx
call r12
jmp 0x140080ea0
test rbx, rbx
je 0x140080edd
mov rcx, qword [0x1401521d8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsi + 0x58]
call fcn.140074660
lea rcx, [rsi + 0x88]
call fcn.140074660
lea rcx, [rsi + 0xb8]
call fcn.140074660
mov rax, qword [rsi + 0x308]
shl rax, 1
test rax, rax
jne 0x140080f34
mov rax, qword [rsi + 0x148]
shl rax, 1
test rax, rax
jne 0x140080f59
mov rbp, qword [rsi + 0x128]
mov r15, qword [rsi + 0x140]
test r15, r15
jne 0x140080f86
jmp 0x140081010
mov r8, qword [rsi + 0x310]
mov rcx, qword [0x1401521d8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsi + 0x148]
shl rax, 1
test rax, rax
je 0x140080f1c
mov r8, qword [rsi + 0x150]
mov rcx, qword [0x1401521d8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbp, qword [rsi + 0x128]
mov r15, qword [rsi + 0x140]
test r15, r15
je 0x140081010
mov rbx, qword [rsi + 0x130]
mov rax, qword [rsi + 0x138]
xor edx, edx
cmp rax, rbp
mov rcx, rbp
cmovb rcx, rdx
mov r8, rax
sub r8, rcx
mov r12, rbp
sub r12, r8
lea r13, [r8 + r15]
cmp r12, r15
mov qword [rsp + 0x20], rbp
cmovb r13, rbp
mov r14, r15
sub r14, r12
cmovb r14, rdx
sub r13, r8
jne 0x1400810a7
cmp r12, r15
mov rbp, qword [rsp + 0x20]
insb byte [rdi], dx
and al, 0x20
shl rax, 5
shl rcx, 5
sub rax, rcx
lea rbp, [rbx + rax]
add rbp, 0x10
mov rdi, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400810dd
add rbp, 0x20
dec r13
je 0x140080fcf
cmp qword [rbp - 8], 0
je 0x1400810d0
mov r8, qword [rbp]
mov rcx, qword [0x1401521d8]
xor edx, edx
call rdi
jmp 0x1400810d0
Function at 0x1400861b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rsp + 0x330]
movzx eax, byte [rsp + 0x338]
movabs r13, 0x8000000000000000
movdqu xmm0, xmmword [r12 + 0x18]
movdqu xmm1, xmmword [r12 + 0x28]
movdqu xmmword [rdx + 0x120], xmm1
movdqu xmmword [rdx + 0x110], xmm0
movabs rcx, 0x14452474e574f44
cmp qword [rdx + 0x128], rcx
sete r14b
and r14b, al
je 0x140086289
mov rbx, qword [r8]
mov word [rsp + 0x110], 4
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x60], 0xd0001
cmp byte [rbx + 0x41], 2
sete r8b
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400726d0
mov byte [rbx + 0x331], 1
mov word [rsi], 8
mov rax, qword [rdi + 0xe8]
lock dec qword [rax]
jne 0x14008626f
mov qword [rsp + 0x48], r9
mov rax, qword [r12 + 0x10]
test rax, rax
je 0x140086638
mov rbx, qword [r12 + 8]
shl rax, 3
lea r15, [rax + rax*4]
xor eax, eax
mov ecx, 0x1f7f
jmp 0x1400862cd
add rax, 0x28
cmp r15, rax
je 0x140086399
movzx edx, word [rbx + rax]
mov bpl, 1
bt ecx, edx
jb 0x1400862c0
cmp edx, 0xd
jne 0x14008639b
cmp word [rbx + rax + 0x20], 0x13
jne 0x1400862c0
jmp 0x14008639b
xor ebp, ebp
mov byte [rdi + 0x130], bpl
xor eax, eax
jmp 0x1400863bd
add rax, 0x28
cmp r15, rax
je 0x1400864ef
movzx ecx, word [rbx + rax]
lea edx, [rcx - 3]
cmp edx, 0xa
jb 0x1400863b0
cmp ecx, 2
jb 0x1400863b0
cmp ecx, 0xd
jne 0x1400863db
cmp word [rbx + rax + 0x20], 0x14
jne 0x1400863b0
mov rax, qword [0x140152108]
xor ecx, ecx
cmp rax, 4
setne cl
mov eax, 0xff
cmovbe eax, ecx
mov cl, 1
mov dword [rsp + 0x44], ecx
cmp al, 0xff
je 0x140086408
movzx eax, al
test eax, eax
jne case.0x1400194c3.2872
mov rax, qword [0x140152100]
mov dword [rsp + 0x44], 0
mov byte [rdi + 0x130], 0
xor ebp, ebp
mov dword [rsp + 0x44], 0
invalid
Function at 0x1400a8330
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 2
mov qword [rsp + 0x30], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x40], rax
xor edi, edi
mov r13d, 0xffffffff
xor esi, esi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400a83b0
jmp 0x1400a839f

Function at 0x1400ac8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x68], rcx
add r9, r8
ror dword [rcx + rcx*4 + 0x44], 0x24
mov qword [rsp + 0x48], r9
Function at 0x1400b63c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs r15, 0x8000000000000000
lea rcx, [rsp + 0x40]
call fcn.1400a6730
mov rax, qword [rsp + 0x40]
cmp rax, r15
jne 0x1400b63f3
mov rdi, qword [rsp + 0x48]
jmp 0x1400b6420
movups xmm0, xmmword [rsp + 0x48]
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.1400b64d0
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
cmp rbx, r15
jne 0x1400b648a
mov eax, edi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400b647b
test rax, rax
je 0x1400b647b
lea rbx, [rdi - 1]
mov r14, qword [rdi - 1]
mov rdi, qword [rdi + 7]
mov rcx, r14
call qword [rdi]
cmp qword [rdi + 8], 0
je 0x1400b6469
cmp qword [rdi + 0x10], 0x11
jb 0x1400b6457
mov r14, qword [r14 - 8]
mov rcx, qword [0x1401521d8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1401521d8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsi], r15
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r14, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400b64aa
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x1400b647e
mov qword [rsi], r15
test rbx, rbx
je 0x1400b647e
mov rcx, qword [0x1401521d8]
xor edx, edx
mov r8, rdi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.kernel32.dll_HeapFree]
Function at 0x1400b89e0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rbx, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [0x140152279]
mov edx, 0x10
xor ecx, ecx
call fcn.1400baaa0
test rax, rax
je 0x1400b8aac
mov rsi, rax
mov qword [rax], r14
mov qword [rax + 8], rbx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400b8c10]
xor ebx, ebx
xor ecx, ecx
mov rdx, rdi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400b8a9f
push rdi
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, rdi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400b8a78
cmp qword [rbx + 0x10], 0x11
jb 0x1400b8a66
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401521d8]
mov ecx, 8
mov edx, 0x10
call fcn.1400ef8e0
int3

Function at 0x1400b9030
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x78
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1400b905f
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x78
ret
call fcn.1400ac4b0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [0x1400ac4d0]
mov qword [rsp + 0x40], rax
lea rax, str.fallback_RNG_broken:
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 1
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
lea rdx, str.C:Users_runneradmin.rustup_toolchains_nightly_x86_64_pc_windows_msvclib_rustlib_src_rustlibrary_std_src_syspalwindows_rand.rs
lea rcx, [rsp + 0x48]
call fcn.1400efae0
int3
Function at 0x1400c39c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1400c3ae0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1400c3a20
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1400c3a20
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1400c3a20

Function at 0x1400c4210
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1400c4210
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret
Function at 0x1400c431a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400c42f0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret
Function at 0x1400c5b3d
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
xchg rcx, rdx
test rcx, rcx
je 0x1400c5cb1
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [r8]
movdqa xmm8, xmmword [0x1401202a0]
sub rsi, rdi
call fcn.1400c5cc0
movdqa xmm6, xmm0
pshufb xmm6, xmmword [0x140120290]
test rcx, 1
je 0x1400c5bfa
movdqu xmm7, xmmword [rdi]
call fcn.1400c5340
pxor xmm0, xmm7
paddd xmm6, xmm8
movdqu xmmword [rsi + rdi], xmm0
sub rcx, 1
lea rdi, [rdi + 0x10]
je 0x1400c5c66
movdqa xmm14, xmm6
movdqa xmm15, xmm6
paddd xmm15, xmm8
movdqa xmm1, xmmword [0x140120290]
movdqa xmm0, xmm14
movdqa xmm6, xmm15
pshufb xmm0, xmm1
pshufb xmm6, xmm1
call fcn.1400c54a0
movdqu xmm1, xmmword [rdi]
movdqu xmm2, xmmword [rdi + 0x10]
movdqa xmm3, xmmword [0x1401202b0]
pxor xmm0, xmm1
pxor xmm6, xmm2
paddd xmm14, xmm3
paddd xmm15, xmm3
movdqu xmmword [rsi + rdi], xmm0
movdqu xmmword [rsi + rdi + 0x10], xmm6
sub rcx, 2
lea rdi, [rdi + 0x20]
jne 0x1400c5c09
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret