joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f82c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x78
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, byte [rcx]
mov r13, r8
cmp al, byte [0x140399968]
mov r12, rdx
jne 0x1401f82fb
movzx eax, byte [rcx + 1]
cmp al, byte [0x140399969]
jne 0x1401f82fb
xor eax, eax
jmp 0x1401f8300
sbb eax, eax
or eax, 1
mov qword [rsp + 0xb8], rsi
lea rbx, str._dev_stdin
test eax, eax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r14
lea rdx, [0x1403231f0]
cmovne rbx, rcx
mov qword [rsp + 0x60], r15
mov rcx, rbx
call fcn.14022fba4
mov rbp, rax
test rax, rax
je 0x1401f8409
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov edi, 0x1000
call fcn.140228bfc
test eax, eax
jne 0x1401f836a
mov eax, 0x8000
test word [rsp + 0x26], ax
je 0x1401f836a
mov eax, dword [rsp + 0x34]
inc eax
movsxd rdi, eax
lea rcx, [rdi + 1]
call fcn.140220234
mov rsi, rax
test rax, rax
je 0x1401f8401
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1402270dc
mov r15, rax
mov byte [rax + rsi], 0
cmp rax, rdi
jne 0x1401f83e1
nop
add rdi, rdi
mov rcx, rsi
lea rdx, [rdi + 1]
call fcn.14021ff38
mov r14, rax
test rax, rax
je 0x1401f83f9
mov rbx, rdi
lea rcx, [rax + r15]
shr rbx, 1
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rsi, rax
call fcn.1402270dc
add r15, rax
mov byte [rsi + r15], 0
cmp rax, rbx
je 0x1401f83a0
mov rcx, rbp
call fcn.140226600
lea rax, [r15 + 1]
mov qword [r12], rsi
mov qword [r13], rax
xor eax, eax
jmp 0x1401f840e
mov rcx, rsi
call fcn.14021ff40
mov rcx, rbp
call fcn.140226600
mov eax, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401fe5e0
add rsp, 0x78
pop r13
pop r12
pop rbp
pop rbx
ret

Function at 0x140202048
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14020205b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140202668
lea rdx, [0x1403d6950]
lea rcx, [rsp + 0x20]
call fcn.14021da30
int3

Function at 0x14020c8a8
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140421d58]
xor edx, edx
jmp fcn.140202048

Function at 0x14020d224
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140421d58]
jmp fcn.140202048

Function at 0x140218e38
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140218ef4]
mov r9, qword [r9 + 8]
jmp fcn.14020a260

Function at 0x140218ecc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140218f04]
mov r9, qword [r9 + 8]
jmp fcn.14020a260

Function at 0x140229fb0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140229ddc
Function at 0x1402306e4
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140230704
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140227cac
or eax, 0xffffffff
jmp 0x140230706
xor eax, eax
add rsp, 0x28
ret
Function at 0x140261ef0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov r8, qword [rdx + 0x70]
mov rbp, rcx
cmp r8, qword [rbx + 0x70]
jne 0x140261f3a
mov rcx, qword [rdx + 0x68]
mov rax, qword [rbx + 0x68]
test rcx, rcx
je 0x140261f35
test rax, rax
je 0x140261f3a
mov rdx, rax
call fcn.14021cd50
test eax, eax
jmp 0x140261f38
test rax, rax
je 0x140261f46
lea rdx, [rdi + 0x68]
mov rcx, rbp
call fcn.140261760
mov r8, qword [rdi + 0x80]
cmp r8, qword [rbx + 0x80]
jne 0x140261f79
mov rcx, qword [rdi + 0x78]
mov rax, qword [rbx + 0x78]
test rcx, rcx
je 0x140261f74
test rax, rax
je 0x140261f79
mov rdx, rax
call fcn.14021cd50
test eax, eax
jmp 0x140261f77
test rax, rax
je 0x140261fb4
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0x80
call fcn.14021d2b0
cmp qword [rdi + 0x80], 0
lea rcx, [rbp + 0x30]
jbe 0x140261fa9
mov rdx, qword [rdi + 0x78]
mov r8d, 0x7f
call fcn.140224520
jmp 0x140261fb4
mov edx, 0x7f
call qword [sym.imp.WS2_32.dll_gethostname]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140262c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x10]
mov rsi, qword [rdx + 8]
cmp byte [rsi + 0x10], 0
je 0x140262dbe
mov ecx, reloc.WS2_32.dll_recv
call fcn.1401fe604
mov qword [rsp + 0x50], rax
lea rcx, [rdi + 8]
lea rdx, vtable.xmrig::HttpServer.0
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov qword [rdi + 0x18], rax
mov ecx, 0xa8
call fcn.1401fe604
mov qword [rsp + 0x50], rax
mov r9, qword [rdi + 0x18]
movzx r8d, word [rsi + 0x38]
lea rdx, [rsi + 0x18]
mov rcx, rax
call fcn.14026af20
nop
mov qword [rdi + 0x20], rax
mov rcx, rax
call fcn.14026ac70
mov ebx, eax
test eax, eax
jns 0x140262d2c
mov ecx, eax
call fcn.1400aa580
jmp 0x140262d33
lea rax, [0x140387da2]
test ebx, ebx
jns 0x140262d3e
movzx r9d, word [rsi + 0x38]
jmp 0x140262d41
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8, qword [rsi + 0x18]
lea rdx, str.HTTP_API
lea rcx, str.e_1_32m__e_0me_1_37m__13se_0me_1_34m_s:_de_0m_e_1_31m_se_0m
call fcn.14024b7c0
test ebx, ebx
jns 0x140262d6d
mov rcx, rdi
call fcn.140262c10
xor al, al
jmp 0x140262dc0
mov word [rdi + 0x28], bx
mov edx, 1
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140262dbe
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140262dbe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140428568], rax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov eax, eax
mov qword [0x140428560], rax
mov al, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14026ac70
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
sub rsp, 0xd0
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
cmp dword [rcx + 8], 0
mov rbp, rcx
jne 0x14026ac9e
mov eax, 0xfffff448
jmp 0x14026aeb8
mov qword [rsp + 0xe8], rbx
lea rdx, [rcx + 0x18]
mov rcx, qword [rcx + 0xa0]
mov qword [rsp + 0xc8], rdi
mov rbx, rcx
cmp dword [rcx + 0x10], 0xc
jne 0x14026aceb
movzx eax, word [rdx]
cmp ax, 2
jne 0x14026acd3
mov r8d, reloc.WS2_32.dll_recv
jmp 0x14026acdf
cmp ax, 0x17
jne 0x14026aceb
mov r8d, 0x1c
call fcn.1400b1970
mov rbx, qword [rbp + 0xa0]
mov eax, dword [rbx + 0x10]
mov edi, 0x57
cmp eax, 7
je 0x14026ad10
cmp eax, 0xc
jne 0x14026adec
mov rcx, rbx
call fcn.1400b1fb0
mov edi, eax
jmp 0x14026adec
mov edx, dword [rbx + 0x58]
lea r8, [0x14026aaa0]
mov qword [rsp + 0xc0], r14
mov r14, qword [rbx + 8]
test dl, 0x40
je 0x14026ad32
mov qword [rbx + 0x100], r8
bt edx, 0xd
jb 0x14026ad42
mov edi, 0x2726
jmp 0x14026ade4
bt edx, 0xc
jae 0x14026ad52
mov edi, 0x2748
jmp 0x14026ade4
bt edx, 0x19
jb 0x14026ad62
mov edi, 0x32
jmp 0x14026ade4
mov ecx, dword [rbx + 0x7c]
mov eax, edx
or eax, 0x40
mov qword [rsp + 0xf0], rsi
mov dword [rbx + 0x58], eax
lea eax, [rcx + 1]
mov dword [rbx + 0x7c], eax
test ecx, ecx
jne 0x14026ad93
test dl, 4
jne 0x14026ad93
or edx, 0x44
mov dword [rbx + 0x58], edx
test dl, 8
je 0x14026ad93
inc dword [r14 + 8]
xor edi, edi
mov qword [rbx + 0x100], r8
mov esi, edi
cmp dword [rbx + 0x128], edi
jle 0x14026addc
nop word [rax + rax]
mov r9d, edi
movsxd r8, esi
test esi, esi
mov rdx, rbx
mov rcx, r14
sete r9b
shl r8, 7
add r8, qword [rbx + 0x130]
call fcn.1400b61b0
inc esi
cmp esi, dword [rbx + 0x128]
jl 0x14026adb0
mov rsi, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xc0]
mov ecx, edi
call fcn.1400b8610
mov rdi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xe8]
test eax, eax
jne 0x14026aeb8
movzx eax, word [rbp + 0x98]
test ax, ax
jne 0x14026aeb5
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x80
call fcn.14021d2b0
mov rdx, qword [rbp + 0xa0]
mov dword [rsp + 0x20], 0x80
mov ecx, dword [rdx + 0x10]
sub ecx, 7
je 0x14026ae6d
sub ecx, 1
je 0x14026ae67
sub ecx, 4
je 0x14026ae5e
sub ecx, 2
je 0x14026ae5e
cmp ecx, 1
jne 0x14026aea3
mov rcx, qword [rdx + 0x70]
jmp 0x14026ae74
mov rcx, qword [rdx + 0x110]
jmp 0x14026ae74
mov rcx, qword [rdx + 0x68]
jmp 0x14026ae74
mov rcx, qword [rdx + 0x118]
test byte [rdx + 0x58], 3
jne 0x14026aea3
cmp rcx, 0xffffffffffffffff
je 0x14026aea3
cmp dword [rdx + 0x118], 0
jne 0x14026aea3
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14026aea3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rbp + 0x98], ax
movzx eax, ax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401fe5e0
add rsp, 0xd0
pop rbp
ret
Function at 0x140282160
Capabilities:
Create directory

Disassembly:
push rdi
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x58]
call fcn.140282380
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 6
jb 0x1402821dd
lea rax, [rcx + 6]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1402821be
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 6
lea rdx, str._xmrig
mov rcx, rbx
call fcn.14021ce50
mov byte [rbx + 6], 0
jmp 0x1402821fd
mov qword [rsp + 0x20], 6
lea r9, str._xmrig
mov edx, 6
mov rcx, rdi
call fcn.140006820
mov rdi, rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140282267
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140282262
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14028236f
call fcn.1401fe640
movdqa xmm0, xmmword [0x14039c560]
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rcx, qword [rsp + 0x38]
call fcn.140227534
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 7
jb 0x1402822dc
lea rax, [rcx + 7]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x38]
add rbx, rcx
mov r8d, 7
lea rdx, str._.cache
mov rcx, rbx
call fcn.14021ce50
mov byte [rbx + 7], 0
jmp 0x1402822fb
mov qword [rsp + 0x20], 7
lea r9, str._.cache
mov edx, 7
lea rcx, [rsp + 0x38]
call fcn.140006820
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rcx, qword [rsp + 0x38]
call fcn.140227534
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14028234b
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140282346
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140282369
call fcn.1401fe640
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401fe5e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
call fcn.140220188
nop
call fcn.140220188
nop
int3
Function at 0x140282380
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor r9d, r9d
mov qword [rsp + 0x20], rcx
mov rbx, rcx
lea rdx, [rsp + 0x30]
xor ecx, ecx
lea r8d, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
test eax, eax
je 0x1402823f1
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1402823e0
lea rdx, [rsp + 0x30]
jmp 0x1402823fe
mov r8d, 1
lea rdx, [0x14038a67c]
mov rcx, rbx
call fcn.140005b10
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401fe5e0
add rsp, 0x150
pop rbx
ret
Function at 0x14029bed0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.14029b5b0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14029b340
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401fe5e0
add rsp, 0xb0
pop rbx
ret
Function at 0x14029c500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1403df5c8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [rcx]
lea rdi, [rcx + 0x3c]
mov dword [rbp - 0x79], eax
lea rdx, [rbp - 0x39]
mov eax, dword [rcx + 4]
mov rbx, rcx
mov dword [rbp - 0x75], eax
xor r8d, r8d
mov eax, dword [rcx + 8]
mov dword [rbp - 0x71], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp - 0x6d], eax
mov eax, dword [rcx + 0x10]
mov dword [rbp - 0x69], eax
mov eax, dword [rcx + 0x14]
mov dword [rbp - 0x65], eax
mov eax, dword [rcx + 0x18]
mov dword [rbp - 0x61], eax
mov eax, dword [rcx + 0x1c]
mov dword [rbp - 0x5d], eax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x59], eax
mov eax, dword [rcx + 0x24]
mov dword [rbp - 0x55], eax
mov eax, dword [rcx + 0x28]
mov dword [rbp - 0x51], eax
mov eax, dword [rcx + 0x2c]
mov dword [rbp - 0x4d], eax
mov eax, dword [rcx + 0x30]
mov dword [rbp - 0x49], eax
mov eax, dword [rcx + 0x34]
mov dword [rbp - 0x45], eax
mov eax, dword [rcx + 0x38]
lea rcx, [rbp - 0x79]
mov dword [rbp - 0x41], eax
mov eax, dword [rdi]
mov dword [rbp - 0x3d], eax
call fcn.14029d8b0
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14029d8b0
mov r8d, 2
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.14029d8b0
mov r8d, 3
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14029d8b0
mov r8d, 4
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.14029d8b0
mov r8d, 5
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14029d8b0
mov r8d, 6
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.14029d8b0
mov r8d, 7
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14029d8b0
mov r8d, 8
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.14029d8b0
mov r8d, 9
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.14029d8b0
lea rax, [rbp - 0x3d]
mov edx, reloc.WS2_32.dll_recv
cmp rbx, rax
ja 0x14029c65e
xor ecx, ecx
lea rax, [rbp - 0x79]
cmp rdi, rax
jae 0x14029c6a7
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbp - 0x69]
pxor xmm0, xmmword [rbp - 0x79]
movdqu xmmword [rbx], xmm0
movdqu xmm0, xmmword [rbx + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmm0, xmmword [rbx + 0x20]
movdqu xmm1, xmmword [rbp - 0x59]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm0, xmmword [rbx + 0x30]
movdqu xmm1, xmmword [rbp - 0x49]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x30], xmm1
mov rcx, rdx
cmp rcx, rdx
jae 0x14029c6d0
lea r8, [rbp - 0x79]
sub r8, rbx
lea rax, [rbx + rcx*4]
sub rdx, rcx
nop word [rax + rax]
mov ecx, dword [r8 + rax]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x14029c6c0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1401fe5e0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1402a1140
Capabilities:
Allocate or change rwx memory

Disassembly:
test r9, r9
je 0x1402a11e3
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, r9
mov qword [rsp + 0x40], rbx
mov r14, r8
mov rsi, rdx
mov r15, rcx
xor edi, edi
nop
mov edx, 0x1000
mov ecx, 0x130
call fcn.140227698
xor ecx, ecx
mov edx, 0x4000
mov r8d, 0x3000
mov rbx, rax
mov qword [rax + 0xe0], rsi
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [rbx + 0x120], 0xffffffff
add rsi, r14
mov qword [rbx + 0x118], rax
mov qword [rbx + 0x128], 0xffffffffffffffff
mov qword [r15 + rdi*8], rbx
inc rdi
cmp rdi, rbp
jb 0x1402a1170
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1402a16d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 8
mov ecx, r8d
ror ecx, 8
xor ecx, 8
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1402a1980
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 4
mov ecx, r8d
ror ecx, 8
xor ecx, 4
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret