joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4622c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402caf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409420
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402c80
cmp byte [0x0069a757], 0
je 0x4622d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45f2a0
jmp 0x402c80

Function at 0x4622e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0069ab00]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0069a757], 0
je 0x462315
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0069ad80]
aesenc xmm0, xmmword [0x0069ad90]
aesenc xmm0, xmmword [0x0069ada0]
movq rax, xmm0
ret
jmp 0x409620

Function at 0x462320
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0069ab00]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0069a757], 0
je 0x462356
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0069ad80]
aesenc xmm0, xmmword [0x0069ad90]
aesenc xmm0, xmmword [0x0069ada0]
movq rax, xmm0
ret
jmp 0x409680

Function at 0x463ca0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0069ad00]
mov qword [rsp + 8], rdx
lea r8d, [0x0069a774]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00462220
add rsp, 0x30
ret

Function at 0x464b60
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
call fcn.0045ece0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x464c00
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x68], rax
call fcn.0045ee20
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
Function at 0x47a440
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x47a458
movzx esi, byte [rbx + rdx]
inc rdx
imul eax, eax, 0x1000193
xor eax, esi
cmp rcx, rdx
jg 0x47a449
ret

Function at 0x4c8f00
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4c9163
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4c9147
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4c8f4d
xor ebx, ebx
xor ecx, ecx
jmp 0x4c8f60
mov rax, rdx
call fcn.004bc500
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4c907b
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00477540
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, str.__128EJLNQTUX_beux
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044c9c0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402a80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4c903e
xor eax, eax
lea rbx, [0x00575ac0]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00542bdf]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x58]
call fcn.0044caa0
jmp 0x4c906b
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00542b6a]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x58]
call fcn.0044c9c0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.00477540
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402a80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4c910a
xor eax, eax
lea rbx, [0x00575ac0]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00542bdf]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x50]
call fcn.0044caa0
jmp 0x4c9137
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00542b6a]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x50]
call fcn.0044c9c0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x00542f7b]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00460180
mov rax, qword [rsp + 8]
jmp fcn.004c8f00
Function at 0x4cd5a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cd7f3
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rsi, qword [rax + 0x50]
test rsi, rsi
jle 0x4cd6d0
nop dword [rax + rax]
cmp rsi, 0x40
ja 0x4cd7e5
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea r8, [rsi - 0x40]
mov r9, r8
neg r8
cmp rcx, r8
cmovl r8, rcx
mov qword [rsp + 0x28], r8
sar r9, 0x3f
and r9, rsi
lea rsi, [rax + r9]
lea rsi, [rsi + 0x10]
cmp rbx, rsi
je 0x4cd642
mov rax, rsi
mov rcx, r8
call fcn.004631e0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
mov rsi, qword [rax + 0x50]
add rsi, r8
mov qword [rax + 0x50], rsi
cmp rsi, 0x40
jne 0x4cd6ac
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004cdae0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x28]
cmp rcx, r8
jb 0x4cd7dc
sub rdi, r8
mov rsi, rcx
sub rcx, r8
mov r9, rdi
neg rdi
sar rdi, 0x3f
and r8, rdi
add rbx, r8
jmp 0x4cd6e0
mov rsi, rcx
mov r9, rdi
nop word [rax + rax]
nop
cmp rcx, 0x40
jl 0x4cd780
mov rdi, rcx
and rcx, 0xffffffffffffffc0
cmp r9, rcx
jb 0x4cd7d4
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r9
call fcn.004cdae0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
cmp rcx, rax
jb 0x4cd7cf
mov rdx, qword [rsp + 0x38]
mov rsi, rax
sub rax, rdx
mov rdx, rcx
sub rcx, rsi
sar rax, 0x3f
and rax, rdx
and rax, 0xffffffffffffffc0
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx + rax]
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
nop dword [rax]
test rcx, rcx
jle 0x4cd7be
cmp rcx, 0x40
mov edx, 0x40
cmovl rdx, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x4cd7ba
mov qword [rsp + 0x38], rdx
mov rax, rdi
mov rcx, rdx
call fcn.004631e0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov qword [rax + 0x50], rdx
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.00462940
mov rdx, r9
call fcn.00462900
mov rax, r8
nop
call fcn.00462940
mov rax, rsi
mov ecx, 0x40
call fcn.00462940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460180
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004cd5a0
Function at 0x4da340
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4da3ab
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4da364
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4da381
cmp rdx, 0
je 0x4da3cd
test rdx, 0xf
je 0x4da35d
test rdx, 7
jne 0x4da381
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4da35d
ret
Function at 0x4dc420
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4dc45f
jb 0x4dc474
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4dc4e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4dc5b0
jb 0x4dc60f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004dc3c0
aeskeygenassist xmm1, xmm0, 1
call fcn.004dc3e0
aeskeygenassist xmm1, xmm2, 2
call fcn.004dc3c0
aeskeygenassist xmm1, xmm0, 2
call fcn.004dc3e0
aeskeygenassist xmm1, xmm2, 4
call fcn.004dc3c0
aeskeygenassist xmm1, xmm0, 4
call fcn.004dc3e0
aeskeygenassist xmm1, xmm2, 8
call fcn.004dc3c0
aeskeygenassist xmm1, xmm0, 8
call fcn.004dc3e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004dc3c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004dc3e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004dc3c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004dc3e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004dc3c0
jmp 0x4dc67d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004dc320
aeskeygenassist xmm1, xmm2, 2
call fcn.004dc380
aeskeygenassist xmm1, xmm2, 4
call fcn.004dc320
aeskeygenassist xmm1, xmm2, 8
call fcn.004dc380
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004dc320
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004dc380
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004dc320
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004dc380
jmp 0x4dc67d
aeskeygenassist xmm1, xmm0, 1
call fcn.004dc2e0
aeskeygenassist xmm1, xmm0, 2
call fcn.004dc2e0
aeskeygenassist xmm1, xmm0, 4
call fcn.004dc2e0
aeskeygenassist xmm1, xmm0, 8
call fcn.004dc2e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004dc2e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004dc2e0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004dc2e0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004dc2e0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004dc2e0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004dc2e0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4dc68a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x4dc7c0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x00575f40]
movdqu xmm14, xmmword [0x00576080]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x4dc8ab
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x4dc8ab
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x4dc910
ret
Function at 0x140001810
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x28], reloc.SHELL32.dll_ILFree
mov byte [rsp + 0x29], 0xd1
mov byte [rsp + 0x2a], 0x32
mov byte [rsp + 0x2b], 0x6c
mov byte [rsp + 0x2c], 0xc6
mov byte [rsp + 0x2d], 0x71
mov byte [rsp + 0x2e], 0x23
mov byte [rsp + 0x2f], 0x6c
mov byte [rsp + 0x30], 0x36
mov byte [rsp + 0x31], 0
mov dword [rsp + 0x40], 0x5c45c6de
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x50], rax
movsxd rax, dword [rsp + 0x20]
cmp rax, 0xa
jae 0x1400018b8
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x68], rcx
movzx ecx, byte [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
movzx eax, byte [rdx + rax]
ror al, cl
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x40]
add eax, 0xe0a9
ror eax, 0x1d
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x140001865
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1400018d7
xor eax, eax
jmp 0x140001a2c
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400018f7
xor eax, eax
jmp 0x140001a2c
mov rax, qword [rsp + 0x58]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x4550
je 0x140001924
xor eax, eax
jmp 0x140001a2c
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140001958
xor eax, eax
jmp 0x140001a2c
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0x18]
mov dword [rax + 0x18], ecx
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x80]
mov qword [rcx], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x20], 0
je 0x140001a21
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x18], 0
je 0x140001a21
mov rax, qword [rsp + 0x80]
cmp qword [rax + 8], 0
je 0x140001a21
mov rax, qword [rsp + 0x80]
cmp qword [rax], 0
je 0x140001a21
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x10], 0
jne 0x140001a27
xor eax, eax
jmp 0x140001a2c
mov eax, 1
add rsp, 0x78
ret
Function at 0x1400f0370
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb8]
call fcn.1400f1450
movabs rax, 0x5cfb72a6594a7fb
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0x654adb69
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0xbc81191
je 0x1400f052c
cmp dword [rsp + 0x48], 0x654adb69
je 0x1400f03d2
jmp 0x1400f0561
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x40]
and rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0xe0]
jae 0x1400f0498
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xe8], rax
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0x4208296a
je 0x1400f0478
cmp dword [rsp + 0x4c], 0x63a1d2a0
je 0x1400f0458
jmp 0x1400f0493
mov eax, dword [rsp + 0x54]
movzx ecx, al
mov eax, dword [rsp + 0x50]
shl eax, cl
mov rcx, qword [rsp + 0x58]
mov dword [rcx], eax
mov cx, 5
call fcn.1400f05b0
nop
jmp 0x1400f0493
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1400f052a
lea rax, [rsp + 0x30]
mov qword [rsp + 0x90], rax
mov byte [rsp + 0x34], 0xd6
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x1400f04be
jmp 0x1400f04ff
mov eax, 0xfec
mov word [rsp + 0x38], ax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0x580046ede3ed8c73
cmp qword [rsp + 0x70], rax
je 0x1400f04f2
jmp 0x1400f04fd
movzx ecx, word [rsp + 0x38]
call fcn.1400f05b0
nop
jmp 0x1400f052a
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x80]
mov edx, ILFree
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_SHChangeNotification_Lock]
mov qword [rsp + 0xa8], rax
jmp 0x1400f0561
mov eax, dword [rsp + 0x30]
add eax, 0xc4f6bf7
mov dword [rsp + 0x30], eax
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x78]
call sub.gdiplus.dll_GdiplusStartup
mov dword [rsp + 0x54], eax
mov ecx, dword [rsp + 0x30]
call fcn.1400f0270
nop
mov dword [rsp + 0x20], 0xf7
lea r9, [rsp + 0x30]
mov r8d, 0x23
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xb0]
call sub.WINSPOOL.DRV_SetPrinterDataW
mov dword [rsp + 0x50], eax
mov ecx, dword [rsp + 0x30]
call fcn.1400f0270
mov eax, ILGetNext
add rsp, 0xd8
ret
Function at 0x140124870
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401248ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401248ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401248ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401248ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1401248ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401248bc
xor al, al
add rsp, 0x28
ret

Function at 0x140127ce0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140127d4f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140127d4f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140127d4f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140127d4f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140127d4f
cmp dword [rcx + 0x84], 0xe
jbe 0x140127d4f
cmp dword [rcx + 0xf8], 0
je 0x140127d4f
mov ecx, ebx
call fcn.140127e00
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140127bdc
nop
cmp dword [rbp + 0x20], 0
je 0x140127d9d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140127da8
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140127ce0

Function at 0x140127ee4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140127ce0
Function at 0x14012a940
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14012a9c7
mov rsi, rbx
cmp word [rax], bp
je 0x14012a986
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14012a970
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14012a96c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14012b360
mov rdi, rax
test rax, rax
je 0x14012a9b4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1401302b0
mov rbp, rdi
xor ecx, ecx
call fcn.140129608
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14012fb10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14012fb38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14012fb38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret