joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b9ad0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14016c040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov ecx, 0x20
call fcn.1400c48d0
mov dword [rax], 1
mov dword [rax + 4], 2
xor edx, edx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], esi
mov qword [rbx + 0x10], rax
mov ecx, 1
call fcn.1400c48d0
mov qword [rsp + 0x38], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400b9e50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400b9b7e
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400c4790
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov dword [rdi], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400b9b90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14016c040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov ecx, 0x20
call fcn.1400c48d0
mov dword [rax], 1
mov dword [rax + 4], 2
xor edx, edx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], esi
mov qword [rbx + 0x10], rax
mov ecx, 1
call fcn.1400c48d0
mov qword [rsp + 0x38], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400b9ee0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400b9c3e
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400c4790
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov dword [rdi], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400b9c50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14016c040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov ecx, 0x20
call fcn.1400c48d0
mov dword [rax], 1
mov dword [rax + 4], 2
xor edx, edx
mov qword [rax + 8], rdx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], esi
mov qword [rbx + 0x10], rax
mov ecx, 1
call fcn.1400c48d0
mov qword [rsp + 0x38], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400b9f10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400b9cfe
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400c4790
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov dword [rdi], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1400bef70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rdi, rcx
xor esi, esi
mov dword [rbp - 0x29], esi
lea rcx, [rbp + 0x27]
call fcn.1400beb80
nop
lea rdx, [0x1401781a8]
cmp qword [0x1401781c0], 0xf
cmova rdx, qword [0x1401781a8]
mov r8, qword [0x1401781b8]
mov rcx, rax
call fcn.14000cde0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
or esi, 2
or esi, 1
mov dword [rbp - 0x29], esi
lea rcx, [rbp + 0x27]
call fcn.140007360
mov rcx, qword [rdi + 0x10]
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400bf00f
mov rax, qword [rdi]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rcx
call fcn.1400c3cf0
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
lea r8, [rbp - 0x19]
mov edx, eax
lea rcx, [rbp + 7]
call fcn.1400bd600
or esi, 0xc
mov dword [rbp - 0x29], esi
lea rcx, [rbp + 7]
call fcn.1400be9b0
movzx ebx, al
lea rcx, [rbp + 7]
call fcn.1400bf980
test bl, bl
jne 0x1400bf126
mov rcx, qword [rdi + 0x10]
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400bf068
mov rax, qword [rdi]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rcx
call fcn.1400c3cf0
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
lea r8, [rbp - 0x19]
mov edx, eax
lea rcx, [rbp + 7]
call fcn.1400bd600
or esi, 0x30
mov dword [rbp - 0x29], esi
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rcx, qword [rbp + 7]
call fcn.1400c3f50
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x1400bf13c
lea rcx, [rbp + 7]
call fcn.1400bf980
test bl, bl
jne 0x1400bf126
lea rdx, [rbp - 0x19]
call fcn.1400bf160
nop
mov rcx, rax
call fcn.140007110
mov rdx, rax
mov r8, rdi
lea rcx, [rbp + 7]
call fcn.140029110
mov rdx, rax
mov rcx, rdi
call fcn.140007130
lea rcx, [rbp + 7]
call fcn.140007120
nop
lea rcx, [rbp - 0x19]
call fcn.140007120
mov rcx, rdi
call fcn.140007110
mov rdx, rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, rdi
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
shr rbx, 0x20
lea r8, [rbp + 7]
mov edx, ebx
lea rcx, str.create_directory
call fcn.1400be1c0
int3
Function at 0x1400c2740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400c27b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400c27b8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400c27a5
nop
cmp rbx, rcx
jae 0x1400c27b8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400c2790
cmp rbx, rcx
jae 0x1400c27b8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x1400c27ba
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400c2ac0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x1b0
mov rax, qword [0x14016c040]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rsi, rcx
mov qword [rsp + 0x60], rcx
xor edi, edi
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
xor edx, edx
mov r8d, 0x12c
lea rcx, [rsp + 0x74]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x70], 0x130
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400c2bf0
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.1400071c0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x9c]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400c2b64
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0x20]
call fcn.140003d60
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400c2b8e
mov rbx, qword [rbx]
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
cmp r8, rax
jne 0x1400c2bb9
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400c2bb9
mov bl, 1
jmp 0x1400c2bbb
xor bl, bl
lea rcx, [rsp + 0x20]
call fcn.140007360
nop
lea rcx, [rsp + 0x40]
call fcn.140007360
test bl, bl
jne 0x1400c2bec
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400c2b33
jmp 0x1400c2bf0
mov edi, dword [rsp + 0x78]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rsi
call fcn.140007360
test edi, edi
je 0x1400c2c0a
mov eax, edi
jmp 0x1400c2c0c
xor eax, eax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400c4790
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400c3bd8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400c3c12
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400c3c17
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400c3c60
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400eef90]
cmp byte [rcx + rax], 0
je 0x1400c3c60
dec r8
sub rdx, 1
jne 0x1400c3c46
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400c5570
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c55ba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c55ba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c55ba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c55ba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c55ba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c55bc
xor al, al
add rsp, 0x28
ret
Function at 0x140afd058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140afd1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140afd089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140afd06f
add dl, dl
jne 0x140afd096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140afd0f6
xor eax, eax
add dl, dl
jne 0x140afd0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140afd1ad
add dl, dl
jne 0x140afd0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afd0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afd0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afd0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140afd0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140afd07e
mov eax, 1
add dl, dl
jne 0x140afd106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140afd113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140afd0fb
sub eax, ebx
mov ebx, 1
jne 0x140afd14c
mov ecx, 1
add dl, dl
jne 0x140afd12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140afd13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140afd123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140afd07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140afd168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140afd175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140afd15d
cmp eax, 0x7d00
jae 0x140afd19b
cmp eax, 0x500
jb 0x140afd196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140afd07e
cmp eax, 0x7f
ja 0x140afd19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140afd07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140afd1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140afd07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400012c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x1400012e0
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, bh
movzx edi, ch
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, dh
shr ecx, 0x10
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, dh
movzx edi, ah
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
mov edx, dword [r15 + 0xc]
movzx edi, bh
movzx ebp, ch
mov eax, dword [r15]
xor r12d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 1]
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
sub r13d, 1
jne 0x1400012e0
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi*8 + 2]
movzx r11d, byte [r14 + rdi*8 + 2]
movzx r12d, byte [r14 + rbp*8 + 2]
movzx esi, dl
movzx edi, bh
movzx ebp, ch
movzx r8d, byte [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and edi, 0xff00
and ebp, 0xff00
xor r10d, edi
xor r11d, ebp
shr ecx, 0x10
movzx esi, dh
movzx edi, ah
shr edx, 0x10
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
and esi, 0xff00
and edi, 0xff00
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr eax, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8]
mov ebp, dword [r14 + rbp*8]
and esi, 0xff0000
and edi, 0xff0000
and ebp, 0xff0000
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, dh
movzx ebp, ah
mov esi, dword [r14 + rsi*8]
mov edi, dword [r14 + rdi*8 + 2]
mov ebp, dword [r14 + rbp*8 + 2]
and esi, 0xff0000
and edi, 0xff000000
and ebp, 0xff000000
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, bh
movzx edi, ch
mov edx, dword [r15 + 0x1c]
mov esi, dword [r14 + rsi*8 + 2]
mov edi, dword [r14 + rdi*8 + 2]
mov eax, dword [r15 + 0x10]
and esi, 0xff000000
and edi, 0xff000000
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x140001720
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x140003080]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.1400014b0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x14000172d
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x140003080]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
call fcn.1400014b0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x140001800
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [r15]
xor ebx, dword [r15 + 4]
xor ecx, dword [r15 + 8]
xor edx, dword [r15 + 0xc]
mov r13d, dword [r15 + 0xf0]
sub r13d, 1
jmp 0x140001820
movzx esi, al
movzx edi, bl
movzx ebp, cl
mov r10d, dword [r14 + rsi*8]
mov r11d, dword [r14 + rdi*8]
mov r12d, dword [r14 + rbp*8]
movzx esi, dh
movzx edi, ah
movzx ebp, dl
xor r10d, dword [r14 + rsi*8 + 3]
xor r11d, dword [r14 + rdi*8 + 3]
mov r8d, dword [r14 + rbp*8]
movzx esi, bh
shr eax, 0x10
movzx ebp, ch
xor r12d, dword [r14 + rsi*8 + 3]
shr edx, 0x10
xor r8d, dword [r14 + rbp*8 + 3]
shr ebx, 0x10
lea r15, [r15 + 0x10]
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
xor r10d, dword [r14 + rsi*8 + 2]
xor r11d, dword [r14 + rdi*8 + 2]
xor r12d, dword [r14 + rbp*8 + 2]
movzx esi, bh
movzx edi, ch
movzx ebp, bl
xor r10d, dword [r14 + rsi*8 + 1]
xor r11d, dword [r14 + rdi*8 + 1]
xor r8d, dword [r14 + rbp*8 + 2]
movzx esi, dh
mov edx, dword [r15 + 0xc]
movzx ebp, ah
xor r12d, dword [r14 + rsi*8 + 1]
mov eax, dword [r15]
xor r8d, dword [r14 + rbp*8 + 1]
xor eax, r10d
mov ebx, dword [r15 + 4]
mov ecx, dword [r15 + 8]
xor ecx, r12d
xor ebx, r11d
xor edx, r8d
sub r13d, 1
jne 0x140001820
lea r14, [r14 + 0x800]
movzx esi, al
movzx edi, bl
movzx ebp, cl
movzx r10d, byte [r14 + rsi]
movzx r11d, byte [r14 + rdi]
movzx r12d, byte [r14 + rbp]
movzx esi, dl
movzx edi, dh
movzx ebp, ah
movzx r8d, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl edi, 8
shl ebp, 8
xor r10d, edi
xor r11d, ebp
shr edx, 0x10
movzx esi, bh
movzx edi, ch
shr eax, 0x10
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
shl esi, 8
shl edi, 8
shr ebx, 0x10
xor r12d, esi
xor r8d, edi
shr ecx, 0x10
movzx esi, cl
movzx edi, dl
movzx ebp, al
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x10
shl ebp, 0x10
xor r10d, esi
xor r11d, edi
xor r12d, ebp
movzx esi, bl
movzx edi, bh
movzx ebp, ch
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
movzx ebp, byte [r14 + rbp]
shl esi, 0x10
shl edi, 0x18
shl ebp, 0x18
xor r8d, esi
xor r10d, edi
xor r11d, ebp
movzx esi, dh
movzx edi, ah
mov edx, dword [r15 + 0x1c]
movzx esi, byte [r14 + rsi]
movzx edi, byte [r14 + rdi]
mov eax, dword [r15 + 0x10]
shl esi, 0x18
shl edi, 0x18
xor r12d, esi
xor r8d, edi
mov ebx, dword [r15 + 0x14]
mov ecx, dword [r15 + 0x18]
lea r14, [r14 - 0x800]
xor eax, r10d
xor ebx, r11d
xor ecx, r12d
xor edx, r8d
repz ret
Function at 0x140001cd0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x140003cc0]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
shr rbp, 3
add r14, rbp
call fcn.1400019e0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret

Function at 0x140001cdd
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
mov r10, rsp
lea rcx, [rdx - 0x3f]
and rsp, 0xffffffffffffffc0
sub rcx, rsp
neg rcx
and rcx, 0x3c0
sub rsp, rcx
sub rsp, 0x20
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r10
mov r15, rdx
mov r13d, dword [r15 + 0xf0]
mov eax, dword [rdi]
mov ebx, dword [rdi + 4]
mov ecx, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
shl r13d, 4
lea rbp, [r15 + r13]
mov qword [rsp], r15
mov qword [rsp + 8], rbp
lea r14, [0x140003cc0]
lea rbp, [rsp + 0x300]
sub rbp, r14
and rbp, 0x300
lea r14, [r14 + rbp]
shr rbp, 3
add r14, rbp
call fcn.1400019e0
mov r9, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov dword [r9], eax
mov dword [r9 + 4], ebx
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], edx
mov r15, qword [rsi]
mov r14, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov r12, qword [rsi + 0x18]
mov rbp, qword [rsi + 0x20]
mov rbx, qword [rsi + 0x28]
lea rsp, [rsi + 0x30]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x140005f40
Capabilities:
Encode data using xor

Disassembly:
mov rsi, rdi
xor r14, r14
pop r11
mov rbx, r11
push rbx
sub r12, 0x29
mov rdi, qword [rsp + r14]
test rax, r15
inc r10
mov r12, 0x368c1b08
dec r13
add rsi, 0x36
mov rax, 0x36ab1b74
addps xmm6, xmm0
xchg rbx, r15
xor r12, rax
addps xmm2, xmm8
sub r13, r11
sub rdi, r12
pop r11
mov rsi, r11
push rsi
ror r10, 0x27
mov r15, 0xa20a044
sub r10, rbx
mov rax, 0xa0d3534
and rsi, 0xf
pop r12
mov r11, r12
push r11
xor r15, rax
subps xmm8, xmm13
add r15, rdi
ror r14, 0x22
dec r13
mov r13, qword [r15]
sub rax, r10
mov r10, 0x3318d9db
and r14, r11
mov r15, 0x335f6e6b
and rax, rbx
xor r10, r15
dec rbx
xorps xmm12, xmm12
add r10, rdi
sub r15, r12
xorps xmm4, xmm4
mov r12, 0x18e5d989
ror rdi, 0x14
or rsi, 0xa1
mov rbx, 0x18e56bdc
subps xmm10, xmm0
push r14
pop r11
xor r12, rbx
ror rax, 0x2d
shr r14, 9
mov r15, 0x8c
or r11, 0xbe
mov rdi, 0x88
subps xmm14, xmm14
or r11, 3
xor r15, rdi
sub rax, r14
push r10
xor rsi, rbx
and rsi, 0x6e
push r12
subps xmm9, xmm13
add rsi, rax
push r13
shl r11, 0x16
subps xmm11, xmm1
sub rsp, 0x20
xchg rdi, rax
mov rcx, r10
xchg rbx, rsi
mov rdx, r12
and rbx, r12
nop
mov r8, r15
or r10, 0x33
lea r9, [rsp]
and rax, rsi
lea r14, [r14 + 0x43]
call r13
xchg r14, r11
add rsp, 0x20
mov r14, rbx
push r10
pop r14
pop rdi
ror r11, 0x14
shr rbx, 0x1e
pop r13
and rbx, 6
pop rsi
pop r12
mov r14, r12
push r14
test r10, r11
xor r14, r14
push r11
pop r10
dec r11
lea r15, [rsi + r14]
push rax
pop r11
subps xmm5, xmm5
mov r12b, byte [r15]
lea rbx, [rbx + 0xa1]
xor r12b, 0x8f
shr rax, 9
add r12b, 0xe1
push rbx
pop rax
add rbx, 0x6c
mov byte [r15], r12b
sub r11, 0x7a
inc r14
sub rbx, 0x12
mov r11, 0xd2
cmp r14, r13
nop
nop
jne 0x1400060ab
shl rax, 0xa
mov r15, reloc.WS2_32.dll_WSACleanup
or rbx, 0x5f
nop
mov rax, 0x54
mov r10, r11
xor r15, rax
xor r12, r11
push rsi
xorps xmm10, xmm7
add rbx, 0xca
sub rsp, 0x20
shl r10, 0x20
shr r14, 0x1a
mov rcx, rsi
xor rax, 0xe7
sub r11, 0x93
mov rdx, r13
dec r14
mov r8, r15
dec rax
xorps xmm0, xmm2
lea r9, [rsp]
xorps xmm12, xmm8
and r14, 0x71
call rdi
shl r12, 0x1c
add rsp, 0x20
mov r11, 0xba
cmp r12, rsi
ret