joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400dfb70
Capabilities:
Encode data using xor

Disassembly:
mov r10d, dword [rsp + 0x28]
mov rax, rcx
lea ecx, [r10 + r10*2]
lea ecx, [rcx*4 - 0xc]
lea rcx, [r9 + rcx*8]
test r10d, r10d
je 0x1400dfd58
lea r10, [r10 + r10*2]
shl r10, 5
add r10, rdx
nop dword [rax + rax]
vmovdqu ymm5, ymmword [rdx + 0x20]
add rdx, 0x60
sub rcx, 0x60
vpaddq ymm0, ymm5, ymmword [r8 + 0x20]
vmovdqu ymm5, ymmword [rdx - 0x60]
vpaddq ymm3, ymm5, ymmword [r8]
vpxor ymm0, ymm0, ymmword [rax + 0x20]
vpxor ymm3, ymm3, ymmword [rax]
vmovdqu ymm5, ymmword [r8 + 0x40]
vpaddq ymm3, ymm3, ymm0
vpxor ymm1, ymm3, ymmword [rax + 0x60]
vpsllq ymm2, ymm1, 0x20
vpsrlq ymm1, ymm1, 0x20
vpor ymm1, ymm1, ymm2
vpaddq ymm2, ymm5, ymmword [rdx - 0x20]
vpxor ymm2, ymm2, ymmword [rax + 0x40]
vpaddq ymm2, ymm2, ymm1
vpxor ymm0, ymm0, ymm2
vpsllq ymm4, ymm0, 0x28
vpsrlq ymm0, ymm0, 0x18
vpor ymm0, ymm0, ymm4
vpaddq ymm3, ymm3, ymm0
vpxor ymm1, ymm1, ymm3
vpsllq ymm4, ymm1, 0x30
vpsrlq ymm1, ymm1, 0x10
vpor ymm1, ymm1, ymm4
vpaddq ymm2, ymm2, ymm1
vpermq ymm1, ymm1, 0x93
vpxor ymm0, ymm0, ymm2
vperm2i128 ymm2, ymm2, ymm2, 1
vpsllq ymm4, ymm0, 1
vpsrlq ymm0, ymm0, 0x3f
vpor ymm0, ymm0, ymm4
vpermq ymm0, ymm0, 0x39
vpaddq ymm3, ymm3, ymm0
vpxor ymm1, ymm1, ymm3
vpsllq ymm4, ymm1, 0x20
vpsrlq ymm1, ymm1, 0x20
vpor ymm1, ymm1, ymm4
vpaddq ymm2, ymm1, ymm2
vpxor ymm0, ymm0, ymm2
vpsllq ymm4, ymm0, 0x28
vpsrlq ymm0, ymm0, 0x18
vpor ymm0, ymm0, ymm4
vpaddq ymm3, ymm3, ymm0
vpxor ymm1, ymm1, ymm3
vmovdqu ymmword [rax], ymm3
vpsllq ymm4, ymm1, 0x30
vpsrlq ymm1, ymm1, 0x10
vpor ymm1, ymm1, ymm4
vpaddq ymm2, ymm2, ymm1
vpermq ymm1, ymm1, 0x39
vpxor ymm0, ymm0, ymm2
vperm2i128 ymm2, ymm2, ymm2, 1
vmovdqu ymmword [rax + 0x60], ymm1
vpsllq ymm4, ymm0, 1
vpsrlq ymm0, ymm0, 0x3f
vpor ymm0, ymm0, ymm4
vmovdqu ymmword [rax + 0x40], ymm2
vpermq ymm0, ymm0, 0x93
vmovdqu ymmword [rax + 0x20], ymm0
vmovdqu ymm4, ymmword [rdx - 0x40]
vmovdqu ymm1, ymmword [rdx - 0x20]
vpxor ymm3, ymm3, ymmword [rdx - 0x60]
vpxor ymm0, ymm4, ymm0
vmovdqu ymmword [rcx + 0x80], ymm0
vpxor ymm0, ymm1, ymm2
vmovdqu ymmword [rcx + 0x60], ymm3
vmovdqu ymmword [rcx + 0xa0], ymm0
mov r9, qword [rax + 0x58]
xor qword [r8], r9
mov r9, qword [rax]
xor qword [r8 + 8], r9
mov r9, qword [rax + 8]
xor qword [r8 + 0x10], r9
mov r9, qword [rax + 0x10]
xor qword [r8 + 0x18], r9
mov r9, qword [rax + 0x18]
xor qword [r8 + 0x20], r9
mov r9, qword [rax + 0x20]
xor qword [r8 + 0x28], r9
mov r9, qword [rax + 0x28]
xor qword [r8 + 0x30], r9
mov r9, qword [rax + 0x30]
xor qword [r8 + 0x38], r9
mov r9, qword [rax + 0x38]
xor qword [r8 + 0x40], r9
mov r9, qword [rax + 0x40]
xor qword [r8 + 0x48], r9
mov r9, qword [rax + 0x48]
xor qword [r8 + 0x50], r9
mov r9, qword [rax + 0x50]
xor qword [r8 + 0x58], r9
add r8, 0x60
cmp rdx, r10
jne 0x1400dfba0
vzeroupper
ret
Function at 0x1400dfd60
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x1400dff30
lea r10, [rcx + rcx*2]
shl r10, 5
add r10, r8
nop word [rax + rax]
vmovdqu ymm5, ymmword [rdx + 0x20]
add r9, 0x60
add rdx, 0x60
vpaddq ymm0, ymm5, ymmword [r8 + 0x20]
vmovdqu ymm5, ymmword [rdx - 0x60]
vpaddq ymm3, ymm5, ymmword [r8]
vpxor ymm0, ymm0, ymmword [rax + 0x20]
vpxor ymm3, ymm3, ymmword [rax]
vmovdqu ymm5, ymmword [r8 + 0x40]
vpaddq ymm3, ymm3, ymm0
vpxor ymm1, ymm3, ymmword [rax + 0x60]
vpsllq ymm2, ymm1, 0x20
vpsrlq ymm1, ymm1, 0x20
vpor ymm1, ymm1, ymm2
vpaddq ymm2, ymm5, ymmword [rdx - 0x20]
vpxor ymm2, ymm2, ymmword [rax + 0x40]
vpaddq ymm2, ymm2, ymm1
vpxor ymm0, ymm0, ymm2
vpsllq ymm4, ymm0, 0x28
vpsrlq ymm0, ymm0, 0x18
vpor ymm0, ymm0, ymm4
vpaddq ymm3, ymm3, ymm0
vpxor ymm1, ymm1, ymm3
vpsllq ymm4, ymm1, 0x30
vpsrlq ymm1, ymm1, 0x10
vpor ymm1, ymm1, ymm4
vpaddq ymm2, ymm2, ymm1
vpermq ymm1, ymm1, 0x93
vpxor ymm0, ymm0, ymm2
vperm2i128 ymm2, ymm2, ymm2, 1
vpsllq ymm4, ymm0, 1
vpsrlq ymm0, ymm0, 0x3f
vpor ymm0, ymm0, ymm4
vpermq ymm0, ymm0, 0x39
vpaddq ymm3, ymm3, ymm0
vpxor ymm1, ymm1, ymm3
vpsllq ymm4, ymm1, 0x20
vpsrlq ymm1, ymm1, 0x20
vpor ymm1, ymm1, ymm4
vpaddq ymm2, ymm1, ymm2
vpxor ymm0, ymm0, ymm2
vpsllq ymm4, ymm0, 0x28
vpsrlq ymm0, ymm0, 0x18
vpor ymm0, ymm0, ymm4
vpaddq ymm3, ymm3, ymm0
vpxor ymm1, ymm1, ymm3
vmovdqu ymmword [rax], ymm3
vpsllq ymm4, ymm1, 0x30
vpsrlq ymm1, ymm1, 0x10
vpor ymm1, ymm1, ymm4
vpaddq ymm2, ymm2, ymm1
vpermq ymm1, ymm1, 0x39
vpxor ymm0, ymm0, ymm2
vperm2i128 ymm2, ymm2, ymm2, 1
vmovdqu ymmword [rax + 0x60], ymm1
vpsllq ymm4, ymm0, 1
vpsrlq ymm0, ymm0, 0x3f
vpor ymm0, ymm0, ymm4
vmovdqu ymmword [rax + 0x40], ymm2
vpermq ymm0, ymm0, 0x93
vmovdqu ymmword [rax + 0x20], ymm0
vpxor ymm3, ymm3, ymmword [r9 - 0x60]
vpxor ymm0, ymm0, ymmword [r9 - 0x40]
vpxor ymm2, ymm2, ymmword [r9 - 0x20]
vmovdqu ymmword [r9 - 0x60], ymm3
vmovdqu ymmword [r9 - 0x40], ymm0
vmovdqu ymmword [r9 - 0x20], ymm2
mov rcx, qword [rax + 0x58]
xor qword [r8], rcx
mov rcx, qword [rax]
xor qword [r8 + 8], rcx
mov rcx, qword [rax + 8]
xor qword [r8 + 0x10], rcx
mov rcx, qword [rax + 0x10]
xor qword [r8 + 0x18], rcx
mov rcx, qword [rax + 0x18]
xor qword [r8 + 0x20], rcx
mov rcx, qword [rax + 0x20]
xor qword [r8 + 0x28], rcx
mov rcx, qword [rax + 0x28]
xor qword [r8 + 0x30], rcx
mov rcx, qword [rax + 0x30]
xor qword [r8 + 0x38], rcx
mov rcx, qword [rax + 0x38]
xor qword [r8 + 0x40], rcx
mov rcx, qword [rax + 0x40]
xor qword [r8 + 0x48], rcx
mov rcx, qword [rax + 0x48]
xor qword [r8 + 0x50], rcx
mov rcx, qword [rax + 0x50]
xor qword [r8 + 0x58], rcx
add r8, 0x60
cmp r8, r10
jne 0x1400dfd80
vzeroupper
ret
Function at 0x140119f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl rdx, 3
jmp sym.groestl

Function at 0x140119f10
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash
Function at 0x14011b720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shl rdx, 3
jmp sym.groestl

Function at 0x14011b730
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rcx
mov rcx, r8
mov r8, rdx
mov rdx, rax
jmp sym.blake256_hash
Function at 0x140128ff0
Capabilities:
Enumerate pe sections

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x28]
mov rbx, rcx
mov rsi, rdx
lea ebp, [rax*8]
mov rdx, rax
add rbp, qword [rcx + 0x20]
mov byte [rcx + rax + 0x2c], pe_nt_image_headers64
lea rcx, [rax + 1]
cmp eax, 0x37
ja 0x140129060
mov eax, 0x37
lea r12, [rbx + 0x2c]
sub eax, edx
lea rdx, [rbx + rcx + 0x2c]
cmp eax, 8
jae 0x140129190
test al, 4
jne 0x1401291d0
test eax, eax
je 0x140129095
mov byte [rdx], 0
test al, 2
je 0x140129095
mov word [rdx + rax - 2], 0
jmp 0x140129095
mov r8d, 0x3f
lea rcx, [rbx + rcx + 0x2c]
xor edx, edx
lea r12, [rbx + 0x2c]
sub r8d, eax
call sym.memset
mov rdx, r12
mov rcx, rbx
call sym.sha256_blocks.constprop.0
vpxor xmm0, xmm0, xmm0
vmovdqu ymmword [rbx + 0x2c], ymm0
vmovdqu ymmword [rbx + 0x44], ymm0
vzeroupper
bswap rbp
mov rdx, r12
mov rcx, rbx
mov qword [rbx + 0x64], rbp
call sym.sha256_blocks.constprop.0
mov eax, 0x18
shrx eax, dword [rbx], eax
mov byte [rsi], al
mov eax, 0x10
shrx eax, dword [rbx], eax
mov byte [rsi + 1], al
mov eax, dword [rbx]
mov byte [rsi + 2], ah
mov eax, dword [rbx]
mov byte [rsi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rsi + 4], al
movzx eax, word [rbx + 6]
mov byte [rsi + 5], al
mov eax, dword [rbx + 4]
mov byte [rsi + 6], ah
mov eax, dword [rbx + 4]
mov byte [rsi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rsi + 8], al
movzx eax, word [rbx + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rbx + 8]
mov byte [rsi + 0xa], ah
mov eax, dword [rbx + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rsi + 0xc], al
movzx eax, word [rbx + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xe], ah
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rsi + 0x10], al
movzx eax, word [rbx + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x12], ah
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x13], al
movzx eax, byte [rbx + 0x17]
mov byte [rsi + 0x14], al
movzx eax, word [rbx + 0x16]
mov byte [rsi + 0x15], al
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x16], ah
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x17], al
movzx eax, byte [rbx + 0x1b]
mov byte [rsi + 0x18], al
movzx eax, word [rbx + 0x1a]
mov byte [rsi + 0x19], al
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1a], ah
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1b], al
movzx eax, byte [rbx + 0x1f]
mov byte [rsi + 0x1c], al
movzx eax, word [rbx + 0x1e]
mov byte [rsi + 0x1d], al
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1e], ah
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1f], al
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdi, [rdx + 8]
mov ecx, eax
mov qword [rdx], 0
and rdi, 0xfffffffffffffff8
mov qword [rdx + rcx - 8], 0
sub rdx, rdi
lea ecx, [rax + rdx]
mov eax, ecx
shr eax, 3
mov ecx, eax
xor eax, eax
rep stosq qword [rdi], rax
jmp 0x140129095
mov dword [rdx], 0
mov dword [rdx + rax - 4], 0
jmp 0x140129095
Function at 0x1401291f0
Capabilities:
Hash data using sha256

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xd0
vpxor xmm0, xmm0, xmm0
mov r8d, 1
vmovdqu ymmword [rsp + 0x20], ymm0
vmovdqu ymmword [rsp + 0x40], ymm0
vmovdqu ymm0, ymmword [0x1401faba0]
lea rdi, [rsp + 0x60]
mov rbx, rcx
mov rsi, rdx
mov qword [rcx + 0x20], 0
mov dword [rcx + 0x28], 0
mov qword [rcx + 0x90], 0
mov dword [rcx + 0x98], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0x10
vmovdqu ymmword [rcx], ymm0
vmovdqu ymmword [rcx + 0x70], ymm0
vmovdqu ymmword [rsp + 0x60], ymm0
mov rcx, rdi
vzeroupper
call sym.sha256_blocks
vmovdqu xmm2, xmmword [rsi + 0x40]
lea rsi, [rsp + 0x20]
mov rcx, rdi
mov rdx, rsi
vmovdqu xmmword [rsp + 0x8c], xmm2
call sym.neoscrypt_hash_finish_sha256
mov eax, 0x36
mov rdx, rsi
vmovd xmm0, eax
mov rcx, rbx
mov r8d, 0x40
vpbroadcastb ymm0, xmm0
vpxor ymm1, ymm0, ymmword [rsp + 0x20]
vpxor ymm0, ymm0, ymmword [rsp + 0x40]
vmovdqu ymmword [rsp + 0x20], ymm1
vmovdqu ymmword [rsp + 0x40], ymm0
vzeroupper
call sym.neoscrypt_hash_update_sha256
mov eax, 0x6a
lea rcx, [rbx + 0x70]
vmovd xmm0, eax
mov r8d, 0x40
mov rdx, rsi
vpbroadcastb ymm0, xmm0
vpxor ymm1, ymm0, ymmword [rsp + 0x20]
vpxor ymm0, ymm0, ymmword [rsp + 0x40]
vmovdqu ymmword [rsp + 0x20], ymm1
vmovdqu ymmword [rsp + 0x40], ymm0
vzeroupper
call sym.neoscrypt_hash_update_sha256
nop
add rsp, 0xd0
pop rbx
pop rsi
pop rdi
ret
Function at 0x14013d290
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
vmovdqu ymm0, ymmword [rcx]
mov edi, r9d
mov r11, rcx
mov rbx, rdx
mov rsi, r8
dec edi
mov ebp, r9d
vmovdqu ymmword [r8], ymm0
vmovdqu ymm1, ymmword [rcx + 0x20]
vmovdqu ymmword [r8 + 0x20], ymm1
vmovdqu ymm2, ymmword [rcx + 0x40]
vmovdqu ymmword [r8 + 0x40], ymm2
vmovdqu ymm3, ymmword [rcx + 0x60]
vmovdqu ymmword [r8 + 0x60], ymm3
je 0x14013d370
mov r10d, edi
mov rcx, r8
shl r10, 7
add r10, r8
nop dword [rax + rax]
mov rdx, rcx
sub rcx, 0xffffffffffffff80
call sym.scrypt_ChunkMix_avx_1
cmp rcx, r10
jne 0x14013d2f0
mov rdx, rcx
mov rcx, r11
xor r12d, r12d
call sym.scrypt_ChunkMix_avx_1
test ebp, ebp
je 0x14013d358
nop word cs:[rax + rax]
nop
mov eax, dword [r11 + 0x40]
mov rdx, r11
mov rcx, rbx
add r12d, 2
and eax, edi
shl eax, 5
lea r8, [rsi + rax*4]
call sym.scrypt_ChunkMix_avx_1_xor
mov eax, dword [rbx + 0x40]
mov rdx, rbx
mov rcx, r11
and eax, edi
shl eax, 5
lea r8, [rsi + rax*4]
call sym.scrypt_ChunkMix_avx_1_xor
cmp r12d, ebp
jb 0x14013d320
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, r8
call sym.scrypt_ChunkMix_avx_1
mov rdx, rcx
mov r8, rsi
mov rcx, rbx
call sym.scrypt_ChunkMix_avx_1_xor
mov rdx, rbx
mov rcx, r11
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.scrypt_ChunkMix_avx_1_xor
Function at 0x14015d314
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
xor rcx, rcx
mov ecx, edx
shr ecx, 6
mov rax, 0x40
movdqa xmm0, xmmword [rdi]
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm4, xmmword [rsi]
movdqa xmm5, xmmword [rsi + 0x10]
movdqa xmm8, xmmword [rsi + 0x20]
movdqa xmm9, xmmword [rsi + 0x30]
pxor xmm0, xmm4
pxor xmm1, xmm5
pxor xmm2, xmm8
pxor xmm3, xmm9
movdqa xmmword [rdi], xmm0
movdqa xmmword [rdi + 0x10], xmm1
movdqa xmmword [rdi + 0x20], xmm2
movdqa xmmword [rdi + 0x30], xmm3
add rdi, rax
add rsi, rax
dec ecx
jne 0x14015d332
mov rdi, r10
mov rsi, r11
ret

Function at 0x14015d390
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
xor rcx, rcx
mov ecx, esi
shr ecx, 1
movdqa xmm0, xmmword [rdi]
movdqa xmm12, xmm0
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm13, xmm1
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm14, xmm2
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm15, xmm3
movdqa xmm4, xmm1
paddd xmm4, xmm0
movdqa xmm5, xmm4
pslld xmm4, 7
psrld xmm5, 0x19
pxor xmm3, xmm4
movdqa xmm4, xmm0
pxor xmm3, xmm5
paddd xmm4, xmm3
movdqa xmm5, xmm4
pslld xmm4, 9
psrld xmm5, 0x17
pxor xmm2, xmm4
movdqa xmm4, xmm3
pxor xmm2, xmm5
pshufd xmm3, xmm3, 0x93
paddd xmm4, xmm2
movdqa xmm5, xmm4
pslld xmm4, 0xd
psrld xmm5, 0x13
pxor xmm1, xmm4
movdqa xmm4, xmm2
pxor xmm1, xmm5
pshufd xmm2, xmm2, 0x4e
paddd xmm4, xmm1
movdqa xmm5, xmm4
pslld xmm4, 0x12
psrld xmm5, 0xe
pxor xmm0, xmm4
movdqa xmm4, xmm3
pxor xmm0, xmm5
pshufd xmm1, xmm1, 0x39
paddd xmm4, xmm0
movdqa xmm5, xmm4
pslld xmm4, 7
psrld xmm5, 0x19
pxor xmm1, xmm4
movdqa xmm4, xmm0
pxor xmm1, xmm5
paddd xmm4, xmm1
movdqa xmm5, xmm4
pslld xmm4, 9
psrld xmm5, 0x17
pxor xmm2, xmm4
movdqa xmm4, xmm1
pxor xmm2, xmm5
pshufd xmm1, xmm1, 0x93
paddd xmm4, xmm2
movdqa xmm5, xmm4
pslld xmm4, 0xd
psrld xmm5, 0x13
pxor xmm3, xmm4
movdqa xmm4, xmm2
pxor xmm3, xmm5
pshufd xmm2, xmm2, 0x4e
paddd xmm4, xmm3
movdqa xmm5, xmm4
pslld xmm4, 0x12
psrld xmm5, 0xe
pxor xmm0, xmm4
pshufd xmm3, xmm3, 0x39
pxor xmm0, xmm5
dec ecx
jne 0x14015d3ca
paddd xmm0, xmm12
movdqa xmmword [rdi], xmm0
paddd xmm1, xmm13
movdqa xmmword [rdi + 0x10], xmm1
paddd xmm2, xmm14
movdqa xmmword [rdi + 0x20], xmm2
paddd xmm3, xmm15
movdqa xmmword [rdi + 0x30], xmm3
mov rdi, r10
mov rsi, r11
ret
Function at 0x14015d57c
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
xor rcx, rcx
mov ecx, esi
shr ecx, 1
movdqa xmm0, xmmword [rdi]
movdqa xmm12, xmm0
movdqa xmm1, xmmword [rdi + 0x10]
movdqa xmm13, xmm1
movdqa xmm2, xmmword [rdi + 0x20]
movdqa xmm14, xmm2
movdqa xmm3, xmmword [rdi + 0x30]
movdqa xmm15, xmm3
paddd xmm0, xmm1
pxor xmm3, xmm0
pshuflw xmm3, xmm3, 0xb1
pshufhw xmm3, xmm3, 0xb1
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm3
pslld xmm3, 8
psrld xmm4, 0x18
pxor xmm3, xmm4
pshufd xmm0, xmm0, 0x93
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x39
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
pshuflw xmm3, xmm3, 0xb1
pshufhw xmm3, xmm3, 0xb1
paddd xmm2, xmm3
pxor xmm1, xmm2
movdqa xmm4, xmm1
pslld xmm1, 0xc
psrld xmm4, 0x14
pxor xmm1, xmm4
paddd xmm0, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmm3
pslld xmm3, 8
psrld xmm4, 0x18
pxor xmm3, xmm4
pshufd xmm0, xmm0, 0x39
paddd xmm2, xmm3
pshufd xmm3, xmm3, 0x4e
pxor xmm1, xmm2
pshufd xmm2, xmm2, 0x93
movdqa xmm4, xmm1
pslld xmm1, 7
psrld xmm4, 0x19
pxor xmm1, xmm4
dec ecx
jne 0x14015d5b6
paddd xmm0, xmm12
movdqa xmmword [rdi], xmm0
paddd xmm1, xmm13
movdqa xmmword [rdi + 0x10], xmm1
paddd xmm2, xmm14
movdqa xmmword [rdi + 0x20], xmm2
paddd xmm3, xmm15
movdqa xmmword [rdi + 0x30], xmm3
mov rdi, r10
mov rsi, r11
ret
Function at 0x14018ba00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov r9, rdx
add r9, 0xa0
movdqa xmm1, xmmword [rcx]
aesenc xmm1, xmmword [rdx]
add rdx, 0x10
cmp rdx, r9
jl 0x14018ba0e
movdqa xmmword [rcx], xmm1
ret
Function at 0x14018f720
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rdi, rdx
mov ecx, 1
mov edx, 0x20
call sym.calloc
mov rbx, rax
mov eax, 0xc
test rbx, rbx
je 0x14018f769
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [rbx], eax
je 0x14018f774
test rdi, rdi
je 0x14018f790
mov qword [rbx + 0x10], 0
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [rsi], rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
xor ebx, ebx
call sym.free
mov eax, 0xb
mov qword [rsi], rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor eax, eax
jmp 0x14018f769
Function at 0x14018fe90
Capabilities:
Allocate thread local storage
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x428
mov eax, dword [0x14020ba28]
mov esi, 1
test eax, eax
je 0x14018ffc0
lea rbx, [rsp + 0x20]
mov edx, 0x400
mov dword [0x14020ba00], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x140190040
mov rcx, qword [0x14020ba30]
test rcx, rcx
je 0x14018ffa0
lea rdx, str.QueueUserAPCEx
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
mov rcx, qword [0x14020ba30]
test rax, rax
mov qword [0x14020b9f0], rax
je 0x14018ff70
lea rdx, str.QueueUserAPCEx_Init
call rbx
test rax, rax
je 0x14018ff18
call rax
test eax, eax
jne 0x14018ff50
lea rax, [sym.ptw32_RegisterCancelation]
mov rcx, qword [0x14020ba30]
mov qword [0x14020b9f0], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14020ba30], 0
mov eax, esi
add rsp, 0x428
pop rbx
pop rsi
ret
cmp qword [0x14020ba30], 0
je 0x14018ff3e
or dword [0x14020ba00], 2
mov eax, esi
add rsp, 0x428
pop rbx
pop rsi
ret
lea rax, [sym.ptw32_RegisterCancelation]
test rcx, rcx
mov qword [0x14020b9f0], rax
je 0x14018ff89
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x14020ba30], 0
mov eax, esi
add rsp, 0x428
pop rbx
pop rsi
ret
cmp qword [0x14020b9f0], 0
je 0x140190103
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x14018ff04
mov edx, 0x20
mov ecx, 1
mov dword [0x14020ba28], 1
call sym.calloc
test rax, rax
mov rbx, rax
je 0x1401900be
mov rsi, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rsi
cmp eax, 0xffffffff
mov dword [rbx], eax
je 0x1401900b0
mov edx, 0x20
mov ecx, 1
mov qword [0x14020ba20], rbx
call sym.calloc
test rax, rax
mov rbx, rax
je 0x1401900f0
call rsi
cmp eax, 0xffffffff
mov dword [rbx], eax
je 0x1401900e1
mov qword [0x14020ba18], rbx
mov esi, dword [0x14020ba28]
jmp 0x14018feac
mov rax, rbx
mov ecx, dword [rax]
add rax, 4
lea edx, [rcx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x140190043
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea rcx, [rax + 2]
cmove rax, rcx
add dl, dl
mov rdx, rbx
mov rcx, rbx
sbb rax, 3
sub rdx, rax
lea r8, [rdx + 0x3ff]
lea rdx, str.QUSEREX.DLL
call sym.strncat
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov qword [0x14020ba30], rax
jmp 0x14018fed8
mov rcx, rbx
call sym.free
mov esi, dword [0x14020ba28]
mov qword [0x14020ba20], 0
test esi, esi
je 0x14018feac
call sym.ptw32_processTerminate.part.5
mov esi, dword [0x14020ba28]
jmp 0x14018feac
mov rcx, rbx
call sym.free
nop dword [rax]
mov qword [0x14020ba18], 0
mov esi, dword [0x14020ba28]
jmp 0x1401900c9
lea rax, [sym.ptw32_RegisterCancelation]
mov qword [0x14020b9f0], rax
jmp 0x14018ff89
Function at 0x140190130
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov edx, dword [0x14020ba28]
test edx, edx
jne 0x140190150
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
ret
mov rbx, qword [0x14020ba20]
test rbx, rbx
je 0x1401901d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x140190185
cmp dword [rbx + 0x184], 1
je 0x1401901e0
mov eax, dword [0x14020ba28]
test eax, eax
jne 0x1401901d0
mov rcx, qword [0x14020ba30]
test rcx, rcx
je 0x140190140
lea rdx, str.QueueUserAPCEx_Fini
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401901af
call rax
mov rcx, qword [0x14020ba30]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
ret
call sym.ptw32_processTerminate.part.5
jmp 0x14019018f
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
call sym.ptw32_threadDestroy
mov rax, qword [0x14020ba20]
xor edx, edx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x140190185

Function at 0x140190220
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [0x14020ba28]
mov ebx, 1
test eax, eax
je 0x140190240
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
mov edx, 0x20
mov ecx, 1
mov dword [0x14020ba28], 1
call sym.calloc
test rax, rax
mov rsi, rax
je 0x1401902be
mov rbx, qword [sym.imp.KERNEL32.dll_TlsAlloc]
call rbx
cmp eax, 0xffffffff
mov dword [rsi], eax
je 0x1401902b0
mov edx, 0x20
mov ecx, 1
mov qword [0x14020ba20], rsi
call sym.calloc
test rax, rax
mov rsi, rax
je 0x1401902f0
call rbx
cmp eax, 0xffffffff
mov dword [rsi], eax
je 0x1401902e1
mov qword [0x14020ba18], rsi
mov ebx, dword [0x14020ba28]
jmp 0x140190235
mov rcx, rsi
call sym.free
mov ebx, dword [0x14020ba28]
mov qword [0x14020ba20], 0
test ebx, ebx
je 0x140190235
call sym.ptw32_processTerminate.part.5
mov ebx, dword [0x14020ba28]
jmp 0x140190235
mov rcx, rsi
call sym.free
nop dword [rax]
mov qword [0x14020ba18], 0
mov ebx, dword [0x14020ba28]
jmp 0x1401902c9
Function at 0x140190310
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov ecx, dword [0x14020ba28]
test ecx, ecx
jne 0x140190330
add rsp, 0x38
pop rbx
pop rsi
ret
call sym.pthread_win32_thread_detach_np.part.8
mov edx, dword [0x14020ba28]
test edx, edx
je 0x140190320
mov rbx, qword [0x14020ba20]
test rbx, rbx
je 0x1401903b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, esi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x140190374
cmp dword [rbx + 0x184], 1
je 0x1401903c0
mov eax, dword [0x14020ba28]
test eax, eax
jne 0x1401903b5
mov rcx, qword [0x14020ba30]
test rcx, rcx
je 0x140190320
lea rdx, str.QueueUserAPCEx_Fini
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14019039e
call rax
mov rcx, qword [0x14020ba30]
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
add rsp, 0x38
pop rbx
pop rsi
jmp rax
call sym.ptw32_processTerminate.part.5
jmp 0x14019037e
mov rax, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rdx
call sym.ptw32_threadDestroy
mov rax, qword [0x14020ba20]
xor edx, edx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x140190374