joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005e500
Capabilities:
Reference sql statements

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x40]
nop dword [rax]
cmp qword [r14 + 0x70], rcx
jb 0x14005e76c
mov qword [rsp + 0x10], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rax
mov qword [rcx + 0xb0], 0
call fcn.1400412e0
test al, al
jne 0x14005e585
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], 0
cmp byte [0x140426670], 0
je 0x14005e6af
mov rax, qword [rsp + 0x18]
jmp 0x14005e729
cmp byte [0x1402420e4], 0
je 0x14005e5ca
movups xmmword [rsp + 0x20], xmm15
lea rax, [0x1400412a0]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.140061240
xorps xmm15, xmm15
mov r14, qword [0x1404746d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp byte [0x140426670], 0
je 0x14005e622
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x18]
cmp rsi, rdi
jne 0x14005e5f8
mov edx, dword [rdx + 0x26c]
cmp dword [rsi + 0x14], edx
je 0x14005e627
lea rax, fcn.140054fe0
mov qword [rsp], rax
call fcn.140061240
xorps xmm15, xmm15
mov r14, qword [0x1404746d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
nop
jmp 0x14005e627
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
nop
call fcn.14003afa0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rdx, qword [rax + 0x30]
dec dword [rdx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x14005e66f
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x14005e67d
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x1404221c0], 0
je 0x14005e6a5
mov ebx, 1
call fcn.140059280
test al, al
jne 0x14005e6a5
nop dword [rax + rax]
call fcn.140039560
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x14028bd88]
call fcn.1400611c0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x14028bfe8]
mov qword [rsp], rax
nop dword [rax]
call fcn.140061240
xorps xmm15, xmm15
mov r14, qword [0x1404746d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, rcx
mov rcx, qword [rsp + 0x10]
test rax, rax
je 0x14005e73d
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rax + 0x14]
cmp dword [rdx + 0x26c], ebx
je 0x14005e6f1
nop dword [rax]
call fcn.1400633c0
xorps xmm15, xmm15
mov r14, qword [0x1404746d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], rax
jmp 0x14005e6af
lea rax, [0x1402883f0]
mov ebx, 0x2d
call fcn.140036ac0
nop
int3
Function at 0x140063480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1404747e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x140474494], 0
je 0x1400634b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x140474b20]
aesenc xmm0, xmmword [0x140474b30]
aesenc xmm0, xmmword [0x140474b40]
movq rax, xmm0
ret
jmp 0x14000ada0

Function at 0x1400659a0
Capabilities:
Reference sql statements

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400323d4
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
cmp dword [0x140474780], 0
nop
jne 0x140032292
lea rdx, [0x140064e20]
mov qword [0x140420818], rdx
jmp 0x1400322a5
lea rdi, [0x140420818]
lea rdx, [0x140064e20]
call fcn.140063680
xor eax, eax
jmp 0x1400322c0
lea r8, [0x140474aa0]
mov byte [r8 + rax], sil
inc dword [0x1404744b0]
mov rax, rdi
nop dword [rax]
cmp rax, 0x36
jge 0x140032310
lea rdx, [0x1402895f5]
movzx esi, byte [rdx + rax]
cmp esi, 0x80
jge 0x1400322df
lea rdi, [rax + 1]
jmp 0x140032305
mov qword [rsp + 0x20], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
call fcn.14005b880
lea rdx, [0x1402895f5]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x20]
cmp rax, 0x64
jb 0x1400322a9
jmp 0x1400323c9
call fcn.140031480
call fcn.1400481e0
call fcn.140048280
nop
call fcn.140031f00
xor eax, eax
call fcn.140031e40
mov dword [0x1404744fc], eax
call fcn.140031fc0
call fcn.140031d20
mov dword [0x1404744dc], eax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [0x14023dbb8]
lea rcx, [rsp + 0x28]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.140033dc0
xorps xmm15, xmm15
mov r14, qword [0x1404746d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x2c]
mov qword [0x140474660], rax
mov rax, qword [0x14023dc00]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 1
call fcn.140033e40
xorps xmm15, xmm15
mov r14, qword [0x1404746d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov ecx, 0x64
call fcn.140063a00
nop
call fcn.140061380
jmp 0x140032260
xorps xmm15, xmm15
mov r14, qword [0x1404746d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x140032260

Function at 0x140065b60
Capabilities:
Reference sql statements

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov eax, 2
lea rbx, [0x140283bb2]
mov ecx, 0x1c
nop
call fcn.140053940
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
xorps xmm15, xmm15
mov r14, qword [0x1404746d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x140039f40
Function at 0x140065de0
Capabilities:
Reference sql statements

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x140288fde]
mov ebx, 0x32
call fcn.140036ac0
nop
xorps xmm15, xmm15
mov r14, qword [0x1404746d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
jmp 0x14005f2e0

Function at 0x14021a2e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140410a50]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14021a300
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14021a308
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14021a300
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x14021a355
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14021a34c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14021a300
add rax, 0x28
cmp rax, r9
jne 0x14021a338
xor eax, eax
ret

Function at 0x14021a360
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140410a50]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14021a380
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14021a388
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x14021a380
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x14021a410
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140410a50]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14021a430
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14021a438
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x140007c00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140007c42
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x140007c4a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140007c5b
jmp 0x140007c72
xor r10d, r10d
jmp 0x140007cfd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140007c72
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140007c89
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140007ca9
add r11, r8
jmp 0x140007dda
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140007d72
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140007d20
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140007d90
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140007da2
jmp 0x140007dbc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140007dbc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140007dd6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000bc70
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov r8d, 0xc
mov rcx, rdi
call fcn.14000bfe0
test rax, rax
je 0x14000bcb9
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14000bd7b
mov eax, dword [rdi + 0x20]
mov ecx, dword [rdi + 0x18]
mov edx, dword [rdi + 0x1c]
xor r9d, r9d
lea r8, [0x1400a7640]
nop dword [rax]
mov r11d, eax
or r11d, 3
mov r10d, r11d
and r10d, 0xfffffffe
imul r10d, r11d
shr r10d, 8
xor r10b, byte [rsp + r9 + 0x20]
mov byte [rsp + r9 + 0x20], r10b
lea r11, [r9 + 1]
mov r9d, ecx
xor r9b, r10b
movzx r9d, r9b
shr ecx, 8
xor ecx, dword [r8 + r9*4]
movzx r9d, cl
add r9d, edx
imul edx, r9d, 0x8088405
inc edx
mov r9d, edx
shr r9d, 0x18
movzx r10d, al
xor r10d, r9d
shr eax, 8
xor eax, dword [r8 + r10*4]
mov r9, r11
cmp r11, 0xc
jne 0x14000bcd0
mov dword [rdi + 0x20], eax
mov dword [rdi + 0x18], ecx
mov dword [rdi + 0x1c], edx
movzx eax, byte [rsp + 0x2b]
test bx, bx
je 0x14000bd6d
shr ebx, 0x18
cmp al, bl
jne 0x14000bd75
mov rax, qword [rdi + 0x20]
mov qword [rsi + 0x28], rax
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 0
jmp 0x14000bd7b
shr rbx, 0x38
cmp al, bl
je 0x14000bd4d
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000bd90
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx + 0x10]
test r15, r15
je 0x14000bdf2
cmp rbx, r15
mov r9, r15
cmovb r9, rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x20]
mov r8, r14
call qword [rax + 0x18]
cmp qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
mov ecx, 1
jne 0x14000bdf6
sub r15, rax
jb 0x14000bea0
mov qword [rdi + 0x10], r15
xor ecx, ecx
jmp 0x14000bdf6
xor ecx, ecx
xor eax, eax
test rbx, rbx
je 0x14000be87
mov r8d, dword [rdi + 0x20]
mov edx, dword [rdi + 0x18]
mov r9d, dword [rdi + 0x1c]
xor r10d, r10d
lea r11, [0x1400a7640]
nop word cs:[rax + rax]
mov r15d, r8d
or r15d, 3
mov ebp, r15d
and ebp, 0xfffffffe
imul ebp, r15d
shr ebp, 8
xor bpl, byte [r14 + r10]
mov r15d, edx
xor r15b, bpl
movzx r15d, r15b
shr edx, 8
xor edx, dword [r11 + r15*4]
movzx r15d, dl
add r15d, r9d
imul r9d, r15d, 0x8088405
inc r9d
mov r15d, r9d
shr r15d, 0x18
movzx r12d, r8b
xor r12d, r15d
shr r8d, 8
xor r8d, dword [r11 + r12*4]
mov byte [r14 + r10], bpl
inc r10
cmp rbx, r10
jne 0x14000be20
mov dword [rdi + 0x20], r8d
mov dword [rdi + 0x18], edx
mov dword [rdi + 0x1c], r9d
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str.X_n_
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
lea rax, str.number_of_read_bytes_exceeds_limit
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rdx, str._z_n_
lea rcx, [rsp + 0x20]
call fcn.1400a5350
ud2
Function at 0x14000f4d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
movaps xmm11, xmmword [rdx]
movaps xmm12, xmmword [rdx + 0xc0]
movaps xmmword [rcx], xmm11
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movaps xmmword [rcx + 0xc0], xmm12
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x14000f5e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x140014ef0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14001510d
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1400b3920]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x140014f60
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x1400b3930]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x14001508a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x140015060
movdqa xmm1, xmmword [0x1400b3930]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x1400b3940], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x14001512b
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.1400149d0
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140016870
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp rdx, r9
jne 0x1400169ad
test rdx, rdx
je 0x140016892
cmp rdx, 8
jae 0x140016899
xor eax, eax
xor r9d, r9d
jmp 0x140016990
xor eax, eax
add rsp, 0x28
ret
cmp rdx, 0x20
jae 0x1400168a9
xor eax, eax
xor r9d, r9d
jmp 0x14001692f
mov r9, rdx
and r9, 0xffffffffffffffe0
pxor xmm0, xmm0
xor eax, eax
pxor xmm1, xmm1
nop word [rax + rax]
movdqu xmm2, xmmword [rcx + rax]
movdqu xmm3, xmmword [rcx + rax + 0x10]
movdqu xmm4, xmmword [r8 + rax]
pxor xmm4, xmm2
por xmm0, xmm4
movdqu xmm2, xmmword [r8 + rax + 0x10]
pxor xmm2, xmm3
por xmm1, xmm2
add rax, 0x20
cmp r9, rax
jne 0x1400168c0
por xmm1, xmm0
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd eax, xmm1
cmp r9, rdx
je 0x1400169a8
test dl, 0x18
je 0x140016990
mov r10, r9
mov r9, rdx
and r9, 0xfffffffffffffff8
movzx eax, al
movd xmm0, eax
mov rax, qword [r8 + r10]
xor rax, qword [rcx + r10]
movq xmm1, rax
por xmm0, xmm1
add r10, 8
cmp r9, r10
jne 0x140016940
pshufd xmm1, xmm0, 0x55
por xmm1, xmm0
movdqa xmm0, xmm1
psrld xmm0, 0x10
por xmm0, xmm1
movdqa xmm1, xmm0
psrlw xmm1, 8
por xmm1, xmm0
movd eax, xmm1
cmp r9, rdx
je 0x1400169a8
nop word cs:[rax + rax]
movzx r10d, byte [r8 + r9]
xor r10b, byte [rcx + r9]
lea r11, [r9 + 1]
or al, r10b
mov r9, r11
cmp rdx, r11
jne 0x140016990
add rsp, 0x28
ret
lea rcx, [0x1400b79d7]
lea r8, str._y_v_
mov edx, 0x24
call fcn.1400a53f0
ud2

Function at 0x140016a80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret
Function at 0x14001fd90
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x14001fe20
jmp 0x14001fe0f
jae 0x14001fee0
cmp r8, 0x201
jae 0x14001fe20
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14001fe78
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14001fe4f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400a4470
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14001fea1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001ff48
mov r8d, r14d
cmp r15, r8
jne 0x14001fe00
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001ff6b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14001fe0f
jmp 0x14001fe20
cmp rsi, r8
jb 0x14001ff85
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140022c40
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x14001ff31
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140009470
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x14001ff19
jmp 0x14001ff31
lea rcx, str.internal_error:_entered_unreachable_code_rustc_cc66ad468955717ab92600c770da8c1601a4ff33library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400a53f0
jmp 0x14001ff9a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400a57e0
ud2