joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032650
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1401082c0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1400326ae
cmp word [rdx], r12w
jne 0x1400326ae
or byte [rax + r8*8 + 0x38], cl
jmp 0x1400326b4
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14003280f
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x1400327ea
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1400326ed
mov rcx, r9
jmp 0x140032710
cmp r9, rdx
jae 0x140032727
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x1400326d1
jmp 0x14003280f
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400327e4
cmp dword [rsp + 0x80], edi
je 0x1400327e4
mov rdx, r14
lea r11, [0x1401082c0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1400327bd
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x140032790
mov word [rbx], r12w
jmp 0x14003280b
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140032799
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x14003280b
cmp word [rsp + 0x70], r12w
jne 0x1400327ca
cmp rbx, rsi
je 0x14003278a
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140030d80
cmp word [rsp + 0x70], r12w
je 0x14003280f
mov word [rbx], r13w
jmp 0x14003280b
lea r11, [0x1401082c0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140032807
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14003280f
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140033064
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x140033096
call fcn.14002c454
mov dword [rax], 0x16
call fcn.14002c318
jmp 0x1400331b5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400331b5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400331b5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400330c5
lock or dword [rcx + 0x14], 0x10
jmp 0x1400331b5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400330d9
call fcn.140039004
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14002e4a0
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.140032afc
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1400331a3
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14003316e
mov rcx, rsi
call fcn.14002e4a0
cmp eax, edi
je 0x140033159
mov rcx, rsi
call fcn.14002e4a0
cmp eax, 0xfffffffe
je 0x140033159
mov rcx, rsi
call fcn.14002e4a0
movsxd rbx, eax
lea r14, [0x1401082c0]
mov rcx, rsi
sar rbx, 6
call fcn.14002e4a0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x140033160
lea rdx, [0x140050170]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14003316e
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x140033192
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x140033192
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x140033192
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x1400331b8
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140034b4c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140034b7c
xor eax, eax
jmp 0x140034c3f
mov rbp, rbx
cmp word [rax], si
je 0x140034ba1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140034b88
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140034b84
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140034a9c
movsxd r14, eax
test eax, eax
jne 0x140034bdf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140034b75
mov rcx, r14
call fcn.14002cf00
mov rdi, rax
test rax, rax
jne 0x140034bf8
xor ecx, ecx
call fcn.14002c4ec
jmp 0x140034bd4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140034a9c
test eax, eax
jne 0x140034c29
mov rcx, rdi
call fcn.14002c4ec
jmp 0x140034c33
xor ecx, ecx
call fcn.14002c4ec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140034c5c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140034ce3
mov rsi, rbx
cmp word [rax], bp
je 0x140034ca2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140034c8c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140034c88
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14002cf00
mov rdi, rax
test rax, rax
je 0x140034cd0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400212e0
mov rbp, rdi
xor ecx, ecx
call fcn.14002c4ec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003a6c0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140030d80
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140030d80
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14003a810
cmp rax, 0xffffffffffffffff
je 0x14003a810
xor edi, edi
test rbp, rbp
jle 0x14003a7bb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14002c474
mov rbx, rax
test rax, rax
jne 0x14003a748
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14003a7b1
mov edx, 0x8000
mov ecx, r14d
call fcn.14002bc44
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140030554
cmp eax, 0xffffffff
je 0x14003a791
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14003a758
mov edx, r15d
mov ecx, r14d
call fcn.14002bc44
jmp 0x14003a7b1
cmp byte [rsi + 0x38], dil
je 0x14003a7a8
cmp dword [rsi + 0x34], 5
jne 0x14003a7a8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], InitCommonControls
cmp byte [rsi + 0x30], dil
je 0x14003a7b1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14002c4ec
jmp 0x14003a824
jns 0x14003a824
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140030d80
cmp rax, 0xffffffffffffffff
jne 0x14003a7dc
cmp byte [rsi + 0x30], dil
je 0x14003a824
mov edi, dword [rsi + 0x2c]
jmp 0x14003a824
mov ecx, r14d
call fcn.140035bb0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14003a824
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, InitCommonControls
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], InitCommonControls
jmp 0x14003a824
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14003a81d
mov eax, dword [rsi + 0x2c]
jmp 0x14003a822
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140030d80
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14003aff0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003b018
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003b018
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001c60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140001d50
test eax, eax
jne 0x140001c79
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, dword [0x140004008]
lea r10, [0x140004020]
mov r9, qword [0x140004020]
xor edx, edx
shl ecx, 0xd
xor ecx, dword [0x140004008]
mov eax, ecx
shr eax, 0x11
xor eax, ecx
mov ecx, eax
shl ecx, 5
xor ecx, eax
mov eax, ecx
mov dword [0x140004008], ecx
div r9d
mov eax, edx
add rax, rax
cmp ebx, dword [r10 + rax*8 + 8]
jne 0x140001cf0
mov r8d, ecx
shl ecx, 0xd
xor edx, edx
xor ecx, r8d
mov eax, ecx
shr eax, 0x11
xor eax, ecx
mov ecx, eax
shl ecx, 5
xor ecx, eax
mov eax, ecx
mov r8d, ecx
div r9d
mov eax, edx
add rax, rax
cmp ebx, dword [r10 + rax*8 + 8]
je 0x140001cc0
mov dword [0x140004008], ecx
mov eax, edx
add rax, rax
mov rax, qword [r10 + rax*8 + 0x10]
add rsp, 0x20
pop rbx
ret
Function at 0x140004510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r11, rcx
test r8d, r8d
jle 0x1400045fc
mov r9, qword [rdx + 0x18]
movsxd r10, r8d
xor r8d, r8d
nop
mov rdx, rbx
cmp r9, 0xf
jbe 0x14000453c
mov rdx, qword [rbx]
movzx ecx, byte [rdx]
mov eax, 0xffffffff
test cl, cl
je 0x1400045e8
nop dword [rax]
movzx ecx, cl
lea rdx, [rdx + 1]
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x140004550
not eax
cmp eax, dword [r11 + r8*4]
je 0x14000464d
inc r8
cmp r8, r10
jl 0x140004530
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140004632
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000462d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004684
mov rcx, r8
call fcn.1402200d0
xor al, al
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0
add rsp, 0x20
pop rbx
ret
cmp r9, 0xf
jbe 0x140004680
mov rcx, qword [rbx]
lea rdx, [r9 + 1]
cmp rdx, 0x1000
jb 0x14000467b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004684
mov rcx, r8
call fcn.1402200d0
mov al, 1
jmp 0x140004634
call fcn.14022d354
int3
Function at 0x140007190
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x14038d940]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, rcx
xor ebp, ebp
lea edx, [rbp + 0xd]
lea rcx, [rsp + 0x68]
call fcn.1400111e0
mov rbx, rax
mov rsi, qword [rax + 0x10]
mov rcx, rax
call fcn.140042b10
test al, al
je 0x1400071e2
mov ecx, ebp
jmp 0x1400071f4
mov rax, qword [rbx + 8]
lea rcx, [0x14025ad40]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rcx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.14008d7e0
nop
mov ebx, 0xffffffff
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140007233
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140007233
mov rcx, qword [rsp + 0x68]
call fcn.1402275a0
nop
lea rcx, [rsp + 0x50]
call fcn.140094620
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140003c20
nop
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14000726b
lock xadd dword [rax], ebx
cmp ebx, 1
jne 0x14000726b
mov rcx, qword [rsp + 0x50]
call fcn.1402275a0
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], 4
cmp qword [rdi + 0x18], 7
jbe 0x140007289
mov rdi, qword [rdi]
lea rdx, [rsp + 0x80]
cmp qword [rsp + 0x98], 7
cmova rdx, qword [rsp + 0x80]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
mov r8, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ebx, dword [rsp + 0x30]
test eax, eax
cmovne ebx, ebp
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140007319
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007314
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007344
call fcn.1402200d0
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1402200b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.14022d354
int3
Function at 0x140009790
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x14038d940]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor esi, esi
mov rbx, rcx
mov qword [rsp + 0x30], rsi
call fcn.140008ed0
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
mov edi, eax
call fcn.14024c480
cmp edi, 0xffffffff
je 0x140009889
lea rdx, [rsp + 0x30]
mov ecx, edi
call fcn.1400081c0
test eax, eax
je 0x140009889
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x140009889
lea rax, [rsp + 0x40]
xor r9d, r9d
lea edx, [rsi + 0x1c]
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rax, [rsp + 0x40]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], si
jne 0x140009826
mov rax, qword [rbx + 0x18]
cmp rdx, rax
ja 0x14000986e
mov rdi, rbx
cmp rax, 7
jbe 0x140009844
mov rdi, qword [rbx]
mov qword [rbx + 0x10], rdx
mov rcx, rdi
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x40]
call fcn.14024bde0
mov word [rbx + rdi], si
mov rcx, qword [rsp + 0x30]
call fcn.140024e10
mov al, 1
jmp 0x14000988b
lea r9, [rsp + 0x40]
mov rcx, rbx
call fcn.140003dc0
mov rcx, qword [rsp + 0x30]
call fcn.140024e10
mov al, 1
jmp 0x14000988b
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1402200b0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400098b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x14034e280]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x140009929
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400098d0
test r8, r8
je 0x14000994d
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x140009930
not ecx
mov eax, ecx
ret
Function at 0x1400164c0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xc98]
sub rsp, 0xd90
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
movaps xmmword [rax - 0x38], xmm8
movaps xmmword [rax - 0x48], xmm9
mov rax, qword [0x14038d940]
xor rax, rsp
mov qword [rbp + 0xc40], rax
mov r10, rdx
mov r11, rcx
mov rcx, qword [rbp + 0xcc0]
lea rdx, [rsp + 0x20]
call fcn.140016200
aesimc xmm0, xmmword [rsp + 0x30]
aesimc xmm1, xmmword [rsp + 0x40]
movdqa xmm2, xmmword [rbp - 0x60]
mov eax, r9d
movdqa xmm7, xmmword [rbp - 0x10]
movdqa xmm5, xmmword [rbp - 0x30]
movdqa xmm6, xmmword [rbp - 0x20]
movdqa xmm3, xmmword [rbp - 0x50]
movdqa xmm4, xmmword [rbp - 0x40]
movdqa xmm8, xmmword [rbp]
movdqa xmm9, xmmword [rsp + 0x20]
movdqa xmmword [rbp - 0x10], xmm0
aesimc xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x30], xmm0
aesimc xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x20], xmm1
aesimc xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rbp - 0x50], xmm0
aesimc xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x40], xmm1
aesimc xmm1, xmmword [rbp - 0x80]
shr eax, 4
movdqa xmmword [rbp - 0x70], xmm0
test r9b, 0xf
movdqa xmmword [rbp - 0x60], xmm1
aesimc xmm1, xmm2
movdqu xmm2, xmmword [r8]
lea ecx, [rax + 1]
aesimc xmm0, xmm3
movdqa xmmword [rsp + 0x70], xmm0
cmove ecx, eax
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmmword [rbp], xmm9
movdqa xmmword [rsp + 0x20], xmm8
aesimc xmm0, xmm5
movdqa xmmword [rsp + 0x50], xmm0
aesimc xmm1, xmm4
movdqa xmmword [rsp + 0x60], xmm1
aesimc xmm0, xmm7
movdqa xmmword [rsp + 0x30], xmm0
aesimc xmm1, xmm6
movdqa xmmword [rsp + 0x40], xmm1
test ecx, ecx
je 0x14001664b
sub r11, r10
mov edx, ecx
nop word [rax + rax]
movdqu xmm1, xmmword [r10 + r11]
lea rax, [rsp + 0x30]
mov ecx, 0xd
movdqa xmm0, xmm8
xorps xmm0, xmm1
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140016620
aesdeclast xmm0, xmm9
xorps xmm0, xmm2
movdqa xmm2, xmm1
movdqu xmmword [r10], xmm0
add r10, 0x10
sub rdx, 1
jne 0x140016600
mov rcx, qword [rbp + 0xc40]
xor rcx, rsp
call fcn.1402200b0
lea r11, [rsp + 0xd90]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rbp
ret
Function at 0x14001fb50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x14038d940]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov r15, rdx
mov rbx, rcx
mov edx, 0x205
lea rcx, [rsp + 0x70]
call fcn.1400111e0
mov rdi, rax
mov rsi, qword [rax + 0x10]
mov rcx, rax
call fcn.140042b10
test al, al
je 0x14001fbb0
xor ecx, ecx
jmp 0x14001fbc2
mov rax, qword [rdi + 8]
lea rcx, [0x14025ad40]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.14008d7e0
nop
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14001fc01
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14001fc01
mov rcx, qword [rsp + 0x70]
call fcn.1402275a0
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.140093540
nop
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call fcn.140041e70
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001fc40
mov eax, edi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x14001fc40
mov rcx, qword [rsp + 0x40]
call fcn.1402275a0
nop
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14001fc5d
lock xadd dword [rax], edi
cmp edi, 1
jne 0x14001fc5d
mov rcx, qword [rsp + 0x58]
call fcn.1402275a0
mov edi, 0x100
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x4e]
call fcn.14024c480
lea r11, [rbp - 0x78]
mov rsi, qword [rbp - 0x78]
mov r14, qword [rbp - 0x60]
cmp r14, 0xf
cmova r11, rsi
xor r10d, r10d
mov word [rbp - 0x50], r10w
xor eax, eax
lea rcx, [rbp - 0x4e]
mov byte [rcx], al
inc eax
lea rcx, [rcx + 1]
cmp eax, edi
jl 0x14001fc92
xor r8d, r8d
lea r9, [rbp - 0x4e]
nop word [rax + rax]
movzx edx, byte [r9]
movzx eax, dl
add al, byte [r8 + r11]
add al, r10b
movzx r10d, al
lea rcx, [rbp - 0x4e]
movzx eax, byte [rcx + r10]
mov byte [r9], al
mov byte [rcx + r10], dl
lea rax, [r8 + 1]
lea r9, [r9 + 1]
xor r8d, r8d
cmp rax, 0xc
cmovl r8, rax
sub rdi, 1
jne 0x14001fcb0
movzx r9d, byte [rbp - 0x50]
movzx r10d, byte [rbp - 0x4f]
test r15d, r15d
jle 0x14001fd3c
mov r11d, r15d
nop dword [rax]
inc r9b
movzx eax, r9b
lea rdx, [rbp - 0x4e]
add rdx, rax
movzx r8d, byte [rdx]
add r10b, r8b
movzx eax, r10b
movzx ecx, byte [rbp + rax - 0x4e]
mov byte [rdx], cl
mov byte [rbp + rax - 0x4e], r8b
add cl, r8b
movzx eax, cl
movzx ecx, byte [rbp + rax - 0x4e]
xor byte [rbx], cl
lea rbx, [rbx + 1]
sub r11, 1
jne 0x14001fd00
cmp r14, 0xf
jbe 0x14001fd6f
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001fd67
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001fd9b
mov rcx, rsi
call fcn.1402200d0
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1402200b0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14022d354
int3