joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400eb760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x1400eb8a0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x1400eb92c
movzx edi, word [rsi + 0x5c]
test bl, bl
je 0x1400eb8dc
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400b6f60
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx edi, word [rsp + 0x56]
jmp 0x1400eb8dc
mov edi, r14d
test rdi, rdi
jle 0x1400eb8fc
mov rdx, qword [rsi + 0x40]
dec rdi
mov eax, edi
movsx eax, byte [rsp + rax + 0x58]
movzx ecx, ax
call fcn.1400d4af4
cmp eax, 0xffffffff
jne 0x1400eb906
mov di, 0xffff
jmp 0x1400eb8dc
movabs rdi, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], rdi
mov eax, dword [rsi + 0x58]
cmp eax, 2
mov r14d, 1
cmovge r14d, eax
xor r15d, r15d
mov rcx, qword [rsi + 0x40]
call fcn.1400d19b4
cmp eax, 0xffffffff
je 0x1400eb926
mov byte [rsp + r15 + 0x58], al
inc r15
cmp r14, r15
jne 0x1400eb94e
mov word [rsp + 0x56], 0xaaaa
cmp byte [rsi + 0x5f], 0
je 0x1400eb9a2
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test bl, bl
je 0x1400eb903
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x1400eb8dc
cmp eax, 2
je 0x1400eb926
cmp eax, 3
je 0x1400eb976
jmp 0x1400eb980
lea r15, [rsp + 0x48]
mov qword [r15], rdi
lea r12, [rsp + 0x40]
mov qword [r12], rdi
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r13d, dword [rdx]
movzx ebp, word [rdx + 4]
movzx edi, word [rdx + 6]
lea r9, [rsp + r14 + 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x56]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x58]
call qword [0x1401af008]
cmp eax, 1
jne 0x1400eb996
mov rax, qword [rsi + 0x50]
mov dword [rax], r13d
mov word [rax + 4], bp
mov word [rax + 6], di
cmp r14d, 8
je 0x1400eb926
mov rcx, qword [rsi + 0x40]
call fcn.1400d19b4
cmp eax, 0xffffffff
je 0x1400eb926
mov byte [rsp + r14 + 0x58], al
inc r14
jmp 0x1400eb9b3

Function at 0x1400ebcd0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400ebd07
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x1400ebce1
ret

Function at 0x1400ebd70
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400ebda8
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x1400ebd81
ret
Function at 0x140100ed0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov edi, edx
mov rsi, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x140100f41
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140100f4b
mov dil, 1
test bl, bl
je 0x140100f2a
cmp byte [rsi + 8], 0
je 0x140100f46
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400b6f60
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
jmp 0x140100efd
mov rcx, qword [rsi]
jmp 0x140100f1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsi + 8], 0
je 0x140100f73
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140100f78
xor edi, edi
jmp 0x140100f2a
mov rcx, qword [rsi]
jmp 0x140100f60
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rsi + 8], 0
je 0x140100f9f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dil, 1
jmp 0x140100f2a
mov rcx, qword [rsi]
jmp 0x140100f8f
Function at 0x140101420
Capabilities:
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rsi, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x90], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x40], rax
movaps xmm0, xmmword [0x140160b90]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DeleteFileAfterReboot
lea r8, str....._base_files_file_util_win.cc
lea r14, [rsp + 0x20]
mov rcx, r14
mov r9d, 0x1ca
call fcn.14007ea40
xor edi, edi
mov rcx, rbx
mov rdx, r14
xor r8d, r8d
call fcn.140086a10
mov al, byte [rsi + 0x17]
test al, al
jns 0x1401014ac
cmp qword [rsi + 8], 0x103
ja 0x1401014ca
test al, al
jns 0x1401014b3
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x40]
call fcn.140086c50
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b6f60
mov eax, edi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140102020
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x250
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov sil, 1
cmp qword [0x14019a680], 0
je 0x140102066
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.1400b6f60
mov eax, esi
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [0x14019a658]
test rdi, rdi
je 0x140102107
test byte [0x14018a028], 1
je 0x140102049
cmp byte [rdi + 0x17], 0
jns 0x140102088
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14019a680], rax
inc rax
cmp rax, 1
ja 0x140102049
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400b90b0
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x1401021d0
xor esi, esi
jmp 0x140102049
mov ecx, 0x18
call fcn.1400b5aac
mov rdi, rax
lea rbx, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rbx
mov dl, 0xaa
call fcn.1400b90b0
xor ecx, ecx
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [0x140160b90]
movups xmmword [rdi], xmm0
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rdi + 0x10], rax
mov rcx, rdi
mov rdx, rbx
call fcn.1400e87f0
movzx eax, byte [rdi + 0x17]
test al, al
js 0x14010216d
and eax, 0x7f
mov rcx, rdi
jmp 0x140102174
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
test rax, rax
je 0x1401021af
lea r8, [rax + rax]
test r8, r8
je 0x1401021af
lea rdx, [r8 - 2]
cmp word [rcx + r8 - 2], 0x5c
mov r8, rdx
jne 0x14010217d
cmp rdx, 0xfffffffffffffffe
je 0x1401021af
sar rdx, 1
cmp rax, rdx
jbe 0x140102297
inc rdx
mov rcx, rdi
call fcn.140101d80
lea rdx, [0x1401678a0]
mov r8d, 9
mov rcx, rdi
call fcn.14002a190
mov qword [0x14019a658], rdi
jmp 0x140102076
mov rdi, qword [0x14019a658]
lea rbx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400d50b0
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.140029e60
mov rcx, qword [0x14019a658]
call fcn.1400fe8e0
cmp word [rax], 0x5c
je 0x14010221d
mov rcx, qword [0x14019a658]
lea rdx, [0x14016789c]
mov r8d, 1
call fcn.14002a190
mov rcx, qword [0x14019a658]
lea rdx, [0x1401678a0]
mov r8d, 9
call fcn.14002a190
mov rcx, qword [0x14019a658]
cmp byte [rcx + 0x17], 0
jns 0x140102246
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14019a680], rax
inc rax
cmp rax, 1
ja 0x140102049
mov qword [0x14019a680], 0
jmp 0x140102100
mov rcx, rdi
call fcn.1400e8790
int3
Function at 0x1401128b0
Capabilities:
Encode data using xor

Disassembly:
movsxd r9, dword [rdx + 8]
mov r8, qword [rdx]
movsxd rdx, dword [rcx + 8]
mov rcx, qword [rcx]
jmp fcn.140091850

Function at 0x140113a40
Capabilities:
Encode data using xor

Disassembly:
push rsi
movsxd r9, dword [rcx + 8]
movsxd rax, dword [rdx + 8]
cmp r9d, eax
jge 0x140113a65
mov r10, qword [rdx]
xor r8d, r8d
mov r11, r9
or r8, qword [r10 + r11*8]
inc r11
cmp rax, r11
jne 0x140113a57
jmp 0x140113a68
xor r8d, r8d
cmp eax, r9d
jge 0x140113a7f
mov r10, qword [rcx]
mov r11, rax
or r8, qword [r10 + r11*8]
inc r11
cmp r9, r11
jne 0x140113a73
cmp r9d, eax
cmovl eax, r9d
test eax, eax
jle 0x140113aa8
mov r9, qword [rcx]
mov r10, qword [rdx]
mov eax, eax
xor r11d, r11d
mov rsi, qword [r10 + r11*8]
xor rsi, qword [r9 + r11*8]
or r8, rsi
inc r11
cmp rax, r11
jne 0x140113a95
mov eax, dword [rdx + 0x10]
xor eax, dword [rcx + 0x10]
movsxd rcx, eax
xor eax, eax
or rcx, r8
sete al
pop rsi
ret
Function at 0x14011b880
Capabilities:
Hash data using sha512

Disassembly:
push rsi
push rdi
sub rsp, 0x108
mov rsi, r8
mov r8, rdx
mov rdx, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x100], rax
movaps xmm0, xmmword [0x140160b90]
lea rdi, [rsp + 0x28]
movups xmmword [rdi + 0xc0], xmm0
movups xmmword [rdi + 0xb0], xmm0
movups xmmword [rdi + 0xa0], xmm0
movups xmmword [rdi + 0x90], xmm0
movups xmmword [rdi + 0x80], xmm0
movups xmmword [rdi + 0x70], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x50], xmm0
movabs rax, 0x6a09e667f3bcc908
mov qword [rdi], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rdi + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rdi + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rdi + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rdi + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rdi + 0x38], rax
movabs rax, 0x4000000000
mov qword [rdi + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x40], xmm0
mov rcx, rdi
call fcn.140049ca0
mov edx, dword [rdi + 0xd4]
mov rcx, rsi
mov r8, rdi
call fcn.14004d880
mov edx, 0xd8
mov rcx, rdi
call fcn.1400940a0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400b6f60
mov rax, rsi
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x14011c710
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
movabs rax, 0x4000000000
mov qword [rcx + 0xd0], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov eax, 1
ret
Function at 0x140120590
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov edx, dword [rsp + 0xe0]
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x78], rax
movsxd r8, dword [rcx + 0x18]
lea ecx, [rdx + 4]
mov r11, rcx
shr r11, 6
xor eax, eax
mov r10d, 0
cmp r11, r8
jae 0x1401205eb
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 5
and r10d, 0x20
lea ecx, [rdx + 3]
mov r11, rcx
shr r11, 6
cmp r11, r8
jae 0x140120607
mov rax, qword [r9 + r11*8]
shr rax, cl
shl eax, 4
and eax, 0x10
or eax, r10d
lea ecx, [rdx + 2]
mov r14, rcx
shr r14, 6
xor r10d, r10d
mov r11d, 0
cmp r14, r8
jae 0x140120631
mov r11, qword [r9 + r14*8]
shr r11, cl
shl r11d, 3
and r11d, 8
or eax, r11d
lea ecx, [rdx + 1]
mov r11, rcx
shr r11, 6
cmp r11, r8
jae 0x140120652
mov r10, qword [r9 + r11*8]
shr r10, cl
shl r10d, 2
and r10d, 4
or eax, r10d
mov ecx, edx
mov r11, rcx
shr r11, 6
xor r10d, r10d
cmp r11, r8
jae 0x140120674
mov r10, qword [r9 + r11*8]
shr r10, cl
add r10d, r10d
and r10d, 2
or eax, r10d
test edx, edx
je 0x14012069a
dec edx
mov r10, rdx
shr r10, 6
xor ecx, ecx
cmp r10, r8
jae 0x140120698
mov r8, qword [r9 + r10*8]
xor ecx, ecx
bt r8, rdx
setb cl
or eax, ecx
mov r14d, eax
shr r14, 5
lea ecx, [r14 - 1]
neg r14
and ecx, eax
xor eax, 0x3f
mov r15d, r14d
and r15d, eax
or r15d, ecx
mov rax, r15
shr rax, 1
and r15d, 1
add r15, rax
xor r12d, r12d
mov r8d, 0xd8
mov rcx, rsi
xor edx, edx
call fcn.1400b90b0
mov r13, r15
not r13
mov r8, r12
xor r8, r15
dec r8
and r8, r13
sar r8, 0x3f
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rsi
mov r9, rbx
call fcn.14011d500
inc r12
add rbx, 0xd8
cmp r12, 0x11
jne 0x1401206dc
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x140160b90]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
add rsi, 0x48
mov eax, dword [rdi + 0x40]
test eax, eax
jle 0x1401207a8
xor ecx, ecx
xor edx, edx
or rdx, qword [rsi + rcx*8]
inc rcx
cmp rax, rcx
jne 0x140120748
test rdx, rdx
sete dl
test rax, rax
je 0x1401207f9
movsxd rcx, eax
mov rax, qword [rdi + 0x38]
xor r8d, r8d
lea r9, [rsp + 0x30]
sub r10, r10
jmp 0x140120780
mov r10, qword [rax + r8*8]
sbb r10, qword [rsi + r8*8]
mov qword [r9 + r8*8], r10
lea r8, [r8 + 1]
dec rcx
jne 0x140120780
sbb r10, r10
movsxd rax, dword [rdi + 0x40]
mov ecx, eax
test rax, rax
jle 0x1401207c7
xor r8d, r8d
jmp 0x1401207bc
mov dl, 1
jmp 0x14012075a
xor r9d, r9d
mov qword [rsp + r8*8 + 0x30], r9
inc r8
cmp rcx, r8
je 0x1401207c7
test dl, dl
jne 0x1401207ac
mov r9, qword [rsp + r8*8 + 0x30]
jmp 0x1401207af
test rcx, rcx
je 0x1401207f9
and r14d, 1
mov rcx, r14
neg rcx
dec r14
xor edx, edx
mov r8, qword [rsp + rdx*8 + 0x30]
and r8, rcx
mov r9, qword [rsi + rdx*8]
and r9, r14
or r9, r8
mov qword [rsi + rdx*8], r9
inc rdx
cmp rax, rdx
jne 0x1401207db
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400b6f60
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140130ed0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov rax, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
je 0x140130f0e
test rax, rax
je 0x140130fd7
mov rcx, qword [rbx]
mov qword [rax], rcx
add rax, 8
mov qword [rsi + 8], rax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
sub rax, qword [rsi]
mov r15, rax
sar r15, 3
lea rcx, [r15 + 1]
mov rdx, rcx
shr rdx, 0x3d
jne 0x140131003
movabs rdx, 0x1fffffffffffffff
lea rdi, [rsi + 0x18]
mov r14, rax
sar r14, 2
cmp r14, rcx
cmovbe r14, rcx
movabs rcx, 0x7ffffffffffffff8
cmp rax, rcx
cmovae r14, rdx
test r14, r14
jne 0x140130fca
xor eax, eax
shl r15, 3
add r15, rax
je 0x140130fd7
lea rax, [rax + r14*8]
mov rcx, qword [rbx]
mov qword [r15], rcx
lea rcx, [r15 + 8]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
cmp r8, rdx
je 0x140130f98
mov r9, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov qword [r15 - 8], r9
add r15, 0xfffffffffffffff8
cmp r8, rdx
jne 0x140130f80
mov rdx, qword [rsi]
mov qword [rsi], r15
mov qword [rsi + 8], rcx
mov r8, qword [rsi + 0x10]
mov qword [rsi + 0x10], rax
test rdx, rdx
je 0x140130f02
sub r8, rdx
sar r8, 3
mov rcx, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140131540
mov rcx, rdi
mov rdx, r14
call fcn.140131b10
jmp 0x140130f5d
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.1400ea040
mov rcx, rsi
call fcn.1400e87d0
int3

Function at 0x140137930
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14013796c
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140137976
add rdi, rbx
sub rsi, rbx
jne 0x14013794a
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.1400cb3d0
int3
Function at 0x14013cb80
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r12, r9
mov r13, r8
mov r15, rdx
mov rbp, rcx
mov r14, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x110]
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x90], rax
test rdi, rdi
jne 0x14013cbce
call fcn.14011b5f0
mov rdi, rax
test r14, r14
cmove r14, rdi
mov rcx, rdi
call fcn.140049500
mov rsi, rax
lea rax, [rax*2 + 2]
cmp rax, r15
ja 0x14013cc3e
lea rax, [rsi + rsi]
mov rbx, rax
not rbx
lea rcx, [r15 + rbx]
dec rcx
cmp rcx, r12
jb 0x14013cc1e
lea rcx, [r15 - 1]
or rax, 1
cmp rcx, rax
jae 0x14013cc9b
mov dword [rsp + 0x20], 0x6d
jmp 0x14013cc46
mov dword [rsp + 0x20], 0x68
lea r9, str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
xor edi, edi
mov ecx, 4
xor edx, edx
mov r8d, 0x72
jmp 0x14013cc5c
mov dword [rsp + 0x20], 0x62
lea r9, str....._third_party_boringssl_srccrypto_rsa_extra_rsa_crypt.c
xor edi, edi
mov ecx, 4
xor edx, edx
mov r8d, 0x7e
call fcn.140137760
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400b6f60
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r12
call fcn.140094060
jmp 0x14013cc61
xor ecx, ecx
jmp 0x14013cc8a
xor ecx, ecx
xor edi, edi
jmp 0x14013cc8a
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
mov byte [rbp], 0
lea r8, [rsi + rbp]
inc r8
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x40], r8
xor r9d, r9d
call fcn.140049510
xor ecx, ecx
mov edi, 0
test eax, eax
je 0x14013cc8a
mov rdi, qword [rsp + 0x38]
sub rdi, r12
add rbx, rdi
mov rcx, qword [rsp + 0x40]
je 0x14013cd0b
mov rax, qword [rsp + 0x40]
lea rcx, [rax + rsi]
xor edx, edx
mov r8, rbx
call fcn.1400b90b0
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 1]
mov qword [rsp + 0x48], rax
mov rax, rsi
not rax
add rdi, rax
mov byte [rcx + rdi], 1
test r12, r12
mov rbx, rcx
je 0x14013cd43
add rbp, rsi
add rbp, r15
sub rbp, r12
sub rbp, rsi
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.1400b8a00
mov r13, qword [rsp + 0x48]
mov rcx, r13
mov rdx, rsi
call fcn.140091b50
test eax, eax
je 0x14013cc95
mov r15, qword [rsp + 0x38]
sub r15, rsi
mov rcx, r15
call fcn.140094000
xor edi, edi
test rax, rax
je 0x14013cc91
mov r12, rax
mov qword [rsp + 0x20], r14
mov rcx, rax
mov rdx, r15
mov r8, r13
mov r9, rsi
call fcn.14004c420
test eax, eax
je 0x14013cc87
cmp qword [rsp + 0x38], rsi
je 0x14013cdba
cmp r15, 1
mov rax, r15
adc rax, 0
xor ecx, ecx
mov dl, byte [r12 + rcx]
xor byte [rbx + rcx], dl
inc rcx
cmp rax, rcx
jne 0x14013cdab
movaps xmm0, xmmword [0x140160b90]
lea rcx, [rsp + 0x50]
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov qword [rsp + 0x20], r14
mov rdx, rsi
mov r8, rbx
mov r9, r15
call fcn.14004c420
test eax, eax
je 0x14013cc87
mov edi, 1
test rsi, rsi
je 0x14013cc87
xor eax, eax
mov cl, byte [rsp + rax + 0x50]
xor byte [r13 + rax], cl
inc rax
cmp rsi, rax
jne 0x14013ce00
jmp 0x14013cc87
Function at 0x140141420
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14014146e
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x1401414ac
cmp rdi, rsi
jae 0x1401414ac
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x140141467
jmp 0x140141464
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b6f60
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140146cd0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140188028]
xor rax, rsp
mov qword [rsp + 0x108], rax
movaps xmm0, xmmword [0x140160b90]
lea r14, [rsp + 0xc0]
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov edx, 0x20
mov rcx, r8
mov r8, r14
call fcn.14011b880
and byte [r14], 0xf8
mov al, byte [r14 + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [r14 + 0x1f], al
lea r15, [rsp + 0x20]
mov r8d, 0xa0
mov rcx, r15
mov dl, 0xaa
call fcn.1400b90b0
lea r8, [0x140176490]
mov rcx, r15
mov rdx, r14
call fcn.1400a8e90
mov rcx, rdi
mov rdx, r15
call fcn.140145a90
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.1400b6f60
nop
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140150ff0
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14015102f
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x140150fff
mov dword [rsi], 7
jmp 0x140150fff
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.14006ee10
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14015100b
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14015100b
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x1401510e1
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x140151001
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140150fff
Function at 0x14000a030
Capabilities:
Hash data using crc32b

Disassembly:
xor r9d, r9d
lea r10, [0x14019ce10]
nop word [rax + rax]
xor eax, eax
test r9b, 1
je 0x14000a04c
bts eax, 7
mov ecx, r9d
shr ecx, 1
test cl, 1
je 0x14000a05a
bts eax, 6
shr ecx, 1
test cl, 1
je 0x14000a065
bts eax, 5
shr ecx, 1
test cl, 1
je 0x14000a070
bts eax, 4
shr ecx, 1
test cl, 1
je 0x14000a07b
bts eax, 3
shr ecx, 1
test cl, 1
je 0x14000a086
bts eax, 2
shr ecx, 1
test cl, 1
je 0x14000a091
bts eax, 1
test cl, 2
je 0x14000a09a
bts eax, 0
shl eax, 0x18
lea ecx, [rax + rax]
mov edx, ecx
xor edx, 0x4c11db7
test eax, eax
cmovns edx, ecx
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov ecx, eax
xor ecx, 0x4c11db7
test edx, edx
cmovns ecx, eax
lea eax, [rcx + rcx]
mov edx, eax
xor edx, 0x4c11db7
test ecx, ecx
cmovns edx, eax
lea eax, [rdx + rdx]
mov r8d, eax
xor r8d, 0x4c11db7
test edx, edx
cmovns r8d, eax
xor ecx, ecx
lea edx, [rcx + 0x1e]
test r8b, 1
je 0x14000a131
lea eax, [rdx + 1]
bts ecx, eax
sar r8d, 1
test r8b, 1
je 0x14000a13d
bts ecx, edx
sar r8d, 1
sub edx, 2
cmp edx, 0xfffffffe
jg 0x14000a125
mov dword [r10], ecx
inc r9d
add r10, 4
cmp r9d, 0x100
jl 0x14000a040
mov dword [0x14019ce00], 1
ret