joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x46ab37
movzx edx, byte [rax]
test edx, edx
jne 0x46a9f4
nop dword [rax]
test r8b, r8b
jne 0x46a9f4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x46aa07
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x46aaf7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x46aae5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x46aad7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x46aa5d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x46aaa0
mov eax, 1
cmp rax, rbx
ja 0x46aa8b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x46aacf
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x46aa93
mov rcx, r11
mov eax, r12d
jmp 0x46aa62
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x46ab2d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x46aaf0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x46aa0d
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3

Function at 0x46c2a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c34f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061e360]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers
Function at 0x46f7a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061e10a], 0
je 0x46f7ae
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x46f7c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061e10a], 0
je 0x46f7d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x46f7e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061e10a], 0
je 0x46f815
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0061e7a0]
aesenc xmm0, xmmword [0x0061e7b0]
aesenc xmm0, xmmword [0x0061e7c0]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x46f820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0061e10a], 0
je 0x46f856
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0061e7a0]
aesenc xmm0, xmmword [0x0061e7b0]
aesenc xmm0, xmmword [0x0061e7c0]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x470ee0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x0061e360]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x470f7b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret
Function at 0x4711a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x0061e360]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x471237
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret

Function at 0x471600
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x471634
mov rcx, 0x28
jmp 0x47163f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0061e360], rcx
pop rbp
ret
Function at 0x48a040
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a77f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x48a06d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x48a2f1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x48a31d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00529a60]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004d6f00]
lea rbx, [0x00527800]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x48a342
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x48a377
lea rdi, [0x004d6f80]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x48a063
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x48a35b
jmp 0x48a330
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x48a920
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x48a937
inc rax
cmp rax, 4
jge 0x48a94f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x48a934
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x48a960
inc rax
cmp rax, 4
jge 0x48a96e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x48a997
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x48a97b
jmp 0x48a95d
Function at 0x490380
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49044a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061e360]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49042f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004d7000]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x49041e
mov edi, 1
lea rsi, [0x004d7000]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00527a48]
lea rsi, [0x00527060]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4a0880
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a092c
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0061e360]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x4a08f3
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call sym.runtime.stringtoslicebyte
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x4a0906
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x4a0919
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x4a0903
mov byte [rax + rcx], dl
jmp 0x4a0903
mov rcx, rbx
mov rbx, rax
xor eax, eax
call sym.runtime.slicebytetostring
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp sym.internal_filepathlite.replaceStringByte
Function at 0x140046610
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140046652
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14004665a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14004666b
jmp 0x140046682
xor r10d, r10d
jmp 0x14004670d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140046682
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140046699
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400466b9
add r11, r8
jmp 0x1400467e9
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140046782
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140046730
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14004679f
mov r9d, dword [rdx + r10]
mov r8d, 4
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jb 0x1400467b0
jmp 0x1400467cb
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x1400467cb
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x1400467e5
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400935a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x14009f250
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x28], 0
test ecx, ecx
je 0x14009f2b7
mov eax, ecx
xor r8d, r8d
xor ecx, ecx
xor edx, edx
nop dword [rax]
lea r9, [r8 + r8*2]
inc rdx
add r9, rcx
lea ecx, [r9 + r9]
and cl, 2
shl r9, cl
rol r9, 3
and r9d, 0xa2
lea rcx, [r9 + 0x55]
xor r9, 0xffffffffffffffaa
test r8b, 1
cmove r9, rcx
add qword [rsp + 0x28], r9
mov r8, rdx
mov rcx, r9
cmp rdx, rax
jne 0x14009f270
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x14009f2bf
add rsp, 0x98
ret
mov rax, qword [0x1403d2d38]
mov rax, qword [rax]
cmp rax, 2
jbe 0x14009f2b7
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [fcn.14023f200]
mov qword [rsp + 0x38], rax
lea rax, str.Unlikely_event_to_use_sum_and_prevent_optimization:
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 1
mov qword [rsp + 0x88], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rcx, str.srcml.rs
call fcn.1401a7c10
lea rcx, str.ICBM::mlNo_hypervisor_signature_detected.
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], 8
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 8
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x68]
lea r8, [rsp + 0x40]
mov edx, 3
xor r9d, r9d
call fcn.1401a7b20
nop
add rsp, 0x98
ret
Function at 0x1400b3930
Capabilities:
Check for time delay via gettickcount
Execute anti-debugging instructions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rbp], rcx
mov r14, qword [rcx + 0x10]
lea rsi, [r14 + 0x10]
mov cl, 1
xor eax, eax
lock cmpxchg byte [r14 + 0x10], cl
je 0x1400b3973
mov rcx, rsi
call fcn.14029c990
mov rax, qword [0x1403d2d60]
mov rax, qword [rax]
shl rax, 1
test rax, rax
je 0x1400b3acf
call fcn.14029c8c0
xor al, 1
mov dword [rbp + 0xc], eax
mov qword [rbp - 8], rsi
movzx eax, byte [r14 + 0x11]
test al, al
jne 0x1400b3ae7
call qword [sym.imp.kernel32.dll_GetTickCount]
mov edi, eax
rdtsc
mov rbx, rdx
mov rsi, rax
mov ecx, 1
call fcn.14009f370
mov word [rbp - 0x58], 0
mov dword [rbp - 0x56], 0
mov word [rbp - 0x30], 0
lea rax, [rbp - 0x58]
lea rcx, [rbp - 0x30]
sgdt [rax]
sldt word [rcx]
mov r12d, dword [rbp - 0x56]
mov r15w, word [rbp - 0x58]
mov r13w, word [rbp - 0x30]
mov ecx, 1
call fcn.14009f250
xor ecx, ecx
mov edx, 0x5f5e100
call fcn.14020c470
shl rbx, 0x20
or rsi, rbx
rdtsc
mov rbx, rdx
shl rbx, 0x20
or rbx, rax
call qword [sym.imp.kernel32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x65
mov ecx, 0x64
cmovae ecx, eax
add rcx, 0xffffffffffffff9c
sub rbx, rsi
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rcx
mov word [rbp - 0x18], r15w
mov qword [rbp - 0x20], r12
mov word [rbp - 0x16], r13w
lea rcx, [rbp - 0x58]
lea r8, [rbp - 0x30]
mov rdx, qword [rbp]
call fcn.14007af50
cmp dword [rbp - 0x58], 1
je 0x1400b3b1f
cmp byte [rbp + 0xc], 0
mov rsi, qword [rbp - 8]
jne 0x1400b3a8b
mov rax, qword [0x1403d2d60]
mov rax, qword [rax]
shl rax, 1
test rax, rax
je 0x1400b3a8b
call fcn.14029c8c0
test al, al
jne 0x1400b3a8b
mov byte [r14 + 0x11], 1
xor eax, eax
xchg byte [rsi], al
cmp al, 2
jne 0x1400b3a9b
mov rcx, rsi
call fcn.14029ca50
mov rax, qword [rbp]
lea rcx, [rax + 0x10]
mov rax, qword [rcx]
lock dec qword [rax]
jne 0x1400b3ab1
call fcn.140008cb0
mov rcx, qword [rbp]
call fcn.14007f040
nop
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov dword [rbp + 0xc], 0
mov qword [rbp - 8], rsi
movzx eax, byte [r14 + 0x11]
test al, al
je 0x1400b39a4
mov rax, qword [rbp - 8]
mov qword [rbp - 0x58], rax
mov eax, dword [rbp + 0xc]
mov byte [rbp - 0x50], al
lea rax, [0x14031b080]
mov qword [rsp + 0x20], rax
lea rcx, [0x14031a218]
lea r9, fcn.140005850
lea r8, [rbp - 0x58]
mov edx, 0x2b
call fcn.14029dbe0
jmp 0x1400b3b57
movups xmm0, xmmword [rbp - 0x50]
movups xmm1, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x20], xmm1
movaps xmmword [rbp - 0x30], xmm0
lea rax, [0x14031b098]
mov qword [rsp + 0x20], rax
lea rcx, [0x14031a218]
lea r9, [0x14031a288]
lea r8, [rbp - 0x30]
mov edx, 0x2b
call fcn.14029dbe0
ud2
Function at 0x1400ff360
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140101cd0
Capabilities:
Get memory capacity

Disassembly:
push rbp
push rsi
sub rsp, 0x1d8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x150], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x58]
call fcn.140104fd0
xorps xmm0, xmm0
movaps xmmword [rbp + 0xe0], xmm0
movaps xmmword [rbp + 0x110], xmm0
movaps xmmword [rbp + 0x100], xmm0
movaps xmmword [rbp + 0xf0], xmm0
mov dword [rbp + 0xe0], 0x40
lea rcx, [rbp + 0xe0]
call qword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140101d3f
movups xmm0, xmmword [rbp + 0xe8]
movups xmmword [rbp + 0x68], xmm0
jmp 0x140101d78
call fcn.14010bd10
mov qword [rbp + 0xd0], rax
mov dword [rbp + 0xd8], edx
mov qword [rbp + 0xc8], 1
movups xmm0, xmmword [rbp + 0xe8]
movups xmmword [rbp + 0x68], xmm0
test rax, rax
je 0x140101d78
lea rcx, [rbp + 0xd0]
call fcn.14010c210
xorps xmm0, xmm0
movaps xmmword [rbp + 0x130], xmm0
movaps xmmword [rbp + 0x120], xmm0
movaps xmmword [rbp + 0x110], xmm0
movaps xmmword [rbp + 0x100], xmm0
movaps xmmword [rbp + 0xf0], xmm0
movaps xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0x140], 0
lea rcx, [rbp + 0xe0]
mov edx, 0x68
call qword [sym.imp.kernel32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x140101e19
mov r8, qword [rbp + 0x100]
mov rdx, qword [rbp + 0xf0]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rbp + 0x130]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rbp + 0xe8]
sub rdx, r8
cmovb rdx, r9
mov qword [rbp + 0x78], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rbp + 0x80], rax
lea rcx, [rbp - 0x58]
mov dl, 1
mov r8b, 1
call fcn.1401051f0
mov byte [rbp + 0xe0], 1
movabs rax, 0x202020202020101
mov qword [rbp + 0xe1], rax
lea rcx, [rbp - 0x58]
lea r9, [rbp + 0xe0]
xor edx, edx
call fcn.140105a60
lea rdx, [rbp - 0x58]
mov r8d, 0x120
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rsi
add rsp, 0x1d8
pop rsi
pop rbp
ret
Function at 0x140105930
Capabilities:
Get memory capacity

Disassembly:
push rsi
push rbx
sub rsp, 0xa8
mov ebx, r8d
mov rsi, rcx
test dl, dl
je 0x1401059bd
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14010597f
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi + 0xc0], xmm0
jmp 0x1401059bd
call fcn.14010bd10
mov qword [rsp + 0x98], rax
mov dword [rsp + 0xa0], edx
mov qword [rsp + 0x90], 1
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi + 0xc0], xmm0
test rax, rax
je 0x1401059bd
lea rcx, [rsp + 0x98]
call fcn.14010c210
test bl, bl
je 0x140105a54
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x20]
mov edx, 0x68
call qword [sym.imp.kernel32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x140105a54
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x70]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x28]
sub rdx, r8
cmovb rdx, r9
mov qword [rsi + 0xd0], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rsi + 0xd8], rax
add rsp, 0xa8
pop rbx
pop rsi
ret