joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462840
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40286f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408fc0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460720
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402840
cmp byte [0x0063d634], 0
je 0x462855
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45f820
jmp 0x402840

Function at 0x462860
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0063d9a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0063d634], 0
je 0x462895
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0063dcc0]
aesenc xmm0, xmmword [0x0063dcd0]
aesenc xmm0, xmmword [0x0063dce0]
movq rax, xmm0
ret
jmp 0x4091c0

Function at 0x4628a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0063d9a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0063d634], 0
je 0x4628d6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0063dcc0]
aesenc xmm0, xmmword [0x0063dcd0]
aesenc xmm0, xmmword [0x0063dce0]
movq rax, xmm0
ret
jmp 0x409220

Function at 0x464260
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0063dc40]
mov qword [rsp + 8], rdx
lea r8d, [0x0063d650]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00462780
add rsp, 0x30
ret
Function at 0x4b6820
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b698b
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
lea rax, [0x00511bd1]
mov ebx, 6
call fcn.004ac0a0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x004b69a0]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
nop
call fcn.00402700
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
nop
cmp rcx, 0xffffffffffffffff
je 0x4b6949
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x4b6985
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
nop
cmp rbx, rcx
jb 0x4b6978
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
nop
call fcn.00462ec0
call fcn.00462e40
nop
call fcn.00460720
jmp fcn.004b6820
Function at 0x4d24c0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4d2723
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x4d2707
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x4d250d
xor ebx, ebx
xor ecx, ecx
jmp 0x4d2520
mov rax, rdx
call fcn.004c4700
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4d263b
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00476380
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005114d9]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044dcc0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00402700
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4d25fe
xor eax, eax
lea rbx, [0x005114ee]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00511563]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044dda0
jmp 0x4d262b
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x0053f148]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044dcc0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop
call fcn.00476380
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00402700
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4d26ca
xor eax, eax
lea rbx, [0x005114ee]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00511563]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044dda0
jmp 0x4d26f7
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0053f148]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044dcc0
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x005118c0]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00460720
mov rax, qword [rsp + 8]
jmp fcn.004d24c0
Function at 0x140001d20
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor edi, edi
mov ebx, ecx
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x48], ebx
lea rsi, str.agent_start
mov dword [rsp + 0x40], eax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov dword [rsp + 0x60], eax
mov r8d, 0xd0
lea rax, str._s_pid:_d__dbg:_d
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 4
call fcn.140008ef0
xor eax, eax
mov dword [0x14005e140], ebx
mov qword [0x14006e2b0], rax
lea rbx, [0x14006e2b0]
mov r9, rbx
mov dword [0x14006e2b0], 0x18
lea r8, [0x14006e2b8]
mov qword [0x14006e2b8], rax
lea edx, [rdi + 1]
mov qword [0x14006e2c0], rax
lea rcx, str.D:PAI_A_OICI_KA___SY__A_OICI_KA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x140001eb4
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREOpenSSHAgent
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001ef0
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ProcessID
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r9d, r9d
test eax, eax
jne 0x140001f26
xor r8d, r8d
lea edx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x14006e288], rax
test rax, rax
je 0x140001f59
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov r8d, 0xda
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
lea rax, str.cannot_convert_sddl_ERROR:_d
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
mov dword [rsp + 0x38], eax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
lea rax, str.cannot_create_agent_root_reg_key__ERROR:_d
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8d, 0xdc
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
mov dword [rsp + 0x38], eax
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
lea rax, str.cannot_publish_agent_master_process_id_ERROR:_d
mov r8d, 0xde
mov qword [rsp + 0x30], rax
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov r8d, 0xe0
lea rcx, str.C:OpenSSHcontribwin32openssh......contribwin32win32compat_ssh_agent_agent.c
lea rax, str.cannot_create_global_stop_event_ERROR:_d
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
call fcn.140008b00
int3
Function at 0x140002600
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xe0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140002640
sub r9, 1
jne 0x140002630
mov bpl, 0xd
lea rdi, [rsi + 0xd0]
lea r14, [0x140061d30]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400026e0
inc r8
sub r9, 1
jne 0x1400026d0
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140002720
sub r8, 1
jne 0x140002710
mov rcx, rbx
call fcn.140002060
sub rdi, 0x10
add bpl, 0xff
jne 0x140002670
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400027c0
inc r8
sub r9, 1
jne 0x1400027b0
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400027f0
sub rdx, 1
jne 0x1400027e2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140013300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov eax, dword [rcx]
xor r9d, r9d
mov rsi, r8
mov r11, rdx
mov r10, rcx
mov ebx, r9d
mov edi, r9d
test eax, eax
jle 0x14001334b
mov rdx, r8
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdi, [rdi + 1]
mov rcx, qword [r11]
lea rdx, [rdx + 4]
inc ebx
xor byte [rcx + rdi - 1], al
mov eax, dword [r10]
cmp ebx, eax
jl 0x140013330
mov r8d, r9d
mov rbx, r9
test eax, eax
jle 0x14001337e
lea rdx, [rsi + 1]
nop dword [rax]
movzx eax, byte [rdx]
lea rbx, [rbx + 1]
mov rcx, qword [r11 + 8]
lea rdx, [rdx + 4]
inc r8d
xor byte [rcx + rbx - 1], al
mov eax, dword [r10]
cmp r8d, eax
jl 0x140013360
mov r8d, r9d
mov rbx, r9
test eax, eax
jle 0x1400133ae
lea rdx, [rsi + 2]
nop dword [rax]
movzx eax, byte [rdx]
lea rbx, [rbx + 1]
mov rcx, qword [r11 + 0x10]
lea rdx, [rdx + 4]
inc r8d
xor byte [rcx + rbx - 1], al
mov eax, dword [r10]
cmp r8d, eax
jl 0x140013390
mov r8, r9
test eax, eax
jle 0x1400133dc
lea rdx, [rsi + 3]
nop dword [rax]
movzx eax, byte [rdx]
lea r8, [r8 + 1]
mov rcx, qword [r11 + 0x18]
lea rdx, [rdx + 4]
inc r9d
xor byte [rcx + r8 - 1], al
cmp r9d, dword [r10]
jl 0x1400133c0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400136c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, dword [rcx]
lea rdi, [0x140061f30]
xor r8d, r8d
mov r11, rdx
mov r10, rcx
mov r9d, r8d
mov ebx, r8d
test eax, eax
jle 0x14001371b
nop word [rax + rax]
mov rdx, qword [r11]
lea rbx, [rbx + 1]
inc r9d
movzx eax, byte [rdx + rbx - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + rbx - 1], al
mov eax, dword [r10]
cmp r9d, eax
jl 0x1400136f0
mov r9d, r8d
mov rbx, r8
test eax, eax
jle 0x14001375c
nop word [rax + rax]
mov rdx, qword [r11 + 8]
lea rbx, [rbx + 1]
inc r9d
movzx eax, byte [rdx + rbx - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + rbx - 1], al
mov eax, dword [r10]
cmp r9d, eax
jl 0x140013730
mov r9d, r8d
mov rbx, r8
test eax, eax
jle 0x14001379c
nop word [rax + rax]
mov rdx, qword [r11 + 0x10]
lea rbx, [rbx + 1]
inc r9d
movzx eax, byte [rdx + rbx - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + rbx - 1], al
mov eax, dword [r10]
cmp r9d, eax
jl 0x140013770
mov r9, r8
test eax, eax
jle 0x1400137ce
mov rdx, qword [r11 + 0x18]
lea r9, [r9 + 1]
inc r8d
movzx eax, byte [rdx + r9 - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + r9 - 1], al
cmp r8d, dword [r10]
jl 0x1400137a3
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140013fa0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10d, dword [rsp + 0x30]
xor r11d, r11d
test r10d, r10d
je 0x1400140a9
mov qword [rsp + 0x10], rbx
cmp r10d, 0x40
jb 0x140014072
lea eax, [r10 - 1]
mov ecx, eax
lea rbx, [rax + r9]
add rax, r8
cmp r9, rax
ja 0x140013fdf
cmp rbx, r8
jae 0x140014072
lea rax, [rcx + rdx]
cmp r9, rax
ja 0x140013ff1
cmp rbx, rdx
jae 0x140014072
mov ebx, r10d
mov qword [rsp], rdi
and ebx, 0xffffffc0
mov edi, 0x20
movdqu xmm0, xmmword [r11 + r8]
lea eax, [rdi - 0x10]
movdqu xmm1, xmmword [r11 + rdx]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax + r8]
movdqu xmmword [r11 + r9], xmm1
add r11d, 0x40
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + r9], xmm1
mov eax, edi
movdqu xmm0, xmmword [rax + r8]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + r9], xmm1
lea eax, [rdi + 0x10]
add edi, 0x40
movdqu xmm1, xmmword [rax + rdx]
movdqu xmm0, xmmword [rax + r8]
pxor xmm1, xmm0
movdqu xmmword [rax + r9], xmm1
cmp r11d, ebx
jb 0x140014000
mov rdi, qword [rsp]
cmp r11d, r10d
jae 0x1400140a4
sub rdx, r8
mov eax, r11d
add rax, r8
sub r9, r8
sub r10d, r11d
mov r8d, r10d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
xor cl, byte [rax]
mov byte [r9 + rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x140014090
mov rbx, qword [rsp + 0x10]
add rsp, 8
ret
Function at 0x14001a8c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13d0
call fcn.140028840
sub rsp, rax
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea ecx, [rdi + 0x10]
call fcn.140027bb4
mov qword [rsi], rax
mov qword [rsi + 8], rax
add rax, 0x10
mov qword [rsi + 0x10], rax
mov rax, qword [rsi]
lea rcx, [rax + 0x10]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rsi + 8], rcx
mov ebx, 1
mov dword [rsp + 0x20], ebx
call fcn.140027278
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, ebx
mov dword [rsp + rbx*4 + 0x34], eax
inc rbx
cmp rbx, 0x270
jb 0x14001a950
mov dword [rsp + 0x30], 0x270
nop word [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.14001c720
movzx edx, al
mov rcx, qword [rsi]
mov byte [rdi + rcx], dl
inc rdi
cmp rdi, 0x10
jl 0x14001a980
mov rax, rsi
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.140027b60
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14001a9d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x130
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebp, edx
mov rbx, r8
add ebp, 0xfffffff0
mov r14, rcx
test rcx, rcx
je 0x14001aa07
movups xmm0, xmmword [rcx]
jmp 0x14001aa1a
call fcn.1400331dc
mov dword [rax], 0x16
call fcn.14002e4d8
xorps xmm0, xmm0
mov rdx, qword [rbx]
lea rcx, [rsp + 0x20]
add r14, 0x10
call fcn.140001bf0
movaps xmmword [rsp + 0x110], xmm0
mov rbx, r14
mov esi, ebp
test ebp, ebp
je 0x14001aaa9
mov qword [rsp + 0x158], rdi
lea rdi, [rsp + 0x110]
sub rdi, r14
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140002600
mov ecx, 0x10
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14001aa80
sub rdi, 0x10
movaps xmmword [rsp + 0x110], xmm0
sub rsi, 1
jne 0x14001aa60
mov rdi, qword [rsp + 0x158]
lea eax, [rbp - 1]
xor ecx, ecx
movzx eax, byte [rax + r14]
sub ebp, eax
cmp eax, 0x10
cmova ebp, ecx
mov eax, ebp
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140027b60
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop r14
pop rsi
pop rbp
ret
Function at 0x14001aaf0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x170
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [r11 + 8], rbx
xorps xmm0, xmm0
mov qword [r11 - 0x18], rdi
mov rbx, rcx
mov qword [r11 - 0x20], r14
lea rcx, [rsp + 0x20]
xor eax, eax
mov qword [r11 - 0x28], r15
mov r14, r8
mov qword [rsp + 0x30], rax
mov rdi, rdx
movups xmmword [rsp + 0x20], xmm0
call fcn.14001a8c0
mov rax, qword [r14]
mov rsi, qword [rsp + 0x20]
mov r15, qword [rbx]
test rax, rax
je 0x14001ac50
mov qword [rsp + 0x168], rbp
mov ebp, dword [rdi + 0x10]
test rsi, rsi
je 0x14001ab6b
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
jmp 0x14001ab81
xorps xmm0, xmm0
movups xmmword [rax], xmm0
call fcn.1400331dc
mov dword [rax], 0x16
call fcn.14002e4d8
cmp qword [rdi + 0x18], 0x10
jb 0x14001ab8b
mov rdi, qword [rdi]
mov rcx, qword [r14]
mov r9, rbp
add rcx, 0x10
mov r8, rdi
mov rdx, rbp
call fcn.14001c8b0
mov rcx, qword [r14]
mov eax, ebp
and eax, 0xf
add rcx, 0x10
mov edi, 0x10
mov r8d, 0x10
sub edi, eax
add rcx, rbp
movzx eax, bpl
mov edx, edi
and eax, 0xf
sub r8, rax
call fcn.14002a480
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140001bf0
mov rbx, qword [r14]
lea eax, [rdi + rbp]
movups xmm0, xmmword [rsi]
mov rbp, qword [rsp + 0x168]
lea r8, [rsp + 0x130]
add rbx, 0x10
mov edi, eax
movaps xmmword [rsp + 0x130], xmm0
test eax, eax
je 0x14001ac4b
dec rdi
shr rdi, 4
inc rdi
nop
mov rax, rbx
sub r8, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14001ac20
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002300
mov r8, rbx
add rbx, 0x10
sub rdi, 1
jne 0x14001ac10
mov rsi, qword [rsp + 0x20]
mov r15, qword [rsp + 0x150]
mov r14, qword [rsp + 0x158]
mov rdi, qword [rsp + 0x160]
mov rbx, qword [rsp + 0x180]
test rsi, rsi
je 0x14001aca6
mov rdx, qword [rsp + 0x30]
mov rax, rsi
sub rdx, rsi
cmp rdx, 0x1000
jb 0x14001ac9e
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001acbf
mov rcx, rsi
call fcn.140027bac
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140027b60
add rsp, 0x170
pop rsi
ret
call fcn.14002e4f8
int3
Function at 0x14001ae90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006b030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x80]
xor sil, sil
cmp qword [r8 + 0x18], 0x10
mov rdi, r9
mov rax, r8
jb 0x14001aec9
mov rax, qword [r8]
lea rcx, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001afb2
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
mov dword [rsp + 0x38], eax
jb 0x14001af05
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001afa7
mov edx, dword [rsp + 0x38]
xor r8d, r8d
dec edx
mov dword [rsp + 0x3c], 1
mov rcx, rbx
call fcn.140002820
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x14001af53
mov rax, qword [rbx]
cmp qword [rdi + 0x18], 0x10
jb 0x14001af5d
mov rdi, qword [rdi]
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001afa7
cmp dword [rsp + 0x38], eax
jne 0x14001afa4
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x14001af99
mov rax, qword [rbx]
mov qword [rbx + 0x10], 0
mov byte [rax], sil
mov sil, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140027b60
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret