joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47fbe0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x47fc1f
jb 0x47fc34
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x47fca0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x47fd70
jb 0x47fdcf
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0047fb80
aeskeygenassist xmm1, xmm0, 1
call fcn.0047fba0
aeskeygenassist xmm1, xmm2, 2
call fcn.0047fb80
aeskeygenassist xmm1, xmm0, 2
call fcn.0047fba0
aeskeygenassist xmm1, xmm2, 4
call fcn.0047fb80
aeskeygenassist xmm1, xmm0, 4
call fcn.0047fba0
aeskeygenassist xmm1, xmm2, 8
call fcn.0047fb80
aeskeygenassist xmm1, xmm0, 8
call fcn.0047fba0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047fb80
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047fba0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047fb80
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047fba0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047fb80
jmp 0x47fe3d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0047fae0
aeskeygenassist xmm1, xmm2, 2
call fcn.0047fb40
aeskeygenassist xmm1, xmm2, 4
call fcn.0047fae0
aeskeygenassist xmm1, xmm2, 8
call fcn.0047fb40
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047fae0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047fb40
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047fae0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0047fb40
jmp 0x47fe3d
aeskeygenassist xmm1, xmm0, 1
call fcn.0047faa0
aeskeygenassist xmm1, xmm0, 2
call fcn.0047faa0
aeskeygenassist xmm1, xmm0, 4
call fcn.0047faa0
aeskeygenassist xmm1, xmm0, 8
call fcn.0047faa0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047faa0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047faa0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0047faa0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0047faa0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0047faa0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0047faa0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x47fe4a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x4cfd40
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cfe5d
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x90], rdi
call fcn.00480000
xor edx, edx
jmp 0x4cfde0
mov qword [rsp + 0x38], rsi
lea rax, [0x004db960]
mov rbx, rsi
mov rcx, rbx
call fcn.00448ca0
mov qword [rsp + 0x58], rax
mov rdx, qword [0x005c84a8]
mov rbx, rax
mov rcx, qword [rsp + 0x38]
mov rdi, rcx
mov rsi, qword [rsp + 0x60]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
mov rax, rdx
nop
call fcn.004ce9e0
mov rdx, qword [rsp + 0x40]
inc rdx
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
mov rax, qword [rsp + 0x58]
nop word [rax + rax]
cmp rdx, 3
jge 0x4cfe36
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov rsi, qword [0x005c84a8]
cmp dword [rsi + 0x140], 0xffffffff
jne 0x4cfe29
lea rsi, [rbx + rbx*2]
mov rdi, rsi
shl rsi, 1
sar rsi, 0x3f
shr rsi, 0x3d
lea rsi, [rsi + rdi*2]
sar rsi, 3
jmp 0x4cfd7e
shr rbx, 2
lea rsi, [rbx + rbx*2]
jmp 0x4cfd7e
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov r8, qword [rsp + 0xa0]
call fcn.00480000
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
nop dword [rax + rax]
call fcn.004602c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004cfd40
Function at 0x100401120
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x430
movzx eax, byte [rcx]
mov qword [rsp + 0x28], 0
mov rbp, rcx
mov r12, rdx
test al, al
je 0x100401282
lea r14, [rsp + 0x30]
mov rbx, rcx
lea r13, [rsp + 0x28]
xor esi, esi
mov rdi, r14
jmp 0x10040118e
call sub.msys_2.0.dll___locale_ctype_ptr
movsx rdx, byte [rbx]
mov rsi, rdx
test byte [rdx + rax + 1], 8
je 0x100401210
xor esi, esi
cmp r14, rdi
jb 0x100401248
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x1004011c6
cmp sil, 0x22
je 0x1004011f0
cmp sil, 0x27
jne 0x100401160
cmp al, 0x27
je 0x100401203
mov rdx, rdi
sub rdx, r14
add rdx, 2
cmp rdx, 0x3ff
ja 0x100401278
add rbx, 1
mov byte [rdi], al
add rdi, 1
movzx eax, byte [rbx]
test al, al
jne 0x10040118e
cmp r14, rdi
jb 0x10040125e
mov rax, qword [rsp + 0x28]
mov qword [r12], rax
xor eax, eax
add rsp, 0x430
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp rbp, rbx
jae 0x100401289
cmp al, 0x22
jne 0x10040119e
cmp byte [rbx - 1], 0x5c
je 0x10040119e
xor esi, esi
jmp 0x100401182
cmp dl, 0x27
je 0x100401182
cmp dl, 0x22
je 0x100401182
mov rax, rdi
sub rax, r14
add rax, 2
cmp rax, 0x3ff
ja 0x100401278
mov byte [rdi], dl
xor esi, esi
add rdi, 1
jmp 0x100401182
mov byte [rdi], 0
mov rdx, r14
mov rcx, r13
mov rdi, r14
call fcn.1004080a0
jmp 0x100401182
mov byte [rdi], 0
lea rcx, [rsp + 0x28]
mov rdx, r14
call fcn.1004080a0
jmp 0x1004011cf
mov eax, 1
jmp 0x1004011da
xor eax, eax
jmp 0x1004011d4
lea r9, str.shell_parse_stringlist
mov r8d, 0x11b
lea rdx, str.gpgtar.c
lea rcx, str.s___str____cannot_be_quoted_at_first_char_
call sub.msys_gpg_error_0.dll__gpgrt_log_assert
nop
nop word [rax + rax]

Function at 0x1004012b0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov eax, dword [0x10041b08c]
test eax, eax
je 0x1004012d1
cmp eax, ecx
je 0x1004012d1
cmp eax, 0x73
jne 0x1004012e0
cmp ecx, 0x65
jne 0x1004012e0
mov ecx, 0x1f5
mov dword [0x10041b08c], ecx
add rsp, 0x28
ret
cmp eax, 0x65
jne 0x1004012ea
cmp ecx, 0x73
je 0x1004012cc
lea rcx, str.conflicting_commands_n
call sub.msys_intl_8.dll_libintl_gettext
mov rcx, rax
call sub.msys_gpg_error_0.dll_gpgrt_log_error
mov ecx, 2
call sub.msys_2.0.dll_exit
nop
nop dword [rax]
Function at 0x1004076a0
Capabilities:
Terminate process
Write file on windows

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
test rcx, rcx
je 0x1004076d8
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x28], rdx
call fcn.100407580
test rax, rax
je 0x1004076e6
add rsp, 0x38
ret
lea rcx, [0x1004157e0]
call sub.msys_gcrypt_20.dll_gcry_xstrdup
jmp 0x1004076c7
call sub.msys_2.0.dll___errno
cmp dword [rax], 0x16
je 0x10040771a
call sub.msys_2.0.dll___getreent
mov r8d, 0x16
mov edx, 1
lea rcx, str._nfatal:_out_of_memory_n
mov r9, qword [rax + 0x18]
call sub.msys_2.0.dll_fwrite
mov ecx, 2
call sub.msys_2.0.dll_exit
call sub.msys_2.0.dll___getreent
mov r8d, 0x25
mov edx, 1
lea rcx, str._nfatal:_too_many_args_for_xstrconcat_n
mov r9, qword [rax + 0x18]
call sub.msys_2.0.dll_fwrite
jmp 0x100407710
Function at 0x1004090c0
Capabilities:
Encode data using base64

Disassembly:
mov r9d, dword [0x10041b224]
jmp fcn.100408430

Function at 0x100409670
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edx, 1
mov rbx, rcx
xor ecx, ecx
call sub.msys_2.0.dll_fcntl
cmp eax, 0xffffffff
je 0x100409760
xor edi, edi
mov edx, 1
mov ecx, 1
call sub.msys_2.0.dll_fcntl
cmp eax, 0xffffffff
je 0x100409730
xor ebp, ebp
mov edx, 1
mov ecx, 2
call sub.msys_2.0.dll_fcntl
cmp eax, 0xffffffff
je 0x100409790
call sub.msys_2.0.dll___getreent
cmp ebp, 2
mov r12, qword [rax + 0x18]
sete al
cmp edi, 2
sete dl
or eax, edx
mov esi, eax
test r12, r12
je 0x100409720
cmp edi, 1
je 0x100409820
cmp ebp, 1
je 0x1004097f8
test sil, sil
je 0x100409725
mov r8, rbx
lea rdx, str._s:_fatal:_unable_to_reopen_standard_input__output__or_error_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov ecx, 3
call sub.msys_2.0.dll_exit
nop word [rax + rax]
test sil, sil
jne 0x10040970d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sub.msys_2.0.dll___errno
cmp dword [rax], 9
jne 0x1004096ac
mov edx, 1
lea rcx, [0x100415ac3]
xor ebp, ebp
call sub.msys_2.0.dll_open
cmp eax, 1
setne bpl
add ebp, 1
jmp 0x1004096ae
call sub.msys_2.0.dll___errno
cmp dword [rax], 9
jne 0x100409692
xor edx, edx
lea rcx, [0x100415ac3]
mov edi, 1
call sub.msys_2.0.dll_open
cmp eax, 1
sbb edi, 0xffffffff
jmp 0x100409694
call sub.msys_2.0.dll___errno
cmp dword [rax], 9
jne 0x1004096c6
mov edx, 1
lea rcx, [0x100415ac3]
call sub.msys_2.0.dll_open
cmp eax, 2
je 0x100409858
test ebp, ebp
jne 0x10040970d
call sub.msys_2.0.dll___getreent
mov r12, qword [rax + 0x10]
test r12, r12
je 0x10040970d
cmp edi, 1
jne 0x1004096fb
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_input_reopened_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
jmp 0x1004096fb
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_output_reopened_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
test sil, sil
jne 0x1004096fb
jmp 0x100409725
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_input_reopened_n
mov rcx, r12
call sub.msys_2.0.dll_fprintf
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_output_reopened_n
mov rcx, r12
cmp ebp, 1
jne 0x1004098c0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msys_2.0.dll_fprintf
cmp ebp, 2
sete al
cmp edi, 2
sete dl
or eax, edx
mov esi, eax
test ebp, ebp
jne 0x100409720
call sub.msys_2.0.dll___getreent
mov rbp, qword [rax + 0x10]
test rbp, rbp
je 0x100409720
mov r8, rbx
cmp edi, 1
je 0x1004098ce
lea rdx, str._s:_WARNING:_standard_error_reopened_n
mov rcx, rbp
call sub.msys_2.0.dll_fprintf
cmp edi, 2
jne 0x100409725
mov r8, rbx
lea rdx, str._s:_fatal:_unable_to_reopen_standard_input__output__or_error_n
mov rcx, rbp
call sub.msys_2.0.dll_fprintf
jmp 0x10040970d
cmp ebp, 2
jne 0x100409725
jmp 0x1004096fb
lea rdx, str._s:_WARNING:_standard_input_reopened_n
mov rcx, rbp
call sub.msys_2.0.dll_fprintf
mov r8, rbx
lea rdx, str._s:_WARNING:_standard_error_reopened_n
mov rcx, rbp
jmp 0x100409844
Function at 0x100409920
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x100409948
lea rdx, [0x100415ac3]
call sub.msys_2.0.dll_strcmp
test eax, eax
jne 0x100409948
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x100411890
jmp qword [sym.imp.msys_2.0.dll_remove]
Function at 0x10040ac60
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, str.GNUPGHOME
lea rsi, str._.gnupg
call sub.msys_2.0.dll_getenv
mov rbx, rax
test rax, rax
je 0x10040ac88
cmp byte [rax], 0
jne 0x10040ac98
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rax
call fcn.10040abe0
test rax, rax
mov rsi, rax
cmove rsi, rbx
xor edx, edx
mov rcx, rsi
call fcn.100406fb0
xor edx, edx
lea rcx, str._.gnupg
mov rbx, rax
call fcn.100406fb0
mov rcx, rbx
mov rdi, rax
mov rdx, rax
call fcn.100407010
mov rcx, rdi
mov ebp, eax
call sub.msys_gcrypt_20.dll_gcry_free
mov rcx, rbx
call sub.msys_gcrypt_20.dll_gcry_free
test ebp, ebp
je 0x10040ac88
mov rax, rsi
mov byte [0x10041b350], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x10040c850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
cmp byte [rcx], 0
lea rdx, [rcx + 8]
jne 0x10040c86b
jmp 0x10040c8d0
mov rcx, rax
movzx eax, byte [rcx]
sub eax, 0x30
cmp al, 9
ja 0x10040c8e0
lea rax, [rcx + 1]
cmp rax, rdx
jne 0x10040c868
xor eax, eax
cmp byte [rcx + 1], 0x54
jne 0x10040c8d0
lea rdx, [rcx + 2]
add rcx, 8
jmp 0x10040c893
mov rdx, rbx
movzx eax, byte [rdx]
sub eax, 0x30
cmp al, 9
ja 0x10040c8e0
lea rbx, [rdx + 1]
cmp rbx, rcx
jne 0x10040c890
movzx ecx, byte [rcx]
cmp cl, 0x5a
jne 0x10040c8b6
movzx ecx, byte [rdx + 2]
lea rbx, [rdx + 2]
test cl, cl
je 0x10040c8fb
jns 0x10040c8e8
cmp cl, 0x2c
setne al
cmp cl, 0x3a
setne dl
and eax, edx
xor eax, 1
movzx eax, al
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
call sub.msys_2.0.dll___locale_ctype_ptr
movsx rdx, byte [rbx]
mov rcx, rdx
test byte [rdx + rax + 1], 8
je 0x10040c8bc
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180552474
Capabilities:
Encode data using xor

Disassembly:
sbb r8, 2
call fcn.18057dc1d
xor al, 0x9d
push rdi
add byte [rcx], 0
add byte [rax], al
add cl, byte [rcx + 0x55]
add byte [rcx], 0
add byte [rax], al
invalid

Function at 0x180561b98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 8]
je 0x180583fd5
lea rsp, [rsp + 8]
and rsp, 0xfffffffffffffff0
push 0xffffffff88b2190b
push 0xffffffffb3074e99
lea rsp, [rsp + 0x10]
add rsp, rcx
push 0xfffffffffe275f30
test ebx, ebx
jmp 0x18058569f
jmp 0x18055c0f0

Function at 0x180579c9f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180574915
mov eax, 0x9c98a72d
add eax, 0xe2a8e920
rol rax, 0xd0
mov rax, qword [rbp + rbx*8]
cmp ebx, 1
jmp 0x18056568a
jmp 0x1805589bc
jne 0x18057030c
push 0x5192703b
pop rcx
mov rcx, rax
jmp 0x180583fc3
mov r8, rax
lea rsp, [rsp + 0x10]
jmp 0x180583fc3
call fcn.18055f9f2
dec ebx
push 0xffffffffc4b8d2a6
lea rsp, [rsp + 8]
jne 0x18055c0fb
mov eax, 0x360940a3
sal rax, 0x3f
shl rax, 0x9c
add rax, qword [rbp + rax]
push 0x7614d81a
not dword [rsp]
sub rsp, 0x18
push 0x52b66634
jmp 0x18057d246

Function at 0x180582571
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 8]
jmp 0x180583fc3
Function at 0x14003f6e0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xe0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x58], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
mov r8d, 0x20
call fcn.1402b6210
test rax, rax
je 0x14003f74c
mov qword [rbp + 0x48], rax
mov rcx, rax
mov qword [rbp + 0x50], rdx
call qword [rdx]
mov rax, qword [rbp + 0x50]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003f7b5
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x48]
call fcn.1400bcc60
jmp 0x14003f7b5
movaps xmm0, xmmword [rbp + 0x20]
movaps xmm1, xmmword [rbp + 0x30]
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x60], xmm0
lea r8, [0x140376160]
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x60]
mov r9d, 8
call fcn.1402b5f90
mov rax, qword [rbp - 0x40]
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x10], xmm0
movups xmm0, xmmword [rbp - 0x28]
movaps xmmword [rbp], xmm0
mov rcx, qword [rbp - 0x18]
mov qword [rbp + 0x10], rcx
mov rcx, qword [rdi + 0x30]
mov qword [rdi + 0x38], rcx
mov qword [rdi], rax
movaps xmm0, xmmword [rbp - 0x10]
movaps xmm1, xmmword [rbp]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
mov rax, qword [rbp + 0x10]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
jmp fcn.1402b3aa0

Function at 0x14004e470
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8, rdx
mov r11, qword [rdx]
xor eax, eax
test r11, r11
setne al
xor rax, qword [rcx]
movabs rsi, 0x5851f42d4c957f2d
mul rsi
mov r9, rdx
xor r9, rax
mov r10, qword [rcx + 8]
test r11, r11
je 0x14004e530
movdqu xmm0, xmmword [rcx + 0x10]
mov r11, qword [r8 + 8]
mov rcx, qword [r8 + 0x10]
add r9, rcx
imul r9, rsi
cmp rcx, 8
jbe 0x14004e543
cmp rcx, 0x10
jbe 0x14004e559
movq r8, xmm0
mov rdx, qword [r11 + rcx - 0x10]
xor rdx, r8
pshufd xmm0, xmm0, 0xee
movq rsi, xmm0
mov rax, qword [r11 + rcx - 8]
xor rax, rsi
mul rdx
xor rdx, rax
add r9, r10
xor r9, rdx
rol r9, 0x17
nop dword [rax]
mov rdx, qword [r11]
mov rax, qword [r11 + 8]
add r11, 0x10
add rcx, 0xfffffffffffffff0
xor rdx, r8
xor rax, rsi
mul rdx
add r9, r10
xor r9, rdx
xor r9, rax
rol r9, 0x17
cmp rcx, 0x10
ja 0x14004e500
jmp 0x14004e5b2
movzx eax, byte [r8 + 8]
xor rax, r9
mul rsi
mov r9, rdx
xor r9, rax
jmp 0x14004e5b2
cmp rcx, 1
jbe 0x14004e572
cmp rcx, 3
jbe 0x14004e57d
mov eax, dword [r11]
mov ecx, dword [r11 + rcx - 4]
jmp 0x14004e58d
movq rdx, xmm0
xor rdx, qword [r11]
pshufd xmm0, xmm0, 0xee
movq rax, xmm0
xor rax, qword [r11 + rcx - 8]
jmp 0x14004e5a2
jne 0x14004e589
movzx eax, byte [r11]
mov rcx, rax
jmp 0x14004e58d
movzx eax, word [r11]
movzx ecx, byte [rcx + r11 - 1]
jmp 0x14004e58d
xor eax, eax
xor ecx, ecx
movq rdx, xmm0
xor rdx, rax
pshufd xmm0, xmm0, 0xee
movq rax, xmm0
xor rax, rcx
mul rdx
xor rdx, rax
add r9, r10
xor r9, rdx
rol r9, 0x17
mov rax, r9
mul r10
xor rax, rdx
mov ecx, r9d
rol rax, cl
pop rsi
ret
Function at 0x1400833b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400833f2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1400833fa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14008340b
jmp 0x140083422
xor r10d, r10d
jmp 0x1400834ad
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140083422
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140083439
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140083459
add r11, r8
jmp 0x14008358b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140083522
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400834d0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140083540
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140083552
jmp 0x14008356d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14008356d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140083587
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140084e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x140084e70
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x140084e65
cmp edi, 0x2d
jne 0x140084e70
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x140085004
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x14008500f
movzx r11d, r11b
cmp rbx, rsi
jae 0x140084f0d
mov ebx, 1
sub rbx, rsi
add r10, 2
jmp 0x140084ecc
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x140084f0d
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x140084f0d
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x140084eb0
cmp r11d, 0xccccccc
jne 0x140084ef8
cmp sil, 7
jbe 0x140084eb0
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.140357640
jmp 0x140084ff1
mov r10d, dword [rsp + 0x80]
test al, al
je 0x140084f2a
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x140084f3a
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x14036b8c0]
subpd xmm1, xmmword [0x14036b8d0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x140084fac
xorpd xmm1, xmm1
movsd xmm2, qword [0x140373990]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x140084f88
jnp 0x140084fda
test r10d, r10d
jns 0x140085038
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x134
ja 0x140084f80
mov eax, eax
mov r9, qword [0x1405060b0]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x140084ff9
mulsd xmm0, xmm1
movapd xmm1, xmmword [0x1403739a0]
andpd xmm1, xmm0
ucomisd xmm1, qword [0x1403739b0]
jae 0x140085038
test r8b, r8b
jne 0x140084fe7
xorpd xmm0, xmmword [0x1403739c0]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x140084fdf
jmp 0x140084fe7
mov qword [rsp + 0x28], 5
jmp 0x140085018
mov qword [rsp + 0x28], 0xc
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1403576e0
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140084ff1
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1403576e0
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140084fee
Function at 0x1400bccc0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp - 8], 0
lea r9, [rbp - 8]
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
test eax, eax
je 0x1400bcd02
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400bcd33
mov rcx, qword [rbp - 8]
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.1402c2880
mov rcx, qword [rbp - 8]
call sub.ole32.dll_CoTaskMemFree
movups xmm0, xmmword [rbp - 0x28]
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x58
pop rsi
pop rbp
ret