joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009bf0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140009c32
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x140009c3a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140009c4b
jmp 0x140009c62
xor r10d, r10d
jmp 0x140009ced
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140009c62
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140009c79
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140009c99
add r11, r8
jmp 0x140009dca
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140009d62
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140009d10
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140009d80
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140009d92
jmp 0x140009dac
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140009dac
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140009dc6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001c8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14001c950
cmp r11, r10
ja 0x14001c9c6
cmp r10, rdx
ja 0x14001c9da
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14001c952
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14001c930
jmp 0x14001c9b4
ja 0x14001c95a
mov r11, r10
cmp rax, r8
jne 0x14001c8f4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14001c990
mov rdi, r8
sub ecx, edx
jns 0x14001c9ab
jmp 0x14001c9b6
cmp r8, rsi
je 0x14001c9eb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14001c9b6
xor al, 1
cmp rdi, rsi
jne 0x14001c970
jmp 0x14001c9b6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140115370
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1401150e0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140115150
ud2
Function at 0x14002a7a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov r15, r9
mov rsi, rcx
lea rdi, [0x1401a11d8]
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x50]
lea r9, [rsp + 0xa8]
call fcn.1400356b0
movzx r14d, byte [rsp + 0x60]
cmp r14b, 3
jne 0x14002a7ef
mov qword [rsi], 2
jmp 0x14002abbe
mov r11, qword [r15 + 0x38]
test r11, r11
je 0x14002a8b2
mov rdx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
cmp dword [r15], 2
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
jne 0x14002a8b9
mov rbx, r11
movdqu xmm0, xmmword [r15 + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet_n_n_n_n]
movdqa xmmword [rsp + 0x50], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x14011d690]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmmword [rsp + 0x70], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], 0
xor eax, eax
cmp r14b, 2
setne al
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x48]
mov r8d, 8
call fcn.140009bf0
mov eax, r14d
cmp al, 2
jne 0x14002a8f9
mov rsi, qword [rsp + 0x30]
movzx eax, sil
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x48]
mov r8d, 8
jmp 0x14002a911
xor eax, eax
jmp 0x14002abb3
xor eax, eax
cmp r14b, 2
setne al
movabs r12, 0xcbf29ce484222325
xor r12, rax
movabs rax, 0x1efac7090aef4a21
imul r12, rax
cmp r14b, 2
jne 0x14002abd2
movzx ecx, dl
xor r12, rcx
imul r12, rax
mov r10b, 2
jmp 0x14002aa13
test al, al
je 0x14002ac2b
lea rcx, [rsp + 0x50]
mov rsi, qword [rsp + 0x30]
mov rdx, rsi
mov r8, rbp
call fcn.140009bf0
mov rdx, rsi
lea rax, [rdx + rbp]
test r14b, r14b
je 0x14002ac7f
mov r10b, 1
test rbp, rbp
je 0x14002acd0
mov r8, rbp
movabs rcx, 0x100000001b3
and r8, 7
je 0x14002ace1
mov r9, r12
mov r10, rdx
nop dword [rax + rax]
movzx r12d, byte [r10]
inc r10
xor r12, r9
imul r12, rcx
mov r9, r12
dec r8
jne 0x14002ac10
jmp 0x14002ace4
test rbp, rbp
mov rdx, qword [rsp + 0x30]
je 0x14002a919
xor esi, esi
lea r12, [rsp + 0x50]
lea r13, [rsp + 0x48]
nop word cs:[rax + rax]
test rbp, rbp
je 0x14002ad60
mov rbx, rbp
and rbx, 3
jrcxz 0x14002ac92
xor ebp, ebp
jmp 0x14002aa13
mov r10, rdx
cmp rbp, 8
jb 0x14002ad58
nop word [rax + rax]
xor ebp, ebp
xor r10d, r10d
jmp 0x14002aa13

Function at 0x14002e230
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x14002e265
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14002e26a
call fcn.1400f55e0
mov ecx, dword [0x1401de2bc]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 0x60], 1
mov qword [rcx + 0x68], rax
mov qword [rcx + 0x70], rdx
add rsp, 0x38
ret
Function at 0x1400401f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x140040286
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet_n_n_n_n]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x14011d690]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140009bf0
test rdi, rdi
je 0x140040315
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14004032e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140040426
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400404a8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140040433
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400402f0
cmp r9, 8
jae 0x14004043c
jmp 0x1400404a8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140009bf0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400404a8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1400404a8
mov r8, rcx
cmp r9, 8
jb 0x1400404a8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140040440
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140049b80
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
movdqa xmmword [rsp + 0x2b0], xmm15
movdqa xmmword [rsp + 0x2a0], xmm14
movdqa xmmword [rsp + 0x290], xmm13
movdqa xmmword [rsp + 0x280], xmm12
movdqa xmmword [rsp + 0x270], xmm11
movdqa xmmword [rsp + 0x260], xmm10
movdqa xmmword [rsp + 0x250], xmm9
movdqa xmmword [rsp + 0x240], xmm8
movdqa xmmword [rsp + 0x230], xmm7
movaps xmmword [rsp + 0x220], xmm6
mov qword [rsp + 0x200], rcx
mov rax, qword [rsp + 0x338]
mov rcx, qword [rsp + 0x330]
mov qword [rsp + 0x120], r9
mov qword [rcx + 0x10], 0
mov dword [rsp + 0x110], 0
mov qword [rsp + 0x108], 0
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x1f8], rax
add r8, rdx
xorps xmm6, xmm6
movups xmmword [rsp + 0x152], xmm6
movzx eax, word [rsp + 0x160]
mov word [rsp + 0xee], ax
movups xmm0, xmmword [rsp + 0x150]
movups xmmword [rsp + 0xde], xmm0
movups xmmword [rsp + 0x12b], xmm6
mov byte [rsp + 0x13b], 0
mov qword [rsp + 0x58], 0
lea r13, [rsp + 0x68]
mov dword [rsp + 0x68], 0
mov word [rsp + 0x6c], 0
mov byte [rsp + 0x70], 0
mov dword [rsp + 0x74], 0
mov byte [rsp + 0x78], 0
and al, 0x78
add bh, al
and al, 0x7c
add byte [rax], al
add byte [rax], al
invalid
Function at 0x1400777d0
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x848
movdqa xmmword [rsp + 0x830], xmm11
movdqa xmmword [rsp + 0x820], xmm10
movdqa xmmword [rsp + 0x810], xmm9
movdqa xmmword [rsp + 0x800], xmm8
movaps xmmword [rsp + 0x7f0], xmm7
movdqa xmmword [rsp + 0x7e0], xmm6
mov rsi, r8
mov r12, rdx
mov qword [rsp + 0x158], rcx
mov rcx, qword [rdx + 0x130]
test rcx, rcx
je 0x140077846
mov rdx, qword [rsi]
call fcn.1400fbb50
test al, al
je 0x14007a6fa
lea rax, [r12 + 0x20]
mov qword [rsp + 0x3d0], rax
lea rax, [r12 + 0x88]
mov qword [rsp + 0x488], rax
lea rax, [r12 + 0xe0]
mov qword [rsp + 0x180], rax
lea rax, [r12 + 0xe3]
mov qword [rsp + 0x470], rax
lea r15, [rsp + 0x5a]
lea rax, [r12 + 0x28]
mov qword [rsp + 0x238], rax
lea rax, [0x1401a51e0]
lea rcx, [0x1401d1658]
pxor xmm6, xmm6
movaps xmm7, xmmword [0x14011d720]
movq xmm0, rcx
movq xmm8, rax
punpcklqdq xmm8, xmm0
movdqa xmm9, xmmword [str.uespemosarenegylmodnarodsetybdet_n_n_n_n]
movdqa xmm10, xmmword [0x14011d690]
lea rax, [r12 + 0xc8]
mov qword [rsp + 0x160], rax
lea rax, [r12 + 0xf8]
mov qword [rsp + 0x5e0], rax
lea rax, [r12 + 0x58]
mov qword [rsp + 0x5f0], rax
lea rax, [r12 + 0x70]
mov qword [rsp + 0x5e8], rax
lea r13, [rsp + 0x240]
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x150], r12
mov qword [rsp + 0x480], rsi
jmp 0x14007796c
movzx eax, byte [0x1401de2b8]
mov rcx, qword [0x1401de220]
test rcx, rcx
jne 0x14007a726
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14007b34a
mov rcx, rax
mov qword [0x1401de220], rax
mov r8d, 0x70
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14007b34a
mov rsi, rax
mov dword [rax], 2
mov qword [rax + 0x58], 1
lea rax, [0x1401a3048]
mov qword [rsi + 0x60], rax
mov word [rsi + 0x68], 1
mov r14, qword [r12 + 0x98]
mov rbx, qword [r12 + 0xa8]
test rbx, rbx
je 0x14007a7be
js 0x14007b324
movzx eax, byte [0x1401de2b8]
mov rcx, qword [0x1401de220]
test rcx, rcx
jne 0x14007a7a6
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14007ab4e
mov rcx, rax
mov qword [0x1401de220], rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r15, rax
test rax, rax
jne 0x14007a7c4
jmp 0x14007ab4e
mov r15d, 1
mov rcx, r15
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
movdqu xmm6, xmmword [r12 + 0xb4]
movups xmm0, xmmword [r12 + 0xc8]
movzx eax, byte [r12 + 0xd8]
mov byte [rsp + 0x60], al
jmp 0x14007a9dd
Function at 0x140092130
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
add byte [rax], al

Function at 0x140093cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov r8d, 0xb
add byte [rax], al

Function at 0x140094e90
Capabilities:
Encrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
add byte [rax], al
add byte [rbp - 0x77], cl
int 0x48
mov esi, edx
mov rbp, rcx
mov r12, qword [rsp + 0xf0]
mov qword [rdx + 0x138], r8
add byte [rax], al
lea r15, [rsp + 0x30]
mov rcx, r15
call fcn.140089490
mov eax, dword [rsp + 0x30]
xor byte [rbx + 0x2d7502f8], al
mov r15, qword [rsp + 0x38]
mov edi, r15d
and edi, 3
lea rax, [0x1401d54d4]
lea eax, [0x1401d54d4]
movsxd rcx, dword [rax + rdi*4]
add rcx, rax
jmp rcx
movzx eax, byte [r15 + 0x10]
cmp al, 0xd
je 0x1400951aa
jmp 0x140095237
test eax, eax
je 0x140095070
mov rdx, qword [rsi + 0x1b0]
mov rbx, qword [rsi + 0x1b8]
cmp rbx, rdx
jne 0x1400950d3
movabs r15, 0x8009031700000002
mov edi, 2
mov rcx, r15
shr rcx, 0x20
call fcn.1400eb040
cmp al, 0xd
je 0x1400951aa
movzx eax, byte [r15 + 0xf]
cmp al, 0xd
jne 0x140095237
invalid
lea eax, [rax]
add byte [rax], al
mov qword [rbp], 2
mov qword [rsi + 0x138], 0
cmp edi, 1
jne 0x14009524e
invalid
lea rsi, [r15 - 1]
mov rdi, qword [r15 - 1]
mov rbx, qword [r15 + 7]
mov rcx, rdi
mov ecx, edi
call qword [rbx]
cmp qword [rbx + 8], 0
je 0x1400951fb
cmp qword [rbx + 0x10], 0x11
jb 0x1400951e9
mov rdi, qword [rdi - 8]
mov rcx, qword [0x1401de220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1401de220]
xor edx, edx
mov r8, rsi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rbp], 1
mov qword [rbp + 8], r15
mov qword [rsi + 0x138], 0
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400e2050
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.140017270
cmp rax, rcx
je 0x1400e2075
cmp rdx, 4
jae 0x1400e2078
xor eax, eax
xor r8d, r8d
jmp 0x1400e2110
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x14011d700]
movdqa xmm3, xmmword [0x14011d710]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1400e20a0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x1400e2127
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400e2110
ret
Function at 0x1400e30a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov r9, qword [rcx]
test r9, r9
je 0x1400e30fb
mov r10, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp rcx, r10
jae 0x1400e30fb
movzx eax, byte [r9 + rcx]
cmp eax, 0x49
je 0x1400e3116
cmp eax, 0x42
jne 0x1400e30fb
lea r11, [rcx + 1]
mov qword [rsi + 0x10], r11
cmp r11, r10
jae 0x1400e31c6
cmp byte [r9 + r11], 0x5f
jne 0x1400e31c6
lea rax, [rcx + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x1400e322e
mov rcx, rsi
xor edx, edx
call fcn.1400de820
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc rcx
mov qword [rsi + 0x10], rcx
mov rcx, rsi
xor edx, edx
call fcn.1400de820
test al, al
jne 0x1400e32c1
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400e3152
lea rdx, [0x1401a5753]
mov r8d, 1
call fcn.140017800
test al, al
jne 0x1400e32c1
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x1400e310a
xor r14d, r14d
lea rbx, [0x1401a5b08]
nop word [rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x1400e3184
cmp byte [rax + rcx], 0x45
je 0x1400e32ea
sub r14, 1
jb 0x1400e31a9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400e31a9
mov r8d, 2
mov rdx, rbx
call fcn.140017800
test al, al
jne 0x1400e32c1
mov rcx, rsi
call fcn.1400e0070
test al, al
jne 0x1400e32c1
mov rax, qword [rsi]
test rax, rax
jne 0x1400e3170
jmp 0x1400e310a
xor eax, eax
mov edi, 0x3e
nop dword [rax]
mov r8b, 1
cmp r11, r10
jae 0x1400e3288
movzx edx, byte [r9 + r11]
cmp dl, 0x5f
je 0x1400e3222
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x1400e320c
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x1400e31fb
add dl, 0xa9
jmp 0x1400e320a
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x1400e3288
add dl, 0xe3
mov ebx, edx
inc r11
mov qword [rsi + 0x10], r11
mul rdi
jo 0x1400e3288
movzx edx, bl
add rax, rdx
jae 0x1400e31d0
jmp 0x1400e3288
inc r11
mov qword [rsi + 0x10], r11
inc rax
je 0x1400e3288
cmp rax, rcx
jae 0x1400e3285
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
ja 0x1400e32c9
cmp qword [rsi + 0x20], 0
je 0x1400e32e3
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.1400e30a0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x1400e310c
mov r8b, 1
xor edi, edi
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1400e32d8
lea rax, str.invalid_syntaxrecursion_limit_reached
lea rdx, [0x1401a5ac8]
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
add r8, 0x10
call fcn.140017800
test al, al
je 0x1400e32d8
mov dil, 2
jmp 0x1400e310a
mov dil, 1
xor r8d, r8d
mov rcx, qword [rsi + 0x20]
test rcx, rcx
jne 0x1400e3293
mov qword [rsi], 0
mov byte [rsi + 8], dil
xor edi, edi
jmp 0x1400e310a
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x1400e310a
Function at 0x1400ee7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rax, rdx
movzx r11d, byte [rdx + 0x38]
cmp r11b, 1
ja 0x1400ee807
movzx r9d, byte [rax + 0x10]
movzx r8d, byte [rax + 0x3a]
xor edx, edx
test r8b, r8b
jne 0x1400ee958
cmp r9b, 5
jb 0x1400ee958
mov r10, qword [rax]
mov rdx, qword [rax + 8]
xor esi, esi
test r11b, r11b
jne 0x1400ee7f7
cmp r9b, 6
je 0x1400ee7f7
mov esi, 2
cmp rdx, 2
jb 0x1400eea08
cmp rsi, rdx
jne case.0x1400edd43.40
xor edx, edx
jmp 0x1400ee958
xor edx, edx
xor r8d, r8d
xor r10d, r10d
mov rsi, qword [rax]
lea r8, [rsi + r9]
cmp r9, rdx
jne 0x1400ee840
movzx eax, byte [rax + 0x10]
xor r11d, r11d
jmp 0x1400ee8b9
movzx eax, byte [rax + 0x10]
add r10, rdi
add r10, r11
sub r10, rdx
inc r10
lea rdi, [rdx + rsi]
dec rdi
xor r11d, r11d
cmp al, 3
jae 0x1400ee880
nop
cmp byte [rdi], 0x5c
je 0x1400ee89b
inc r10
dec rdi
cmp r10, 1
jne 0x1400ee860
jmp 0x1400ee8b9
lea r8, str.library_std_srcpath.rs
mov rcx, r9
call fcn.140115000
ud2
lea r8, str.library_std_srcpath.rs
mov ecx, 2
call fcn.140115000
ud2
Function at 0x1400f52d0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1401de2b8]
mov rcx, qword [0x1401de220]
test rcx, rcx
jne 0x1400f531c
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400f53ea
mov rcx, rax
mov qword [0x1401de220], rax
mov r8d, 0x10
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400f53ea
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x1400f5480]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1400f53dc
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x18]
je 0x1400f53b5
cmp qword [rax + 0x10], 0x11
jae 0x1400f539e
mov r8, qword [rbp - 0x20]
jmp 0x1400f53a6
mov r8, qword [rbp - 0x20]
mov r8, qword [r8 - 8]
mov rcx, qword [0x1401de220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1401de220]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.140114cd0
ud2

Function at 0x1400f55e0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x1400f5623
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [fcn.1400efcc0]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140114fc0
ud2

Function at 0x1401136a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1401136ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401136ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401136ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401136ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1401136ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401136f0
xor al, al
add rsp, 0x28
ret