joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x450bf7
movzx edx, byte [rax]
test edx, edx
jne 0x450ab4
nop dword [rax]
test r8b, r8b
jne 0x450ab4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x450ac7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x450bb7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x450ba5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x450b97
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x450b1d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x450b60
mov eax, 1
cmp rax, rbx
ja 0x450b4b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00463ea0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x450b8f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x450b53
mov rcx, r11
mov eax, r12d
jmp 0x450b22
mov rcx, rbx
call fcn.00463de0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00463de0
mov eax, r8d
mov rcx, rbx
call fcn.00463ea0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x450bed
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x450bb0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x450acd
mov eax, edx
mov rcx, rbx
call fcn.00463de0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00463de0
nop
int3

Function at 0x456920
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4569d5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.004545a0
nop
test bl, bl
je 0x4569cf
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00456a20]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.004619e0
xorps xmm15, xmm15
mov r14, qword [0x0060e820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461b00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00456920
Function at 0x459920
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4599cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00459a20]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004619e0
xorps xmm15, xmm15
mov r14, qword [0x0060e820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00461b00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00459920
Function at 0x463900
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4043c3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a180
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461b00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4043a0
cmp byte [0x0060e60c], 0
je 0x463915
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x460b40
jmp 0x4043a0

Function at 0x463920
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0060e900]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0060e60c], 0
je 0x463955
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0060ec20]
aesenc xmm0, xmmword [0x0060ec30]
aesenc xmm0, xmmword [0x0060ec40]
movq rax, xmm0
ret
jmp 0x40a3a0

Function at 0x463960
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0060e900]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0060e60c], 0
je 0x463996
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0060ec20]
aesenc xmm0, xmmword [0x0060ec30]
aesenc xmm0, xmmword [0x0060ec40]
movq rax, xmm0
ret
jmp 0x40a400

Function at 0x465720
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x465754
mov rcx, 0x28
jmp 0x46575f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0060e820], rcx
pop rbp
ret
Function at 0x47de40
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e07b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x47deda
mov qword [rsp + 0x88], rax
lea rbx, [0x004cc680]
mov rcx, rax
lea rax, [0x00589b60]
call fcn.0046aba0
test cl, cl
jne 0x47dec3
mov rax, qword [rsp + 0x88]
call fcn.0047d6a0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x28]
lea rbx, [0x004f6ed0]
call fcn.0044d940
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rbx
call fcn.0047e0c0
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x47def7
lea rdx, [0x004ca8e0]
cmp rax, rdx
jne 0x47dee5
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call fcn.0045f700
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004bb360]
call fcn.0040aea0
inc rdx
cmp rbx, rdx
jle 0x47df41
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x47def4
lea rax, [0x00589b60]
lea rbx, [0x004cc680]
lea rdi, [0x004ca8e0]
nop dword [rax + rax]
call fcn.0046ad60
lea rdx, [0x004ca8e0]
cmp rax, rdx
jne 0x47e06b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x004b5880]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rcx
lea rax, [0x004be800]
call fcn.0040e140
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x0060e860], 0
nop
je 0x47df9b
mov rbx, rax
lea rax, [0x004be800]
call fcn.00412f00
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.00401480
call fcn.0045f7c0
mov rsi, qword [rsp + 0x70]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x47e002
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x47dff4
mov dword [rsi + 0x10], edx
cmp dword [0x0060e860], 0
je 0x47e023
call fcn.00463a40
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x00589b60]
lea rbx, [0x004cc680]
lea rdi, [0x004ca8e0]
nop dword [rax]
call fcn.0046ad60
lea rdx, [0x004ca8e0]
cmp rax, rdx
jne 0x47e05c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004bb360]
call fcn.0040aea0
mov rbx, rdx
lea rcx, [0x004bb360]
call fcn.0040aea0
nop
mov qword [rsp + 8], rax
call fcn.00461b00
mov rax, qword [rsp + 8]
jmp fcn.0047de40
Function at 0x486be0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486caa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403920
xorps xmm15, xmm15
mov r14, qword [0x0060e820]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x486c8f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004b80c0]
xor ebx, ebx
mov rcx, rdx
call fcn.00449b80
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004878e0
inc rbx
cmp rcx, rbx
jae 0x486c7e
mov edi, 1
lea rsi, [0x004b80c0]
call fcn.00449c60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004f85d8]
lea rsi, [0x004f7bc8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461b00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00486be0
Function at 0x401f20
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
push rsi
mov esi, ecx
push rbx
sub rsp, 0x20
call fcn.00401016
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x10]
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x401f68
movzx edx, word [rbx + 0x58]
mov rcx, qword [rbx + 0x60]
call fcn.00402678
cmp eax, esi
jne 0x401f63
mov rax, qword [rbx + 0x30]
jmp 0x401f6a
mov rbx, qword [rbx]
jmp 0x401f47
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x401f72
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x401f8c
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
je 0x401f8c
xor eax, eax
ret

Function at 0x402a80
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x10
jne 0x402a84
mov r10d, 4
lea r11, [0x004035e0]
lea rbx, [0x004034c0]
movzx r9d, byte [rcx + 0xc]
movzx r8d, byte [rcx + 0xd]
movzx edx, byte [rcx + 0xe]
movzx eax, byte [rcx + 0xf]
test r10b, 3
jne 0x402afe
mov sil, byte [r11 + r8]
mov r8b, byte [r11 + rdx]
mov dl, byte [r11 + rax]
mov al, byte [r11 + r9]
mov r9d, r10d
shr r9d, 2
xor sil, byte [rbx + r9]
mov r9d, esi
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r10d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0xc], r9b
mov byte [rcx + 0xd], r8b
mov byte [rcx + 0xe], dl
mov byte [rcx + 0xf], al
cmp r10d, 0x2c
jne 0x402ac8
pop rbx
pop rsi
ret

Function at 0x402b29
Capabilities:
Encode data using xor

Disassembly:
shl rcx, 4
xor eax, eax
and ecx, 0xff0
add r8, rcx
lea r9, [rdx + rax]
xor ecx, ecx
mov r10b, byte [r8 + rcx]
inc rcx
xor byte [r9], r10b
inc r9
cmp rcx, 4
jne 0x402b3e
add rax, 4
add r8, 4
cmp rax, 0x10
jne 0x402b38
ret
Function at 0x402cf0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
mov r11, rcx
mov r8, rdx
push r14
mov r14d, 9
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x98], rdx
mov rdx, rcx
mov ecx, 0xa
call fcn.00402b29
lea rax, [r11 + 4]
mov qword [rsp + 0x28], rax
lea rax, [r11 + 0x10]
mov qword [rsp + 0x30], rax
mov dl, byte [r11 + 9]
mov al, byte [r11 + 0xd]
mov rbx, r11
mov byte [r11 + 0xd], dl
mov dl, byte [r11 + 5]
mov byte [r11 + 9], dl
mov dl, byte [r11 + 1]
mov byte [r11 + 1], al
mov al, byte [r11 + 2]
mov byte [r11 + 5], dl
mov dl, byte [r11 + 0xa]
mov byte [r11 + 0xa], al
mov al, byte [r11 + 6]
mov byte [r11 + 2], dl
mov dl, byte [r11 + 0xe]
mov byte [r11 + 0xe], al
mov al, byte [r11 + 3]
mov byte [r11 + 6], dl
mov dl, byte [r11 + 7]
mov byte [r11 + 3], dl
mov dl, byte [r11 + 0xb]
mov byte [r11 + 7], dl
mov dl, byte [r11 + 0xf]
mov byte [r11 + 0xf], al
mov rax, r11
mov byte [r11 + 0xb], dl
mov rdx, rax
xor ecx, ecx
movzx r8d, byte [rdx]
lea rdi, [0x004034e0]
inc ecx
add rdx, 4
mov r8b, byte [rdi + r8]
mov byte [rdx - 4], r8b
cmp cl, 4
jne 0x402d9e
inc rax
cmp qword [rsp + 0x28], rax
jne 0x402d99
mov r8, qword [rsp + 0x98]
mov rdx, r11
mov ecx, r14d
call fcn.00402b29
test r14d, r14d
je 0x402f33
mov al, byte [rbx]
mov r15b, byte [rbx + 3]
mov byte [rsp + 0x3a], al
mov al, byte [rbx + 1]
movzx ecx, byte [rsp + 0x3a]
mov byte [rsp + 0x3b], al
mov al, byte [rbx + 2]
mov byte [rsp + 0x3c], al
call fcn.00402b60
movzx ecx, al
mov byte [rsp + 0x3d], al
call fcn.00402b60
movzx ecx, al
mov r8d, ecx
call fcn.00402b60
movzx ecx, byte [rsp + 0x3b]
mov edi, eax
call fcn.00402b60
movzx ecx, al
mov r9d, ecx
call fcn.00402b60
movzx ecx, al
mov byte [rsp + 0x3e], al
call fcn.00402b60
movzx ecx, byte [rsp + 0x3c]
mov esi, eax
call fcn.00402b60
movzx ecx, al
mov byte [rsp + 0x3f], cl
call fcn.00402b60
movzx ecx, al
mov r13d, ecx
call fcn.00402b60
movzx ecx, r15b
mov r10d, eax
call fcn.00402b60
movzx ecx, al
mov r12d, ecx
call fcn.00402b60
movzx ecx, al
mov ebp, ecx
call fcn.00402b60
mov dl, byte [rsp + 0x3f]
mov ecx, eax
mov al, byte [rsp + 0x3d]
xor eax, r8d
xor eax, edi
xor eax, r9d
xor eax, esi
xor eax, r13d
xor eax, r10d
xor eax, ecx
xor al, byte [rsp + 0x3b]
xor eax, dword [rsp + 0x3c]
xor eax, r15d
mov byte [rbx], al
mov eax, r9d
xor eax, edi
xor al, byte [rsp + 0x3e]
xor eax, esi
xor eax, edx
xor eax, r10d
xor eax, ebp
xor eax, ecx
xor al, byte [rsp + 0x3a]
xor eax, dword [rsp + 0x3c]
xor eax, r15d
xor r8d, edi
add rbx, 4
xor r8d, esi
mov byte [rbx - 3], al
mov al, byte [rsp + 0x3d]
xor edx, r8d
xor r13d, edx
xor eax, edi
xor r13d, r10d
xor r13d, r12d
xor r13d, ecx
xor r13b, byte [rsp + 0x3a]
xor r13b, byte [rsp + 0x3b]
xor r15d, r13d
mov byte [rbx - 2], r15b
xor al, byte [rsp + 0x3e]
xor esi, eax
xor r10d, esi
xor r12d, r10d
xor ebp, r12d
xor ebp, ecx
xor bpl, byte [rsp + 0x3a]
xor bpl, byte [rsp + 0x3b]
xor ebp, dword [rsp + 0x3c]
mov byte [rbx - 1], bpl
cmp qword [rsp + 0x30], rbx
jne 0x402de2
dec r14d
jmp 0x402d33
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x403024
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r13
push r12
mov r12, r8
push rdi
mov rdi, rdx
push rsi
mov rsi, rcx
push rbx
xor ebx, ebx
and rsp, 0xfffffffffffffff0
sub rsp, 0x20
lea r13, [rdi + rbx]
cmp rbx, r12
jae 0x40307e
mov rdx, rsi
mov rcx, r13
movups xmm0, xmmword [rdi + rbx]
call fcn.00402cf0
xor eax, eax
mov dl, byte [rsi + rax + 0xb0]
xor byte [r13 + rax], dl
inc rax
cmp rax, 0x10
jne 0x40305c
movups xmmword [rsi + 0xb0], xmm0
add rbx, 0x10
jmp 0x403042
lea rsp, [rbp - 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
Function at 0x1400027e0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x140207528]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1400bc980
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x140207528]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140002970
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x14000298c
cmp rcx, r8
jl 0x14000297f
mov qword [rdx + 0x80], rcx
test dword [0x140200aa8], 1
je 0x1400029bb
cmp byte [rsp + 0xd0], 0
je 0x1400029bb
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1400024e0
mov rsp, r8
jmp rax
Function at 0x1400029c0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x140207528]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x10
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + pe_nt_image_headers64]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret