joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003c6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18006add0]
mov rcx, qword [rax + 0x4de8]
mov r9, qword [rax + 0x4008]
movups xmm0, xmmword [r9 + 0x248]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x248], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2a8]
add rsp, 0x38
jmp fcn.180037860

Function at 0x18003c790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18006add0]
mov rcx, qword [rax + 0x4de8]
mov r10, qword [rax + 0x4008]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2a8]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x248], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2a8]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.180037860
Function at 0x18004f9d0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x18006a040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x18006add0]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x18004fbee
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x18004fbee
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x18006add0]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x18004faa4
movsx rdx, word [r8 + 0x60a8]
lea rax, [r8 + 0x60ac]
mov r9d, dword [r8 + 0x3f60]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x18004fa99
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60a8], cx
movsx rax, cx
lea rax, [rax*8 + 0x60ac]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60a0]
test rdi, rdi
je 0x18004fac1
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x18004fac4
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x18004fb07
mov rsi, qword [r8 + 0x90]
jmp 0x18004fb0a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x18004fb35
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x18006add0]
mov rcx, qword [rax + 0x4b00]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, [0x1800623c0]
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x18004fbae
inc rbx
cmp rbx, 5
jl 0x18004fb90
jmp 0x18004fbda
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x18004fbf0
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800595a0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x180052150
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
je 0x180052160
xor eax, eax
add rsp, 0x38
ret
xor eax, eax
lea r8, [0x1800520d0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180057980
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x180057a5b
nop dword [rax]
cmp rbx, qword [section..data]
jb 0x1800579ce
cmp rbx, qword [0x18006a008]
ja 0x1800579ce
sub rbx, 0x8000000
jmp 0x180057a52
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180057a5b
cmp dword [rsp + 0x40], 0x10000
jne 0x180057a36
cmp qword [rsp + 0x38], 0x10000
jb 0x180057a36
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180057a5d
sub rbx, 0x10000
jmp 0x180057a52
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x1800579b0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180057a70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x180057a92
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x180057b4d
nop dword [rax + rax]
cmp rbx, qword [section..data]
jb 0x180057abe
cmp rbx, qword [0x18006a008]
ja 0x180057abe
add rbx, 0x8000000
jmp 0x180057b44
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180057b4d
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x180057b29
cmp rcx, 0x10000
jb 0x180057b29
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180057b4f
add rbx, 0x10000
jmp 0x180057b44
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x180057b44
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x180057aa0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180057b60
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x180057b82
mov edi, 0x80000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x180057b9e
mov rsi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x180057bb5
cmp byte [rcx + 1], 0x25
jne 0x180057bf9
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x180057bc1
cmp al, 0xe9
jne 0x180057bf9
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, rbx
cmp rcx, rbx
jae 0x180057be4
cmp rcx, 0xffffffff80000000
jae 0x180057bdb
lea rsi, [rcx + 0x7ff80000]
jmp 0x180057bf9
mov rsi, 0xfffffffffff80000
jmp 0x180057bf9
lea rdi, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x180057bf9
mov edi, 0x80000
mov rdx, qword [0x18006a748]
mov rax, qword [0x18006a740]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x180057c20
test rax, rax
je 0x180057c37
mov rdx, rax
mov qword [0x18006a748], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x180057c37
cmp rcx, rdi
jb 0x180057c37
cmp rcx, rsi
jbe 0x180057d8a
mov qword [0x18006a748], rax
mov rdx, rax
test rax, rax
je 0x180057c82
mov rcx, rax
nop dword [rax]
test rax, rax
je 0x180057c6c
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x180057c6c
cmp rax, rdi
jb 0x180057c6c
cmp rax, rsi
jbe 0x180057d8a
mov rdx, qword [rdx + 8]
mov qword [0x18006a748], rdx
mov rcx, rdx
mov rax, rdx
test rdx, rdx
jne 0x180057c50
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x180057cac
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.180057980
mov rdx, rax
test rax, rax
jne 0x180057d38
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x180057cd2
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.180057a70
mov rdx, rax
test rax, rax
jne 0x180057d38
cmp rbx, 0x40000000
jbe 0x180057cf2
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.180057a70
mov rdx, rax
test rax, rax
jne 0x180057d38
cmp rbx, rbp
jae 0x180057d0e
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.180057980
mov rdx, rax
test rax, rax
jne 0x180057d38
mov rdx, rbx
mov rcx, rdi
call fcn.180057980
mov rdx, rax
test rax, rax
jne 0x180057d38
mov rdx, rsi
mov rcx, rbx
call fcn.180057a70
mov rdx, rax
test rax, rax
je 0x180057dc1
mov dword [rdx], 0x52727464
lea rcx, [rdx + 0xffa8]
xor r8d, r8d
mov qword [0x18006a748], rdx
mov qword [rdx + 0x10], r8
mov r9d, 0x2a7
mov rax, qword [0x18006a740]
mov qword [rdx + 8], rax
lea rax, [rdx + 0xff60]
mov qword [0x18006a740], rdx
mov qword [rcx], r8
lea rcx, [rcx - 0x60]
mov r8, rax
sub rax, 0x60
sub r9, 1
jne 0x180057d72
mov qword [rdx + 0x10], r8
mov rax, qword [rdx + 0x10]
cmp rax, rdi
jb 0x180057dc1
cmp rax, rsi
ja 0x180057dc1
mov rcx, qword [rax + 0x48]
movdqa xmm0, xmmword [0x18005b580]
mov qword [rdx + 0x10], rcx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
jmp 0x180057dc3
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180058020
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x18005804e
xor al, al
jmp 0x180058090
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x18005805f
xor al, al
jmp 0x180058090
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x180058086
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x180058086
mov al, 1
jmp 0x180058090
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x180058570
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rsi
sub rsp, 0x28
mov rbp, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x18006a758], eax
je 0x180058597
mov eax, 0x10dd
add rsp, 0x28
pop rsi
pop rbp
ret
mov eax, dword [0x18006a75c]
test eax, eax
jne 0x1800586d3
test rbp, rbp
jne 0x1800585b4
lea eax, [rbp + 0x57]
add rsp, 0x28
pop rsi
pop rbp
ret
test rsi, rsi
je 0x1800585d0
cmp qword [rsi], 0
jne 0x1800585dc
mov dword [0x18006a75c], 6
mov qword [0x18006a760], rsi
mov eax, 6
add rsp, 0x28
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rbx
mov ecx, 0x30
mov qword [rsp + 0x20], rdi
call fcn.1800595c0
mov rdi, rax
test rax, rax
jne 0x180058600
lea ebx, [rax + 8]
jmp 0x1800586a8
mov rcx, qword [rsi]
xor edx, edx
call fcn.1800584c0
xor edx, edx
mov rcx, rbp
mov rbx, rax
call fcn.1800584c0
movzx edx, byte [rbx + 0x3e]
mov rbp, qword [rbx + 0x48]
sub rbp, rdx
test dl, dl
je 0x18005869a
cmp rdx, 0x1e
ja 0x18005869a
cmp qword [rbx + 0x50], rax
jne 0x18005869a
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0
mov r8d, 0x40
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18005865c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1800586a8
mov qword [rdi + 0x20], rbx
mov rbx, qword [rsp + 0x40]
mov dword [rdi + 8], 1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rbp
mov eax, dword [rsp + 0x50]
mov dword [rdi + 0x28], eax
mov rax, qword [0x18006a770]
mov qword [rdi], rax
xor eax, eax
mov qword [0x18006a770], rdi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbp
ret
cmp dword [0x18006a750], 0
mov ebx, 9
jne 0x1800586b3
mov dword [0x18006a75c], ebx
test rdi, rdi
je 0x1800586c0
mov edx, 0x30
mov rcx, rdi
call fcn.180059604
mov rdi, qword [rsp + 0x20]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov qword [0x18006a760], rsi
add rsp, 0x28
pop rsi
pop rbp
ret

Function at 0x1800586e0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x18006a758], 0
jne 0x180058787
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x18006a758], ecx
jne 0x180058787
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x18006a740]
mov qword [rsp + 0x20], rdi
xor edi, edi
mov qword [0x18006a770], rdi
mov qword [0x18006a768], rdi
mov qword [0x18006a760], rdi
test rbx, rbx
je 0x180058770
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180058768
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180058740
jmp 0x180058770
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov dword [0x18006a75c], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x10dd
add rsp, 0x28
ret
Function at 0x180058da0
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x18006a75c]
mov rdi, rcx
test eax, eax
jne 0x180058e43
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x180058dca
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.1800595c0
mov rbx, rax
test rax, rax
jne 0x180058de6
lea edi, [rax + 8]
jmp 0x180058e09
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180058e27
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.180059604
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x18006a75c], edi
mov qword [0x18006a760], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x18006a768]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x18006a768], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800c6ddd
Capabilities:
Encode data using base64

Disassembly:
neg bp
mov r11, qword [rsp + rsi - 0x45277a4a]
movsxd r10, r10d
sub edx, dword [rsp + rsi - 0x45277a52]
jae 0x1800cd6f5
add rbx, r10
xchg qword [rsp + rcx - 0x45277a7f], rbp
mov r10, qword [rax + r9]
mov bpl, byte ss:[r10 + rsi - 0x45277a52]
lea r9, [rsi + r9 - 0x45277a4c]
mov qword [rsp + rcx - 0x45277a77], 0x1620848f
call fcn.1800cff00
neg r8d
not ebp
mov qword [rsp + rsi - 0xf03f870], r8
ror cx, 0xcc
inc rax
inc ebp
neg ebp
xor al, 0x31
mov r10d, r8d
shl r8d, 0x3f
xor ebp, 0x60a9478a
dec al
not ebp
call fcn.1800a5f47
mov rax, qword [rdx + r9 - 0x1eb8751b]
mov rcx, qword [r9 + rdx - 0x1eb87513]
call fcn.1800a598e
xor r11b, r10b
ror esi, 0x45
jb 0x1800c95c2
mov word [rbp + r10 - 0x660923a8], cx
je 0x1800aae82
sal byte [rsp + rbp - 0x6609239e], 0x21
rol rsi, 0x29
mov qword [rsp + r8 + 0x22e69ad0], rbx
ret 0x10
xor ebp, 0xc4a02799
lea r10, [rsp + r10 + 0x18]
adc dword [rsp + rbp - 0x6609239c], 0xbf990d30
jp 0x1800c9017
lea r9, [rdx + r9 - 0x4d]
or qword [rsp + rdx*2 - 0x9e], 0x4bad05a6
movzx esi, word [rdx + rdi - 0x4f]
lea rdi, [rdi + rdx - 0x4d]
sub dword [rsp + rdx*8 - 0x275], edx
movzx r8d, dl
xor si, r11w
call fcn.1800b94b1
Function at 0x140013558
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
or r8d, 0xffffffff
mov r10d, edx
xor r9d, r9d
mov r11, rcx
test edx, edx
je 0x14001358e
movzx edx, byte [r11 + r9]
mov eax, r8d
xor rdx, rax
shr r8d, 8
movzx ecx, dl
lea rax, [0x14016e880]
inc r9
xor r8d, dword [rax + rcx*4]
cmp r9, r10
jb 0x140013569
not r8d
mov eax, r8d
ret
Function at 0x140015bec
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
mov rax, qword [0x140230040]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x120
lea rcx, [rsp + 0x20]
call fcn.14013a51c
mov ecx, 0x2000000
call fcn.140017070
mov r14d, 4
test eax, eax
je 0x140015c55
mov rcx, rsi
shr rcx, 2
and ecx, 3
je 0x140015c55
mov eax, r14d
sub eax, ecx
jmp 0x140015c57
xor eax, eax
mov qword [rsi + 8], rax
lea rcx, [rsp + 0x20]
add rax, r14
mov r8d, edi
mov rdx, rbp
lea rbx, [rsi + rax*4]
call fcn.140015898
mov r11d, eax
test eax, eax
jne 0x140015db5
mov edx, dword [rsp + 0x20]
mov ecx, 0x2000000
mov dword [rsi], edx
call fcn.140017070
test eax, eax
je 0x140015cd2
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
lea rdx, [rdx + rcx*4]
movsxd rcx, dword [rsi]
shl rcx, 4
add rcx, rdx
movdqu xmm0, xmmword [rcx]
jmp 0x140015cb4
aesimc xmm0, xmmword [rcx]
movdqu xmmword [rbx], xmm0
sub rcx, 0x10
add rbx, 0x10
cmp rcx, rdx
ja 0x140015caf
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rbx], xmm0
jmp 0x140015db5
mov eax, dword [rsp + 0x20]
lea rdi, [rsp + 0x30]
shl eax, 2
movsxd rcx, eax
add rcx, qword [rsp + 0x28]
lea rdi, [rdi + rcx*4]
mov eax, dword [rdi]
add rdi, r14
mov dword [rbx], eax
add rbx, r14
mov eax, dword [rdi]
add rdi, r14
mov dword [rbx], eax
add rbx, r14
mov eax, dword [rdi]
add rdi, r14
mov dword [rbx], eax
add rbx, r14
mov eax, dword [rdi]
sub rdi, 0x1c
mov dword [rbx], eax
add rbx, r14
mov r8d, dword [rsi]
dec r8d
test r8d, r8d
jle 0x140015d95
lea r10, sym.MZ__EK3tihnfyn:sdGOhulW__sGsI7___x_T_.HuMBYZm
mov r9, r14
movzx eax, byte [rdi + 3]
movzx edx, byte [rax + r10 + 0x24c850]
movzx eax, byte [rdi + 2]
mov edx, dword [r10 + rdx*4 + 0x24c950]
movzx ecx, byte [rax + r10 + 0x24c850]
movzx eax, byte [rdi + 1]
xor edx, dword [r10 + rcx*4 + 0x24e680]
movzx ecx, byte [rax + r10 + 0x24c850]
movzx eax, byte [rdi]
add rdi, r14
xor edx, dword [r10 + rcx*4 + 0x24d680]
movzx ecx, byte [rax + r10 + 0x24c850]
xor edx, dword [r10 + rcx*4 + 0x24da80]
mov dword [rbx], edx
add rbx, r14
sub r9, 1
jne 0x140015d28
dec r8d
sub rdi, 0x20
test r8d, r8d
jg 0x140015d25
mov eax, dword [rdi]
mov dword [rbx], eax
add rbx, r14
add rdi, r14
mov eax, dword [rdi]
mov dword [rbx], eax
mov eax, dword [rdi + r14]
mov dword [rbx + r14], eax
mov eax, dword [rdi + r14 + 4]
mov dword [rbx + r14 + 4], eax
xor eax, eax
lea rdi, [rsp + 0x20]
mov ecx, 0x120
rep stosb byte [rdi], al
mov eax, r11d
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140138940
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140016930
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r9
mov rbp, r8
mov esi, edx
mov rbx, rcx
cmp edx, 1
jbe 0x140016963
mov eax, 0xffffffdf
jmp 0x140016a33
mov ecx, 0x2000000
call fcn.140017070
test eax, eax
je 0x140016986
mov rcx, rbx
shr rcx, 2
and ecx, 3
je 0x140016986
mov eax, 4
sub eax, ecx
jmp 0x140016988
xor eax, eax
mov rdx, qword [rbx + 8]
mov r14d, eax
cmp r14, rdx
je 0x1400169b7
mov eax, dword [rbx]
lea rcx, [rbx + 0x10]
add rdx, 4
lea rcx, [rcx + r14*4]
inc eax
shl eax, 4
movsxd r8, eax
lea rdx, [rbx + rdx*4]
call fcn.14013a528
mov qword [rbx + 8], r14
mov ecx, 0x2000000
call fcn.140017070
test eax, eax
je 0x140016a19
mov rax, qword [rbx + 8]
movups xmm0, xmmword [rbp]
lea rcx, [rbx + rax*4]
mov eax, dword [rbx]
xorps xmm0, xmmword [rcx + 0x10]
dec eax
add rcx, 0x20
test esi, esi
jne 0x1400169fa
test eax, eax
je 0x1400169f3
aesdec xmm0, xmmword [rcx]
add rcx, 0x10
add eax, 0xffffffff
jne 0x1400169e5
aesdeclast xmm0, xmmword [rcx]
jmp 0x140016a11
test eax, eax
je 0x140016a0c
aesenc xmm0, xmmword [rcx]
add rcx, 0x10
add eax, 0xffffffff
jne 0x1400169fe
aesenclast xmm0, xmmword [rcx]
movdqu xmmword [rdi], xmm0
xor eax, eax
jmp 0x140016a33
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
cmp esi, 1
jne 0x140016a2e
call fcn.140015ed0
jmp 0x140016a33
call fcn.140016400
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140017240
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rdx]
movdqa xmm1, xmm0
movdqu xmmword [rcx], xmm0
aeskeygenassist xmm0, xmm0, 1
pshufd xmm3, xmm0, 0xff
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x10], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x20], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x30], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x40], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x50], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x60], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
movdqa xmm3, xmm2
xorps xmm0, xmm1
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x70], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x80], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x90], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm1, xmm3
xorps xmm1, xmm0
pslldq xmm3, 4
xorps xmm1, xmm3
movdqu xmmword [rcx + 0xa0], xmm1
ret