joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
jbe 0x451bb9
mov rdx, qword [rsp + 0x20]
movzx ebx, byte [rdx]
test ebx, ebx
jne 0x451a36
movzx esi, byte [rsp + 0x48]
test sil, sil
je 0x451b67
bt ebx, 7
nop word [rax + rax]
jae 0x451b59
xor eax, eax
xor ebx, ebx
xor esi, esi
jmp 0x451a60
lea esi, [rcx + 7]
mov rcx, rax
mov eax, r8d
nop word [rax + rax]
cmp rcx, rax
jbe 0x451bb4
movzx edi, byte [rax + rdx]
lea r8d, [rax + 1]
mov r9d, edi
and edi, 0x7f
mov rax, rcx
mov ecx, esi
shl edi, cl
or ebx, edi
test r9b, 0x80
jne 0x451a4e
mov esi, ebx
and ebx, 1
neg ebx
shr esi, 1
xor ebx, esi
mov rsi, qword [rsp + 0x40]
add dword [rsi], ebx
nop dword [rax + rax]
cmp rax, r8
jb 0x451ba9
sub rax, r8
mov rbx, qword [rsp + 0x30]
sub rbx, r8
mov rsi, rbx
neg rbx
sar rbx, 0x3f
and r8, rbx
lea rbx, [rdx + r8]
test rax, rax
jbe 0x451b9f
movzx edx, byte [rdx + r8]
bt edx, 7
jae 0x451b51
xor ecx, ecx
xor edx, edx
xor edi, edi
nop
jmp 0x451ae8
lea edi, [rcx + 7]
mov ecx, r9d
cmp rax, rcx
jbe 0x451b92
movzx r8d, byte [rcx + rbx]
lea r9d, [rcx + 1]
mov r10d, r8d
and r8d, 0x7f
mov ecx, edi
shl r8d, cl
or edx, r8d
test r10b, 0x80
jne 0x451ae2
cmp rax, r9
jb 0x451b87
mov rcx, qword [rsp + 0x38]
add qword [rcx], rdx
sub rsi, r9
mov rcx, rsi
neg rsi
sar rsi, 0x3f
and rsi, r9
lea rdx, [rbx + rsi]
mov qword [rsp + 0x50], rdx
sub rax, r9
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov byte [rsp + 0x68], 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov r9d, 1
jmp 0x451b0f
mov rax, rcx
mov r8d, 1
jmp 0x451a86
mov qword [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x68], 0
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rax
mov eax, r9d
call fcn.00467160
mov rdx, rax
mov eax, ecx
mov rcx, rdx
call fcn.004670a0
mov rcx, rax
xor eax, eax
call fcn.004670a0
mov rcx, rax
mov eax, r8d
call fcn.00467160
call fcn.004670a0
xor eax, eax
nop dword [rax + rax]
call fcn.004670a0
nop
int3

Function at 0x458dc0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x458ea1
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00460c80]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00464d80
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
nop
ret
call fcn.00464ee0
jmp fcn.00458dc0
Function at 0x466ac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x402d60
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rax
call fcn.00409e20
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.00464ee0
jmp 0x402d00
cmp byte [0x005c5a55], 0
je 0x466adf
mov rax, qword [rsp + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
lea rdx, [rsp + 0x18]
jmp 0x463f00
jmp 0x402d00

Function at 0x466b00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x005c5ce0]
nop
mov rcx, qword [rsp + 8]
mov ecx, dword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*4]
xor rax, rcx
shl rcx, 0x20
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rcx, rax
movabs rax, 0x83cf8eadf876d2d7
imul rax, rcx
mov rcx, rax
shr rax, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x005c5a55], 0
je 0x466b3c
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005c5f60]
aesenc xmm0, xmmword [0x005c5f70]
aesenc xmm0, xmmword [0x005c5f80]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a0a0

Function at 0x466b60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [0x005c5ce0]
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
mov rdx, qword [rsp + 0x10]
lea rax, [rdx + rax*8]
xor rcx, rax
movabs rax, 0xea38ec9079f01541
imul rax, rcx
rol rax, 0x1f
movabs rcx, 0x2723a30d96da1399
imul rcx, rax
mov rax, rcx
shr rcx, 0x1d
xor rax, rcx
movabs rcx, 0x83cf8eadf876d2d7
imul rcx, rax
mov rax, rcx
shr rcx, 0x20
xor rax, rcx
mov qword [rsp + 0x18], rax
ret
cmp byte [0x005c5a55], 0
je 0x466b9d
mov rax, qword [rsp + 8]
movq xmm0, qword [rsp + 0x10]
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005c5f60]
aesenc xmm0, xmmword [0x005c5f70]
aesenc xmm0, xmmword [0x005c5f80]
movq qword [rsp + 0x18], xmm0
ret
jmp 0x40a120

Function at 0x4683c0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005c5ee0]
mov qword [rsp + 8], rdx
lea r8d, [0x005c5a6c]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
add rsp, 0x30
ret

Function at 0x4a4800
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x4a4821
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rcx, rbx
jg 0x4a4812
mov dword [rsp + 0x28], edx
ret
Function at 0x4ae620
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4ae68b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4ae644
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4ae661
cmp rdx, 0
je 0x4ae6ad
test rdx, 0xf
je 0x4ae63d
test rdx, 7
jne 0x4ae661
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4ae63d
ret
Function at 0x4b0120
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4b015f
jb 0x4b0174
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x4b01e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4b021f
jb 0x4b0234
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4b02a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4b0370
jb 0x4b03cf
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004b00c0
aeskeygenassist xmm1, xmm0, 1
call fcn.004b00e0
aeskeygenassist xmm1, xmm2, 2
call fcn.004b00c0
aeskeygenassist xmm1, xmm0, 2
call fcn.004b00e0
aeskeygenassist xmm1, xmm2, 4
call fcn.004b00c0
aeskeygenassist xmm1, xmm0, 4
call fcn.004b00e0
aeskeygenassist xmm1, xmm2, 8
call fcn.004b00c0
aeskeygenassist xmm1, xmm0, 8
call fcn.004b00e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004b00c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004b00e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004b00c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004b00e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004b00c0
jmp 0x4b043d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004b0020
aeskeygenassist xmm1, xmm2, 2
call fcn.004b0080
aeskeygenassist xmm1, xmm2, 4
call fcn.004b0020
aeskeygenassist xmm1, xmm2, 8
call fcn.004b0080
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004b0020
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004b0080
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004b0020
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004b0080
jmp 0x4b043d
aeskeygenassist xmm1, xmm0, 1
call fcn.004affe0
aeskeygenassist xmm1, xmm0, 2
call fcn.004affe0
aeskeygenassist xmm1, xmm0, 4
call fcn.004affe0
aeskeygenassist xmm1, xmm0, 8
call fcn.004affe0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004affe0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004affe0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004affe0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004affe0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004affe0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004affe0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4b044a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x140032f7e
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx + 0xa0]
mov rax, qword [rdx + 0xa0]
cmp r8, rax
cmova rax, r8
cmp rax, 0x29
jae 0x140032fec
test rax, rax
je 0x140032fe1
mov r9b, 1
xor r8d, r8d
mov r10d, dword [rdx + r8*4]
not r10d
add r10d, dword [rcx + r8*4]
setb r11b
movzx r9d, r9b
and r9d, 1
add r9d, r10d
mov dword [rcx + r8*4], r9d
lea r10, [r8 + 1]
not r11b
setae r9b
and r9b, r11b
xor r9b, 1
mov r8, r10
cmp rax, r10
jne 0x140032fa4
test r9b, r9b
je 0x140032fec
mov qword [rcx + 0xa0], rax
mov rax, rcx
ret
ud2
Function at 0x14003708c
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rbx, r9
mov rsi, rcx
mov r14, qword [rsp + 0xa0]
mov r10d, 1
xor r12d, r12d
xor eax, eax
mov r9d, 1
xor r15d, r15d
mov ecx, 1
mov rdi, r15
and rdi, rax
mov r11, r15
or r11, rax
add r11, rdi
cmp r11, r14
jae 0x1400373bf
mov r11b, byte [rbx + r11]
cmp byte [rbx + r10], r11b
jae 0x140037102
inc r9
mov rcx, r9
and rcx, r15
or r9, r15
add r9, rcx
mov rcx, r9
sub rcx, rax
xor r15d, r15d
mov r11, r9
jmp 0x14003713a
jne 0x14003712b
mov r10d, r15d
and r10d, 1
or r15, 1
add r15, r10
cmp r15, rcx
mov r10, r15
cmove r10, r12
cmovne r15, r12
mov r11, r15
add r11, r9
mov r15, r10
jmp 0x14003713a
lea r11, [r9 + 1]
mov ecx, 1
xor r15d, r15d
mov rax, r9
lea r10, [r11 + r15]
mov r9, r11
cmp r10, r14
jb 0x1400370c3
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
movabs rdx, 0xebd468d28862ae2d
movabs r8, 0xc3ef81b9107e6a3b
movabs r9, 0x4557a14111054af5
mov ebp, 1
xor r10d, r10d
xor r12d, r12d
mov r11d, 1
xor r15d, r15d
mov r13d, 1
lea rdi, [r12 + r15]
cmp rdi, r14
jae 0x1400373bf
mov dil, byte [rbx + rdi]
cmp byte [rbx + rbp], dil
jbe 0x1400371c1
add r11, r9
add r11, r15
sub r11, r9
lea r13, [r11 + r8]
inc r13
inc r11
sub r13, r12
sub r13, r8
xor r15d, r15d
jmp 0x1400371e4
jne 0x1400371e9
mov edi, r15d
and edi, 1
or r15, 1
add r15, rdi
cmp r15, r13
mov rdi, r15
cmove rdi, r10
cmovne r15, r10
add r11, r15
mov r15, rdi
mov rdi, r11
jmp 0x140037206
mov edi, r11d
and edi, 1
mov r15, r11
xor r15, 1
lea rdi, [r15 + rdi*2]
mov r13d, 1
xor r15d, r15d
mov r12, r11
mov rbp, rdi
sub rbp, rdx
add rbp, r15
add rbp, rdx
mov r11, rdi
cmp rbp, r14
jb 0x14003718c
cmp rax, r12
cmova r13, rcx
cmova r12, rax
cmova esp, eax
cmp r14, r12
jb 0x1400373bf
lea rax, [r12 + r13]
cmp rax, r13
jb 0x1400373bf
cmp rax, r14
ja 0x1400373bf
ja 0x140037247
add byte [rax], al
lea rdx, [rbx + r13]
mov rcx, rbx
mov r8, r12
call fcn.140070a90
test eax, eax
je 0x1400372bf
movabs rax, 0xb402b90208c8be56
lea rdx, [r14 + rax]
sub rdx, r12
sub rdx, rax
xor r8d, r8d
sal byte [rcx], 0xc0
mov cl, byte [rbx + r8]
mov r9d, 1
shl r9, cl
mov rcx, rax
and rcx, r9
add rax, r9
sub rax, rcx
inc r8
cmp r14, r8
jne 0x140037274
cmp r12, rdx
cmova rdx, r12
mov ecx, edx
and ecx, 1
xor rdx, 1
lea r13, [rdx + rcx*2]
mov rdi, 0xffffffffffffffff
mov rcx, 0xffffffffffffffff
mov rdx, r12
jmp 0x140037369
xor edi, edi
mov rcx, rbx
mov rdx, r14
mov r8, r13
xor r9d, r9d
call fcn.1400373c1
mov rbp, rax
mov rcx, rbx
mov rdx, r14
mov r8, r13
mov r9b, 1
call fcn.1400373c1
cmp rbp, rax
cmova rax, rbp
mov rdx, r14
sub rdx, rax
test r13, r13
je case.0x140008453.252
movabs r15, 0xdedf4066cac65c24
mov r9, r15
stc
not r9
xor eax, eax
rol byte [rbp + 0x31], 0xd2
ud2
Function at 0x140039ccb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
test r8, r8
je 0x140039d45
mov rax, qword [rsp + 0x50]
mov r10d, ecx
shr r10d, 8
lea r8, [rdx + r8*2]
movabs r11, 0x5ba6ae379c07c655
xor esi, esi
mov r14, rdx
movzx ebx, byte [rdx + 1]
add rdx, 2
mov rdi, rsi
sub rdi, r11
add rdi, r11
add rdi, rbx
cmp byte [r14], r10b
jne 0x140039d3b
cmp rdi, rsi
jb 0x140039db4
cmp rdi, rax
ja 0x140039db4
add rsi, r9
xor r14d, r14d
cmp rbx, r14
je 0x140039d3d
lea r15, [r14 + 1]
cmp byte [rsi + r14], cl
mov r14, r15
jne 0x140039d27
jmp 0x140039da4
ja 0x140039d45
mov rsi, rdi
cmp rdx, r8
jne 0x140039cf3
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140039da8
mov r8, qword [rsp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140039d6e
mov r8, r10
jmp 0x140039d87
cmp r10, rdx
je 0x140039db4
and r9d, 0x7f
shl r9d, 8
movzx r10d, byte [r8 + 1]
add r8, 2
or r9d, r10d
mov r10d, ecx
not r10d
and r10d, r9d
not r9d
and ecx, r9d
sub ecx, r10d
js 0x140039daa
xor al, 1
cmp r8, rdx
jne 0x140039d5c
jmp 0x140039daa
xor eax, eax
jmp 0x140039daa
mov al, 1
and al, 1
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
ud2

Function at 0x14003b3a9
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
movabs r9, 0x4e2723f2c784df55
mov edx, ecx
shl edx, 0xb
mov r10d, 0x16
xor eax, eax
lea r8, [0x14007db08]
mov r11, rax
mov rsi, r10
shr rsi, 1
mov rax, rsi
and rax, r11
mov rdi, rsi
xor rdi, r11
lea rax, [rdi + rax*2]
mov edi, dword [r8 + rax*4]
shl edi, 0xb
cmp edi, edx
cmova rax, r11
sub r10, r9
sub r10, rsi
add r10, r9
cmp r10, 1
ja 0x14003b3c9
mov r10d, dword [r8 + rax*4]
shl r10d, 0xb
xor r9d, r9d
cmp r10d, edx
sete r9b
adc rax, 0
movabs rdx, 0x7ac3bf1debc2be84
sub rax, rdx
add r9, rdx
add r9, rax
cmp r9, 0x15
ja 0x14003b4dd
mov eax, dword [r8 + r9*4]
shr eax, 0x15
mov edx, 0x13b
cmp r9, 0x15
je 0x14003b454
mov edx, dword [r8 + r9*4 + 4]
shr edx, 0x15
test r9, r9
je 0x14003b4d8
mov r9d, dword [r8 + r9*4 - 4]
mov r8d, r9d
xor r8d, 0xffe00000
and r8d, r9d
mov r9, rax
not r9
mov r10d, r9d
and r10d, edx
or r9, rdx
add r9, r10
je 0x14003b4c8
mov r10d, ecx
not r10d
and r10d, r8d
not r8d
and r8d, ecx
sub r8d, r10d
dec rdx
xor ecx, ecx
lea r10, [0x14007db60]
xor r11d, r11d
cmp rax, 0x13a
ja 0x14003b4dd
movzx esi, byte [rax + r10]
add ecx, esi
cmp ecx, r8d
ja 0x14003b4c8
mov esi, r11d
and esi, 1
xor r11, 1
lea r11, [r11 + rsi*2]
inc rax
cmp r11, r9
jne 0x14003b49b
mov rax, rdx
mov rcx, rax
xor rcx, 0xfffffffffffffffe
test rcx, rax
setne al
pop rdi
pop rsi
ret
xor r8d, r8d
jmp 0x14003b466
ud2
Function at 0x14003b61b
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
mov eax, dword [rcx + 0x50]
mov ecx, dword [rcx + 0x54]
lea edx, [r8*8]
lea r8d, [rax + r8*8]
mov dword [rbx + 0x50], r8d
xor r9d, r9d
cmp r8d, edx
setb r9b
mov edx, ecx
and edx, r9d
xor ecx, r9d
lea ecx, [rcx + rdx*2]
mov edx, esi
shr edx, 0x1d
add edx, ecx
mov dword [rbx + 0x54], edx
test rsi, rsi
je 0x14003b77c
lea r14, [rbx + 0x40]
add rsi, rdi
movabs r12, 0x9eabfbb26c09caf2
shr eax, 3
and eax, 0x3f
lea r15, [rsp + 0x20]
mov cl, byte [rdi]
mov byte [rbx + rax], cl
inc rax
cmp rax, 0x40
jne 0x14003b770
mov rax, 0xffffffffffffffff
xor ecx, ecx
xor edx, edx
mov r8, r12
not r8
mov r9, rax
and r9, r12
mov r10, rcx
and r10, r8
or r10, r9
mov r9, r12
and r9, 0xfffffffffffffffc
mov r11d, r8d
and r11d, 3
or r11, r9
xor r11, r10
mov r9d, eax
not r9d
or r8d, r12d
and r8d, r9d
and r8d, 3
or r8, r11
inc rdx
mov r9, rcx
or r9, 1
movzx r8d, byte [rbx + r8]
shl r8d, 0x18
mov r10, rcx
and r10, 0xfffffffffffffffd
mov r11, rcx
xor r11, 2
sub r11, r10
lea r10, [rbx + rcx]
movzx r10d, byte [r11 + r10]
shl r10d, 0x10
not r10d
not r8d
and r8d, r10d
not r8d
movzx r9d, byte [rbx + r9]
shl r9d, 8
or r9d, r8d
movzx r8d, byte [rbx + rcx]
or r8d, r9d
mov dword [rsp + rcx + 0x20], r8d
add rcx, 4
add rax, 0xfffffffffffffffc
cmp rcx, 0x40
jne 0x14003b6bf
mov rcx, r14
mov rdx, r15
call fcn.14003b78a
xor eax, eax
inc rdi
cmp rdi, rsi
jne 0x14003b6a2
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140040a9c
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov rsi, rcx
movabs rdi, 0x8000000000000000
lea rbx, [rsp + 0x78]
mov rcx, rbx
call fcn.140040cca
mov rax, qword [rbx]
mov rbp, qword [rbx + 8]
cmp rax, rdi
jne 0x140040ae5
mov rcx, rbp
call fcn.140040de6
mov qword [rsi], rdi
jmp 0x140040cb3
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rsi
xor edi, edi
lea rax, [rsp + 0x60]
mov qword [rax], rdi
mov qword [rax + 8], 2
mov qword [rax + 0x10], rdi
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
mov ebx, 0xffffffff
xor r14d, r14d
cmp r8, 0x201
jae 0x140040b35
lea r12, [rsp + 0x78]
mov esi, 0x200
mov r13, r8
jmp 0x140040b6c
sub r8, r14
lea rcx, [rsp + 0x60]
mov rdx, r8
call fcn.14004bf46
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
cmp rdi, rbx
mov r14d, 0xffffffff
cmovb r14, rdi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x28], r12
mov rsi, r14
mov r13, r14
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov r15, rbp
mov rcx, rbp
mov rdx, r12
mov r8d, r13d
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov ebp, eax
test eax, eax
jne 0x140040b9a
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140040c31
mov r8d, ebp
cmp r13, r8
jne 0x140040bd0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140040cc8
mov rbp, r15
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
mov ebx, 0xffffffff
cmovae r13, rax
mov r8, r13
jmp 0x140040b1d
mov rbp, r15
jb 0x140040b1d
cmp rsi, r8
jb 0x140040cc8
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.14004afe7
test rdi, rdi
mov rsi, qword [rsp + 0x38]
movabs r14, 0x8000000000000000
je 0x140040c17
mov rcx, qword [0x14008fb30]
xor edx, edx
mov r8, qword [rsp + 0x28]
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x40], r14
je 0x140040c8a
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
jmp 0x140040c97
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
movabs rcx, 0x5110e51b14eed08e
mov rdx, 0xfffffffffffffffd
and rdx, rcx
xor rdx, rcx
xor rdx, rax
mov qword [rsp + 0x48], rdx
movabs r14, 0x8000000000000000
mov qword [rsp + 0x40], r14
test rdi, rdi
je 0x140040c82
mov rcx, qword [0x14008fb30]
xor edx, edx
mov r8, qword [rsp + 0x28]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbp, r15
mov rsi, qword [rsp + 0x38]
mov qword [rsi], r14
mov rcx, qword [rsp + 0x48]
call fcn.140040de6
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140040cb3
mov rcx, qword [0x14008fb30]
xor edx, edx
mov r8, rbp
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x14004149c
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov eax, 0x7fffffff
invalid
invalid
jg 0x1400414ef
cmp eax, eax
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
add byte [rbx + 0x774fff8], al
movsxd rdx, eax
xor eax, eax
jmp case.0x140040251.461
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
movabs rcx, 0xc1db04167cfce368
lea rdx, [rcx + 2]
xor rdx, rcx
xor rdx, rax
mov eax, 1
add rsp, 0x28
ret
Function at 0x140045a34
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
movabs rbx, 0x8000000000000000
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.140045ac2
mov r14, qword [rdi]
mov rdi, qword [rdi + 8]
cmp r14, rbx
jne 0x140045a72
mov rcx, rdi
call fcn.140040de6
mov qword [rsi], rbx
jmp 0x140045a90
mov r15, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140045a9c
mov qword [rsi], r14
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsi], rbx
test r14, r14
je 0x140045a90
mov rcx, qword [0x14008fb30]
xor edx, edx
mov r8, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.kernel32.dll_HeapFree]