joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100071304
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rsi, rcx
mov edi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul edi, dword [rdx + 0x80]
add rdi, rbx
jmp 0x10007142c
mov eax, dword [rdx + 0x88]
mov r12d, dword [rdx + 0x80]
mov r15, rbp
lea r13, [rbx + rax*2]
add r12, rbx
mov r14, rbx
cmp rbx, r13
jae 0x100071412
mov esi, 0x7e0
movzx r8d, word [r12]
movzx r10d, word [r14]
movzx r9d, word [r14 + 2]
movzx r11d, word [r12 + 2]
mov edx, 0xf81f
mov ecx, r10d
and ecx, edx
mov eax, r8d
add r14, 4
and eax, edx
add r12, 4
add ecx, eax
mov eax, r9d
and eax, edx
add ecx, eax
mov eax, r11d
and eax, edx
lea edx, [rcx + rax + 0x1002]
mov ecx, r10d
mov eax, r8d
and eax, esi
and ecx, esi
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, esi
add ecx, eax
mov eax, r11d
and eax, esi
lea ecx, [rcx + rax + 0x40]
mov eax, 0xf81f
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
shr ecx, 2
xor dx, cx
add r10d, r9d
and dx, si
lea eax, [r10 + r11 + 0x1002]
shr eax, 2
xor dx, ax
mov word [r15], dx
add r15, 2
cmp r14, r13
jb 0x10007136f
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rdi
jb 0x100071347
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100071584
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rsi, rcx
mov edi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul edi, dword [rdx + 0x80]
add rdi, rbx
jmp 0x1000716af
mov eax, dword [rdx + 0x88]
mov r12d, dword [rdx + 0x80]
mov r15, rbp
lea r13, [rbx + rax*2]
add r12, rbx
mov r14, rbx
cmp rbx, r13
jae 0x100071695
mov esi, 0x7c1f
movzx r8d, word [r12]
movzx r10d, word [r14]
movzx r9d, word [r14 + 2]
movzx r11d, word [r12 + 2]
mov edx, 0x83e0
mov ecx, r10d
and ecx, edx
mov eax, r8d
add r14, 4
and eax, edx
add r12, 4
add ecx, eax
mov eax, r9d
and eax, edx
add ecx, eax
mov eax, r11d
and eax, edx
lea edx, [rcx + rax + 0x10040]
mov ecx, r10d
mov eax, r8d
and eax, esi
and ecx, esi
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, esi
add ecx, eax
mov eax, r11d
and eax, esi
lea ecx, [rcx + rax + 0x802]
mov eax, 0x83e0
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
shr ecx, 2
xor dx, cx
add r10d, r9d
and dx, si
lea eax, [r10 + r11 + 0x10040]
shr eax, 2
xor dx, ax
mov word [r15], dx
add r15, 2
cmp r14, r13
jb 0x1000715ef
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rdi
jb 0x1000715c7
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1000716dc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rsi, rcx
mov edi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul edi, dword [rdx + 0x80]
add rdi, rbx
jmp 0x100071807
mov eax, dword [rdx + 0x88]
mov r12d, dword [rdx + 0x80]
mov r15, rbp
lea r13, [rbx + rax*2]
add r12, rbx
mov r14, rbx
cmp rbx, r13
jae 0x1000717ed
mov esi, 0xf0f
movzx r8d, word [r12]
movzx r10d, word [r14]
movzx r9d, word [r14 + 2]
movzx r11d, word [r12 + 2]
mov edx, 0xf0f0
mov ecx, r10d
and ecx, edx
mov eax, r8d
add r14, 4
and eax, edx
add r12, 4
add ecx, eax
mov eax, r9d
and eax, edx
add ecx, eax
mov eax, r11d
and eax, edx
lea edx, [rcx + rax + 0x2020]
mov ecx, r10d
mov eax, r8d
and eax, esi
and ecx, esi
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, esi
add ecx, eax
mov eax, r11d
and eax, esi
lea ecx, [rcx + rax + 0x202]
mov eax, 0xf0f0
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
shr ecx, 2
xor dx, cx
add r10d, r9d
and dx, si
lea eax, [r10 + r11 + 0x2020]
shr eax, 2
xor dx, ax
mov word [r15], dx
add r15, 2
cmp r14, r13
jb 0x100071747
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rdi
jb 0x10007171f
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100071834
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rsi, rcx
mov edi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul edi, dword [rdx + 0x80]
add rdi, rbx
jmp 0x10007194a
mov r12d, dword [rdx + 0x88]
mov r13d, dword [rdx + 0x80]
mov r15, rbp
add r12, rbx
add r13, rbx
mov r14, rbx
cmp rbx, r12
jae 0x100071930
movzx r8d, byte [r13]
movzx r10d, byte [r14]
movzx r9d, byte [r14 + 1]
movzx r11d, byte [r13 + 1]
mov edx, 0xe3
mov ecx, r10d
and ecx, edx
mov eax, r8d
add r14, 2
and eax, edx
add r13, 2
add ecx, eax
mov eax, r9d
and eax, edx
add ecx, eax
mov eax, r11d
and eax, edx
lea edx, [rcx + rax + 0x42]
mov ecx, r10d
mov eax, r8d
and eax, 0x1c
and ecx, 0x1c
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, 0x1c
add ecx, eax
mov eax, r11d
and eax, 0x1c
lea ecx, [rcx + rax + 8]
mov eax, 0xe3
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
shr ecx, 2
xor dl, cl
add r10d, r9d
and dl, 0x1c
lea eax, [r10 + r11 + 0x42]
shr eax, 2
xor dl, al
mov byte [r15], dl
inc r15
cmp r14, r12
jb 0x100071899
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rdi
jb 0x100071876
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x100071a30
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rsi, rcx
mov edi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul edi, dword [rdx + 0x80]
add rdi, rbx
jmp 0x100071b60
mov eax, dword [rdx + 0x88]
mov r12d, dword [rdx + 0x80]
mov r15, rbp
lea r13, [rbx + rax*2]
add r12, rbx
mov r14, rbx
cmp rbx, r13
jae 0x100071b46
mov esi, 0xe3
movzx r8d, word [r12]
movzx r10d, word [r14]
movzx r9d, word [r14 + 2]
movzx r11d, word [r12 + 2]
mov ecx, r10d
mov eax, r8d
and eax, esi
and ecx, esi
add r14, 4
add ecx, eax
mov eax, r9d
add r12, 4
and eax, esi
add ecx, eax
mov eax, r11d
and eax, esi
lea edx, [rcx + rax + 0x42]
mov ecx, r10d
mov eax, r8d
and eax, 0xff1c
and ecx, 0xff1c
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, 0xff1c
add ecx, eax
mov eax, r11d
and eax, 0xff1c
lea ecx, [rcx + rax + 0x208]
mov eax, 0xff1c
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
shr ecx, 2
xor dx, cx
add r10d, r9d
and dx, si
lea eax, [r10 + r11 + 0x208]
shr eax, 2
xor dx, ax
mov word [r15], dx
add r15, 2
cmp r14, r13
jb 0x100071a9b
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rdi
jb 0x100071a73
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x100071cb8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rdi, rcx
mov esi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul esi, dword [rdx + 0x80]
add rsi, rbx
jmp 0x100071dde
mov eax, dword [rdx + 0x88]
mov r12d, dword [rdx + 0x80]
mov r15, rbp
lea r13, [rbx + rax*2]
add r12, rbx
mov r14, rbx
cmp rbx, r13
jae 0x100071dc4
movzx r8d, word [r12]
movzx r10d, word [r14]
movzx r9d, word [r14 + 2]
movzx r11d, word [r12 + 2]
movzx ecx, r10b
movzx eax, r8b
add ecx, eax
movzx eax, r9b
add r14, 4
add ecx, eax
movzx eax, r11b
add r12, 4
lea edx, [rcx + rax + 2]
mov ecx, r10d
mov eax, r8d
and eax, 0xff00
and ecx, 0xff00
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, 0xff00
add ecx, eax
mov eax, r11d
and eax, 0xff00
lea ecx, [rcx + rax + 0x200]
mov eax, 0xff
shr ecx, 2
xor dx, cx
and dx, ax
mov eax, 0xff00
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
add r10d, r9d
lea eax, [r10 + r11 + 0x200]
shr eax, 2
xor dx, ax
mov word [r15], dx
add r15, 2
cmp r14, r13
jb 0x100071d1d
mov rax, qword [rdi + 8]
mov rdx, qword [rdi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rsi
jb 0x100071cfa
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
ret

Function at 0x100071e0c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov rsi, rcx
mov edi, dword [rdx + 0x8c]
mov rbx, qword [rdx + 0x28]
mov rbp, qword [rax + 0x28]
imul edi, dword [rdx + 0x80]
add rdi, rbx
jmp 0x100071f22
mov r12d, dword [rdx + 0x88]
mov r13d, dword [rdx + 0x80]
mov r15, rbp
add r12, rbx
add r13, rbx
mov r14, rbx
cmp rbx, r12
jae 0x100071f08
movzx r8d, byte [r13]
movzx r10d, byte [r14]
movzx r9d, byte [r14 + 1]
movzx r11d, byte [r13 + 1]
mov edx, 0xf0
mov ecx, r10d
and ecx, edx
mov eax, r8d
add r14, 2
and eax, edx
add r13, 2
add ecx, eax
mov eax, r9d
and eax, edx
add ecx, eax
mov eax, r11d
and eax, edx
lea edx, [rcx + rax + 0x20]
mov ecx, r10d
mov eax, r8d
and eax, 0xf
and ecx, 0xf
shr edx, 2
add ecx, eax
mov eax, r9d
and eax, 0xf
add ecx, eax
mov eax, r11d
and eax, 0xf
lea ecx, [rcx + rax + 2]
mov eax, 0xf0
and r10d, eax
and r8d, eax
and r9d, eax
and r11d, eax
add r10d, r8d
shr ecx, 2
xor dl, cl
add r10d, r9d
and dl, 0xf
lea eax, [r10 + r11 + 0x20]
shr eax, 2
xor dl, al
mov byte [r15], dl
inc r15
cmp r14, r12
jb 0x100071e71
mov rax, qword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, dword [rax + 0x80]
mov eax, dword [rdx + 0x80]
lea rbx, [rbx + rax*2]
add rbp, rcx
cmp rbx, rdi
jb 0x100071e4e
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
xor eax, eax
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x100071f50
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r8
lea rax, [r11 + 0x20]
lea r9, [r11 - 0x18]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rdx
mov rdx, rcx
mov rcx, qword [rdi]
xor r8d, r8d
mov dword [rsp + 0x68], 4
call qword [sym.imp.KERNEL32.dll_RegQueryValueExA]
mov rcx, qword [rdi]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
xor eax, eax
cmp ebx, eax
jne 0x100071fa3
cmp dword [rsp + 0x30], 4
jne 0x100071fa3
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x100076d54
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x100076dbf
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x100076ddf
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x140026080
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140026186
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov rbx, rdx
xchg rbx, rcx
mov rdi, rbx
xchg rcx, rbx
mov esi, r8d
sub rdi, rdx
mov rbp, rcx
add rdi, 0x6e516743
sub rdi, 0x6e516653
dec rsi
shr rsi, 1
shr rsi, 2
shr rsi, 1
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
xchg rbp, r9
mov rdx, r9
xchg rbp, r9
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.140026840
mov ecx, 0x4d0dea68
xor ecx, 0x1e08bd69
add ecx, 0x213db36
add ecx, 0x1c443b96
xor ecx, 0x6dc7b2e3
xor ecx, 0x187cdf5d
add ecx, 0x76efda68
sub ecx, 0x665a195f
xor ecx, 0x157bc16c
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14002612f
sub rdi, 0x10
xchg rbp, r11
movups xmmword [r11 + 0xf0], xmm0
xchg r11, rbp
sub rsi, 1
jne 0x1400260d3
xchg rdi, r13
mov r13, qword [rsp + 0x30]
xchg rdi, r13
mov rbx, qword [rsp + 0x38]
xchg rbp, rcx
mov rcx, qword [rsp + 0x40]
xchg rbp, rcx
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
ret

Function at 0x140026190
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg r10, rbx
mov qword [rsp + 0x10], rbp
xchg rsi, rbp
mov qword [rsp + 0x18], rbp
xchg rbp, rsi
push rdi
sub rsp, 0x20
mov edi, r8d
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
lea r9, [rcx + 0xf0]
mov rsi, rcx
test r8d, r8d
je 0x14002626f
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg rbx, r9
mov rax, r9
xchg r9, rbx
sub r9, rbx
mov edx, 0x54211110
xor edx, 0x1fd9629
sub edx, 0x4f3c15b2
add edx, 0x272f4413
sub edx, 0x22ea61de
xor edx, 0x685afd4
add edx, 0x19df469a
sub edx, 0x264042f2
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140026226
xchg r10, rsi
mov rdx, r10
xchg rsi, r10
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.140026310
xchg rbx, rdi
mov r9, rdi
xchg rdi, rbx
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
sub rdi, 1
jne 0x1400261e6
movups xmm0, xmmword [r9]
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
xchg r9, rbp
mov r9, qword [rsp + 0x38]
xchg rbp, r9
xchg rsi, rdx
movups xmmword [rdx + 0xf0], xmm0
xchg rdx, rsi
xchg r10, rsi
mov r10, qword [rsp + 0x40]
xchg r10, rsi
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400279f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
push rdi
sub rsp, 0x10
mov rbx, rdx
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
test r8b, 0xf
je 0x140027a3a
xor al, al
xchg rsi, rbx
mov rsi, qword [rsp + 0x20]
xchg rsi, rbx
add rsp, 0x10
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027afc
movdqa xmm2, xmmword [rsp]
nop
xchg r10, rdx
movdqu xmm1, xmmword [r10 + rbx]
xchg rdx, r10
test edx, edx
jne 0x140027a6d
xchg rdi, r10
movdqu xmm2, xmmword [rdi + 0x200]
xchg r10, rdi
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x280f4bbe
add ecx, 0x1826b8f5
sub ecx, 0x192af4b7
add ecx, 0x2ad6df8c
sub ecx, 0x20435091
xor ecx, 0x645351e0
xor ecx, 0xcf1f325
sub ecx, 0x593c3c25
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027ab5
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg rdx, r13
movups xmmword [r13 + r9], xmm0
xchg r13, rdx
nop
add edx, 0x6e4001c3
sub edx, 0x6e4001b3
cmp edx, r8d
jb 0x140027a4b
xchg rbx, r15
mov r15, qword [rsp + 0x20]
xchg rbx, r15
mov al, 0
add al, 0x7a
xor al, 0x44
xor al, 7
sub al, 0x22
add al, 0x3a
xor al, 0x62
xor al, 0x2e
sub al, 0x1c
add rsp, 0x10
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140027b30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x10
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
xchg rcx, r14
mov r10, r14
xchg rcx, r14
test r8b, 0xf
je 0x140027b62
xor al, al
add rsp, 0x10
nop
xchg qword [rsp], rbx
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x140027c12
movdqa xmm0, xmmword [rsp]
xchg rdi, r9
mov qword [rsp + 0x20], r9
xchg rdi, r9
nop dword [rax + rax]
movdqu xmm1, xmmword [rdx + rbx]
test edx, edx
jne 0x140027b9d
xchg rbx, r10
movdqu xmm0, xmmword [rbx + 0x200]
xchg r10, rbx
pxor xmm0, xmm1
lea rax, [r10 + 0x10]
pxor xmm0, xmmword [r10 + 0x1e0]
mov ecx, 0x391d063c
sub ecx, 0x176643f7
add ecx, 0x6803b57
add ecx, 0x1489560d
sub ecx, 0x134074aa
sub ecx, 0x297fdef2
nop dword [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140027bd9
aesenclast xmm0, xmmword [r10 + 0xe0]
xchg r10, rdx
movups xmmword [r10 + r9], xmm0
xchg r10, rdx
sub edx, 0xfffffff0
cmp edx, r8d
jb 0x140027b82
mov rdi, qword [rsp + 0x20]
mov al, 0x5e
xor al, 6
xor al, 0x51
xor al, 0x6c
sub al, 0x20
add al, 0x27
xor al, 0x5c
xor al, 0x31
add rsp, 0x10
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140028980
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
xchg r9, rsi
mov qword [rsp + 0x10], r9
xchg rsi, r9
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg rbx, r8
xchg rdx, r8
mov rdi, r8
xchg r8, rdx
mov rsi, rcx
jne 0x140028a1e
nop
xchg r8, r15
mov r15, qword [rbx + 0x10]
xchg r8, r15
xchg rdi, rdx
mov rdi, rdx
xchg rdi, rdx
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.140028980
mov rcx, rbx
mov edx, 0x645de61f
sub edx, 0x48045a1b
add edx, 0x567a83e0
xor edx, 0x2ebf890
sub edx, 0xeec2df1
sub edx, 0x6153c953
mov rbx, qword [rbx]
call fcn.1401fcccc
cmp byte [rbx + 0x19], 0
je 0x1400289c5
mov rbx, qword [rsp + 0x30]
xchg rsi, r15
mov r15, qword [rsp + 0x38]
xchg r15, rsi
add rsp, 0x20
push rdx
xchg qword [rsp + 8], rdi
pop rdx
add rsp, 8
ret

Function at 0x140029940
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg r11, rdi
mov r11, rcx
xchg rdi, r11
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400299cd
xchg rdx, r10
mov r10, qword [rdi + 0x28]
xchg rdx, r10
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400299b0
mov r8, qword [rcx - 8]
sub rdx, 0xffffffffffffffd9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029a98
xchg rbx, rcx
mov rbx, r8
xchg rcx, rbx
call fcn.1401fcccc
xchg rbx, r15
mov qword [rdi + 0x18], r15
xchg r15, rbx
mov qword [rdi + 0x20], rbx
xchg rbx, rcx
mov qword [rdi + 0x28], rcx
xchg rcx, rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
xchg rsi, rbx
mov qword [rax], rsi
xchg rsi, rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140029a41
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x1fb5df71
add edx, 0x4ff13ef0
add edx, 0xc63d6d2
xor edx, 0x5eb66642
add edx, 0x1057b0c8
xor edx, 0x13840c9
sub edx, 0x1530b5d4
xor edx, 0x42ce2705
xor edx, 0x5e356801
call fcn.1401fcccc
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
test rbx, rbx
jne 0x1400299f2
xchg rcx, r9
mov r9, qword [rdi + 8]
xchg rcx, r9
mov edx, 0x7a205a05
xor edx, 0x5fd66c87
xor edx, 0x24ce7f0f
add edx, 0x708e7433
xor edx, 0x47fe3e54
add edx, 0x3cd9689d
sub edx, 0x5433b424
add edx, 0x1b818491
sub edx, 0x3a5fbc86
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
jmp fcn.1401fcccc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002cb80
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, r13
mov qword [rsp + 0x18], r13
xchg rsi, r13
xchg rdi, rbx
mov qword [rsp + 0x20], rbx
xchg rdi, rbx
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x30
mov rsi, rcx
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, rbp
mov qword [rsp + 0x40], rbp
xchg rbx, rbp
sub rcx, 0x5b6784b0
add rcx, 0x5b678578
xchg r9, rbx
mov qword [rsp + 0x28], r9
xchg rbx, r9
mov dword [rsp + 0x20], 0x5ce6dbd6
add dword [rsp + 0x20], 0x8bb05ec
sub dword [rsp + 0x20], 0x5c0dc9de
sub dword [rsp + 0x20], 0x3e24048
sub dword [rsp + 0x20], 0x40365f1
xor dword [rsp + 0x20], 0x22983f3
add dword [rsp + 0x20], 0x5f3fc62f
sub dword [rsp + 0x20], 0x2dadf9da
sub dword [rsp + 0x20], 0x3519bea5
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b7a0
test eax, eax
js 0x14002cc5b
cmp qword [rsp + 0x40], rbx
je 0x14002cc5b
lea eax, [rbx + 1]
jmp 0x14002cd8e
mov rax, qword gs:[0x60]
xchg r9, rcx
mov r9, qword [rax + 0x30]
xchg r9, rcx
cmp dword [rcx + 0x70], 2
jbe 0x14002cc9b
mov eax, 0x5ed55ee0
sub eax, 0x56bb5854
add eax, 0x5df2e92c
sub eax, 0x2b3a6164
sub eax, 0x1723c25a
xor eax, 0x23aecbf8
jmp 0x14002cd8e
cmp dword [rcx + 0x74], ebx
jbe 0x14002ccd6
mov eax, 0x169629ab
xor eax, 0x7ab00787
add eax, 0xc4565da
sub eax, 0x3157bc72
add eax, 0x2b897030
sub eax, 0x50c3011f
add eax, 0x203ec496
sub eax, 0x104f0ed
sub eax, 0x41141a4b
jmp 0x14002cd8e
cmp byte [rdi + 2], bl
je 0x14002cd02
mov eax, 0x1bf14007
add eax, 0xe2be8e4
sub eax, 0x5361bad
add eax, 0x16d4b05f
xor eax, 0x7aded95b
xor eax, 0x416564c2
jmp 0x14002cd8e
cmp r14d, 0xa
jb 0x14002cd53
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cd53
mov eax, 0x7b71d5c8
xor eax, 0x3e489208
add eax, 0xb88fe89
sub eax, 0x4a255788
add eax, 0x601d859f
xor eax, 0x7d3e72a6
add eax, 0x5b1c08be
sub eax, 0x3dac4b65
xor eax, 0x38f3c417
jmp 0x14002cd8e
lea rcx, [rsi + 0xb8]
mov edx, 0x7b459fc
add edx, 0x2422985c
sub edx, 0x7e6ec15
sub edx, 0x1ada6030
add edx, 0x65c852ba
add edx, 0x2abba0cc
call fcn.14002c100
jmp 0x14002cd8c
mov eax, ebx
xchg rbx, r15
mov r15, qword [rsp + 0x48]
xchg rbx, r15
xchg r12, rsi
mov r12, qword [rsp + 0x50]
xchg rsi, r12
xchg r10, rdi
mov r10, qword [rsp + 0x58]
xchg rdi, r10
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
add rsp, 8
jmp qword [rsp - 8]