joyce8/EMBER2024-capa huggingface dataset:
Function at 0x673d10
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x673d1d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x673d2d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x673d15
lea eax, [rcx + 1]
jmp 0x673d3b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x673d4e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x673d34
sub eax, 3
jb 0x673d6e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x673dbd
sar eax, 1
movsxd rbp, eax
jb 0x673da4
jmp 0x673d7c
add ebx, ebx
jne 0x673d7a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x673da4
inc ecx
add ebx, ebx
jne 0x673d8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x673da4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x673d9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x673d8c
add ecx, 2
jmp 0x673da9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00673cd2
jmp 0x673d1d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x97400
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x673e09
cmp rsi, rcx
jae 0x673e11
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x673df0
cmp al, 0x8f
ja 0x673df0
cmp byte [rsi - 2], 0xf
je 0x673df6
sub al, 0xe8
cmp al, 1
ja 0x673dda
cmp rsi, rcx
jae 0x673e11
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x673de0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x673e11
lodsb al, byte [rsi]
jmp 0x673df0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x26f000]
mov eax, dword [rdi]
or eax, eax
je 0x673e6e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x273000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x673e1e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x673e68
mov qword [rbx], rax
add rbx, 8
jmp 0x673e3e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x673ea8
cmp al, 0xef
ja 0x673e9a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x673e7a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x673e89
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x673efc
sub rsp, 0xffffffffffffff80
jmp 0x46d600
Function at 0x1811d6058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1811d61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1811d6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1811d606f
add dl, dl
jne 0x1811d6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1811d60f6
xor eax, eax
add dl, dl
jne 0x1811d60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1811d61ad
add dl, dl
jne 0x1811d60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1811d60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1811d60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1811d60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1811d60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1811d607e
mov eax, 1
add dl, dl
jne 0x1811d6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1811d6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1811d60fb
sub eax, ebx
mov ebx, 1
jne 0x1811d614c
mov ecx, 1
add dl, dl
jne 0x1811d612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1811d613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1811d6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1811d607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1811d6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1811d6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1811d615d
cmp eax, 0x7d00
jae 0x1811d619b
cmp eax, 0x500
jb 0x1811d6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1811d607e
cmp eax, 0x7f
ja 0x1811d619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1811d607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1811d61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1811d607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140019610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test byte [rdx], 1
je 0x140019650
lea rax, [rdx + 8]
cmp qword [rdx + 0x38], 0xffffffffffffffff
mov r8, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10, qword [rdx + 0x58]
mov rdx, qword [rdx + 0x60]
je 0x140019772
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x140019781
cmp byte [rdx + 0x1a], 0
jne 0x1400197a8
mov r8, qword [rdx + 8]
mov rax, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
movzx r10d, byte [rdx + 0x18]
jmp 0x140019677
add r8, r11
mov qword [rdx + 8], r8
mov r11d, r10d
xor r10b, 1
test r8, r8
je 0x1400196a6
cmp r8, r9
jae 0x1400196a0
cmp byte [rax + r8], 0xbf
jg 0x1400196a6
jmp 0x1400197b6
jne 0x1400197b6
cmp r8, r9
je 0x14001978b
movzx ebx, byte [rax + r8]
movzx esi, bl
test sil, sil
js 0x140019700
test r11b, 1
jne 0x140019769
mov r11d, 1
cmp esi, 0x80
jb 0x140019670
mov r11d, 2
cmp esi, 0x800
jb 0x140019670
cmp esi, 0x10000
mov r11d, 4
sbb r11, 0
jmp 0x140019670
mov edi, esi
and edi, 0x1f
movzx ebp, byte [rax + r8 + 1]
and ebp, 0x3f
cmp sil, 0xdf
jbe 0x140019747
movzx esi, byte [rax + r8 + 2]
shl ebp, 6
and esi, 0x3f
or esi, ebp
cmp bl, 0xf0
jb 0x14001975a
movzx ebx, byte [rax + r8 + 3]
and edi, 7
shl edi, 0x12
shl esi, 6
and ebx, 0x3f
or ebx, esi
or ebx, edi
mov esi, ebx
test r11b, 1
je 0x1400196c6
jmp 0x140019769
shl edi, 6
or edi, ebp
mov esi, edi
test r11b, 1
je 0x1400196c6
jmp 0x140019769
shl edi, 0xc
or esi, edi
test r11b, 1
je 0x1400196c6
mov byte [rdx + 0x18], r10b
mov r9, r8
jmp 0x140019795
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
mov rdx, rax
call fcn.140018fb0
jmp 0x1400197ad
mov byte [rdx + 0x18], r10b
test r11b, 1
je 0x1400197a4
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov eax, 1
jmp 0x1400197aa
mov byte [rdx + 0x1a], 1
xor eax, eax
mov qword [rcx], rax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov byte [rdx + 0x18], r10b
lea rcx, [0x1400ea038]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, r9
call fcn.1400e6390
int3
Function at 0x14001bbe0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
mov rdx, rbp
mov r8d, 0x20
call fcn.14002af80
mov qword [rbp + 0x28], rax
test rax, rax
je 0x14001bc54
mov qword [rbp + 0x30], rdx
mov rax, qword [rdx]
test rax, rax
je 0x14001bc38
mov rcx, qword [rbp + 0x28]
call rax
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14001bc9d
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.140028750
jmp 0x14001bc9d
movaps xmm0, xmmword [rbp]
movaps xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x50]
lea r8, [0x1400ead18]
lea rdx, [rbp - 0x20]
mov r9d, 8
call fcn.14002ad60
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movaps xmm2, xmmword [rbp - 0x30]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
jmp fcn.140028850
Function at 0x14001f090
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14001f0d2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14001f0da
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14001f0eb
jmp 0x14001f102
xor r10d, r10d
jmp 0x14001f18d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14001f102
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14001f119
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14001f139
add r11, r8
jmp 0x14001f269
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14001f202
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14001f1b0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14001f21f
mov r9d, dword [rdx + r10]
mov r8d, 4
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jb 0x14001f230
jmp 0x14001f24b
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x14001f24b
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x14001f265
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002b230
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14002b2a2
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.ADVAPI32.dll_SystemFunction036]
jmp 0x14002b268
add rdi, rbx
sub rsi, rbx
je 0x14002b2a2
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x14002b260
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x14002b260
and ebp, 0x7fffffff
jmp 0x14002b2a4
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14005c520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm9
movaps xmmword [rsp + 0x50], xmm8
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm6
movsd xmm7, qword [rdx]
movsd xmm6, qword [rdx + 8]
movss xmm0, dword [0x1400ed860]
movss xmm1, dword [r9]
mulss xmm1, xmm0
xorps xmm2, xmm2
xorps xmm3, xmm3
maxss xmm3, xmm1
movaps xmm1, xmm0
minss xmm1, xmm3
cvttss2si eax, xmm1
movss xmm1, dword [r9 + 4]
mulss xmm1, xmm0
xorps xmm3, xmm3
maxss xmm3, xmm1
movaps xmm1, xmm0
minss xmm1, xmm3
cvttss2si edx, xmm1
movss xmm1, dword [r9 + 8]
mulss xmm1, xmm0
xorps xmm3, xmm3
maxss xmm3, xmm1
movaps xmm1, xmm0
minss xmm1, xmm3
cvttss2si r10d, xmm1
movss xmm1, dword [r9 + 0xc]
mulss xmm1, xmm0
maxss xmm2, xmm1
minss xmm0, xmm2
cvttss2si r9d, xmm0
shl r9d, 0x18
movzx r10d, r10b
shl r10d, 0x10
or r10d, r9d
movzx edx, dl
shl edx, 8
or edx, r10d
movzx ebx, al
or ebx, edx
addps xmm6, xmm7
movsd xmm9, qword [r8]
movsd xmm8, qword [r8 + 8]
addps xmm8, xmm9
mov rdx, qword [rcx]
mov rsi, qword [rcx + 0x10]
sub rdx, rsi
mov rax, rsi
cmp rdx, 3
jbe 0x14005c741
mov rdx, qword [rcx + 8]
lea r8, [rax + rax*4]
movlps qword [rdx + r8*8], xmm7
mov dword [rdx + r8*8 + 8], 0
movlps qword [rdx + r8*8 + 0xc], xmm9
mov dword [rdx + r8*8 + 0x14], ebx
xorps xmm0, xmm0
movups xmmword [rdx + r8*8 + 0x18], xmm0
movss dword [rdx + r8*8 + 0x28], xmm6
movshdup xmm1, xmm7
movss dword [rdx + r8*8 + 0x2c], xmm1
mov dword [rdx + r8*8 + 0x30], 0
movss dword [rdx + r8*8 + 0x34], xmm8
movshdup xmm1, xmm9
movss dword [rdx + r8*8 + 0x38], xmm1
mov dword [rdx + r8*8 + 0x3c], ebx
movups xmmword [rdx + r8*8 + 0x40], xmm0
movlps qword [rdx + r8*8 + 0x50], xmm6
mov dword [rdx + r8*8 + 0x58], 0
movlps qword [rdx + r8*8 + 0x5c], xmm8
mov dword [rdx + r8*8 + 0x64], ebx
movups xmmword [rdx + r8*8 + 0x68], xmm0
movss dword [rdx + r8*8 + 0x78], xmm7
movshdup xmm1, xmm6
movss dword [rdx + r8*8 + 0x7c], xmm1
mov dword [rdx + r8*8 + 0x80], 0
movss dword [rdx + r8*8 + 0x84], xmm9
movshdup xmm1, xmm8
movss dword [rdx + r8*8 + 0x88], xmm1
mov dword [rdx + r8*8 + 0x8c], ebx
movups xmmword [rdx + r8*8 + 0x90], xmm0
add rax, 4
mov qword [rcx + 0x10], rax
mov rax, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x28]
sub rax, rdx
cmp rax, 5
jbe 0x14005c76d
mov rax, qword [rcx + 0x20]
mov word [rax + rdx*2], si
lea r8d, [rsi + 1]
mov word [rax + rdx*2 + 2], r8w
lea r8d, [rsi + 2]
mov word [rax + rdx*2 + 4], r8w
mov word [rax + rdx*2 + 6], si
mov word [rax + rdx*2 + 8], r8w
lea r8d, [rsi + 3]
mov word [rax + rdx*2 + 0xa], r8w
add rdx, 6
mov qword [rcx + 0x28], rdx
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm9, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x20], 0x28
mov r8d, 4
mov r9d, 4
mov rdi, rcx
mov rdx, rsi
call fcn.1400dc6f0
mov rcx, rdi
mov rax, qword [rdi + 0x10]
jmp 0x14005c602
lea rax, [rcx + 0x18]
mov qword [rsp + 0x20], 2
mov r8d, 6
mov r9d, 2
mov rdi, rcx
mov rcx, rax
call fcn.1400dc6f0
mov rcx, rdi
mov rdx, qword [rdi + 0x28]
jmp 0x14005c6ea
Function at 0x140082820
Capabilities:
Encode data using xor

Disassembly:
movabs r8, 0x517cc1b727220a95
cmp rdx, 8
jb 0x14008284f
lea rax, [rdx - 8]
mov r10, rax
shr r10, 3
inc r10
mov r9d, r10d
and r9d, 3
cmp rax, 0x18
jae 0x140082853
xor eax, eax
jmp 0x14008289d
xor eax, eax
jmp 0x1400828cb
and r10, 0xfffffffffffffffc
xor eax, eax
nop dword [rax]
rol rax, 5
xor rax, qword [rcx]
imul rax, r8
rol rax, 5
xor rax, qword [rcx + 8]
imul rax, r8
rol rax, 5
xor rax, qword [rcx + 0x10]
imul rax, r8
rol rax, 5
xor rax, qword [rcx + 0x18]
imul rax, r8
add rcx, 0x20
add rdx, 0xffffffffffffffe0
add r10, 0xfffffffffffffffc
jne 0x140082860
test r9, r9
je 0x1400828cb
shl r9d, 3
xor r10d, r10d
nop dword [rax]
rol rax, 5
xor rax, qword [rcx + r10]
imul rax, r8
add r10, 8
cmp r9, r10
jne 0x1400828b0
add rcx, r10
sub rdx, r10
cmp rdx, 3
jbe 0x1400828e7
mov r9d, dword [rcx]
rol rax, 5
xor rax, r9
imul rax, r8
add rcx, 4
add rdx, 0xfffffffffffffffc
test rdx, rdx
je 0x140082968
mov r10, rdx
mov r9, rcx
and r10, 3
je 0x140082917
nop dword [rax + rax]
movzx r11d, byte [r9]
rol rax, 5
inc r9
xor rax, r11
imul rax, r8
dec r10
jne 0x140082900
cmp rdx, 4
jb 0x140082968
add rcx, rdx
rol rax, 5
movzx edx, byte [r9]
xor rax, rdx
imul rax, r8
movzx edx, byte [r9 + 1]
rol rax, 5
xor rax, rdx
imul rax, r8
movzx edx, byte [r9 + 2]
rol rax, 5
xor rax, rdx
imul rax, r8
movzx edx, byte [r9 + 3]
rol rax, 5
xor rax, rdx
imul rax, r8
add r9, 4
cmp r9, rcx
jne 0x140082920
ret
Function at 0x1400a3d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x1400a3fae
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x140111600]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x1400a3e00
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pmovzxdq xmm5, qword [0x140111620]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x1400a3f2a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x1400a3f00
pmovzxdq xmm1, qword [0x140111620]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x140111610], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x1400a3fcc
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.1400a3860
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400bb950
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400bb9f0
jmp 0x1400bb9df
jae 0x1400bbabe
cmp r8, 0x201
jae 0x1400bb9f0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x1400bba56
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x1400bba2e
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.1400e49e0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1400bba7f
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400bbb2a
mov r8d, r13d
cmp r12, r8
jne 0x1400bb9d0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400bbb5e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400bb9df
jmp 0x1400bb9f0
cmp r14, r8
jb 0x1400bbb78
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.1400bedd0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x1400bbb13
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140028750
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x1400bbafe
jmp 0x1400bbb13
lea rcx, str.internal_error:_entered_unreachable_code_rustc_f6e511eec7342f59a25f7c0534f1dbea00d01b14library_alloc_src_vecmod.rs
lea r8, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400e5d70
jmp 0x1400bbb8d
lea rax, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.1400e6200
ud2