joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a3ee0
Capabilities:
Allocate thread local storage

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
lea rsi, [0x1405a80e0]
mov rcx, rsi
call fcn.1401a37a0
lea r13, [rax + 8]
mov r12, rax
mov rcx, r13
call fcn.1401a3030
mov ebx, dword [0x1405a80e0]
test ebx, ebx
jne 0x1401a3f50
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140423a38], eax
cmp eax, 0xffffffff
je 0x140414e06
mov dword [0x1405a80e0], 1
mov rcx, r13
call fcn.1401a3350
test r12, r12
je 0x1401a3f82
mov rcx, r12
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
jmp fcn.1401a3b60
cmp ebx, 1
je 0x1401a3f31
mov ecx, 2
call qword [fcn.1401a17f0]
mov r9d, ebx
mov r8, rsi
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rcx, r13
call fcn.1401a3350
test r12, r12
jne 0x1401a3f3e
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
call sub.msvcrt.dll_abort
nop
Function at 0x1401a5820
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rsi, rdx
mov rbx, r8
mov rbp, r9
call fcn.1401a3c60
mov r12, rax
test rax, rax
je 0x1401a5a89
test rdi, rdi
je 0x1401a585a
mov rax, qword [rax + 0x1d8]
mov qword [rdi], rax
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [r12 + 8], rbp
mov dword [r12 + 0x44], 1
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [r12 + 0xbc], 0
mov r14, r13
mov qword [r12 + 0x28], 0xffffffffffffffff
mov qword [r12 + 0x10], rbx
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rbp
mov qword [r12 + 0x30], rax
test rax, rax
jne 0x1401a58c7
add ebx, 1
cmp ebx, 1
je 0x1401a59d0
mov ecx, 0x14
call r14
cmp ebx, 5
jne 0x1401a5895
mov qword [r12 + 0x38], 0xffffffffffffffff
lea r14, [r12 + 0x68]
mov rcx, r14
call fcn.1401a36a0
cmp eax, 1
je 0x1401a5aca
cmp qword [r12 + 0x30], 0
mov qword [r12 + 0x68], 0xffffffffffffffff
mov dword [r12], 0xbab1f00d
mov dword [r12 + 0xc0], 0
mov dword [r12 + 0xb8], 0
je 0x1401a5a72
xor edx, edx
test rsi, rsi
je 0x1401a593f
mov eax, dword [rsi]
mov edx, dword [rsi + 0x10]
mov dword [r12 + 0x44], eax
test al, 8
jne 0x1401a5aa0
mov eax, dword [rsi + 0x18]
mov dword [r12 + 0xc0], eax
lea r8, [0x1401a40d0]
mov r9, r12
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1401a5a30
mov eax, dword [r12 + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jge 0x1401a5a00
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r12 + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [r12 + 0x44], 4
jne 0x1401a59e0
mov qword [r12 + 0x28], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor ecx, ecx
call r13
jmp 0x1401a5895
mov qword [r12 + 0x28], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401a59af
mov edx, 0xfffffffe
cmp eax, 0xffffffff
jl 0x1401a5985
mov edx, 2
cmp eax, edx
cmovle edx, eax
cmp eax, 0xf
mov eax, 0xf
cmovge edx, eax
jmp 0x1401a5985
mov rcx, qword [r12 + 0x30]
test rcx, rcx
je 0x1401a5a40
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r12 + 0x38]
call fcn.1401a3520
mov rcx, r14
call fcn.1401a36a0
cmp eax, 1
je 0x1401a5aca
mov qword [r12 + 0x68], 0xffffffffffffffff
mov qword [r12 + 0x30], 0
mov qword [r12 + 0x28], 0
test rdi, rdi
je 0x1401a5a7e
mov qword [rdi], 0
cmp qword [r12 + 0x1d0], 0
je 0x1401a5ac0
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x3c], edx
call fcn.1401a4280
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [r12 + 0xc0], eax
jmp 0x1401a593f
mov rcx, r12
call fcn.1401a3d30
jmp 0x1401a5a89
call fcn.1401a3a30
nop
Function at 0x1401a7cd0
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0xd0
xor eax, eax
mov r10, rcx
lea rdi, [rsp + 0x6c]
mov ecx, 0x19
mov r11, rdx
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x50]
mov ecx, 6
mov dword [rsp + 0x68], 0x68
rep stosd dword [rdi], eax
mov dword [rsp + 0xa4], 0x101
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdi, qword [rax + 0x10]
mov rax, qword [rdi + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
add rdx, rax
cmp rax, rdx
je 0x1401a7dee
mov esi, dword [rdx + 0x18]
lea r8d, [rsi - 1]
cmp r8d, 0xffffffff
je 0x1401a7dee
mov r9d, dword [rdx + 0x20]
mov ecx, r8d
lea rbx, [rax + rcx*4]
mov ebx, dword [rbx + r9]
mov r9d, 0x811c9dc5
add rbx, rax
movsx esi, byte [rbx]
inc rbx
test sil, sil
jne 0x1401a7ddf
dec r8d
cmp r9d, 0x4a7c0a09
jne 0x1401a7d40
mov r8d, dword [rdx + 0x24]
add rcx, rcx
mov edx, dword [rdx + 0x1c]
xor r9d, r9d
add rcx, rax
movzx ecx, word [rcx + r8]
xor r8d, r8d
lea rcx, [rax + rcx*4]
mov edx, dword [rcx + rdx]
mov dword [rsp + 0x28], 0x10
mov rcx, r10
mov dword [rsp + 0x20], 1
add rax, rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x48], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rdx
xor edx, edx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov rdx, r11
call rax
nop
add rsp, 0xd0
pop rbx
pop rsi
pop rdi
ret
xor r9d, esi
imul r9d, r9d, 0x1000193
jmp 0x1401a7d62
mov rdi, qword [rdi]
jmp 0x1401a7d1e
Function at 0x1401b9810
Capabilities:
Encode data using base64

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
mov rax, rdx
mov r11, rcx
xor edx, edx
mov ecx, 3
div rcx
mov ebp, eax
lea r10d, [rax*4]
test rdx, rdx
je 0x1401b983f
lea r10d, [rax*4 + 4]
movsxd r10, r10d
cmp r9, r10
jb 0x1401b9974
mov rcx, r8
mov rbx, r11
lea rsi, [0x1404e0ec0]
xor edi, edi
cmp edi, ebp
jge 0x1401b98d0
mov r9b, byte [rbx]
add rbx, 3
add rcx, 4
inc edi
mov r13d, r9d
shr r9b, 2
and r9d, 0x3f
shl r13d, 4
mov r9b, byte [rsi + r9]
and r13d, 0x30
mov byte [rcx - 4], r9b
mov r9b, byte [rbx - 2]
mov r12d, r9d
shl r9d, 2
shr r12b, 4
and r9d, 0x3c
or r12d, r13d
and r12d, 0x3f
mov r12b, byte [rsi + r12]
mov byte [rcx - 3], r12b
mov r13b, byte [rbx - 1]
mov r12d, r13d
and r13d, 0x3f
shr r12b, 6
or r9d, r12d
and r9d, 0x3f
mov r9b, byte [rsi + r9]
mov byte [rcx - 2], r9b
mov r9b, byte [rsi + r13]
mov byte [rcx - 1], r9b
jmp 0x1401b985a
mov r9d, eax
xor ebx, ebx
test eax, eax
lea rcx, [r9 + r9*2]
cmovs rcx, rbx
shl r9, 2
add rcx, r11
test eax, eax
cmovs r9, rbx
add r8, r9
cmp rdx, 1
jne 0x1401b9922
mov al, byte [rcx]
lea rcx, [0x1404e0ec0]
mov word [r8 + 2], 0x3d3d
mov edx, eax
shl eax, 4
shr dl, 2
and eax, 0x30
and edx, 0x3f
mov al, byte [rcx + rax]
mov dl, byte [rcx + rdx]
mov byte [r8 + 1], al
mov byte [r8], dl
jmp 0x1401b9977
cmp rdx, 2
jne 0x1401b9977
mov al, byte [rcx]
lea r9, [0x1404e0ec0]
mov r11d, eax
shr al, 2
and eax, 0x3f
shl r11d, 4
mov al, byte [r9 + rax]
and r11d, 0x30
mov byte [r8], al
mov al, byte [rcx + 1]
mov byte [r8 + 3], 0x3d
mov edx, eax
shl eax, 2
shr dl, 4
and eax, 0x3c
or edx, r11d
mov al, byte [r9 + rax]
and edx, 0x3f
mov dl, byte [r9 + rdx]
mov byte [r8 + 2], al
mov byte [r8 + 1], dl
jmp 0x1401b9977
xor r10d, r10d
mov rax, r10
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x1401d1dd0
Capabilities:
Get local ipv4 addresses

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rdi, qword [rcx]
lea rcx, str.ws2_32.dll
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.InetNtop
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
jne 0x1401d1e0b
lea rbp, [0x1401a79c0]
lea r12, [rsp + 0x44]
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov ecx, 2
mov dword [rsp + 0x44], eax
xor esi, esi
mov qword [rsp + 0x20], r12
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x1401d1e6d
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rsi
xor edx, edx
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, dword [rsp + 0x44]
mov qword [rsp + 0x38], r8
call rsi
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov r9, rsi
mov edx, 0x10
mov ecx, 2
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x1401d1ed3
shr rdi, 0x20
mov rcx, rdi
mov rdi, rsi
test rdi, rdi
je 0x1401d1ed3
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x1401d1ecd
mov rdx, qword [rax + 0x10]
cmp dword [rdx + 4], ecx
jne 0x1401d1ec7
add rdx, 4
mov r9d, 0x16
lea r8, [rsp + 0x4a]
mov ecx, 2
call rbp
mov ebx, dword [rdi + 0x60]
jmp 0x1401d1ed3
mov rax, qword [rax + 8]
jmp 0x1401d1e9e
mov rdi, qword [rdi + 8]
jmp 0x1401d1e95
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1401d1f00
Capabilities:
Get local ipv4 addresses

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
mov ebx, edx
mov r12, rcx
lea rcx, str.ws2_32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.InetNtop
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
jne 0x1401d1f3e
lea rbp, [0x1401a79c0]
lea rdi, [rsp + 0x48]
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov ecx, 0x17
mov dword [rsp + 0x48], eax
xor esi, esi
mov qword [rsp + 0x20], rdi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x1401d1fa0
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rsi
xor edx, edx
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, dword [rsp + 0x48]
mov qword [rsp + 0x38], r8
call rsi
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov qword [rsp + 0x20], rdi
mov r9, rsi
xor r8d, r8d
mov edx, 0x10
mov ecx, 0x17
mov rdi, rsi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x1401d2020
test rdi, rdi
je 0x1401d2020
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1401d201a
mov rdx, qword [rcx + 0x10]
mov eax, 8
xor r8d, r8d
mov r10w, word [r12 + rax]
cmp word [rdx + rax], r10w
jne 0x1401d200f
add rax, 2
mov r8b, 1
cmp rax, 0x18
jne 0x1401d1fdb
add rdx, 8
mov r9d, 0x41
lea r8, [rsp + 0x4f]
mov ecx, 0x17
call rbp
mov ebx, dword [rdi + 0x60]
jmp 0x1401d2020
test r8b, r8b
jne 0x1401d1ff4
mov rcx, qword [rcx + 8]
jmp 0x1401d1fca
mov rdi, qword [rdi + 8]
jmp 0x1401d1fc1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1401d2920
Capabilities:
Get local ipv4 addresses

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
xor r8d, r8d
xor r9d, r9d
mov edx, 0x10
xor esi, esi
lea rdi, [rsp + 0x4c]
mov dword [rsp + 0x4c], r8d
mov rbx, rcx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov ecx, 0x17
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x1401d2993
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
call rsi
xor edx, edx
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, dword [rsp + 0x4c]
mov qword [rsp + 0x38], r8
call rsi
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
mov qword [rsp + 0x20], rdi
mov edx, 0x10
mov r9, rsi
xor r8d, r8d
mov ecx, 0x17
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov edx, eax
mov rax, rsi
test edx, edx
jne 0x1401d2a03
test rax, rax
je 0x1401d2a03
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x1401d29fd
mov r8, qword [rdx + 0x10]
mov dil, byte [r8 + 8]
lea ecx, [rdi - 2]
cmp cl, 1
ja 0x1401d29f7
movups xmm6, xmmword [r8 + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
movups xmmword [rbx], xmm6
mov dword [rbx + 0x10], ecx
jmp 0x1401d2a25
mov rdx, qword [rdx + 8]
jmp 0x1401d29bf
mov rax, qword [rax + 8]
jmp 0x1401d29b6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
xor edx, edx
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], edx
movaps xmm6, xmmword [rsp + 0x50]
mov rax, rbx
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
Function at 0x1401e5f10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov rbx, rcx
mov ecx, 0xa0
call fcn.1403cd4b0
lea r8, [rbx + 0x10c]
mov rsi, rax
mov rax, qword [rbx + 0x18]
mov rcx, rsi
mov rdx, qword [rax + 0x168]
call fcn.14027f960
mov rdx, rsi
lea rdi, [rsp + 0x6e]
lea rcx, [rbx + 0x128]
call fcn.140370050
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x1a
mov dword [rsp + 0x20], r8d
lea r12, [rsp + 0x20]
mov rdx, qword [rbx + 0x128]
rep stosb byte [rdi], al
mov qword [rsp + 0x28], r9
lea rbp, [rsp + 0xa8]
lea rsi, [rsp + 0x88]
mov qword [rsp + 0x30], r9
mov rcx, qword [rdx + 8]
mov word [rsp + 0x6c], 2
cmp rcx, 0xffffffffffffffff
jne 0x1401e5fb7
mov edx, 0x2719
mov rcx, r12
call fcn.1402c62c0
jmp 0x1401e5fed
lea rdx, [rsp + 0x6c]
mov r8, rbp
mov dword [rsp + 0xa8], 0x1c
call qword [sym.imp.WSOCK32.dll_getsockname]
xor edx, edx
mov rcx, r12
movsxd r13, dword [rsp + 0xa8]
test eax, eax
mov edi, eax
setne dl
call fcn.140285ad0
test edi, edi
je 0x1401e601b
mov rcx, r12
lea r8, [0x14050bcd0]
mov rdx, r12
mov r13d, 2
call fcn.1402c4e30
lea rdi, [rsp + 0xaa]
mov ecx, 0x1a
xor eax, eax
rep stosb byte [rdi], al
jmp 0x1401e60fa
cmp r13, 0x80
jbe 0x1401e60db
lea rdi, [rsp + 0x38]
mov edx, 0x2726
mov rcx, rdi
call fcn.1402c5ab0
lea rax, [0x140441e1c]
mov rcx, rdi
mov qword [rsp + 0x60], 0x6a
mov qword [rsp + 0x50], rax
lea rax, [0x140441e5f]
mov qword [rsp + 0x58], rax
call fcn.1402ee430
test al, al
je 0x1401e60db
mov rdx, rdi
mov rcx, rsi
call fcn.1402ee330
mov rdx, rsi
mov rcx, rbp
call fcn.140368f40
mov rcx, rsi
call fcn.1403907e0
lea rax, fcn.1402c6dc0
movups xmm0, xmmword [rsp + 0x38]
mov rcx, rbp
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], rax
call fcn.140274990
mov rbx, rax
mov rcx, rsi
call fcn.1403907e0
jmp 0x1401e60d3
mov rcx, rbx
call fcn.1401963f0
movups xmm1, xmmword [rsp + 0x6c]
movups xmm2, xmmword [rsp + 0x78]
mov r13d, dword [rsp + 0x6c]
movups xmmword [rsp + 0xa8], xmm1
movups xmmword [rsp + 0xb4], xmm2
lea rdi, [0x140441b5a]
lea rdx, [0x140441e66]
mov r8, rsi
mov rcx, r12
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x98], 0x462
call fcn.140287cc0
mov rax, qword [rbx + 0x128]
xor ecx, ecx
xor edx, edx
mov word [rsp + 0xa8], r13w
movups xmm4, xmmword [rsp + 0xb4]
mov r8, rsi
movups xmm3, xmmword [rsp + 0xa8]
mov dword [rsp + 0x88], edx
mov edx, 0x7fffffff
mov qword [rsp + 0x90], rcx
movups xmmword [rbx + 0x10c], xmm3
mov qword [rsp + 0x98], rcx
movups xmmword [rbx + 0x118], xmm4
mov rcx, qword [rax + 8]
call fcn.140287490
lea rdx, [0x140441bd4]
mov rcx, rsi
mov r8, rbp
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0xb8], 0x270
call fcn.140287cc0
mov rcx, rbx
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1401e61f0
Function at 0x140212970
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
or rax, rdx
and eax, 3
jne 0x14021298f
mov r8d, dword [rdx + rax]
xor dword [rcx + rax], r8d
add rax, 4
cmp rax, 0x10
jne 0x14021297b
jmp 0x1402129a2
xor eax, eax
mov r8b, byte [rdx + rax]
xor byte [rcx + rax], r8b
inc rax
cmp rax, 0x10
jne 0x140212991
ret

Function at 0x140212fd0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
shr r8, 4
mov eax, r8d
test r8d, r8d
jle 0x140212fe6
mov r8, rdx
mov edx, eax
jmp fcn.140212ff0
ret

Function at 0x140212ff0
Capabilities:
Decrypt data using aes via x86 extensions
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rax, qword [0x1404d90c0]
cmp byte [rax], 0
mov rdi, rcx
mov ebp, edx
mov rsi, r8
mov rbx, r9
jne 0x140213024
xor r12d, r12d
lea r13, [rcx + 0x28]
jmp 0x1402130c6
mov rax, qword [rcx + 0x20]
mov rdx, qword [rcx + 0x128]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [r8]
movaps xmm2, xmm0
pxor xmm0, xmmword [rdx + 0xe0]
aesdec xmm0, xmmword [rdx + 0xd0]
aesdec xmm0, xmmword [rdx + 0xc0]
aesdec xmm0, xmmword [rdx + 0xb0]
aesdec xmm0, xmmword [rdx + 0xa0]
aesdec xmm0, xmmword [rdx + 0x90]
aesdec xmm0, xmmword [rdx + 0x80]
aesdec xmm0, xmmword [rdx + 0x70]
aesdec xmm0, xmmword [rdx + 0x60]
aesdec xmm0, xmmword [rdx + 0x50]
aesdec xmm0, xmmword [rdx + 0x40]
aesdec xmm0, xmmword [rdx + 0x30]
aesdec xmm0, xmmword [rdx + 0x20]
aesdec xmm0, xmmword [rdx + 0x10]
aesdeclast xmm0, xmmword [rdx]
pxor xmm0, xmm1
movups xmmword [r9], xmm0
movaps xmm1, xmm2
add r8, 0x10
add r9, 0x10
dec ebp
jne 0x140213032
movups xmmword [rax], xmm1
jmp 0x1402130fc
cmp r12d, ebp
jge 0x1402130fc
mov r8, rbx
mov rdx, rsi
mov rcx, r13
movups xmm6, xmmword [rsi]
call fcn.140213460
mov rdx, qword [rdi + 0x20]
mov rcx, rbx
inc r12d
add rsi, 0x10
add rbx, 0x10
call fcn.140212970
mov rax, qword [rdi + 0x20]
movups xmmword [rax], xmm6
jmp 0x1402130c6
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x1402131c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
shr r8, 4
mov eax, r8d
test r8d, r8d
jle 0x1402131d6
mov r8, rdx
mov edx, eax
jmp fcn.1402131e0
ret
Function at 0x1402131e0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x1404d90c0]
cmp byte [rax], 0
mov rsi, rcx
mov ebp, edx
mov rbx, r8
mov r12, r9
jne 0x14021320e
xor edi, edi
lea r13, [rcx + 0x28]
jmp 0x1402132ad
mov rax, qword [rcx + 0x20]
mov rdx, qword [rcx + 0x128]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [r8]
pxor xmm0, xmm1
pxor xmm0, xmmword [rdx]
aesenc xmm0, xmmword [rdx + 0x10]
aesenc xmm0, xmmword [rdx + 0x20]
aesenc xmm0, xmmword [rdx + 0x30]
aesenc xmm0, xmmword [rdx + 0x40]
aesenc xmm0, xmmword [rdx + 0x50]
aesenc xmm0, xmmword [rdx + 0x60]
aesenc xmm0, xmmword [rdx + 0x70]
aesenc xmm0, xmmword [rdx + 0x80]
aesenc xmm0, xmmword [rdx + 0x90]
aesenc xmm0, xmmword [rdx + 0xa0]
aesenc xmm0, xmmword [rdx + 0xb0]
aesenc xmm0, xmmword [rdx + 0xc0]
aesenc xmm0, xmmword [rdx + 0xd0]
aesenclast xmm0, xmmword [rdx + 0xe0]
movaps xmm1, xmm0
movups xmmword [r9], xmm0
add r8, 0x10
add r9, 0x10
dec ebp
jne 0x14021321c
movups xmmword [rax], xmm1
jmp 0x1402132f0
cmp ebp, edi
jle 0x1402132f0
mov rcx, qword [rsi + 0x20]
mov rdx, rbx
add rbx, 0x10
call fcn.140212970
mov rdx, qword [rsi + 0x20]
mov rcx, r13
mov r8, rdx
call fcn.140213530
mov rdx, qword [rsi + 0x20]
mov rax, rdi
inc rdi
shl rax, 4
mov r8, qword [rdx]
mov r9, qword [rdx + 8]
mov qword [r12 + rax], r8
mov qword [r12 + rax + 8], r9
jmp 0x1402132ad
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140213350
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
mov rax, rdx
mov rdx, qword [0x1404d90c0]
cmp byte [rdx], 0
je 0x140213448
mov rdx, rax
call fcn.1402138d0
mov rax, qword [rcx + 0x100]
movaps xmm0, xmmword [rax + 0x10]
aesimc xmm0, xmm0
movaps xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [rax + 0x20]
aesimc xmm0, xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [rax + 0x30]
aesimc xmm0, xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmm0, xmmword [rax + 0x40]
aesimc xmm0, xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [rax + 0x50]
aesimc xmm0, xmm0
movaps xmmword [rax + 0x50], xmm0
movaps xmm0, xmmword [rax + 0x60]
aesimc xmm0, xmm0
movaps xmmword [rax + 0x60], xmm0
movaps xmm0, xmmword [rax + 0x70]
aesimc xmm0, xmm0
movaps xmmword [rax + 0x70], xmm0
movaps xmm0, xmmword [rax + 0x80]
aesimc xmm0, xmm0
movaps xmmword [rax + 0x80], xmm0
movaps xmm0, xmmword [rax + 0x90]
aesimc xmm0, xmm0
movaps xmmword [rax + 0x90], xmm0
movaps xmm0, xmmword [rax + 0xa0]
aesimc xmm0, xmm0
movaps xmmword [rax + 0xa0], xmm0
movaps xmm0, xmmword [rax + 0xb0]
aesimc xmm0, xmm0
movaps xmmword [rax + 0xb0], xmm0
movaps xmm0, xmmword [rax + 0xc0]
aesimc xmm0, xmm0
movaps xmmword [rax + 0xc0], xmm0
movaps xmm0, xmmword [rax + 0xd0]
aesimc xmm0, xmm0
movaps xmmword [rax + 0xd0], xmm0
add rsp, 0x28
ret
lea r8, [rcx + 0x108]
mov edx, 0x100
mov rcx, rax
add rsp, 0x28
jmp fcn.140084320
Function at 0x140213460
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rcx
mov rcx, rdx
mov rdx, r8
mov r8, qword [0x1404d90c0]
cmp byte [r8], 0
je 0x1402134f1
mov rax, qword [rax + 0x100]
movups xmm0, xmmword [rcx]
pxor xmm0, xmmword [rax + 0xe0]
aesdec xmm0, xmmword [rax + 0xd0]
aesdec xmm0, xmmword [rax + 0xc0]
aesdec xmm0, xmmword [rax + 0xb0]
aesdec xmm0, xmmword [rax + 0xa0]
aesdec xmm0, xmmword [rax + 0x90]
aesdec xmm0, xmmword [rax + 0x80]
aesdec xmm0, xmmword [rax + 0x70]
aesdec xmm0, xmmword [rax + 0x60]
aesdec xmm0, xmmword [rax + 0x50]
aesdec xmm0, xmmword [rax + 0x40]
aesdec xmm0, xmmword [rax + 0x30]
aesdec xmm0, xmmword [rax + 0x20]
aesdec xmm0, xmmword [rax + 0x10]
aesdeclast xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
ret
lea r8, [rax + 0x108]
jmp fcn.140084d50

Function at 0x140213500
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdx
mov rdx, qword [0x1404d90c0]
cmp byte [rdx], 0
je 0x140213517
mov rdx, rax
jmp fcn.1402138d0
lea r8, [rcx + 0x108]
mov edx, 0x100
mov rcx, rax
jmp fcn.140084310

Function at 0x140213530
Capabilities:
Encrypt data using aes
Encrypt data using aes via x86 extensions
Reference aes constants

Disassembly:
mov rax, rcx
mov rcx, rdx
mov rdx, r8
mov r8, qword [0x1404d90c0]
cmp byte [r8], 0
je 0x1402135c1
mov rax, qword [rax + 0x100]
movups xmm0, xmmword [rcx]
pxor xmm0, xmmword [rax]
aesenc xmm0, xmmword [rax + 0x10]
aesenc xmm0, xmmword [rax + 0x20]
aesenc xmm0, xmmword [rax + 0x30]
aesenc xmm0, xmmword [rax + 0x40]
aesenc xmm0, xmmword [rax + 0x50]
aesenc xmm0, xmmword [rax + 0x60]
aesenc xmm0, xmmword [rax + 0x70]
aesenc xmm0, xmmword [rax + 0x80]
aesenc xmm0, xmmword [rax + 0x90]
aesenc xmm0, xmmword [rax + 0xa0]
aesenc xmm0, xmmword [rax + 0xb0]
aesenc xmm0, xmmword [rax + 0xc0]
aesenc xmm0, xmmword [rax + 0xd0]
aesenclast xmm0, xmmword [rax + 0xe0]
movups xmmword [rdx], xmm0
ret
lea r8, [rax + 0x108]
jmp fcn.1400847a0

Function at 0x1402137e0
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
lea r12, [0x1404e2fa0]
lea rbp, [0x1404e27a0]
lea rdi, [0x1404e37a0]
lea rbx, [0x1404e3fa0]
lea r11, [0x1404e47a0]
lea r10, [0x1404e4fa0]
lea r9, [0x1404e57a0]
lea r8, [0x1404e5fa0]
mov rdx, rcx
xor ecx, ecx
movzx esi, byte [rdx + rcx + 0x38]
movzx eax, byte [rdx + rcx + 0x30]
movzx r13d, byte [rdx + rcx]
mov rax, qword [r12 + rax*8]
xor rax, qword [rbp + rsi*8]
movzx esi, byte [rdx + rcx + 0x28]
xor rax, qword [rdi + rsi*8]
movzx esi, byte [rdx + rcx + 0x20]
xor rax, qword [rbx + rsi*8]
movzx esi, byte [rdx + rcx + 0x18]
xor rax, qword [r11 + rsi*8]
movzx esi, byte [rdx + rcx + 0x10]
xor rax, qword [r10 + rsi*8]
movzx esi, byte [rdx + rcx + 8]
xor rax, qword [r9 + rsi*8]
mov rsi, rsp
xor rax, qword [r8 + r13*8]
mov qword [rsi + rcx*8], rax
inc rcx
cmp rcx, 8
jne 0x140213829
mov rdi, rdx
mov ecx, 0x10
rep movsd dword [rdi], dword [rsi]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret