joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400739ea
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov rdx, rcx
sar rdx, 0x39
test edx, edx
js 0x140073a0a
cmp edx, 0x3e
jbe 0x140073a11
movabs rax, 0x7fffffffffffffff
jmp 0x140073b8b
xor eax, eax
jmp 0x140073b8b
movabs rax, 0x3fffffffffffffe0
mov r8, rcx
shl r8, 7
je 0x140073b39
shl rcx, 5
and rcx, rax
movabs r8, 0x26a3d0e401dd846d
lea r9, [0x1402284c8]
mov eax, 1
mov r11, r8
mov r10, rcx
mov rsi, rcx
mov ecx, eax
sar r8, cl
sar rsi, 0x3f
add r8, rsi
xor r8, rsi
add r8, r11
mov rcx, qword [r9]
add rcx, rsi
xor rcx, rsi
sub r10, rcx
lea rcx, [r10 + r10]
add r9, 8
inc rax
cmp rax, 5
jne 0x140073a45
mov ecx, 4
lea r9, [0x1402284c8]
mov r11, r8
sar r8, cl
mov rax, r10
sar r10, 0x3f
add r8, r10
xor r8, r10
add r8, r11
mov r11, qword [r9 + rcx*8 - 8]
add r11, r10
xor r11, r10
sub rax, r11
lea r10, [rax + rax]
inc rcx
cmp rcx, 0xe
jne 0x140073a89
mov ecx, 0xd
cmp rcx, 0x21
je 0x140073af1
mov r10, r8
sar r10, cl
mov r11, rax
sar r11, 0x3f
add r10, r11
xor r10, r11
add r8, r10
mov r10, qword [r9 + rcx*8 - 8]
add r10, r11
xor r10, r11
sub rax, r10
add rax, rax
inc rcx
jmp 0x140073abf
xor r9d, r9d
cmp edx, 0x1f
jl 0x140073b75
mov ecx, 0x20
movabs r10, 0x2e2a8eca5705fc2f
mov r11d, r9d
mov rsi, rax
mov r9, r8
sar r9, cl
sar rsi, 0x3f
add r9d, esi
xor r9d, esi
add r9d, r11d
lea r11, [rsi + r10]
xor r11, rsi
sub rax, r11
cmp rcx, 0x27
je 0x140073b3f
add rax, rax
inc rcx
jmp 0x140073b08
add rax, 0x20
jmp 0x140073b79
mov ecx, 0x27
cmp rcx, 0x3d
je 0x140073b72
mov r11, rax
sar r11, 0x3f
mov rsi, r8
sar rsi, cl
add esi, r11d
xor esi, r11d
add r9d, esi
lea rsi, [r11 + r10]
xor rsi, r11
sub rax, rsi
add rax, rax
inc rcx
jmp 0x140073b44
movsxd r9, r9d
lea rax, [r9 + r8*2]
cmp edx, 0x3e
je 0x140073b8b
mov cl, 0x3d
sub cl, dl
sar rax, cl
inc rax
sar rax, 1
pop rsi
ret

Function at 0x140073c44
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
jle 0x140073c8c
mov rdx, rcx
bsr rax, rcx
mov r8d, 0x3d
mov ecx, 0x3d
sub ecx, eax
mov r9, rdx
shr r9, 1
shl rdx, cl
cmp r8d, eax
cmovb rdx, r9
lea rcx, [rdx - 1]
test rdx, rcx
jne 0x140073c98
shl rax, 0x39
jmp 0x140073d54
mov rax, 0xffffffffffffffff
jmp 0x140073d54
movabs r8, 0x2000000000000000
add r8, rdx
movabs r9, 0xe000000000000000
add r9, rdx
mov qword [rsp], 3
mov qword [rsp + 8], 0xc
mov qword [rsp + 0x10], 0x27
mov qword [rsp + 0x18], 0x3d
xor r10d, r10d
lea r11, [0x1402284c8]
xor esi, esi
xor edx, edx
mov rcx, rsi
mov rsi, qword [rsp + r10*8]
lea rdi, [rsi + 1]
mov rbx, r9
sar rbx, 0x3f
cmp rcx, 0x1f
mov r14d, 0x1f
cmovb r14, rcx
mov r14d, r14d
mov r14, qword [r11 + r14*8]
sar r14, cl
add r14, rbx
xor r14, rbx
inc rcx
mov r15, r8
sar r15, cl
mov r12, r9
sar r12, cl
add rdx, r14
add r12, rbx
xor r12, rbx
sub r8, r12
add r15, rbx
xor r15, rbx
sub r9, r15
cmp rdi, rcx
jne 0x140073cee
inc r10
cmp r10, 4
jne 0x140073ce3
add rdx, 8
sar rdx, 4
shl rax, 0x39
add rax, rdx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400d1a12
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov esi, edx
mov rbx, rcx
mov rdi, qword [rsp + 0x70]
mov rax, qword [r9 + 0x10]
mov rcx, qword [r9]
mov rdx, qword [r9 + 8]
imul r8, rax, 0xa
inc rax
mov r10, qword [rdi + r14]
mov qword [rdx + r8], r10
mov word [rdx + r8 + 8], r14w
mov qword [r9 + 0x10], rax
sub rcx, rax
cmp rcx, 4
ja 0x1400d1a5d
mov rcx, r9
call fcn.1400d1a98
add rdi, r14
mov eax, esi
test esi, esi
je 0x1400d1a6d
movzx edx, word [rdi + rax*2 - 2]
jmp 0x1400d1a71
mov dx, 0x8000
movzx r8d, word [rdi + rax*2]
mov r9d, esi
xor r9d, 3
mov rcx, rbx
call fcn.1400d17a1
mov rcx, rdi
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400d1b5a

Function at 0x1400d1e17
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov esi, edx
mov rbx, rcx
mov rdi, qword [rsp + 0x70]
mov rax, qword [r9 + 0x28]
mov rcx, qword [r9 + 0x18]
mov rdx, qword [r9 + 0x20]
imul r8, rax, 0x22
inc rax
movups xmm0, xmmword [rdi + r14]
movups xmm1, xmmword [rdi + r14 + 0x10]
movups xmmword [rdx + r8 + 0x10], xmm1
movups xmmword [rdx + r8], xmm0
mov word [rdx + r8 + 0x20], r14w
mov qword [r9 + 0x28], rax
sub rcx, rax
cmp rcx, 0x10
ja 0x1400d1e75
add r9, 0x18
mov rcx, r9
call fcn.1400d2081
add rdi, r14
mov eax, esi
test esi, esi
je 0x1400d1e85
movzx edx, word [rdi + rax*2 - 2]
jmp 0x1400d1e89
mov dx, 0x8000
movzx r8d, word [rdi + rax*2]
mov r9d, esi
xor r9d, 7
mov rcx, rbx
call fcn.1400d17a1
mov rcx, rdi
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400d23cb
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rdx, rcx
movzx eax, word [rcx + 0xc]
mov ecx, eax
shr ecx, 5
neg ecx
add ecx, eax
inc ecx
mov edi, eax
shr edi, 4
add edi, 5
mov word [rdx + 0xc], cx
lea r9, [0x14023e820]
mov ecx, 6
mov r8d, 7
call fcn.140081837
lea rcx, [rax + rdx*2]
lea rbx, [rsp + 0x20]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
and edi, 0xf
mov rcx, rbx
call fcn.1400d1bfc
test rdx, rdx
je 0x1400d2465
movzx r8d, word [rdx]
cmp eax, esi
jae 0x1400d2452
mov eax, 0xffff8000
sub eax, r8d
movzx eax, ax
mov ecx, edi
shr eax, cl
add eax, r8d
jmp 0x1400d2460
movzx eax, r8w
mov ecx, edi
shr eax, cl
sub r8d, eax
mov eax, r8d
mov word [rdx], ax
jmp 0x1400d2429
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400dc8df
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rax, rdx
mov r10, rcx
mov rcx, qword [rcx]
mov rbx, qword [r10 + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
mov rcx, qword [r10 + 0x20]
mov qword [rsp + 0x28], rcx
mov r10, qword [r10 + 0x28]
mov rcx, qword [rdx]
mov r15, qword [rdx + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x38], rcx
mov r12, qword [rdx + 0x20]
mov r13, qword [rdx + 0x28]
cmp r8, r12
mov qword [rsp + 0x20], r8
cmovb r12, r8
xor eax, eax
mov qword [rsp + 0x30], r9
xor edi, edi
xor esi, esi
xor r11d, r11d
xor ebp, ebp
sub r9, 1
jb 0x1400dc9d2
sub r10, 1
jb 0x1400dc9d2
sub r13, 1
setb cl
test rbx, rbx
je 0x1400dc9d2
test cl, cl
jne 0x1400dc9d2
test r15, r15
je 0x1400dc9d2
mov rcx, qword [rsp + 0x28]
cmp rcx, qword [rsp + 0x20]
jb 0x1400dcac8
mov rcx, qword [rsp + 0x40]
add rcx, rbx
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x38]
add rcx, r15
mov qword [rsp + 0x48], rcx
xor r14d, r14d
cmp r12, r14
je 0x1400dc9c3
movzx ecx, byte [rbx + r14]
movzx r8d, byte [r15 + r14]
inc r14
add ebp, ecx
add r11d, r8d
mov edx, r8d
imul r8d, ecx
imul ecx, ecx
add esi, ecx
imul edx, edx
add edi, edx
add eax, r8d
jmp 0x1400dc996
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
jmp 0x1400dc944
mov r8, qword [rsp + 0x30]
imul r8, qword [rsp + 0x20]
lea rcx, [r8 - 1]
cmp rcx, 0x40
jae 0x1400dcab0
mov ecx, r11d
mov edx, ebp
add eax, eax
mov ebx, edi
sub ebx, eax
add ebx, esi
lea rax, [0x1402415c0]
movzx eax, word [rax + r8*2 - 2]
imul rdx, rdx
imul rdx, rax
mov r8d, 0x2000
add rdx, r8
shr rdx, 0xe
xor r9d, r9d
sub esi, edx
cmovb esi, r9d
imul rcx, rcx
imul rcx, rax
add rcx, r8
shr rcx, 0xe
sub edi, ecx
cmovb edi, r9d
imul rsi, rax
mov ecx, 0x80
add rsi, rcx
shr rsi, 8
imul rdi, rax
add rdi, rcx
shr rdi, 8
mov rcx, qword [rsp + 0xc0]
add ecx, ecx
and cl, 0x1e
xor cl, 0x10
shr esi, cl
shr edi, cl
mov rcx, rsi
imul rcx, rdi
add rcx, 0xabc0d9
call fcn.14007277f
mov ecx, edx
add rsi, rdi
imul rdx, rsi, 0x1167
add rdx, 0x4485900
movzx eax, ax
imul rax, rdx
shr rax, 0xe
imul rax, rbx
shr rax, cl
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rav1e_0.7.1_srcdist.rs
mov edx, 0x40
mov rcx, 0xffffffffffffffff
call fcn.1401c6eb0
lea r8, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rav1e_0.7.1_srcdist.rs
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
call fcn.1401c6f20
int3
Function at 0x1400de81a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov esi, edx
mov rbx, rcx
mov rdi, qword [rsp + 0x70]
mov rax, qword [r9 + 0x10]
mov rcx, qword [r9]
mov rdx, qword [r9 + 8]
imul r8, rax, 0xa
inc rax
mov r10, qword [rdi + r14]
mov qword [rdx + r8], r10
mov word [rdx + r8 + 8], r14w
mov qword [r9 + 0x10], rax
sub rcx, rax
cmp rcx, 4
ja 0x1400de865
mov rcx, r9
call fcn.1400d1a98
invalid
invalid
add rdi, r14
mov eax, esi
test esi, esi
je 0x1400de875
movzx edx, word [rdi + rax*2 - 2]
jmp 0x1400de879
mov dx, 0x8000
movzx r8d, word [rdi + rax*2]
mov r9d, esi
xor r9d, 3
mov rcx, rbx
call fcn.1400de727
mov rcx, rdi
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400d1b5a

Function at 0x1400de93b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov esi, edx
mov rbx, rcx
mov rdi, qword [rsp + 0x70]
jo 0x1400de99b
mov eax, dword [rcx + 0x28]
mov rcx, qword [r9 + 0x18]
mov rdx, qword [r9 + 0x20]
imul r8, rax, 0x22
inc rax
movups xmm0, xmmword [rdi + r14]
movups xmm1, xmmword [rdi + r14 + 0x10]
movups xmmword [rdx + r8 + 0x10], xmm1
movups xmmword [rdx + r8], xmm0
mov word [rdx + r8 + 0x20], r14w
mov qword [r9 + 0x28], rax
sub rcx, rax
cmp rcx, 0x10
ja 0x1400de999
add r9, 0x18
mov rcx, r9
call fcn.1400d2081
add rdi, r14
mov eax, esi
test esi, esi
je 0x1400de9a9
movzx edx, word [rdi + rax*2 - 2]
jmp 0x1400de9ad
mov dx, 0x8000
movzx r8d, word [rdi + rax*2]
mov r9d, esi
xor r9d, 7
mov rcx, rbx
call fcn.1400de727
mov rcx, rdi
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x1400d23cb
Function at 0x1400f0db4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push rbp
push r12
push rsi
push rdi
push rbx
mov eax, 0x3758
call fcn.1401c5d60
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x36c0], xmm6
mov qword [rbp + 0x36b8], 0xfffffffffffffffe
mov qword [rbp + 0x34f8], r9
mov qword [rbp + 0x36a8], r8
mov r15, rdx
and qword [rbp + 0x3608], 0
mov qword [rbp + 0x3610], 1
and qword [rbp + 0x3618], 0
mov qword [rbp + 0x3350], rcx
cmp byte [rdx + 0x32b], 0
mov qword [rbp + 0x3688], rdx
je 0x1400f11c7
mov r14d, dword [r15 + 0x2d8]
mov bl, 2
cmp r14, 7
jne 0x1400f0e46
mov rsi, qword [rbp + 0x36a8]
jmp 0x1400f0e90
cmp r14d, 6
ja 0x1400f32c1
movzx ecx, byte [r15 + r14 + 0x2f4]
cmp rcx, 8
mov rsi, qword [rbp + 0x36a8]
jae 0x1400f32d8
mov rdx, qword [r15 + rcx*8 + 0xa0]
test rdx, rdx
je 0x1400f0e90
mov bl, byte [rdx + 0x38]
add rdx, 0x39
lea rcx, [rbp + 0x2b00]
mov r8d, 0xe3
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 0x3f]
mov byte [rcx - 1], bl
lea rdx, [rbp + 0x2b00]
mov r8d, 0xe3
call sub.VCRUNTIME140.dll_memcpy
lea rbx, [rbp + 0x2e50]
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.1400b6fe3
mov rdi, rsi
add rsi, 0x3000
mov r8d, 0xe4
mov rcx, rsi
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp r14d, 7
mov al, 1
mov byte [rdi + 0x30dc], al
mov byte [rdi + 0x30de], al
sete byte [rdi + 0x30dd]
movzx edx, byte [r15 + 0x2fb]
push 1
pop r13
sub r13d, edx
cmp r14d, 7
jne 0x1400f116a
mov dword [rbp + 0x3680], edx
cmp byte [r15 + 0xf0], 2
lock add byte [rax], al
add byte [rdx], al
mov qword [rbp + 0x2e50], 8
lea rcx, [rdi + 0x3040]
xor eax, eax
cmp rax, 8
je 0x1400f332c
cmp byte [rsi + rax*8], 0
je 0x1400f1194
cmp word [rcx], r13w
jge 0x1400f119d
add rcx, 0x10
inc rax
jmp 0x1400f117e
mov rcx, qword [rbp + 0x36a8]
mov byte [rcx + 0x30e1], al
mov rax, qword [r15 + 0x2b8]
mov r8, qword [rax + 0x80]
mov rcx, rsi
call fcn.14007b355
mov r15, qword [rbp + 0x3688]
lea r8, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rav1e_0.7.1_srcencoder.rs
push 7
pop rdx
mov rcx, r14
call fcn.1401c6eb0
jmp 0x1400f3768
lea r8, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rav1e_0.7.1_srcencoder.rs
push 8
pop rdx
call fcn.1401c6eb0
jmp 0x1400f3768
lea r9, [rbp - 0x40]
and qword [r9], 0
lea rax, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rav1e_0.7.1_src_segmentation.rs
mov qword [rsp + 0x20], rax
lea r8, [0x14023e7a0]
lea rdx, [rbp + 0x2e50]
mov cl, 1
call fcn.1401c6b08
jmp 0x1400f3768
Function at 0x14010dd5f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rax, rdx
mov r10, rcx
mov rcx, qword [rcx]
mov rbx, qword [r10 + 8]
mov rdx, qword [rcx]
mov rcx, qword [r10 + 0x20]
mov qword [rsp + 0x28], rcx
mov r10, qword [r10 + 0x28]
mov rcx, qword [rax]
mov r15, qword [rax + 8]
mov rcx, qword [rcx]
mov r12, qword [rax + 0x20]
mov r13, qword [rax + 0x28]
cmp r8, r12
mov qword [rsp + 0x20], r8
cmovb r12, r8
add rdx, rdx
mov qword [rsp + 0x40], rdx
add rcx, rcx
mov qword [rsp + 0x38], rcx
xor eax, eax
mov qword [rsp + 0x30], r9
xor edi, edi
xor esi, esi
xor r11d, r11d
xor ebp, ebp
sub r9, 1
jb 0x14010de59
sub r10, 1
jb 0x14010de59
sub r13, 1
setb cl
test rbx, rbx
je 0x14010de59
test cl, cl
jne 0x14010de59
test r15, r15
je 0x14010de59
mov rcx, qword [rsp + 0x28]
cmp rcx, qword [rsp + 0x20]
jb 0x14010df4f
mov rcx, qword [rsp + 0x40]
add rcx, rbx
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x38]
add rcx, r15
mov qword [rsp + 0x48], rcx
xor r14d, r14d
cmp r12, r14
je 0x14010de4a
movzx r8d, word [rbx + r14*2]
movzx ecx, word [r15 + r14*2]
inc r14
add ebp, r8d
add r11d, ecx
mov edx, ecx
imul ecx, r8d
imul r8d, r8d
add esi, r8d
imul edx, edx
add edi, edx
add eax, ecx
jmp 0x14010de1c
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
jmp 0x14010ddca
mov r8, qword [rsp + 0x30]
imul r8, qword [rsp + 0x20]
lea rcx, [r8 - 1]
cmp rcx, 0x40
jae 0x14010df37
mov ecx, r11d
mov edx, ebp
add eax, eax
mov ebx, edi
sub ebx, eax
add ebx, esi
lea rax, [0x1402415c0]
movzx eax, word [rax + r8*2 - 2]
imul rdx, rdx
imul rdx, rax
mov r8d, 0x2000
add rdx, r8
shr rdx, 0xe
xor r9d, r9d
sub esi, edx
cmovb esi, r9d
imul rcx, rcx
imul rcx, rax
add rcx, r8
shr rcx, 0xe
sub edi, ecx
cmovb edi, r9d
imul rsi, rax
mov ecx, 0x80
add rsi, rcx
shr rsi, 8
imul rdi, rax
add rdi, rcx
shr rdi, 8
mov rcx, qword [rsp + 0xc0]
add ecx, ecx
and cl, 0x1e
xor cl, 0x10
shr esi, cl
shr edi, cl
mov rcx, rsi
imul rcx, rdi
add rcx, 0xabc0d9
call fcn.14007277f
mov ecx, edx
add rsi, rdi
imul rdx, rsi, 0x1167
add rdx, 0x4485900
movzx eax, ax
imul rax, rdx
shr rax, 0xe
imul rax, rbx
shr rax, cl
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rav1e_0.7.1_srcdist.rs
mov edx, 0x40
mov rcx, 0xffffffffffffffff
call fcn.1401c6eb0
lea r8, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rav1e_0.7.1_srcdist.rs
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
call fcn.1401c6f20
int3
Function at 0x14016cbbd
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x11a8
call fcn.1401c5d60
sub rsp, rax
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x1110], xmm8
movdqa xmmword [rbp + 0x1100], xmm7
movaps xmmword [rbp + 0x10f0], xmm6
mov qword [rbp + 0x10e8], 0xfffffffffffffffe
mov qword [rbp + 0x1058], rdx
mov qword [rbp + 0x1060], rcx
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea r13, [rbp - 0x40]
push 0x33
pop r8
mov rcx, r13
call fcn.14015638e
lea rax, [rbp + 0x1070]
and qword [rax], 0
mov rdx, qword [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov qword [rbp + 0x10e0], rdx
xor r8d, r8d
mov r9d, 0x20219
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x14016cc66
mov rdi, qword [rbp + 0x1070]
jmp 0x14016cc71
mov rdi, rsi
shl rdi, 0x20
or rdi, 2
mov rdx, qword [rbp + 0x10e0]
mov rcx, qword [rbp - 0x40]
call fcn.1401c595f
xor eax, eax
test esi, esi
setne al
mov qword [rbp + 0x1038], rax
mov qword [rbp + 0x1040], rdi
je 0x14016ccb4
mov rax, qword [rbp + 0x1060]
and word [rax], 0
mov rax, qword [rbp + 0x1058]
inc rax
mov qword [rbp + 0xfd0], rax
xor eax, eax
mov qword [rbp + 0x1008], rax
xorps xmm6, xmm6
lea rsi, [rbp + 0x1070]
movabs r12, 0x8000000000000000
push 2
pop rax
mov qword [rbp + 0x1010], rax
xor ebx, ebx
mov qword [rbp + 0x1068], rdi

Function at 0x140171760
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140171785
cmp rax, rcx
je 0x14017178b
cmp rdx, 4
jae 0x140171792
xor eax, eax
xor r8d, r8d
jmp 0x140171830
pop rbp
jmp fcn.140024fa0
xor eax, eax
jmp 0x140171847
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1401cd9a0]
movdqa xmm3, xmmword [0x1401cd9b0]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1401717c0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140171847
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140171830
pop rbp
ret

Function at 0x140175323
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
add byte [rax - 0x39], cl
push 0xfffffffffffffffe

Function at 0x140175c1a
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x20]

Function at 0x140176245
Capabilities:
Create directory

Disassembly:
mov r8, rdx
mov rdx, rcx
mov cl, 1
jmp fcn.140196550
Function at 0x140178f01
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov r10d, r8d
rol r10d, 0x19
mov eax, dword [rdx]
mov esi, eax
rol esi, 0x19
mov r11d, dword [rdx + 4]
mov ebp, r11d
rol ebp, 0x19
mov edi, dword [rdx + 8]
mov r14d, edi
rol r14d, 0x19
mov ebx, r8d
rol ebx, 0xe
xor ebx, r10d
mov r15d, eax
rol r15d, 0xe
xor r15d, esi
mov r12d, r11d
rol r12d, 0xe
xor r12d, ebp
mov ebp, edi
rol ebp, 0xe
mov r10, qword [rsp + 0x60]
xor ebp, r14d
shr r8d, 3
mov esi, eax
shr esi, 3
xor esi, r15d
add esi, r11d
shr r11d, 3
xor r11d, r12d
add r11d, edi
shr edi, 3
xor edi, ebp
add edi, dword [rdx + 0xc]
add esi, dword [r9]
add r11d, dword [r9 + 4]
add edi, dword [r9 + 8]
mov edx, dword [r10 + 4]
mov ebp, edx
rol ebp, 0xf
xor r8d, ebx
mov ebx, edx
rol ebx, 0xd
mov r9d, dword [r10]
xor ebx, ebp
shr edx, 0xa
xor edx, ebx
add edx, edi
mov edi, r9d
rol edi, 0xf
mov ebx, r9d
rol ebx, 0xd
xor ebx, edi
shr r9d, 0xa
mov edi, edx
rol edi, 0xf
xor r9d, ebx
mov ebx, edx
rol ebx, 0xd
add r9d, r11d
xor ebx, edi
mov r11d, edx
shr r11d, 0xa
xor r11d, ebx
mov edi, r9d
rol edi, 0xf
add r11d, esi
mov esi, r9d
rol esi, 0xd
xor esi, edi
mov edi, r9d
shr edi, 0xa
xor edi, esi
add eax, dword [r10 + 0xc]
add eax, r8d
add eax, edi
mov dword [rcx], eax
mov dword [rcx + 4], r11d
mov dword [rcx + 8], r9d
mov dword [rcx + 0xc], edx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140179842
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg1 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret

Function at 0x14017985e
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg2 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret
Function at 0x14017986a
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov al, byte [0x1402c6091]
cmp al, 0xff
je 0x1401798b1
cmp al, 1
jne 0x140179903
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.14017c64e
lea r14, [rsp + 0x20]
mov rcx, r14
call fcn.14000348e
lea rcx, [rsp + 0x60]
call fcn.1400034b0
mov ebp, dword [r14 + 8]
mov eax, ebp
not eax
test eax, 0xc000000
jne 0x1401798e5
call case.0x14002e130.483
not eax
test al, 6
sete al
jmp 0x1401798e7
xor eax, eax
mov ecx, dword [rsp + 0x64]
and ecx, 0x20
shr ecx, 5
shr ebp, 0x1c
and bpl, al
and bpl, cl
mov byte [0x1402c6091], bpl
jne 0x140179892
xorps xmm0, xmm0
lea r14, [rsp + 0x60]
movaps xmmword [r14 + 0x70], xmm0
movaps xmmword [r14 + 0x60], xmm0
movaps xmmword [r14 + 0x50], xmm0
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmm3, xmmword [rsi + 0x30]
lea r15, [rsp + 0x20]
movaps xmmword [r15], xmm0
movaps xmmword [r15 + 0x10], xmm1
movaps xmmword [r15 + 0x20], xmm2
movaps xmmword [r15 + 0x30], xmm3
shl rdi, 7
add rdi, rbx
mov r12d, 0x10
cmp rbx, rdi
je 0x1401799ab
mov ecx, 0x80
mov edx, 8
call fcn.14001f4b4
cmp rax, 0x10
cmovae rax, r12
xor ecx, ecx
cmp rax, rcx
je 0x14017999a
mov rdx, qword [rbx + rcx*8]
bswap rdx
mov qword [rsp + rcx*8 + 0x60], rdx
inc rcx
jmp 0x140179984
sub rbx, 0xffffffffffffff80
mov rcx, r15
mov rdx, r14
call fcn.1401799e0
jmp 0x140179966
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movaps xmm3, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x30], xmm3
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret