joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140060ba0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
jne 0x140060bfb
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140060c2c
test bl, bl
jne 0x140060c06
mov rcx, rdi
mov edx, esi
call fcn.140054af0
mov sil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140060bc7
cmp byte [rdi + 8], 0
je 0x140060c22
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140060bd7
mov rcx, qword [rdi]
jmp 0x140060c15
mov rcx, qword [rdi]
jmp 0x140060c41
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x140060c27
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140060c54
xor esi, esi
jmp 0x140060be4
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x140060c87
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140060bd7
mov esi, dword [rsp + 0x24]
jmp 0x140060bd7
mov rcx, qword [rdi]
jmp 0x140060c6b

Function at 0x140060fc0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
mov edi, r8d
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x90], rax
movaps xmm0, xmmword [0x14029ca60]
lea r15, [rsp + 0x50]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea rdx, str.WriteAtCurrentPos
lea r8, str.file_win.cc
lea r12, [rsp + 0x30]
mov rcx, r12
mov r9d, 0x97
call fcn.140158eb0
xor esi, esi
mov rcx, r15
mov rdx, r12
xor r8d, r8d
call fcn.140181c40
test edi, edi
js 0x14006109b
lea r15, [rsp + 0x30]
mov dword [r15], 0xaaaaaaaa
mov rcx, qword [r14]
mov qword [rsp + 0x20], 0
mov rdx, rbx
mov r8d, edi
mov r9, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [r15]
lea rcx, [rsp + 0x50]
call fcn.140181760
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 0xffffffff
jmp 0x14006106e
Function at 0x1400610b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov rdi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x14029ca60]
lea rbx, [rsp + 0x60]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.PathHasAccess
lea r8, str.file_util_win.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r9d, 0x22f
call fcn.140158eb0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1401a26e0
test byte [0x1402d90d0], 0x19
jne 0x140061251
cmp byte [rdi + 0x17], 0
jns 0x14006112e
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006124d
test al, 0x10
mov eax, 0x40000000
mov edx, 2
cmove edx, eax
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
xor esi, esi
mov rcx, rdi
mov r8d, 7
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
test rax, rax
je 0x1400611ab
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rbx, 0xffffffffffffffff
je 0x140061208
call fcn.14017a3f0
mov rsi, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
setne dil
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1400611e1
call fcn.14017a3f0
cmp qword [0x1402e5b90], 0
je 0x14006120c
mov rcx, qword [0x1402e5b90]
mov rax, qword [rcx]
mov rax, qword [rax]
mov rdx, rsi
call qword [0x1402f5008]
lea rcx, [rsp + 0x60]
call fcn.140181760
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, edi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
xor esi, esi
jmp 0x1400611a3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1402b09b1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006126d
lea rcx, [sym.browser.exe_GetHandleVerifier]
cmp rax, rcx
je 0x140061247
call qword [0x1402f5008]
mov rcx, rax
xor edx, edx
call fcn.140013b30
jmp 0x1400611cb
xor ecx, ecx
mov dl, 1
jmp 0x140061240
xor edi, edi
jmp 0x1400611e1
lea rdx, [rsp + 0xa0]
mov qword [rdx], rsi
lea rcx, str.ScopedBlockingCall
call fcn.1402380c0
jmp 0x140061125
xor ecx, ecx
jmp 0x14006123e
Function at 0x140061280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [0x14029ca60]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.DirectoryExists
lea r8, str.file_util_win.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r9d, 0x24e
call fcn.140158eb0
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1401a26e0
test byte [0x1402d90d0], 0x19
jne 0x14006133b
cmp byte [rsi + 0x17], 0
jns 0x1400612fa
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
setne al
and esi, 0x10
shr esi, 4
and sil, al
lea rcx, [rsp + 0x40]
call fcn.140181760
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x80]
mov qword [rdx], rdi
lea rcx, str.ScopedBlockingCall
call fcn.1402380c0
jmp 0x1400612f1
Function at 0x140063b60
Capabilities:
Delete file
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, qword [0x1402e5ab0]
test rdi, rdi
je 0x140063bb0
lea rbx, [0x1402aa6f3]
mov rcx, rdi
mov rdx, rbx
call fcn.1401a49f0
test al, al
jne 0x140063bd9
lea rdx, str.vmodule
mov rcx, rdi
call fcn.1401a49f0
test al, al
jne 0x140063bd9
mov eax, dword [rsi]
mov dword [0x1402da9cc], eax
test al, 1
jne 0x140063c92
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401ce5b0
mov al, 1
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.vmodule
lea r8, [rsp + 0x48]
mov qword [r8], rax
mov qword [r8 + 8], 7
lea r14, [rsp + 0x58]
mov rcx, rdi
mov rdx, r14
call fcn.14017d0a0
lea r8, [rsp + 0x20]
mov qword [r8], rbx
mov qword [r8 + 8], 1
lea rbx, [rsp + 0x30]
mov rcx, rdi
mov rdx, rbx
call fcn.14017d0a0
mov ecx, 0x20
call fcn.1401cbbc4
mov rdi, rax
lea r9, [0x1402e5a28]
mov rcx, rax
mov rdx, rbx
mov r8, r14
call fcn.14024af10
cmp byte [rbx + 0x17], 0
jns 0x140063c52
mov rcx, qword [rsp + 0x30]
call fcn.1401cbbbc
cmp byte [rsp + 0x6f], 0
jns 0x140063c63
mov rcx, qword [rsp + 0x58]
call fcn.1401cbbbc
test rdi, rdi
je 0x140063bb0
xor eax, eax
lock cmpxchg qword [0x1402e5a38], rdi
je 0x140063bb0
mov rcx, rdi
call fcn.14024afd0
mov rcx, rdi
call fcn.1401cbbbc
jmp 0x140063bb0
mov rcx, qword [0x1402e5a30]
test rcx, rcx
jne 0x140063cac
mov rcx, qword [0x1402e5a20]
test rcx, rcx
je 0x140063cd0
jmp 0x140063cf2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1402e5a30], 0
mov rcx, qword [0x1402e5a20]
test rcx, rcx
jne 0x140063cf2
and byte [0x1402da9cc], 0xfe
mov ecx, 0x18
call fcn.1401cbbc4
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x1402e5a20], rax
mov rdx, qword [rsi + 8]
call fcn.1400606d0
cmp dword [rsi + 0x14], 0
jne 0x140063d17
mov rcx, qword [0x1402e5a20]
cmp byte [rcx + 0x17], 0
jns 0x140063d11
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401ce5b0
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14023c5a0
Function at 0x1400691d0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x30], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x28]
mov qword [rsi], rax
mov rdx, rsi
call fcn.1400255d0
mov rax, qword [rsi]
test rax, rax
je 0x140069247
mov rbx, qword [rax + 0x50]
mov r15, qword [rax + 0x58]
xor esi, esi
cmp rbx, r15
jne 0x14006924e
lea rcx, [rsp + 0x28]
call fcn.140024cd0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401ce5b0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov esi, 3
jmp 0x140069220
mov r12, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [rbx + 0x68], 2
jne 0x14006928f
cmp byte [rbx + 0x27], 0
js 0x140069267
lea rcx, [rbx + 0x10]
jmp 0x14006926b
mov rcx, qword [rbx + 0x10]
call r12
test al, 0x10
jne 0x14006928f
mov r14, qword [rdi + 8]
cmp r14, qword [rdi + 0x10]
jae 0x14006929a
mov rcx, r14
mov rdx, rbx
call fcn.14012c830
add r14, 0x68
mov qword [rdi + 8], r14
add rbx, 0x70
cmp rbx, r15
je 0x140069220
jmp 0x140069255
mov rcx, rdi
mov rdx, rbx
call fcn.14012c620
mov r14, rax
jmp 0x14006928b

Function at 0x1400f8b60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400f8b80
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x1400f8bc0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400f8be0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x1400f8c20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400f8c43
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret
Function at 0x1400f8ca0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400f8cc3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x1400f8d20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400f8d49
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret

Function at 0x1400f8db0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400f8dd9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x1400f8e40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400f8e9f
Function at 0x1400f8e90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1400f8e90
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x1400f8f20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400f8f7f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400f8f70
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret

Function at 0x1400f9000
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400f905a

Function at 0x1400f907a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400f9050
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret
Function at 0x1400f9110
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400f916a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400f9160
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
ret
Function at 0x14010fdc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x14010fee0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x14010fe20
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x14010fe20
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x14010fe20
Function at 0x140121ca0
Capabilities:
Query or enumerate registry key

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0x70], rax
or r9d, 0x20019
mov qword [rsp + 0x20], rcx
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140121d75
lea rdi, [rsp + 0x64]
mov dword [rdi], 0
mov rcx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x58], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140121d97
mov edx, dword [rsp + 0x64]
sub edx, 1
setb al
mov dword [rsi + 8], edx
mov rcx, qword [rsi]
test rcx, rcx
je 0x140121d7c
test al, al
jne 0x140121d7c
lea r8, [rsi + 0xc]
lea r9, [rsp + 0x6c]
mov dword [r9], 0x104
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x38], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140121d82
jmp 0x140121d7c
mov qword [rsi], 0
mov word [rsi + 0xc], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401ce5b0
nop
add rsp, 0x78
pop rdi
pop rsi
ret
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140121d75
Function at 0x140125c70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rcx + 8]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140125ca7
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140125ca7
movzx edx, word [rax + rcx + 0x14]
cmp edx, 0xf0
jne 0x140125ca7
movzx eax, word [rax + rcx + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x140125ca6

Function at 0x140126450
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
mov rsi, rcx
mov rax, qword [0x1402cb038]
xor rax, rsp
mov qword [rsp + 0xe0], rax
cmp byte [rcx], 0
jne 0x1401264be
cmp byte [rsi + 0x37], 0
js 0x1401264b3
cmp byte [rsi + 0x1f], 0
js 0x1401264a8
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1401ce5b0
nop
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [rsi + 8]
call fcn.1401cbbbc
jmp 0x140126486
mov rcx, qword [rsi + 0x20]
call fcn.1401cbbbc
jmp 0x140126480
mov rcx, rsi
call fcn.14024b6e0
test al, al
je 0x1401265bb
mov rcx, rsi
call fcn.1401265d0
movzx eax, byte [rsi + 0x1f]
test al, al
jns 0x1401264e2
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1401265be
lea rdi, [rsi + 8]
xorps xmm0, xmm0
lea r14, [rsp + 0x70]
movaps xmmword [r14], xmm0
movaps xmmword [r14 + 0x50], xmm0
movaps xmmword [r14 + 0x40], xmm0
movaps xmmword [r14 + 0x30], xmm0
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
xor r15d, r15d
mov qword [r14 + 0x60], r15
mov dword [r14], 0x68
lea rcx, [rsi + 0x20]
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x50]
mov qword [r12 + 0x10], rax
movaps xmm0, xmmword [0x14029ca60]
movaps xmmword [r12], xmm0
xor edx, edx
call fcn.140173210
mov rbx, rax
mov rcx, rdi
xor edx, edx
call fcn.140173210
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14012647a
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
jmp 0x14012647a
int3
int3