joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014720
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xe0
movdqa xmmword [rsp + 0xd0], xmm7
movdqa xmmword [rsp + 0xc0], xmm6
mov rsi, rdx
mov rdi, rcx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmmword [rsp + 0x80], xmm0
lea rdx, [rsp + 0x80]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x140014794
mov ebx, eax
lea rcx, [rsp + 0x80]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x140014811
movdqa xmm7, xmmword [rsp + 0x80]
movdqa xmm6, xmmword [rsp + 0x90]
movdqu xmmword [rsp + 0xb0], xmm6
movdqu xmmword [rsp + 0xa0], xmm7
mov rax, qword [0x1404c84d0]
test rax, rax
je 0x140014852
test eax, 0x4000
jne 0x140014862
pshufd xmm0, xmm7, 0xee
pshufd xmm1, xmm6, 0xee
movq rax, xmm7
movq rcx, xmm0
movq rdx, xmm6
movq r8, xmm1
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
jmp 0x140014880
and ebx, 0x7fffffff
je 0x140014794
movzx eax, byte [0x1404c8501]
mov edx, 4
xor ecx, ecx
call fcn.140277170
test rax, rax
je 0x14001491f
mov dword [rax], ebx
mov rcx, qword [0x1404c8458]
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400148e2
call fcn.1402d51e0
test eax, 0x4000
je 0x1400147d3
lea r8, [0x14047cdd8]
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
call fcn.140107e20
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x40], rcx
mov qword [rdi], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rdx
mov qword [rdi + 0x20], r8
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
call fcn.140107e40
movaps xmm6, xmmword [rsp + 0xc0]
movaps xmm7, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 4
mov edx, 4
call fcn.1402c6fa0
int3
Function at 0x1400199c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140019a02
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140019a0a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140019a1b
jmp 0x140019a32
xor r10d, r10d
jmp 0x140019abd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140019a32
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140019a49
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140019a69
add r11, r8
jmp 0x140019b9b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140019b32
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140019ae0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140019b50
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140019b62
jmp 0x140019b7d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140019b7d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140019b97
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140020200
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, qword [rcx]
mov rax, r8
shl rax, 7
lea rbx, [rax + r8*8]
add rbx, rdx
nop dword [rax + rax]
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rdi]
xorps xmm1, xmm0
movups xmm0, xmmword [rdi + 0x10]
movups xmm2, xmmword [rdi + 0x20]
movups xmm3, xmmword [rdi + 0x30]
movups xmmword [rdi], xmm1
movups xmm1, xmmword [rsi + 0x10]
xorps xmm1, xmm0
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rsi + 0x20]
xorps xmm0, xmm2
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [rsi + 0x30]
xorps xmm0, xmm3
movups xmmword [rdi + 0x30], xmm0
movups xmm0, xmmword [rsi + 0x40]
movups xmm1, xmmword [rdi + 0x40]
xorps xmm1, xmm0
movups xmmword [rdi + 0x40], xmm1
movups xmm0, xmmword [rsi + 0x50]
movups xmm1, xmmword [rdi + 0x50]
xorps xmm1, xmm0
movups xmmword [rdi + 0x50], xmm1
movups xmm0, xmmword [rsi + 0x60]
movups xmm1, xmmword [rdi + 0x60]
xorps xmm1, xmm0
movups xmmword [rdi + 0x60], xmm1
movups xmm0, xmmword [rsi + 0x70]
movups xmm1, xmmword [rdi + 0x70]
xorps xmm1, xmm0
movups xmmword [rdi + 0x70], xmm1
mov rax, qword [rsi + 0x80]
xor qword [rdi + 0x80], rax
mov rdx, qword [rdi + 0xc8]
mov rcx, rdi
call fcn.1400f6b50
add rsi, 0x88
cmp rsi, rbx
jne 0x140020220
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140083d70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov rsi, rcx
mov qword [rsp + 0x30], 3
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
adc byte [rdx + 0x10], cl

Function at 0x140095120
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x608
movdqa xmmword [rsp + 0x5f0], xmm6
mov qword [rsp + 0x50], rdx
mov rbx, rcx
mov qword [rsp + 0x130], r9
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0xa8]
test rcx, rcx
je 0x140095174
mov rdx, qword [rax + 0xa0]
cmp rcx, 4
jae 0x14009517c
xor r15d, r15d
xor r11d, r11d
jmp 0x140095212
xor r15d, r15d
jmp 0x140095236
mov r11, rcx
and r11, 0xfffffffffffffffc
lea r9, [rdx + 0x60]
pxor xmm0, xmm0
movdqa xmm2, xmmword [0x1402d83b0]
movdqa xmm3, xmmword [0x1402d8160]
mov r10, r11
pxor xmm1, xmm1
nop word cs:[rax + rax]
movd xmm4, dword [r9 - 0x40]
movd xmm5, dword [r9 - 0x60]
punpckldq xmm5, xmm4
movd xmm4, dword [r9]
movd xmm6, dword [r9 - 0x20]
punpckldq xmm6, xmm4
pshufd xmm4, xmm5, 0xd4
pcmpeqd xmm4, xmm2
pand xmm4, xmm3
paddq xmm0, xmm4
pshufd xmm4, xmm6, 0xd4
pcmpeqd xmm4, xmm2
pand xmm4, xmm3
paddq xmm1, xmm4
sub r9, 0xffffffffffffff80
add r10, 0xfffffffffffffffc
jne 0x1400951b0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq r15, xmm0
cmp rcx, r11
je 0x140095236
sub rcx, r11
shl r11, 5
add rdx, r11
nop dword [rax]
xor r9d, r9d
cmp dword [rdx], 2
sete r9b
add r15, r9
add rdx, 0x20
dec rcx
jne 0x140095220
mov rcx, qword [rax + 0x88]
imul rax, qword [rax + 0x90], 0x228
nop dword [rax + rax]
mov rdx, rax
test rax, rax
je 0x14009526f
test byte [rcx + 0x221], 1
lea rcx, [rcx + 0x228]
lea rax, [rdx - 0x228]
je 0x140095250
mov qword [rsp + 0x4b0], rdx
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x240], rax
mov rax, qword [r8 + 8]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x1e0], r8
mov rax, qword [r8 + 0x10]
mov qword [rsp + 0xa0], rax

Function at 0x1400b14d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
add rdx, rcx
xor r8d, r8d
xor eax, eax
Function at 0x1400bdbc0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
test rdx, rdx
je 0x1400be045
mov rax, rdx
shr rax, 0x3d
jne 0x1400be05d
mov r14, rcx
mov rax, rdx
shr rax, 0x20
mov rcx, rdx
shl rcx, 0x20
lea r10d, [r8 - 0x20]
test rax, rax
cmovne rcx, rdx
cmovne r10d, r8d
mov rax, rcx
shr rax, 0x30
mov rdx, rcx
shl rdx, 0x10
lea r8d, [r10 - 0x10]
test rax, rax
cmovne rdx, rcx
cmovne r8d, r10d
mov rax, rdx
shr rax, 0x38
mov rcx, rdx
shl rcx, 8
lea r10d, [r8 - 8]
test rax, rax
cmovne rcx, rdx
cmovne r10d, r8d
mov rax, rcx
shr rax, 0x3c
mov r8, rcx
shl r8, 4
lea r11d, [r10 - 4]
test rax, rax
cmovne r8, rcx
cmovne r11d, r10d
mov rcx, r8
shr rcx, 0x3e
lea rax, [r8*4]
lea edx, [r11 - 2]
test rcx, rcx
cmovne rax, r8
cmovne edx, r11d
xor ecx, ecx
test rax, rax
setns cl
sub edx, ecx
mov ecx, 0xffffffa0
sub ecx, edx
movsx ecx, cx
lea ecx, [rcx + rcx*4]
shl ecx, 4
add ecx, 0x153b0
movsxd rcx, ecx
imul rcx, rcx, 0x7b4dc993
mov r8, rcx
shr r8, 0x3f
sar rcx, 0x2a
add ecx, r8d
movsxd rdi, ecx
cmp edi, 0x51
jae 0x1400be031
test rax, rax
setns cl
shl rax, cl
shl rdi, 4
lea r8, [0x1403e24c0]
mov r10, qword [rdi + r8]
mov rcx, rax
shr rcx, 0x20
mov eax, eax
mov r11d, r10d
shr r10, 0x20
mov rsi, r10
imul rsi, rcx
imul r10, rax
imul rcx, r11
imul r11, rax
shr r11, 0x20
mov ebx, ecx
add rbx, r11
mov eax, r10d
add rax, rbx
sub rax, 0xffffffff80000000
shr rcx, 0x20
add rcx, rsi
shr r10, 0x20
add r10, rcx
shr rax, 0x20
add dx, word [rdi + r8 + 8]
add rax, r10
mov ecx, 0xffffffc0
sub ecx, edx
movzx r11d, cx
mov r10d, r11d
and r10d, 0x3f
mov rdx, rax
mov ecx, r10d
shr rdx, cl
mov ebx, 1
shl rbx, cl
lea rcx, [rbx - 1]
mov r12, rax
and r12, rcx
je 0x1400bdd89
movzx edi, word [rdi + r8 + 0xa]
cmp edx, 0x2710
mov qword [rbp - 0x10], rcx
jae 0x1400bdd95
cmp edx, 0x64
jae 0x1400bddbb
xor ecx, ecx
cmp edx, 0xa
setae cl
lea r15d, [rcx + rcx*8]
inc r15d
jmp 0x1400bde1b
mov qword [r14], 0
jmp 0x1400bdff8
cmp edx, 0xf4240
jae 0x1400bddd9
cmp edx, 0x186a0
setb cl
mov r8d, 0x2710
mov r15d, 0x186a0
cmovb r15d, r8d
xor cl, 5
jmp 0x1400bde1b
cmp edx, 0x3e8
setb cl
mov r8d, 0x64
mov r15d, 0x3e8
cmovb r15d, r8d
xor cl, 3
jmp 0x1400bde1b
cmp edx, 0x5f5e100
jae 0x1400bddff
cmp edx, 0x989680
setb cl
mov r8d, 0xf4240
mov r15d, 0x989680
cmovb r15d, r8d
xor cl, 7
jmp 0x1400bde1b
cmp edx, 0x3b9aca00
setb cl
mov r8d, 0x5f5e100
mov r15d, 0x3b9aca00
cmovb r15d, r8d
xor cl, 9
mov r8, qword [rbp + 0x70]
movzx ecx, cl
mov esi, ecx
sub esi, edi
inc esi
movzx edi, word [rbp + 0x78]
cmp si, di
jle 0x1400bded2
mov qword [rbp], rbx
mov qword [rbp - 8], r14
movsx rax, si
movsx eax, si
Function at 0x1400c28d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400c2950
cmp r11, r10
ja 0x1400c29c7
cmp r10, rdx
ja 0x1400c29d9
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x1400c2952
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x1400c2930
jmp 0x1400c29b4
ja 0x1400c295a
mov r11, r10
cmp rax, r8
jne 0x1400c28fe
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400c2990
mov rdi, r8
sub ecx, edx
jns 0x1400c29ab
jmp 0x1400c29b6
cmp r8, rsi
je 0x1400c29e8
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1400c29b6
xor al, 1
cmp rdi, rsi
jne 0x1400c2970
jmp 0x1400c29b6
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1402c78e0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1402c76e0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1402c7a40
int3
Function at 0x1400cfd40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400cfdd6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1402d8090]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400199c0
test rdi, rdi
je 0x1400cfe65
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400cfe7e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x1400cff76
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400cfff8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1400cff83
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400cfe40
cmp r9, 8
jae 0x1400cff8c
jmp 0x1400cfff8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1400199c0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
or ecx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
ror byte [rax + 0x31], 0xd1
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
adc dword [rax + 0x31], ecx
ror dword [rax - 0x3f], 1
ret 0x4c20
xor eax, eax
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400cfff8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1400cfff8
mov r8, rcx
cmp r9, 8
jb 0x1400cfff8
add rcx, r9
nop
Function at 0x1400e6360
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
test rcx, rcx
je 0x1400e648a
mov rbx, rdx
mov rdi, rcx
lea rsi, [rcx + 0x10]
mov cl, 1
xor eax, eax
lock cmpxchg byte [rdi + 0x10], cl
jne 0x1400e6496
mov rax, qword [0x1404c84f8]
shl rax, 1
test rax, rax
jne 0x1400e64b1
xor r14d, r14d
movzx eax, byte [rdi + 0x11]
test al, al
jne 0x1400e64c9
cmp dword [rdi + 0x50], 0x3b9aca00
je 0x1400e63ee
mov qword [rbp - 0x10], 0
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400e650f
mov rcx, qword [rbp - 0x10]
call fcn.14026dd00
mov qword [rdi + 0x48], rax
mov dword [rdi + 0x50], edx
cmp dword [rdi + 0x40], 0x3b9aca00
jne 0x1400e6415
lea rcx, [rdi + 0x18]
cmp qword [rcx], 0
je 0x1400e6456
add qword [rdi + 0x20], rbx
cmp dword [rdi + 0x30], 0x3b9aca00
jne 0x1400e6456
call fcn.1400e6a40
jmp 0x1400e6456
mov qword [rbp - 0x10], 0
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400e654b
mov rcx, qword [rbp - 0x10]
call fcn.14026dd00
cmp rax, qword [rdi + 0x38]
jb 0x1400e6456
jne 0x1400e6445
cmp edx, dword [rdi + 0x40]
jb 0x1400e6456
mov dword [rdi + 0x40], 0x3b9aca00
lea rcx, [rdi + 0x18]
cmp qword [rcx], 0
jne 0x1400e6401
test r14b, r14b
jne 0x1400e646e
mov rax, qword [0x1404c84f8]
shl rax, 1
test rax, rax
jne 0x1400e64f9
xor eax, eax
xchg byte [rsi], al
cmp al, 2
jne 0x1400e648a
mov rcx, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov rcx, rsi
call fcn.1402d48f0
mov rax, qword [0x1404c84f8]
shl rax, 1
test rax, rax
je 0x1400e63ac
call fcn.1402d49b0
mov r14d, eax
xor r14b, 1
movzx eax, byte [rdi + 0x11]
test al, al
je 0x1400e63bb
mov qword [rbp - 0x20], rsi
mov byte [rbp - 0x18], r14b
lea rax, str.C:UsersNico.cargo_registry_srcindex.crates.io_6f17d22bba15001fhyper_0.14.28_srcprotoh2ping.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1403fb0c0]
lea r8, [rbp - 0x20]
mov edx, 0x2b
call fcn.1402c79b0
call fcn.1402d49b0
test al, al
jne 0x1400e646e
mov byte [rdi + 0x11], 1
jmp 0x1400e646e
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x20], rax
lea rax, str._b_E_
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, fcn.14026c5d0
lea r8, [rbp - 0x20]
mov edx, 0x2b
call fcn.1402c79b0
jmp 0x1400e6585
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x20], rax
lea rax, str._b_E_
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, fcn.14026c5d0
lea r8, [rbp - 0x20]
mov edx, 0x2b
call fcn.1402c79b0
ud2
Function at 0x14019d680
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov r14, rdx
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov r8d, 0xb
mov rdx, rax
call fcn.14019d380
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 0
movzx eax, byte [0x1404c8501]
mov edx, 0x800
xor ecx, ecx
call fcn.140277170
test rax, rax
je 0x14019d7ef
mov rbx, rax
mov qword [rsp + 0x38], 0x800
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov rdi, qword [rsp + 0x58]
lea rbp, [rsp + 0x30]
lea r15, [rsp + 0x34]
mov r12, qword [rsp + 0x38]
mov r13, qword [rsp + 0x48]
sub r12, r13
nop
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x14019d750
mov r8d, dword [rsp + 0x30]
cmp r12, r8
jae 0x14019d710
lea rcx, [rsp + 0x38]
mov rdx, r13
call fcn.1402c8070
mov rbx, qword [rsp + 0x40]
jmp 0x14019d701
test eax, eax
jne 0x14019d772
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x14019d7d1
movabs rax, 0xde00000002
jmp 0x14019d77a
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
cmp qword [rsp + 0x38], 0
je 0x14019d7a5
mov rcx, qword [0x1404c8458]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x50], 0
je 0x14019d7bf
mov rcx, qword [0x1404c8458]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
cmp qword [rsp + 0x50], 0
jne 0x14019d7ad
jmp 0x14019d7bf
mov ecx, 1
mov edx, 0x800
call fcn.1402c6f80
int3
Function at 0x1401ae440
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xd0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1401ae450
test al, 1
je case.0x14014c760.1480
xchg edx, eax
add byte [rax], al
invalid
test al, 2
jne 0x1401ae510
test al, 8
jne 0x1401ae48a
test al, 0x10
je 0x1401ae4a8
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x1401ae594
test byte [rax], 0
invalid
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
Function at 0x4017f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rbx
lea rax, [rcx + 0x10]
cmp rdx, rax
jae 0x401808
lea rax, [rdx + 0x10]
cmp rcx, rax
jb 0x401894
movdqu xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movzx r9d, byte [rcx + 0xf]
mov r10d, 4
movzx r8d, byte [rcx + 0xe]
lea r11, [0x00407c40]
movzx edx, byte [rcx + 0xd]
lea rsi, [0x00407b20]
movzx eax, byte [rcx + 0xc]
test r10b, 3
jne 0x401868
movzx edx, dl
movzx r8d, r8b
movzx r9d, r9b
movzx eax, al
movzx ebx, byte [r11 + rdx]
movzx edx, byte [r11 + r8]
movzx r8d, byte [r11 + r9]
movzx r9d, byte [r11 + rax]
mov eax, r10d
shr eax, 2
xor bl, byte [rsi + rax]
mov eax, ebx
xor al, byte [rcx]
add r10d, 1
add rcx, 4
xor dl, byte [rcx - 3]
xor r8b, byte [rcx - 2]
xor r9b, byte [rcx - 1]
mov byte [rcx + 0xc], al
mov byte [rcx + 0xd], dl
mov byte [rcx + 0xe], r8b
mov byte [rcx + 0xf], r9b
cmp r10d, 0x2c
jne 0x401835
pop rbx
pop rsi
ret
movzx eax, byte [rdx]
mov byte [rcx], al
movzx eax, byte [rdx + 1]
mov byte [rcx + 1], al
movzx eax, byte [rdx + 2]
mov byte [rcx + 2], al
movzx eax, byte [rdx + 3]
mov byte [rcx + 3], al
movzx eax, byte [rdx + 4]
mov byte [rcx + 4], al
movzx eax, byte [rdx + 5]
mov byte [rcx + 5], al
movzx eax, byte [rdx + 6]
mov byte [rcx + 6], al
movzx eax, byte [rdx + 7]
mov byte [rcx + 7], al
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
movzx eax, byte [rdx + 9]
mov byte [rcx + 9], al
movzx eax, byte [rdx + 0xa]
mov byte [rcx + 0xa], al
movzx eax, byte [rdx + 0xb]
mov byte [rcx + 0xb], al
movzx eax, byte [rdx + 0xc]
mov byte [rcx + 0xc], al
movzx eax, byte [rdx + 0xd]
mov byte [rcx + 0xd], al
movzx eax, byte [rdx + 0xe]
mov byte [rcx + 0xe], al
movzx eax, byte [rdx + 0xf]
mov byte [rcx + 0xf], al
jmp 0x40180f
Function at 0x402870
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor edi, edi
test r8, r8
mov rsi, rcx
mov rbx, rdx
mov rbp, r8
je 0x402956
nop dword [rax]
movdqu xmm5, xmmword [rbx]
mov rcx, rbx
mov rdx, rsi
add rdi, 0x10
call fcn.00402160
movzx eax, byte [rsi + 0xb0]
xor byte [rbx], al
movzx eax, byte [rsi + 0xb1]
xor byte [rbx + 1], al
movzx eax, byte [rsi + 0xb2]
xor byte [rbx + 2], al
movzx eax, byte [rsi + 0xb3]
xor byte [rbx + 3], al
movzx eax, byte [rsi + 0xb4]
xor byte [rbx + 4], al
movzx eax, byte [rsi + 0xb5]
xor byte [rbx + 5], al
movzx eax, byte [rsi + 0xb6]
xor byte [rbx + 6], al
movzx eax, byte [rsi + 0xb7]
xor byte [rbx + 7], al
movzx eax, byte [rsi + 0xb8]
xor byte [rbx + 8], al
movzx eax, byte [rsi + 0xb9]
xor byte [rbx + 9], al
movzx eax, byte [rsi + 0xba]
xor byte [rbx + 0xa], al
movzx eax, byte [rsi + 0xbb]
xor byte [rbx + 0xb], al
movzx eax, byte [rsi + 0xbc]
xor byte [rbx + 0xc], al
movzx eax, byte [rsi + 0xbd]
xor byte [rbx + 0xd], al
movzx eax, byte [rsi + 0xbe]
xor byte [rbx + 0xe], al
movzx eax, byte [rsi + 0xbf]
xor byte [rbx + 0xf], al
add rbx, 0x10
cmp rbp, rdi
movups xmmword [rsi + 0xb0], xmm5
ja 0x402890
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret