joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400faf10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x141dda6b8]
mov edx, 0x38
xor ecx, ecx
call fcn.1400bf230
mov rcx, rax
nop word [rax + rax]
mov eax, dword [0x141dcd480]
xor eax, dword [0x141dcd484]
imul eax, eax, 0x607b3d77
add eax, 0x31b2db1e
or eax, 0x805f126
cmp eax, 0xbf739944
ja 0x1400faf30
test rcx, rcx
je 0x1400fb195
mov qword [rcx], 1
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 2
mov eax, dword [0x141dcd488]
and eax, dword [0x141dcd48c]
xor eax, 0x24ed2b34
imul eax, eax, 0xdf8f22f
add eax, 0x897a8539
cmp eax, 0x3e166379
jb 0x1400fafc2
mov eax, dword [0x141dcd490]
imul eax, dword [0x141dcd494]
or eax, 0x80738004
and eax, 0xf67f9a04
imul edx, eax, 0x78023848
mov rax, qword [0x141dda680]
cmp edx, 0xf6f55e4f
jbe 0x1400fafd0
mov rax, qword [0x141dda680]
jmp 0x1400faf96
mov edx, dword [0x141dcd498]
imul edx, dword [0x141dcd49c]
or edx, 0xa3e4ba3e
add edx, 0xa2dd6827
imul rdx, rdx, 0x5c6a5ad3
shr rdx, 0x3d
cmp edx, 0xa0b09cb6
je 0x1400fafd0
cmp rax, 0xffffffffffffffff
je 0x1400fb065
lea rdx, [rax + 1]
lock cmpxchg qword [0x141dda680], rdx
sete r8b
nop word cs:[rax + rax]
mov r9d, dword [0x141dcd4a0]
or r9d, dword [0x141dcd4a4]
imul r9d, r9d, 0x3e25a8d7
add r9d, 0x2c43874a
shr r9d, 2
imul r9, r9, 0x2cec31d5
shr r9, 0x39
cmp r9d, 0xb36ca08a
ja 0x1400fb020
test r8b, r8b
je 0x1400fafd0
xor eax, eax
test al, al
je 0x1400fb090
jmp 0x1400fb0d7
mov eax, dword [0x141dcd4a8]
sub eax, dword [0x141dcd4ac]
or eax, 0x1ffe2cfa
add eax, 0x32198cff
or eax, 0xa7f21830
cmp eax, 0x656a42d2
jae 0x1400fb16d
jmp 0x1400fb191
mov r8d, dword [0x141dcd4b8]
and r8d, dword [0x141dcd4bc]
mov qword [rcx + 0x28], rdx
mov byte [rcx + 0x30], 0
mov eax, dword [0x141dda6bc]
mov r9, qword gs:[0x58]
mov rax, qword [r9 + rax*8]
imul r8d, r8d, 0xbc11d851
and r8d, 0x3e453bd3
mov qword [rax + 0x88], rdx
cmp r8d, 0xb2a62b0f
jne 0x1400fb0fb
mov qword [rcx + 0x28], rdx
mov byte [rcx + 0x30], 0
mov eax, dword [0x141dda6bc]
mov r8, qword gs:[0x58]
mov rax, qword [r8 + rax*8]
mov qword [rax + 0x88], rdx
jmp 0x1400fb090
cmp qword [rax + 0x90], 0
jne 0x1400fb124
mov eax, dword [0x141dda6bc]
mov rdx, qword gs:[0x58]
mov rax, qword [rdx + rax*8]
mov qword [rax + 0x90], rcx
add rsp, 0x28
ret
mov eax, dword [0x141dcd4c0]
xor edx, edx
div dword [0x141dcd4c4]
cmp eax, 0x906da48
jne 0x1400fb140
ud2
mov eax, dword [0x141dcd4c8]
or eax, dword [0x141dcd4cc]
imul eax, eax, 0x30bab306
add eax, 0x8e0237b6
imul rax, rax, 0x7cdc4a95
shr rax, 0x3e
ud2
mov eax, dword [0x141dcd4b0]
or eax, dword [0x141dcd4b4]
add eax, 0xa54b84f9
and eax, 0x3f53f9d5
add eax, 0xe42845d6
ud2
ud2
ud2
Function at 0x1400fb990
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
nop word cs:[rax + rax]
mov eax, dword [0x141dd41d8]
xor edx, edx
div dword [0x141dd41dc]
add eax, 0xf540a3ce
or eax, 0x1db25f1e
xor eax, 0xcabec455
cmp eax, 0x796d4da0
ja 0x1400fb9b0
nop word cs:[rax + rax]
mov eax, dword [0x141dd41e0]
imul eax, dword [str.eR0]
cmp eax, 0x36cca8b2
je 0x1400fb9e0
test rcx, rcx
je 0x1400fba32
mov qword [0x141dda6a0], rcx
mov edx, edi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov ecx, dword [0x141dd41e8]
xor ecx, dword [0x141dd41ec]
and ecx, 0x3d818a28
add ecx, 0x6996d1ce
cmp ecx, 0x46581695
jb 0x1400fba10
jmp 0x1400fba34
xor eax, eax
mov ecx, 0x9527ec25
nop dword [rax]
mov edx, dword [0x141dd41f0]
mov r8d, dword [0x141dd41f4]
add edx, r8d
add edx, 0x37f41339
imul rdx, rcx
shr rdx, 0x3f
cmp edx, 0x31281402
je 0x1400fba40
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400fce40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r10, qword [rsp + 0xc0]
mov rdi, r9
mov r9, rdx
mov rsi, rcx
nop word cs:[rax + rax]
mov eax, dword [0x141dd4690]
xor edx, edx
div dword [0x141dd4694]
and eax, 0x740066e
add eax, 0x4350d363
and eax, 0x4dd0501b
mov r12, r9
add r12, r8
setb cl
cmp eax, 0x96dc18e2
ja 0x1400fce70
xor eax, eax
nop
test al, al
jne 0x1400fcea0
test cl, cl
jne 0x1400fd099
mov rcx, qword [rsi]
lea rax, [rcx + rcx]
cmp rax, r12
cmova r12, rax
xor eax, eax
cmp r10, 1
sete al
lea rax, [rax*4 + 4]
cmp rax, r12
cmova r12, rax
lea rdx, [rdi + r10]
dec rdx
mov rax, rdi
neg rax
and rax, rdx
mul r12
jo 0x1400fd099
mov rbx, rax
movabs rax, 0x8000000000000000
sub rax, rdi
cmp rbx, rax
ja 0x1400fd099
xor eax, eax
nop word cs:[rax + rax]
test al, al
jne 0x1400fcf10
test rcx, rcx
je 0x1400fd09b
mov r8, qword [rsi + 8]
imul rcx, r10
nop word cs:[rax + rax]
mov eax, dword [0x141dd4698]
and eax, dword [0x141dd469c]
imul eax, eax, 0xa2efc22d
cmp eax, 0x435598eb
je 0x1400fcf30
mov eax, dword [0x141dd46a0]
xor edx, edx
div dword [0x141dd46a4]
and eax, 0xb013003
cmp eax, 0x29dbcebf
jne 0x1400fcf6d
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x38], rcx
mov eax, 0x99ca2e71
nop word cs:[rax + rax]
mov edx, dword [0x141dd46a8]
and edx, dword [0x141dd46ac]
imul rdx, rax
shr rdx, 0x3e
imul edx, edx, 0x75000cfb
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x38], rcx
cmp edx, 0x4ad668b8
ja 0x1400fcf80
mov r13, rdi
xor eax, eax
test al, al
je 0x1400fcfcf
mov qword [rsp + 0x30], r13
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x28]
mov rdx, rdi
mov r8, rbx
call fcn.1400c0610
lea r14, [rsp + 0x40]
lea r15, [rsp + 0x28]
nop dword [rax]
mov eax, dword [0x141dd46b0]
xor edx, edx
div dword [0x141dd46b4]
imul ebp, eax, 0x38413748
mov qword [rsp + 0x30], r13
mov rcx, r14
mov rdx, rdi
mov r8, rbx
mov r9, r15
call fcn.1400c0610
cmp ebp, 0x682865e7
je 0x1400fcfe0
cmp qword [rsp + 0x40], 0
jne 0x1400fd070
mov rax, qword [rsp + 0x48]
mov qword [rsi + 8], rax
mov qword [rsi], r12
nop word cs:[rax + rax]
mov eax, dword [0x141dd46c0]
xor eax, dword [0x141dd46c4]
add eax, 0x9afd07a0
and eax, 0x150b4628
add eax, 0x7bf74e63
cmp eax, 0xe515d9b7
ja 0x1400fd030
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x141dd46b8]
and eax, dword [0x141dd46bc]
add eax, 0x315c9c7
imul rax, rax, 0x1b49485f
shr rax, 0x3c
imul eax, eax, 0x18c6126d
cmp eax, 0xc92e6f58
ja 0x1400fd070
ud2
xor r13d, r13d
xor eax, eax
test al, al
jne 0x1400fcfb5
jmp 0x1400fcfcf
Function at 0x1400fef20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xd8
mov rdi, r8
mov rax, rdx
mov rsi, rcx
lea rcx, [r8 + 0x110]
mov rdx, qword [r8 + 0x100]
mov r8, qword [r9 + 0x50]
mov qword [rsp + 0x70], r8
movups xmm0, xmmword [r9 + 0x40]
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [r9]
movups xmm1, xmmword [r9 + 0x10]
movups xmm2, xmmword [r9 + 0x20]
movups xmm3, xmmword [r9 + 0x30]
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], rdx
mov byte [rsp + 0xc8], 1
mov qword [rsp + 0x78], 0
lea rdx, [0x1400cca50]
lea r8, [rsp + 0x20]
mov rcx, rax
call fcn.140081e20
mov rax, qword [rsp + 0xb8]
cmp rax, 3
jne 0x1400ff0f1
nop dword [rax]
mov eax, dword [0x141dd5fa8]
imul eax, dword [0x141dd5fac]
or eax, 0x55b68f8b
imul rax, rax, 0x5916ba35
shr rax, 0x3e
or eax, 0x539ee392
cmp eax, 0x34bd3c2d
je 0x1400fefd0
mov rax, qword [rsp + 0x78]
nop
mov ecx, dword [0x141dd5fb0]
imul ecx, dword [0x141dd5fb4]
or ecx, 0x179e28ba
add ecx, 0xb89a5f6f
or ecx, 0xc148bbf0
cmp ecx, 0x1f5bfdaa
je 0x1400ff000
cmp rax, 1
jne 0x1400ff137
movaps xmm0, xmmword [rsp + 0x80]
lea rcx, [rsp + 0x90]
nop word cs:[rax + rax]
mov eax, dword [0x141dd5fe0]
xor edx, edx
div dword [0x141dd5fe4]
or eax, 0xff7759ee
cmp eax, 0x6edb31e3
je 0x1400ff050
mov eax, dword [0x141dd5fe8]
xor edx, edx
div dword [0x141dd5fec]
imul eax, eax, 0x1285fd27
or eax, 0x1ea8e0ca
cmp eax, 0xf87f91f3
jne 0x1400ff08d
movups xmmword [rsi], xmm0
lea rax, [rsi + 0x10]
nop word cs:[rax + rax]
mov edx, dword [0x141dd5ff0]
sub edx, dword [0x141dd5ff4]
imul edx, edx, 0x11e43a06
add edx, 0x579a58fc
imul r8, rdx, 0x2ed2831f
shr r8, 0x20
sub edx, r8d
shr edx, 1
add edx, r8d
shr edx, 0x1e
movups xmmword [rsi], xmm0
cmp edx, 0xf7e382d6
je 0x1400ff0a0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
add rsp, 0xd8
pop rdi
pop rsi
ret
lea rdx, [rsp + 0xb8]
mov rcx, rdi
call fcn.1400f5aa0
nop word cs:[rax + rax]
mov eax, dword [0x141dd5fa0]
and eax, dword [0x141dd5fa4]
add eax, 0x78c53638
xor eax, 0x3850191c
or eax, 0xc207c621
cmp eax, 0x91ced2f6
jb 0x1400ff110
jmp 0x1400fefd0
test rax, rax
jne 0x1400ff16b
ud2
cmp rax, 2
jne 0x1400ff1b7
mov eax, dword [0x141dd5fc8]
add eax, dword [0x141dd5fcc]
and eax, 0xc2d8400
cmp eax, 0xa979480c
je 0x1400ff171
mov eax, dword [0x141dd5fd0]
or eax, dword [0x141dd5fd4]
xor eax, 0x9f3166a6
mov ecx, 0xffd0b42f
imul rcx, rax
shr rcx, 0x3e
add ecx, 0x5c2ad553
cmp ecx, 0x76b18153
jbe 0x1400ff1dc
jmp 0x1400ff201
mov eax, dword [0x141dd5fb8]
imul eax, dword [0x141dd5fbc]
add eax, 0x4b1771c7
or eax, 0xd0d7a53c
add eax, 0xf8bd32fc
cmp eax, 0x1440b27b
jb 0x1400ff1b7
ud2
mov esi, dword [0x141dd5fd8]
and esi, dword [str.gSW]
xor esi, 0x52c30200
or esi, 0xd1c7c5d
call fcn.1400735a0
cmp esi, 0x46b98f99
jne 0x1400ff1da
call fcn.1400735a0
jmp 0x1400ff1dc
Function at 0x1400ff208
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov rbp, rsp
mov eax, dword [0x141dd7238]
xor edx, edx
div dword [0x141dd723c]
or eax, 0xbdc7ef7b
xor eax, 0x9906ecf3
push 0x10
pop rcx
cmp eax, 0xbc5a56cd
ja 0x1400ff280
mov edx, dword [0x141dd7240]
sub edx, dword [0x141dd7244]
xor edx, 0x1101100
and edx, 0x1101188
xor eax, eax
call fcn.1400eeec0
sub rsp, rax
mov r8, rsp
mov rax, rcx
call fcn.1400eeec0
sub rsp, rax
mov rsi, rsp
mov rax, rcx
call fcn.1400eeec0
sub rsp, rax
mov r15, rsp
cmp edx, 0xf28c4564
jne 0x1400ff2a2
xor eax, eax
call fcn.1400eeec0
sub rsp, rax
mov rax, rcx
call fcn.1400eeec0
sub rsp, rax
mov rax, rcx
call fcn.1400eeec0
sub rsp, rax
jmp 0x1400ff237
mov eax, dword [0x141dda6b0]
mov ecx, dword [0x141dd7248]
sub ecx, dword [0x141dd724c]
xor ecx, 0x66f8525b
add ecx, 0x4ec58730
cmp ecx, 0x52e04e57
ja 0x1400ff2a8
cmp eax, 3
je 0x1400ff3c9
mov eax, dword [0x141dd7250]
sub eax, dword [0x141dd7254]
add eax, 0x457ee1e3
and eax, 0x76adec62
imul eax, eax, 0x5ebe7cd1
cmp eax, 0x50667a67
je 0x1400ff2d1
mov eax, dword [0x141dd7258]
sub eax, dword [0x141dd725c]
add eax, 0x5bb97f74
mov ecx, 0xa9a74a40
xor edx, edx
div ecx
add eax, 0xf90ed417
cmp eax, 0x27ac99ff
jb 0x1400ff346
lea rax, [0x141dda6b4]
mov qword [r15], rax
mov eax, dword [0x141dd7260]
xor eax, dword [0x141dd7264]
and eax, 0xa875005a
imul eax, eax, 0x19bef8e0
mov qword [r15 + 8], r8
cmp eax, 0x6266d2
jae 0x1400ff356
lea rax, [0x141dda6b4]
mov qword [r15], rax
mov qword [r15 + 8], r8
jmp 0x1400ff31a
mov eax, dword [0x141dd7268]
and eax, dword [0x141dd726c]
mov ecx, 0x95569031
xor edx, edx
div ecx
cmp eax, 0x5ef22720
je 0x1400ff3d7
mov r12d, 0xc6410156
lea rdi, [0x141dda6b0]
lea rbx, [0x141db8ab0]
mov eax, dword [0x141dd7270]
add eax, dword [0x141dd7274]
or eax, 0xa98554fd
imul eax, eax, 0xfbc94c80
xor edx, edx
div r12d
mov r14d, eax
mov qword [rsi], r15
sub rsp, 0x20
mov rcx, rdi
mov dl, 1
mov r8, rsi
mov r9, rbx
call fcn.1400fa280
add rsp, 0x20
cmp r14d, 0x85cb4b0e
je 0x1400ff386
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov qword [rsi], r15
sub rsp, 0x20
lea rcx, [0x141dda6b0]
lea r9, [0x141db8ab0]
mov dl, 1
mov r8, rsi
call fcn.1400fa280
add rsp, 0x20
jmp 0x1400ff372
Function at 0x140100a20
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov r9, rdx
mov rsi, rcx
nop dword [rax]
mov eax, dword [0x141dd83c8]
xor edx, edx
div dword [0x141dd83cc]
add eax, 0xbef73389
xor eax, 0x6de9ca48
imul rcx, rax, 0x28c629bf
shr rcx, 0x20
sub eax, ecx
shr eax, 1
add eax, ecx
shr eax, 0x1c
mov rdx, r9
add rdx, r8
setb cl
cmp eax, 0x8e846c0e
je 0x140100a30
nop dword [rax]
mov eax, dword [0x141dd83d0]
imul eax, dword [0x141dd83d4]
imul eax, eax, 0x44d42080
cmp eax, 0x20bbc0b8
je 0x140100a70
test cl, cl
jne 0x140100c39
mov rax, qword [rsi]
lea rcx, [rax + rax]
cmp rcx, rdx
cmova rdx, rcx
cmp rdx, 5
mov edi, 4
cmovae rdi, rdx
test rdi, rdi
js 0x140100c39
lea r9, [rdi + rdi]
movabs rdx, 0x7ffffffffffffffe
cmp r9, rdx
ja 0x140100c39
nop dword [rax]
mov edx, dword [0x141dd83d8]
xor edx, dword [0x141dd83dc]
add edx, 0x176b3304
or edx, 0xf63bf1fd
cmp edx, 0x731b6c6e
je 0x140100ad0
test rax, rax
je 0x140100b20
mov rax, qword [rsi + 8]
mov edx, dword [0x141dd83e0]
xor edx, dword [0x141dd83e4]
imul rdx, rdx, 0x27858edb
shr rdx, 0x3d
or edx, 0x821d010a
cmp edx, 0xea78d13b
jne 0x140100b24
jmp 0x140100b4f
xor eax, eax
jmp 0x140100b8e
mov edx, dword [0x141dd83e8]
sub edx, dword [0x141dd83ec]
add edx, 0xe2d5968d
xor edx, 0x2f949a4b
add edx, 0x8ed8bc84
mov qword [rsp + 0x28], rax
cmp edx, 0xa6598551
jbe 0x140100b56
mov qword [rsp + 0x28], rax
jmp 0x140100b24
mov eax, dword [0x141dd83f0]
xor edx, edx
div dword [0x141dd83f4]
cmp eax, 0x79e40876
jne 0x140100b70
mov qword [rsp + 0x38], rcx
xor eax, eax
nop word cs:[rax + rax]
mov qword [rsp + 0x38], rcx
test al, al
jne 0x140100b80
mov eax, 2
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
lea r8, [rsp + 0x28]
mov rdx, r9
call fcn.1400dd4b0
cmp qword [rsp + 0x40], 0
jne 0x140100be2
nop dword [rax]
mov eax, dword [0x141dd8410]
sub eax, dword [0x141dd8414]
imul eax, eax, 0x74152f24
add eax, 0x435ee224
cmp eax, 0x4e92ea20
jb 0x140100bb0
mov rax, qword [rsp + 0x48]
xor ecx, ecx
test cl, cl
je 0x140100c65
jmp 0x140100c72
mov eax, 0xb1925425
nop word [rax + rax]
mov ecx, dword [0x141dd83f8]
imul ecx, dword [0x141dd83fc]
add ecx, 0xf9dcc656
imul rcx, rax
shr rcx, 0x3f
cmp ecx, 0xab67abaf
je 0x140100bf0
nop word cs:[rax + rax]
mov eax, dword [0x141dd8400]
imul eax, dword [0x141dd8404]
and eax, 0x20642010
cmp eax, 0xc10efc21
ja 0x140100c20
ud2
mov qword [rsi + 8], rax
mov qword [rsi], rdi
xor ecx, ecx
test cl, cl
je 0x140100c7b
mov qword [rsi + 8], rax
mov qword [rsi], rdi
jmp 0x140100c65
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140015190
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001126c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012cc0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012ce0
xor al, al
jmp 0x140012d61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012cf3
xor al, al
jmp 0x140012d61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012d1d
xor al, al
jmp 0x140012d61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012d31
xor al, al
jmp 0x140012d61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012d43
xor al, al
jmp 0x140012d61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012d5f
xor al, al
jmp 0x140012d61
mov al, 1
add rsp, 0x38
ret

Function at 0x140011ac0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011389
movzx eax, al
test eax, eax
jne 0x140011ae0
mov ecx, 7
call fcn.140011307
nop
mov byte [rsp + 0x20], 0
call fcn.14001131b
mov byte [rsp + 0x21], al
cmp dword [0x14001c220], 1
jne 0x140011b04
mov ecx, 7
call fcn.140011307
nop
jmp 0x140011b5c
cmp dword [0x14001c220], 0
jne 0x140011b57
mov dword [0x14001c220], 1
lea rdx, [0x140019660]
lea rcx, [0x140019330]
call fcn.14001119a
test eax, eax
je 0x140011b38
mov eax, 0xff
jmp 0x140011c61
lea rdx, [0x140019220]
lea rcx, [section..rdata]
call fcn.140011311
mov dword [0x14001c220], 2
jmp 0x140011b5c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400112f8
call fcn.14001128f
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140011bb9
mov rcx, qword [rsp + 0x30]
call fcn.140011154
movzx eax, al
test eax, eax
je 0x140011bb9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140022020]
nop
call fcn.1400112c1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140011bed
mov rcx, qword [rsp + 0x38]
call fcn.140011154
movzx eax, al
test eax, eax
je 0x140011bed
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011348
nop
call fcn.140011d10
mov dword [rsp + 0x28], eax
call fcn.14001126c
movzx eax, al
test eax, eax
jne 0x140011c0c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140011c1b
call fcn.140011352
nop
xor edx, edx
mov cl, 1
call fcn.140011145
mov eax, dword [rsp + 0x28]
jmp 0x140011c61
add rsp, 0x68
ret
Function at 0x14000d83d
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rcx, [rbp - 0x50]
mov rdx, r8
mov r8, r9
call fcn.14000d79c
mov dword [rbp + 0xc], 0x800
and dword [rbp + 8], 0
lea rcx, [rbp - 0x20]
mov edx, 0x800
xor r8d, r8d
call fcn.1400803cc
cmp qword [rbp - 0x20], 0
mov rcx, qword [rbp - 0x18]
jne 0x14000d99d
mov rax, qword [rbp - 0x10]
lea rbx, [rbp - 0x38]
mov qword [rbx], rcx
mov qword [rbx + 8], rax
and qword [rbx + 0x10], 0
mov r14, qword [rdi]
lea r12, [rbp + 0xc]
lea r15, [rbp + 8]
mov r13, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov rdx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov rcx, r14
xor r8d, r8d
mov r9, r15
call r13
cmp eax, 0xea
jne 0x14000d8f8
mov edx, dword [rbp + 0xc]
mov rcx, rbx
call fcn.140084401
jmp 0x14000d8c6
mov edi, eax
movabs rbx, 0x8000000000000000
test eax, eax
jne 0x14000d923
mov eax, dword [rbp + 0xc]
mov qword [rbp - 0x28], rax
mov eax, dword [rbp + 8]
cmp eax, 0xb
jbe 0x14000d95b
movabs rdi, 0xde00000002
jmp 0x14000d92b
shl rdi, 0x20
or rdi, 2
lea rcx, [rbp - 0x38]
call fcn.140001c41
lea rcx, [rbp - 0x50]
call fcn.14000745b
mov qword [rsi + 8], rdi
mov qword [rsi], rbx
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x10], rcx
mov byte [rbp - 8], al
mov rdi, qword [rbp - 0x20]
lea rcx, [rbp - 0x50]
call fcn.14000745b
cmp rdi, rbx
jne 0x14000d986
mov rdi, qword [rbp - 0x18]
jmp 0x14000d93d
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.1401982ea
lea rcx, [rbp - 0x20]
call fcn.14000d4ab
jmp 0x14000d944
mov rdx, qword [rbp - 0x10]
call fcn.1401d7700
ud2
Function at 0x14004fd8b
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rdx + 0x60]
mov rdx, qword [rdx + 0x78]
lea r8, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov rcx, rbx
call fcn.14004e9a3
mov r9, rdx
lea r14, [rsp + 0x78]
mov ebp, 1
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.140086421
lea r15, [rsp + 0x88]
mov rcx, r15
xor edx, edx
xor r8d, r8d
call fcn.140086421
lea r12, [rsp + 0x68]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.140086421
lea r13, [rsp + 0x50]
mov rcx, r13
xor edx, edx
xor r8d, r8d
call fcn.140086421
movups xmm0, xmmword [r14]
movaps xmmword [r13 - 0x30], xmm0
movups xmm0, xmmword [r15]
movaps xmmword [r13 - 0x20], xmm0
movups xmm0, xmmword [r12]
movaps xmmword [r13 - 0x10], xmm0
lea r14, [rsp + 0x68]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, r14
call fcn.140086438
lea rcx, [rdi + 0xf0]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14004ff2e
test eax, eax
je 0x14004fec0
cmp eax, 0x90317
je 0x14004ff28
cmp eax, 0x90321
jne 0x14004ff47
mov dword [rdi + 0xd0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xd4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14004efee
and qword [rdi + 0x110], 0
mov byte [rsi + 1], bl
jmp 0x14004ff55
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rdi + 0x68]
mov r8d, dword [rsp + 0x30]
add r8, rdx
lea r14, [rdi + 0x40]
and qword [rdi + 0x50], 0
mov rcx, rbx
call fcn.14004e954
mov r8, rdx
mov rcx, r14
mov rdx, rax
call fcn.140154fdb
and qword [rdi + 0x58], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14004efee
xor eax, eax
cmp qword [rdi + 0x78], rbx
sete al
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x14004ff55
mov byte [rsi + 1], 1
jmp 0x14004ff43
cmp dword [rsp + 0x34], 4
cmove ebp, dword [rsp + 0x30]
mov qword [rdi + 0x110], rbp
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x14004ff55
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14004ff6e
Capabilities:
Decrypt data via sspi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rdi, rdx
mov rsi, rcx
lea rbx, [rdx + 0x160]
mov rdx, qword [rdx + 0x178]
lea r8, str.C:UsersMiko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_schannel_0.1.24_src_tls_stream.rs
mov rcx, rbx
call fcn.14004e9a3
mov r9, rdx
lea r14, [rsp + 0x78]
mov ebp, 1
mov rcx, r14
mov edx, 1
mov r8, rax
call fcn.140086421
lea r15, [rsp + 0x88]
mov rcx, r15
xor edx, edx
xor r8d, r8d
call fcn.140086421
lea r12, [rsp + 0x68]
mov rcx, r12
xor edx, edx
xor r8d, r8d
call fcn.140086421
lea r13, [rsp + 0x50]
mov rcx, r13
xor edx, edx
xor r8d, r8d
call fcn.140086421
movups xmm0, xmmword [r14]
movaps xmmword [r13 - 0x30], xmm0
movups xmm0, xmmword [r15]
movaps xmmword [r13 - 0x20], xmm0
movups xmm0, xmmword [r12]
movaps xmmword [r13 - 0x10], xmm0
lea r14, [rsp + 0x68]
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, r14
call fcn.140086438
lea rcx, [rdi + 0x1f0]
mov rdx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x14005012c
test eax, eax
je 0x1400500ac
cmp eax, 0x90317
je 0x140050126
cmp eax, 0x90321
jne 0x140050145
mov dword [rdi + 0x1d0], 0x10000
xor ebx, ebx
mov byte [rdi + 0x1d4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14004f044
and qword [rdi + 0x210], 0
mov byte [rsi + 1], bl
jmp 0x140050153
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rdi + 0x168]
mov r8d, dword [rsp + 0x30]
add r8, rdx
lea r14, [rdi + 0x140]
and qword [rdi + 0x150], 0
mov rcx, rbx
call fcn.14004e954
mov r8, rdx
mov rcx, r14
mov rdx, rax
call fcn.140154fdb
and qword [rdi + 0x158], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x178]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14004f044
xor eax, eax
cmp qword [rdi + 0x178], rbx
sete al
mov qword [rdi + 0x210], rax
mov byte [rsi + 1], 0
jmp 0x140050153
mov byte [rsi + 1], 1
jmp 0x140050141
cmp dword [rsp + 0x34], 4
cmove ebp, dword [rsp + 0x30]
mov qword [rdi + 0x210], rbp
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x140050153
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
mov rax, rsi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret