joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x140013aa0
test ecx, ecx
jne 0x140013af0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x140013aac
test ecx, ecx
jne 0x140013af0
mov rcx, rdi
call fcn.140013950
movzx eax, al
test bpl, bpl
jne 0x140013af7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x140013ae3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140013c68]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x140013ae3.2
xor eax, eax
test bpl, bpl
je 0x140013abc
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140013c49
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x140013b2a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140013ba9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140013b70
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x140013b8b
inc rax
dec rdi
cmp rax, 1
jne 0x140013b50
jmp 0x140013ba9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x140013b8b
cmp ebx, 0x5c
je 0x140013b8b
inc rax
dec rdi
cmp rax, 1
jne 0x140013b70
jmp 0x140013ba9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140013c57
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140013bd3
mov al, 9
cmp rdx, 2
je 0x140013bd7
cmp rdx, 1
jne 0x140013be7
cmp byte [r8], 0x2e
jne 0x140013be7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140013be7
mov al, 0xa
jmp 0x140013be7
cmp byte [r8], 0x2e
jne 0x140013be7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x140013ae3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x140013ae3.2
mov ecx, 2
jmp case.0x140013ae3.2
lea r8, str.library_std_srcpath.rs
call fcn.140028dd0
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140028dd0
ud2
Function at 0x140014160
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4b8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x430], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.140011310
mov r14, qword [rbp - 0x60]
test r14, r14
je 0x140014303
mov qword [rbp + 0x3d8], rsi
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rbp + 0x3c8], xmm0
mov qword [rbp + 0x3c0], r14
mov qword [rbp + 0x408], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x428], rax
xor eax, eax
mov qword [rbp + 0x420], rax
xor ebx, ebx
xor edi, edi
cmp r8, 0x201
jae 0x140014230
jmp 0x140014212
mov r14, rsi
jae 0x140014315
cmp r8, 0x201
jae 0x140014230
lea r13, [rbp - 0x60]
mov r15d, 0x200
mov r12, r8
jmp 0x140014292
sub r8, rdi
sub rbx, rdi
cmp rbx, r8
jae 0x140014266
lea rcx, [rbp + 0x408]
mov rdx, rdi
call fcn.140029b20
mov rax, qword [rbp + 0x408]
mov qword [rbp + 0x428], rax
mov rax, qword [rbp + 0x410]
mov qword [rbp + 0x420], rax
mov rbx, qword [rbp + 0x420]
mov eax, 0xffffffff
cmp rbx, rax
mov edi, 0xffffffff
cmovb rdi, rbx
mov qword [rbp + 0x418], rdi
mov r13, qword [rbp + 0x428]
mov r15, rdi
mov r12, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, r14
mov rcx, r14
mov rdx, r13
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x1400142c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001434b
mov r8d, r14d
cmp r12, r8
jne 0x140014200
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400143f2
mov r14, rsi
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140014212
jmp 0x140014230
lea rcx, [rbp - 0x58]
call fcn.14000e950
mov byte [rsi + 0x18], 2
jmp 0x1400143bc
cmp r15, r8
jb 0x14001440c
lea rcx, [rbp + 0x3a0]
mov rdx, r13
call fcn.140012630
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3f0], xmm1
movaps xmmword [rbp + 0x3e0], xmm0
jmp 0x14001436a
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3e0], rax
mov byte [rbp + 0x3f8], 2
mov r14, rsi
cmp qword [rbp + 0x420], 0
mov rsi, qword [rbp + 0x3d8]
je 0x14001438c
mov edx, 2
mov rcx, qword [rbp + 0x428]
call fcn.140007680
cmp byte [rbp + 0x3f8], 2
jne 0x1400143d1
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3e0]
call fcn.14000e950
cmp qword [rbp + 0x3c8], 0
je 0x1400143bc
mov edx, 2
mov rcx, r14
call fcn.140007680
nop
add rsp, 0x4b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3e0]
movaps xmm1, xmmword [rbp + 0x3f0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp qword [rbp + 0x3c8], 0
jne 0x1400143af
jmp 0x1400143bc
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140028ed0
jmp 0x140014421
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.140028e50
ud2
Function at 0x14001fd60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.140011310
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x14001fdd6
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.14001fc50
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x14001fde4
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001fe04
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x14001fdf5
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
call fcn.14000e950
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x14001fdf5
mov edx, 2
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp fcn.140007680
Function at 0x1400229f0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x140022a2f
mov rax, qword [rbp - 0x20]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x140014d80]
mov qword [rbp - 0x28], rax
lea rax, [0x140561088]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.140028d10
ud2

Function at 0x1400287a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400287ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400287ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400287ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400287ee
cmp dword [rcx + 0x84], 0xe
jbe 0x1400287ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400287f0
xor al, al
add rsp, 0x28
ret
Function at 0x140003d90
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
mov rdx, rbp
mov r8d, 0x20
call fcn.14018e7f0
test rax, rax
je 0x140003dfb
mov qword [rbp + 0x28], rax
mov rcx, rax
mov qword [rbp + 0x30], rdx
call qword [rdx]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140003e44
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.140005670
jmp 0x140003e44
movaps xmm0, xmmword [rbp]
movaps xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x50]
lea r8, [0x1401dbf60]
lea rdx, [rbp - 0x20]
mov r9d, 8
call fcn.14018e600
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movaps xmm2, xmmword [rbp - 0x30]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
jmp fcn.14018c110
Function at 0x14004b690
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14004b726
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1401e2380]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140053bc0
test rdi, rdi
je 0x14004b7b5
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14004b7ce
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14004b8c6
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14004b948
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14004b8d3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14004b790
cmp r9, 8
jae 0x14004b8dc
jmp 0x14004b948
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140053bc0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14004b948
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14004b948
mov r8, rcx
cmp r9, 8
jb 0x14004b948
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14004b8e0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14004b960
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
cmp dword [rcx], 2
jne 0x14004b9f6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
pshufd xmm2, xmm0, 0xee
pxor xmm2, xmmword [0x1401e2380]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rsi, qword [rdx]
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140053bc0
test rdi, rdi
je 0x14004ba85
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14004ba9e
mov rcx, qword [rdx]
mov r8, qword [rcx]
xor edx, edx
test r8, r8
setne dl
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x1efac7090aef4a21
imul rax, rdx
test r8, r8
je 0x14004bb96
mov r9, qword [rcx + 0x10]
test r9, r9
je 0x14004bc18
mov rcx, qword [rcx + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14004bba3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14004ba60
cmp r9, 8
jae 0x14004bbac
jmp 0x14004bc18
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140053bc0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14004bc18
movzx ecx, byte [rcx + 8]
xor rax, rcx
imul rax, rdx
jmp 0x14004bc18
mov r8, rcx
cmp r9, 8
jb 0x14004bc18
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14004bbb0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140053bc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140053c02
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140053c0a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140053c1b
jmp 0x140053c32
xor r10d, r10d
jmp 0x140053cbd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140053c32
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140053c49
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140053c69
add r11, r8
jmp 0x140053d9b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140053d32
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140053ce0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140053d50
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140053d62
jmp 0x140053d7d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140053d7d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140053d97
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400547c0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm9
movaps xmmword [rsp + 0xa0], xmm8
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm6
call fcn.14018edc0
cmp qword [rax], 0
je 0x1400547ff
add rax, 8
jmp 0x140054809
mov rcx, rax
xor edx, edx
call fcn.14006cd70
movdqu xmm6, xmmword [rax]
inc qword [rax]
pshufd xmm7, xmm6, 0x44
pxor xmm7, xmmword [str.uespemosarenegylmodnarodsetybdet]
pshufd xmm8, xmm6, 0xee
pxor xmm8, xmmword [0x1401e2380]
mov ebx, 1
lea r14, [rsp + 0x60]
xorps xmm9, xmm9
lea rsi, [rsp + 0x30]
lea rdi, [rsp + 0x28]
nop word cs:[rax + rax]
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm6
movaps xmmword [r14], xmm9
mov qword [r14 + 0x10], 0
mov qword [rsp + 0x28], rbx
mov r8d, 8
mov rcx, rsi
mov rdx, rdi
call fcn.140053bc0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x30]
add rax, rcx
rol rcx, 0xd
xor rdx, r9
xor rcx, rax
rol rax, 0x20
mov r8, qword [rsp + 0x38]
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rdx, rax
xor rcx, r8
rol r8, 0x20
xor rax, r9
add rax, rcx
rol rcx, 0xd
xor rcx, rax
rol rax, 0x20
xor r8, 0xff
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rcx, r8
rol r8, 0x20
xor rdx, rax
add rax, rcx
rol rcx, 0xd
xor rcx, rax
rol rax, 0x20
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rcx, r8
rol r8, 0x20
xor rdx, rax
add rax, rcx
rol rcx, 0xd
add r8, rdx
rol rdx, 0x10
xor rdx, r8
rol rdx, 0x15
xor rcx, rax
add r8, rcx
rol rcx, 0x11
mov rax, r8
rol rax, 0x20
xor rax, rcx
xor rax, rdx
inc rbx
xor rax, r8
je 0x140054850
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm9, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140063890
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov qword [rbp - 0x30], rcx
add r9, r8
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], r9
mov word [rbp - 0x18], 0
mov dword [rbp - 0x10], 1
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x28]
call fcn.140086340
mov dword [rbp - 4], 0x800
mov dword [rbp - 8], 0
movzx eax, byte [0x1402f3cf1]
mov ecx, 0x800
mov edx, 1
call fcn.140005660
test rax, rax
je 0x140063a2e
mov rbx, rax
mov qword [rbp - 0x28], 0x800
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
mov rdi, qword [rbp - 0x48]
lea r12, [rbp - 4]
lea r15, [rbp - 8]
mov rsi, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov r13, qword [rbp - 0x28]
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
sub r13, rax
nop word cs:[rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call rsi
cmp eax, 0xea
jne 0x14006398b
mov r8d, dword [rbp - 4]
cmp r13, r8
jae 0x140063950
lea rcx, [rbp - 0x28]
mov rdx, qword [rbp - 0x38]
call fcn.1401cea30
mov rbx, qword [rbp - 0x20]
jmp 0x140063936
test eax, eax
jne 0x1400639ae
mov eax, dword [rbp - 4]
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 8]
cmp eax, 0xb
mov rdx, qword [rbp - 0x30]
jbe 0x140063a11
movabs rax, 0xde00000002
jmp 0x1400639ba
shl rax, 0x20
or rax, 2
mov rdx, qword [rbp - 0x30]
mov qword [rdx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rdx], rax
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x1400639e2
mov r8d, 1
mov rcx, rbx
call fcn.140005670
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x1400639fc
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140005670
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp - 0x18]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
mov rdx, qword [rbp - 0x50]
test rdx, rdx
jne 0x1400639eb
jmp 0x1400639fc
mov ecx, 1
mov edx, 0x800
call fcn.1401d9a00
ud2
Function at 0x1400db5a0
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x1400db5d4
mov rdx, qword [rsp + 0x20]
mov al, cl
add rsp, 0x28
ret
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret