joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b420
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
mov rbx, qword [0x140193250]
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x14001b455
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jbe 0x14001b46e
add rax, 8
jmp 0x14001b51a
mov rcx, qword [0x140193250]
call fcn.140143d70
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
ja 0x14001b44c
je 0x14001b518
test rsi, rsi
je 0x14001b48a
movups xmm6, xmmword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x14001b4a6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x10
call sub.bcryptprimitives.dll_ProcessPrng
movaps xmm6, xmmword [rsp + 0x20]
mov rax, qword [0x140472688]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call fcn.14000d8f0
test rax, rax
je 0x14001b549
mov r14, rax
mov rsi, rax
mov qword [rax], rbx
movups xmmword [rax + 8], xmm6
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x14001b529
dec ecx
call sub.kernel32.dll_TlsGetValue
mov rdi, rax
mov ecx, dword [rbx + 0x18]
test ecx, ecx
je 0x14001b539
dec ecx
add r14, 8
mov rdx, rsi
call sub.kernel32.dll_TlsSetValue
test rdi, rdi
je 0x14001b513
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.14000d900
mov rax, r14
jmp 0x14001b51a
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rcx, qword [0x140193250]
call fcn.140143d70
mov ecx, eax
jmp 0x14001b4de
mov rcx, qword [0x140193250]
call fcn.140143d70
mov ecx, eax
jmp 0x14001b4ef
mov ecx, 8
mov edx, 0x18
call fcn.14016da90
int3
Function at 0x140024d40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140024d82
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140024d8a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140024d9b
jmp 0x140024db2
xor r10d, r10d
jmp 0x140024e3d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140024db2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140024dc9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140024de9
add r11, r8
jmp 0x140024f1b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140024eb2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140024e60
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140024ed0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140024ee2
jmp 0x140024efd
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140024efd
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140024f17
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400d0ff0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
movaps xmmword [rsp + 0xd0], xmm6
mov r8, qword [rcx + 8]
mov qword [rsp + 0x28], rcx
mov rbp, qword [rcx + 0x10]
mov eax, 0xff
mov ecx, 0xffffffff
mov rdx, rbp
mov qword [rsp + 0x38], r8
nop word [rax + rax]
cmp rdx, 2
jb 0x1400d1880
mov esi, dword [r8]
mov r11d, dword [r8 + 4]
mov r9d, dword [r8 + 8]
mov r10d, dword [r8 + 0xc]
xor edi, edi
cmp esi, r9d
setne dil
cmovb edi, eax
cmp r11d, r10d
mov ebx, 0
sbb ebx, ebx
test dil, dil
cmovne ebx, edi
cmp bl, 2
jb 0x1400d108b
dec rdx
cmp esi, r9d
cmova r9d, esi
cmp r11d, r10d
cmovb r10d, r11d
inc r10d
cmove r10d, ecx
add r8, 8
cmp r9d, r10d
ja 0x1400d1030
cmp rbp, 0x15
jae 0x1400d10b8
cmp rbp, 1
jbe 0x1400d189c
mov r8d, 1
mov rcx, qword [rsp + 0x38]
mov rdx, rbp
call fcn.1400b9720
mov r11, qword [rsp + 0x28]
jmp 0x1400d1797
movabs rax, 0x7ffffffffffffff8
lea rcx, [rbp*4]
and rcx, rax
mov rsi, qword [0x140472688]
movzx eax, byte [rsi]
mov edx, 4
mov qword [rsp + 0x70], rcx
call fcn.14000d8f0
test rax, rax
je 0x1400d19ea
mov rdi, rax
movzx eax, byte [rsi]
mov ecx, 0x100
mov edx, 8
call fcn.14000d8f0
test rax, rax
je 0x1400d19f6
mov rbx, rax
mov rax, qword [rsp + 0x38]
lea rcx, [rax + 8]
mov qword [rsp + 0x78], rcx
add rax, 0xfffffffffffffff8
mov qword [rsp + 0x68], rax
mov eax, 0x10
mov qword [rsp + 0x50], rax
xor r13d, r13d
movabs r12, 0x1ffffffffffffffe
xor r14d, r14d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rbp
jmp 0x1400d1164
mov r11, qword [rsp + 0x28]
test rbp, rbp
jne 0x1400d1797
Function at 0x1400e68a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x20], rcx
mov r12d, 0xd
xor r15d, r15d
lea r14, [0x14043ca80]
mov r13d, 0xd
nop word cs:[rax + rax]
shr r12, 1
add r12, r15
mov rbp, r12
shl rbp, 5
mov rcx, qword [rbp + r14]
mov r8, qword [rbp + r14 + 8]
mov rsi, r8
sub rsi, rdi
cmovae r8, rdi
mov rdx, rbx
call sub.msvcrt.dll_memcmp
cdqe
test eax, eax
cmovne rsi, rax
test rsi, rsi
je 0x1400e6949
lea rax, [r12 + 1]
test rsi, rsi
cmovg r13, r12
cmovs r15, rax
mov r12, r13
sub r12, r15
ja 0x1400e68e0
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 8], 1
movabs rax, 0x8000000000000000
mov qword [rcx], rax
jmp 0x1400e6a59
mov rbx, qword [rbp + r14 + 0x18]
test rbx, rbx
je 0x1400e6a1d
mov r14, qword [rbp + r14 + 0x10]
lea rdi, [rbx*8]
mov rax, qword [0x140472688]
movzx eax, byte [rax]
mov edx, 4
mov rcx, rdi
call fcn.14000d8f0
test rax, rax
je 0x1400e6b24
cmp rbx, 0x10
jae 0x1400e6a6a
xor ecx, ecx
mov rdx, rcx
or rdx, 1
test bl, 1
je 0x1400e69bf
mov r8d, dword [r14 + rcx*8]
mov r9d, dword [r14 + rcx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rcx*8], r10d
mov dword [rax + rcx*8 + 4], r9d
mov rcx, rdx
cmp rbx, rdx
je 0x1400e6a22
nop word cs:[rax + rax]
mov edx, dword [r14 + rcx*8]
mov r8d, dword [r14 + rcx*8 + 4]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8], r9d
mov dword [rax + rcx*8 + 4], r8d
mov edx, dword [r14 + rcx*8 + 8]
mov r8d, dword [r14 + rcx*8 + 0xc]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8 + 8], r9d
mov dword [rax + rcx*8 + 0xc], r8d
add rcx, 2
cmp rbx, rcx
jne 0x1400e69d0
jmp 0x1400e6a22
mov eax, 4
test rbx, rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
sete byte [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.1400d0ff0
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
mov rax, qword [rsp + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rax + rbx*8]
add rdx, 0xfffffffffffffff8
xor ecx, ecx
cmp rdx, rax
jb 0x1400e6990
lea rdx, [rax + rbx*8]
add rdx, 0xfffffffffffffffc
mov r8, rax
add r8, 4
cmp rdx, r8
jb 0x1400e6990
lea rdx, [rbx - 1]
shr rdx, 0x3d
jne 0x1400e6990
mov rcx, rbx
and rcx, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [0x1403eb780]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [r14 + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x1400e6ac0
cmp rbx, rcx
jne 0x1400e6990
jmp 0x1400e6a22
mov ecx, 4
mov rdx, rdi
call fcn.14016da70
int3
Function at 0x1400e6b40
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x20], rcx
mov r12d, 0x12
xor r15d, r15d
lea r14, [0x14043ece8]
mov r13d, 0x12
nop word cs:[rax + rax]
shr r12, 1
add r12, r15
mov rbp, r12
shl rbp, 5
mov rcx, qword [rbp + r14]
mov r8, qword [rbp + r14 + 8]
mov rsi, r8
sub rsi, rdi
cmovae r8, rdi
mov rdx, rbx
call sub.msvcrt.dll_memcmp
cdqe
test eax, eax
cmovne rsi, rax
test rsi, rsi
je 0x1400e6be9
lea rax, [r12 + 1]
test rsi, rsi
cmovg r13, r12
cmovs r15, rax
mov r12, r13
sub r12, r15
ja 0x1400e6b80
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 8], 1
movabs rax, 0x8000000000000000
mov qword [rcx], rax
jmp 0x1400e6cf9
mov rbx, qword [rbp + r14 + 0x18]
test rbx, rbx
je 0x1400e6cbd
mov r14, qword [rbp + r14 + 0x10]
lea rdi, [rbx*8]
mov rax, qword [0x140472688]
movzx eax, byte [rax]
mov edx, 4
mov rcx, rdi
call fcn.14000d8f0
test rax, rax
je 0x1400e6dc4
cmp rbx, 0x10
jae 0x1400e6d0a
xor ecx, ecx
mov rdx, rcx
or rdx, 1
test bl, 1
je 0x1400e6c5f
mov r8d, dword [r14 + rcx*8]
mov r9d, dword [r14 + rcx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rcx*8], r10d
mov dword [rax + rcx*8 + 4], r9d
mov rcx, rdx
cmp rbx, rdx
je 0x1400e6cc2
nop word cs:[rax + rax]
mov edx, dword [r14 + rcx*8]
mov r8d, dword [r14 + rcx*8 + 4]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8], r9d
mov dword [rax + rcx*8 + 4], r8d
mov edx, dword [r14 + rcx*8 + 8]
mov r8d, dword [r14 + rcx*8 + 0xc]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8 + 8], r9d
mov dword [rax + rcx*8 + 0xc], r8d
add rcx, 2
cmp rbx, rcx
jne 0x1400e6c70
jmp 0x1400e6cc2
mov eax, 4
test rbx, rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
sete byte [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.1400d0ff0
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
mov rax, qword [rsp + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rax + rbx*8]
add rdx, 0xfffffffffffffff8
xor ecx, ecx
cmp rdx, rax
jb 0x1400e6c30
lea rdx, [rax + rbx*8]
add rdx, 0xfffffffffffffffc
mov r8, rax
add r8, 4
cmp rdx, r8
jb 0x1400e6c30
lea rdx, [rbx - 1]
shr rdx, 0x3d
jne 0x1400e6c30
mov rcx, rbx
and rcx, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [0x1403eb790]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [r14 + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x1400e6d60
cmp rbx, rcx
jne 0x1400e6c30
jmp 0x1400e6cc2
mov ecx, 4
mov rdx, rdi
call fcn.14016da70
int3
Function at 0x1400e6de0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x20], rcx
mov r12d, 0xe
xor r15d, r15d
lea r14, [0x140443ac0]
mov r13d, 0xe
nop word cs:[rax + rax]
shr r12, 1
add r12, r15
mov rbp, r12
shl rbp, 5
mov rcx, qword [rbp + r14]
mov r8, qword [rbp + r14 + 8]
mov rsi, r8
sub rsi, rdi
cmovae r8, rdi
mov rdx, rbx
call sub.msvcrt.dll_memcmp
cdqe
test eax, eax
cmovne rsi, rax
test rsi, rsi
je 0x1400e6e89
lea rax, [r12 + 1]
test rsi, rsi
cmovg r13, r12
cmovs r15, rax
mov r12, r13
sub r12, r15
ja 0x1400e6e20
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 8], 1
movabs rax, 0x8000000000000000
mov qword [rcx], rax
jmp 0x1400e6f99
mov rbx, qword [rbp + r14 + 0x18]
test rbx, rbx
je 0x1400e6f5d
mov r14, qword [rbp + r14 + 0x10]
lea rdi, [rbx*8]
mov rax, qword [0x140472688]
movzx eax, byte [rax]
mov edx, 4
mov rcx, rdi
call fcn.14000d8f0
test rax, rax
je 0x1400e7064
cmp rbx, 0x10
jae 0x1400e6faa
xor ecx, ecx
mov rdx, rcx
or rdx, 1
test bl, 1
je 0x1400e6eff
mov r8d, dword [r14 + rcx*8]
mov r9d, dword [r14 + rcx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rcx*8], r10d
mov dword [rax + rcx*8 + 4], r9d
mov rcx, rdx
cmp rbx, rdx
je 0x1400e6f62
nop word cs:[rax + rax]
mov edx, dword [r14 + rcx*8]
mov r8d, dword [r14 + rcx*8 + 4]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8], r9d
mov dword [rax + rcx*8 + 4], r8d
mov edx, dword [r14 + rcx*8 + 8]
mov r8d, dword [r14 + rcx*8 + 0xc]
cmp edx, r8d
mov r9d, r8d
cmovb r9d, edx
cmova r8d, edx
mov dword [rax + rcx*8 + 8], r9d
mov dword [rax + rcx*8 + 0xc], r8d
add rcx, 2
cmp rbx, rcx
jne 0x1400e6f10
jmp 0x1400e6f62
mov eax, 4
test rbx, rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
sete byte [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.1400d0ff0
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
mov rax, qword [rsp + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rax + rbx*8]
add rdx, 0xfffffffffffffff8
xor ecx, ecx
cmp rdx, rax
jb 0x1400e6ed0
lea rdx, [rax + rbx*8]
add rdx, 0xfffffffffffffffc
mov r8, rax
add r8, 4
cmp rdx, r8
jb 0x1400e6ed0
lea rdx, [rbx - 1]
shr rdx, 0x3d
jne 0x1400e6ed0
mov rcx, rbx
and rcx, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [0x1403eb7a0]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [r14 + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x1400e7000
cmp rbx, rcx
jne 0x1400e6ed0
jmp 0x1400e6f62
mov ecx, 4
mov rdx, rdi
call fcn.14016da70
int3
Function at 0x1400e88f0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x140444738]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e893e
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e895d
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1400e8970
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x140444748]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e89be
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e89dd
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1400e89f0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x140444758]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e8a3e
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e8a5d
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1400e8a70
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x140444768]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e8abe
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e8add
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret
Function at 0x1400e8af0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x140444778]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e8b3e
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e8b5d
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1400e8b70
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x140444788]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e8bbe
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e8bdd
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1400e8bf0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x140444798]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e8c3e
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e8c5d
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1400e8c70
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x1404447a8]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e8cbe
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e8cdd
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret
Function at 0x1400e8cf0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x1404447b8]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e8d3e
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e8d5d
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1400e8d70
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x1404447c8]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e8dbe
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e8ddd
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x1400e8df0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
movups xmm0, xmmword [0x1404447d8]
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.shell32.dll_SHGetKnownFolderPath
mov rcx, qword [rsp + 0x28]
test eax, eax
je 0x1400e8e3e
call sub.ole32.dll_CoTaskMemFree
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x1400e8e5d
call sub.kernel32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.140129d40
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, rsi
add rsp, 0x40
pop rsi
ret
Function at 0x1400eba50
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1060
call fcn.140190a40
sub rsp, rax
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx]
mov ebx, dword [rdx + 8]
mov r14, qword [rax]
mov dword [rsp + 0x44], 0x800
lea r15, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, r15
xor edx, edx
call sub.msvcrt.dll_memset
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x44]
mov rcx, r14
mov edx, ebx
mov r8, r15
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
je 0x1400ebacd
cmp eax, 0x103
jne 0x1400ebb05
movabs rax, 0x8000000000000000
or rax, 1
mov qword [rsi], rax
jmp 0x1400ebb38
mov r8d, dword [rsp + 0x44]
cmp r8, 0x801
jae 0x1400ebb4a
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.140170450
mov rcx, qword [rsp + 0x48]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x1400ebb19
mov rax, qword [rsp + 0x50]
jmp 0x1400ebb23
movabs rcx, 0x8000000000000000
shl rax, 0x20
or rax, 2
jmp 0x1400ebb28
movabs rax, 0x900000002
mov rdx, qword [rsp + 0x58]
inc ebx
mov dword [rdi + 8], ebx
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdx
mov rax, rsi
add rsp, 0x1060
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.C:UsersAdministrator.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinreg_0.7.0_srclib.rs
mov edx, 0x800
mov rcx, r8
mov r8, rax
call fcn.140181240
int3
Function at 0x1400f0910
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x1400f0976
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
jmp 0x1400f0938
add rdi, rbx
sub rsi, rbx
je 0x1400f0976
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xbfffffff
jbe 0x1400f0930
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call sub.advapi32.dll_SystemFunction036
test al, al
jne 0x1400f0930
and ebp, 0x7fffffff
jmp 0x1400f0978
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret