joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015f51c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140403720]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x1403fad74]
test eax, eax
je 0x14015f567
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403fad74]
test eax, eax
jne 0x14015f570
call fcn.140014d08
test eax, eax
je 0x14015f58c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1403f2d68]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14015f594
xor eax, eax
jmp 0x14015f5f1
test rbx, rbx
jne 0x14015f5b4
lea rcx, str.DestroyPropertySheetPage
call fcn.14015f700
mov rbx, rax
test rax, rax
je 0x14015f5bf
mov qword [0x140403720], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14015f5d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14015f5d6
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14015f5ef
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14015f608
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
or rdi, 0xffffffffffffffff
mov qword [rax - 0x18], rdi
mov rbx, qword [0x140403728]
and qword [rax + 0x10], 0
xor esi, esi
mov eax, dword [0x1403fad74]
test eax, eax
je 0x14015f657
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1403fad74]
test eax, eax
jne 0x14015f660
call fcn.140014d08
test eax, eax
je 0x14015f67c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1403f2d68]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14015f686
or rax, 0xffffffffffffffff
jmp 0x14015f6e8
test rbx, rbx
jne 0x14015f6a6
lea rcx, str.PropertySheetW
call fcn.14015f700
mov rbx, rax
test rax, rax
je 0x14015f6b3
mov qword [0x140403728], rax
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x14015f6ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14015f6cc
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14015f6e5
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401885e4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14018844c
Function at 0x14001108c
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x140012140
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, gethostbyname
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
lea rcx, [0x140025036]
call fcn.140011410
mov dword [rbp + 0x24], 0x2c0
mov ecx, 0x2c0
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400121ad
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.1400111ea
xor eax, eax
jmp 0x1400122fc
lea rdx, [rbp + 0x24]
mov rcx, qword [rbp + 8]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1400121f3
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_free]
mov eax, dword [rbp + 0x24]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400121f3
lea rcx, str.Error_allocating_memory_needed_to_call_GetAdaptersinfo_n
call fcn.1400111ea
xor eax, eax
jmp 0x1400122fc
mov dword [rbp + 0x44], 0
lea rdx, [rbp + 0x24]
mov rcx, qword [rbp + 8]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov eax, dword [rax + 0x194]
mov dword [rbp + 0x84], eax
mov dword [rbp + 0xa4], 0
jmp 0x140012240
mov eax, dword [rbp + 0xa4]
inc eax
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 0x84]
cmp dword [rbp + 0xa4], eax
jae 0x1400122d7
mov eax, dword [rbp + 0x84]
dec eax
cmp dword [rbp + 0xa4], eax
jae 0x14001229b
mov eax, dword [rbp + 0xa4]
mov rcx, qword [rbp + 0x68]
movzx eax, byte [rcx + rax + 0x198]
imul ecx, dword [rbp + 0xa4], 3
mov ecx, ecx
mov rdx, qword [rbp + 0x1a0]
add rdx, rcx
mov rcx, rdx
mov r8d, eax
lea rdx, str._02X:
call fcn.1400113ca
jmp 0x1400122d2
mov eax, dword [rbp + 0xa4]
mov rcx, qword [rbp + 0x68]
movzx eax, byte [rcx + rax + 0x198]
imul ecx, dword [rbp + 0xa4], 3
mov ecx, ecx
mov rdx, qword [rbp + 0x1a0]
add rdx, rcx
mov rcx, rdx
mov r8d, eax
lea rdx, str._02X
call fcn.1400113ca
jmp 0x140012232
mov rax, qword [rbp + 0x68]
add rax, 0x1c0
mov rdx, rax
mov rcx, qword [rbp + 0x1a8]
call fcn.14001114f
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_free]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001c010]
call fcn.140011389
mov rax, rdi
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140011249
Capabilities:
Terminate process

Disassembly:
jmp 0x140014350
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112df
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400156a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400156c0
xor al, al
jmp 0x140015741
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400156d3
xor al, al
jmp 0x140015741
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400156fd
xor al, al
jmp 0x140015741
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015711
xor al, al
jmp 0x140015741
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015723
xor al, al
jmp 0x140015741
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001573f
xor al, al
jmp 0x140015741
mov al, 1
add rsp, 0x38
ret

Function at 0x140011311
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket

Disassembly:
jmp 0x140011c40
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x3d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x8e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3f8]
mov rax, qword [0x14001f008]
xor rax, rbp
mov qword [rbp + 0x3a8], rax
lea rcx, [0x140025036]
call fcn.140011410
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbp + 0x1c8], rax
mov r8d, setsockopt
xor edx, edx
lea rcx, [rbp + 0x1e8]
call fcn.140011334
mov eax, 2
mov word [rbp + 0x1e8], ax
mov cx, 0x270f
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x1ea], ax
lea rcx, str.127.0.0.1
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rbp + 0x1ec], eax
mov r8d, setsockopt
lea rdx, [rbp + 0x1e8]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_connect]
mov dword [rbp + 0x214], eax
cmp dword [rbp + 0x214], 0
je 0x140011d2d
lea rcx, [0x14001c540]
call fcn.1400111ea
xor r9d, r9d
mov r8d, 0x3e8
mov rdx, qword [rbp + 0x3d0]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bf80]
call fcn.140011389
mov rcx, qword [rbp + 0x3a8]
xor rcx, rbp
call fcn.140011203
lea rsp, [rbp + 0x3b8]
pop rdi
pop rbp
ret
Function at 0x140058830
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14005883d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14005884d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140058835
lea eax, [rcx + 1]
jmp 0x14005885b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14005886e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140058854
sub eax, 3
jb 0x14005888e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400588dd
sar eax, 1
movsxd rbp, eax
jb 0x1400588c4
jmp 0x14005889c
add ebx, ebx
jne 0x14005889a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400588c4
inc ecx
add ebx, ebx
jne 0x1400588aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400588c4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400588bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400588ac
add ecx, 2
jmp 0x1400588c9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400587f2
jmp 0x14005883d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x29c00
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140058929
cmp rsi, rcx
jae 0x140058931
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140058910
cmp al, 0x8f
ja 0x140058910
cmp byte [rsi - 2], 0xf
je 0x140058916
sub al, 0xe8
cmp al, 1
ja 0x1400588fa
cmp rsi, rcx
jae 0x140058931
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140058900
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140058931
lodsb al, byte [rsi]
jmp 0x140058910
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x56000]
mov eax, dword [rdi]
or eax, eax
je 0x14005899a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x67440]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14005893e
jns 0x140058973
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14005897d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140058994
mov qword [rbx], rax
add rbx, 8
jmp 0x14005895e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400589d4
cmp al, 0xef
ja 0x1400589c6
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400589a6
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400589b5
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x237]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140058a28
sub rsp, 0xffffffffffffff80
jmp 0x14000c1a0
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140196000
add rsp, 0x28
jmp 0x14000c43c
Function at 0x140018340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140018460
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1400183a0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1400183a0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1400183a0

Function at 0x140048670
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x140148038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
lea r9, [rsp + 0x3c]
mov dword [r9], eax
lea r8, [rsp + 0x38]
mov dword [r8], eax
lea rax, [rsp + 0x34]
mov dword [rax], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400486f8
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x1400486e2
cmp dword [rsp + 0x38], 4
jne 0x1400486e2
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140096290
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
mov edi, eax
jmp 0x1400486e2
Function at 0x140049680
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x1400496c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1400496e1
lea rax, [rdi + 1]
cmp rax, 2
jb 0x1400496bf
mov qword [rsi], rdi
call fcn.14007ae40
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x1400496f7
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14007ae40
mov rcx, qword [rsi]
int3
int3

Function at 0x14004a470
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x278
mov rsi, rcx
mov rax, qword [0x140148038]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rbx, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rbx
mov dl, 0xaa
call fcn.1400983d0
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
dec edi
cmp edi, 0x102
ja 0x14004a50f
lea r14, [rsp + 0x20]
mov qword [r14], rbx
mov rcx, rbx
call fcn.1400b9930
mov qword [r14 + 8], rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r14
int3
cmp edi, 0x103
setb bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140096290
mov eax, ebx
add rsp, 0x278
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140050ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140148038]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov r8, qword [rcx + 8]
cmp r8, 2
jb 0x140050e08
cmp word [rax + 2], 0x3a
jne 0x140050e08
movzx ecx, word [rax]
and ecx, 0xffffffdf
add ecx, 0xffffffbf
cmp cx, 0x1a
jae 0x140050e08
mov r14d, 2
xor edx, edx
mov rcx, qword [rsi]
mov r9, qword [rsi + 8]
cmp r9, 2
jb 0x140050de4
cmp word [rcx + 2], 0x3a
jne 0x140050de4
movzx r10d, word [rcx]
and r10d, 0xffffffdf
add r10d, 0xffffffa5
cmp r10w, 0xffe6
setae r10b
not dl
test dl, r10b
je 0x140050de4
cmp r8, r14
cmovae r8, r14
cmp r9, 2
mov r10d, 2
cmovb r10, r9
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
mov qword [rdx + 8], r10
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], r8
mov r8d, 1
call fcn.1400728f0
test al, al
je 0x140050da0
mov rax, qword [rdi + 8]
cmp rax, r14
jb 0x140050e12
sub rax, r14
js 0x140050e15
mov rcx, qword [rsi + 8]
cmp rcx, 1
jbe 0x140050e18
add rcx, 0xfffffffffffffffe
js 0x140050e1b
cmp rax, rcx
je 0x140050dbb
xor ebx, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140096290
mov eax, ebx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov bl, 1
test rax, rax
je 0x140050da2
add r14, r14
add r14, qword [rdi]
mov rcx, qword [rsi]
xor edx, edx
movzx r8d, word [r14 + rdx*2]
cmp r8w, word [rcx + rdx*2 + 4]
jne 0x140050da0
inc rdx
cmp rax, rdx
jne 0x140050dcd
jmp 0x140050da2
cmp r8, r9
jne 0x140050da0
mov bl, 1
test r8, r8
je 0x140050da2
xor edx, edx
movzx r9d, word [rax + rdx*2]
cmp r9w, word [rcx + rdx*2]
jne 0x140050da0
inc rdx
cmp r8, rdx
jne 0x140050df2
jmp 0x140050da2
mov dl, 1
xor r14d, r14d
jmp 0x140050cf5
int3
int3
int3
int3
Function at 0x140054020
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x238
mov rsi, rcx
mov rax, qword [0x140148038]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1400983d0
mov word [rdi], 0
lea rcx, str.PROGRAMFILES
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x1400540b5
mov eax, eax
inc rax
cmp rax, 1
je 0x1400540b5
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x140054081
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x1400540a2
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
int3
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140054116
mov eax, eax
inc rax
cmp rax, 1
je 0x140054116
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x1400540e2
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140054103
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
int3
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140054173
mov eax, eax
inc rax
cmp rax, 1
je 0x140054173
lea r14, [rax - 1]
cmp word [rsp + rax*2 + 0x1c], 0x5c
mov rax, r14
je 0x140054143
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140054164
mov rcx, qword [rsi]
mov rdx, rdi
mov r8, r14
int3
xor ebx, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140096290
mov eax, ebx
add rsp, 0x238
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14005e110
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x140148038]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x14005e143
mov rax, qword [rsi + 8]
test rax, rax
je 0x14005e23f
bt ebx, 8
jae 0x14005e15f
mov eax, ebx
and eax, 0x200
jne 0x14005e23f
cmp edi, 2
lea rax, [0x14015f980]
lea rcx, [0x14015fb80]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14005e23f
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x20], xmm0
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [r14], 0
je 0x14005e23f
cmp byte [0x14015ff80], 0
setne al
bt ebx, 8
jb 0x14005e23f
shr ebx, 9
and ebx, 1
or bl, al
je 0x14005e23f
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea r12, str.SOFTWARE
cmove r12, rax
movzx ebp, byte [rsi + 0x17]
test bpl, bpl
jns 0x14005e29b
mov r14, qword [rsi]
mov rbp, qword [rsi + 8]
mov edi, 1
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov r15, qword [r12 + 8]
mov r13, rbp
sub r13, r15
jb 0x14005e22c
mov rdx, qword [r12]
mov rcx, r14
mov r8, r15
int3
add r12, 0x28
inc rbx
cmp rbx, rdi
jb 0x14005e20c
cmp dword [rsp + 0x2c], 0
jne 0x14005e2a3
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140096290
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rsi
jmp 0x14005e1ef
cmp byte [rsi + 0x17], 0
mov rax, rsi
jns 0x14005e2af
mov rax, qword [rsi]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, rsi
mov r8, qword [rsp + 0x38]
int3