joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008dd88
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp dword [0x1400b7724], ebx
jne 0x14008ddda
lea rcx, str.HWLOC_LIBXML
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14008ddbc
lea rcx, str.HWLOC_LIBXML_EXPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14008ddd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test eax, eax
sete bl
mov dword [0x1400b7728], ebx
mov dword [0x1400b7724], 1
mov eax, dword [0x1400b7728]
add rsp, 0x20
pop rbx
ret

Function at 0x14008dde8
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp dword [0x1400b771c], ebx
jne 0x14008de3a
lea rcx, str.HWLOC_LIBXML
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14008de1c
lea rcx, str.HWLOC_LIBXML_IMPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14008de30
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test eax, eax
sete bl
mov dword [0x1400b7720], ebx
mov dword [0x1400b771c], 1
mov eax, dword [0x1400b7720]
add rsp, 0x20
pop rbx
ret

Function at 0x140090518
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x2c0]
mov edx, 1
mov dword [rcx + 0xb4], edx
mov rbx, rcx
mov rcx, rax
test rax, rax
je 0x140090557
cmp dword [rcx + 0x10], 0
jne 0x14009054e
cmp dword [rcx + 0x24], 0xffffffff
je 0x14009054e
and dword [rbx + 0xb4], 0
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x14009053b
test byte [rbx + 0x20], 2
je 0x14009057b
mov dword [rbx + 0xb4], edx
jmp 0x14009057b
cmp dword [rax + 0x10], edx
jne 0x140090577
cmp dword [rax + 0x24], 0xffffffff
je 0x140090577
and dword [rbx + 0xb4], 0
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x140090565
lea rcx, str.HWLOC_THISSYSTEM
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400905a1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rbx + 0xb4], eax
add rsp, 0x20
pop rbx
ret
Function at 0x14009063c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov r14d, 1
jmp 0x140090663
call qword [sym.imp.KERNEL32.DLL_SwitchToThread]
xor eax, eax
lock cmpxchg dword [0x1400b7740], r14d
jne 0x14009065d
mov eax, dword [0x1400b7738]
mov ecx, eax
add eax, r14d
mov dword [0x1400b7738], eax
test ecx, ecx
jne 0x1400907d3
lea rcx, str.HWLOC_COMPONENTS_VERBOSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400906a4
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
and qword [0x1400b7748], 0
lea r15, [0x1400b53d0]
and dword [0x1400b7744], 0
xor r8d, r8d
mov rcx, qword [0x1400b53d0]
mov dword [0x1400b773c], eax
test rcx, rcx
je 0x14009070d
mov edx, dword [0x1400b7744]
add r8d, r14d
inc edx
mov dword [0x1400b7744], edx
cmp qword [r15 + r8*8], 0
jne 0x1400906cf
test edx, edx
je 0x14009070d
mov ecx, edx
mov edx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
and dword [0x1400b7744], 0
mov rcx, qword [0x1400b53d0]
mov qword [0x1400b7748], rax
xor esi, esi
test rcx, rcx
je 0x1400907d3
mov rbx, r15
mov edi, dword [rcx + 0x1c]
test edi, edi
je 0x140090741
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, edi
lea rdx, str.Ignoring_static_component_with_invalid_flags__lx_n
mov rcx, rax
call fcn.140001200
jmp 0x1400907c0
mov rax, qword [rcx + 8]
test rax, rax
je 0x140090777
xor ecx, ecx
call rax
test eax, eax
jns 0x140090777
cmp dword [0x1400b773c], 0
je 0x1400907c0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Ignoring_static_component__failed_to_initialize_n
call fcn.140001200
jmp 0x1400907c0
mov rcx, qword [rbx]
mov rdx, qword [rcx + 0x10]
test rdx, rdx
je 0x14009079e
mov ecx, dword [0x1400b7744]
mov rax, qword [0x1400b7748]
mov qword [rax + rcx*8], rdx
add dword [0x1400b7744], r14d
mov rcx, qword [rbx]
cmp dword [rcx + 0x18], 0
jne 0x1400907b1
mov rcx, qword [rcx + 0x20]
xor edx, edx
call fcn.1400908f0
jmp 0x1400907c0
cmp dword [rcx + 0x18], r14d
jne 0x1400907c0
mov rcx, qword [rcx + 0x20]
call fcn.14008df6c
add esi, r14d
lea rbx, [r15 + rsi*8]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x14009071b
and dword [0x1400b7740], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x140090f30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x1400b5528]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r15, rdx
mov rbx, rcx
call fcn.14008e844
xor r14d, r14d
xor ebp, ebp
mov rsi, rax
lea r13d, [r14 + 1]
cmp dword [rbx + 0x2fc], ebp
je 0x140090fd7
mov edx, dword [rbx + 0x300]
xor eax, eax
test edx, edx
je 0x140090fcb
mov r8, qword [rbx + 0x308]
movzx r11d, word [r15]
lea r9, [rax + rax*2]
cmp r11d, dword [r8 + r9*8]
jne 0x140090fae
movzx r10d, byte [r15 + 2]
cmp r10d, dword [r8 + r9*8 + 4]
jb 0x140090fae
cmp r10d, dword [r8 + r9*8 + 8]
jbe 0x140090fb7
add eax, r13d
cmp eax, edx
jae 0x140090fcb
jmp 0x140090f91
lea rdx, [rax + rax*2]
mov rcx, rsi
mov rdx, qword [r8 + rdx*8 + 0x10]
call fcn.14008ee90
mov r14d, r13d
mov ebp, r13d
test r14d, r14d
jne 0x1400910a3
movzx eax, byte [r15 + 2]
lea r8, str.HWLOC_PCI__04x__02x_LOCALCPUS
movzx r9d, word [r15]
lea rcx, [rsp + 0x30]
mov edx, 0x100
mov dword [rsp + 0x20], eax
call fcn.140085140
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
je 0x14009106f
cmp dword [rbx + 0x2fc], 0
jne 0x140091043
cmp dword [0x1400b7750], 0
jne 0x140091043
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rdi
lea rdx, str.Environment_variable__s_is_deprecated__please_use_HWLOC_PCI_LOCALITY_instead._n
mov rcx, rax
call fcn.140001200
mov dword [0x1400b7750], r13d
cmp byte [rdi], 0
je 0x140091067
lea rdx, [rsp + 0x30]
lea rcx, str.Overriding_localcpus_using__s_in_the_environment_n
call fcn.140086950
mov rdx, rdi
mov rcx, rsi
call fcn.14008f8f8
mov r14d, r13d
mov ebp, r13d
test r14d, r14d
jne 0x1400910a3
mov rax, qword [rbx + 0x2c8]
test rax, rax
je 0x140091089
mov r8, rsi
mov rdx, r15
mov rcx, rax
call qword [rax + 0x40]
jmp 0x14009108c
or eax, 0xffffffff
test eax, eax
jns 0x1400910a3
mov rcx, rbx
call fcn.1400882e8
mov rdx, rax
mov rcx, rsi
call fcn.14008ee90
mov rdx, rsi
mov rcx, rbx
call fcn.1400874c0
mov rdi, rax
test rax, rax
je 0x1400910ca
test ebp, ebp
jne 0x1400910da
mov r8, rax
mov rdx, r15
mov rcx, rbx
call fcn.140091378
jmp 0x1400910d7
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14008e028
mov rdi, rax
mov rcx, rsi
call fcn.14008f014
mov rax, rdi
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140099bf0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x140091268
Capabilities:
Query environment variable
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400b5528]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
lea rcx, str.HWLOC_PCI_LOCALITY
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
test rax, rax
je 0x140091357
xor edx, edx
mov dword [rsi + 0x2fc], 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open]
mov edi, eax
test eax, eax
js 0x14009134c
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fstat64i32]
test eax, eax
jne 0x140091342
mov eax, dword [rsp + 0x34]
cmp eax, 0x10000
jg 0x140091320
inc eax
movsxd rcx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, dword [rsp + 0x34]
mov ecx, edi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cmp eax, dword [rsp + 0x34]
jne 0x140091315
movsxd rdx, dword [rsp + 0x34]
mov rcx, rsi
mov byte [rdx + rbx], 0
mov rdx, rbx
call fcn.1400915c8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140091342
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [rsp + 0x34]
lea rdx, str.Ignoring_HWLOC_PCI_LOCALITY_file___s_too_large___lu_bytes__n
mov rcx, rax
mov r8, rbx
call fcn.140001200
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
jmp 0x140091357
mov rdx, rbx
mov rcx, rsi
call fcn.1400915c8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140099bf0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140092640
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov dword [rcx + 0x29c], 1
xor esi, esi
cmp dword [rcx + 0x9c], 1
mov rbx, rcx
mov eax, dword [rcx + 0x29c]
cmove eax, esi
mov dword [rcx + 0x29c], eax
lea rcx, str.HWLOC_GROUPING
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140092699
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
test eax, eax
jne 0x140092699
mov dword [rbx + 0x29c], esi
cmp dword [rbx + 0x29c], esi
je 0x14009275b
mov qword [rbx + 0x2b8], 0x3dcccccd
lea rcx, str.HWLOC_GROUPING_ACCURACY
mov dword [rbx + 0x2a8], esi
mov dword [rbx + 0x2ac], 0x3c23d70a
mov dword [rbx + 0x2b0], 0x3ca3d70a
mov dword [rbx + 0x2b4], 0x3d4ccccd
mov dword [rbx + 0x2a4], 5
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
test rax, rax
jne 0x1400926ff
mov dword [rbx + 0x2a4], 1
jmp 0x140092734
lea rdx, [0x1400a8120]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x140092734
mov rcx, rdi
mov dword [rbx + 0x2a4], 1
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movss dword [rbx + 0x2a8], xmm1
lea rcx, str.HWLOC_GROUPING_VERBOSE
mov dword [rbx + 0x2a0], esi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14009275b
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rbx + 0x2a0], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140093204
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov ecx, dword [0x1400b5408]
mov edx, 1
mov eax, dword [rsp + 0x40]
cmp ecx, edx
jbe 0x14009324f
mov rax, qword [0x1400b7770]
test rax, rax
je 0x14009324a
sub cx, dx
call rax
movzx ecx, ax
mov eax, dword [0x1400b5408]
shl eax, 6
add eax, 0xffffffc0
add eax, ecx
jmp 0x14009324f
mov eax, ecx
shl eax, 6
add rsp, 0x58
ret

Function at 0x140093c10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
jmp qword [sym.imp.KERNEL32.DLL_VirtualAlloc]
Function at 0x140093e6c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140093fb6
lea rdx, str.GetActiveProcessorGroupCount
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.GetActiveProcessorCount
mov rcx, rbx
mov qword [0x1400b7760], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.GetLogicalProcessorInformation
mov rcx, rbx
mov qword [0x1400b7770], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.GetCurrentProcessorNumber
mov rcx, rbx
mov qword [0x1400b7788], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.GetCurrentProcessorNumberEx
mov rcx, rbx
mov qword [0x1400b7778], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.SetThreadGroupAffinity
mov rcx, rbx
mov qword [0x1400b7780], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.GetThreadGroupAffinity
mov rcx, rbx
mov qword [0x1400b7798], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.GetNumaAvailableMemoryNode
mov rcx, rbx
mov qword [0x1400b77a0], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.GetNumaAvailableMemoryNodeEx
mov rcx, rbx
mov qword [0x1400b77a8], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.GetLogicalProcessorInformationEx
mov rcx, rbx
mov qword [0x1400b77b0], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.K32QueryWorkingSetEx
mov rcx, rbx
mov qword [0x1400b7790], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.VirtualAllocExNuma
mov rcx, rbx
mov qword [0x1400b77c8], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
lea rdx, str.VirtualFreeEx
mov rcx, rbx
mov qword [0x1400b77b8], rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1400b77c0], rax
mov rax, qword [0x1400b7760]
test rax, rax
je 0x140093fcd
call rax
movzx eax, ax
mov dword [0x1400b5408], eax
cmp qword [0x1400b77c8], 0
jne 0x140094000
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test rax, rax
je 0x140094000
lea rdx, str.QueryWorkingSetEx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [0x1400b77c8], rax
add rsp, 0x20
pop rbx
ret
Function at 0x14009724c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400b5528]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r12, rdx
mov r13, r8
lea rdx, [0x1400a90e8]
mov rbx, rcx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
lea rdi, str._dev_stdin
lea rdx, [0x1400a90fc]
cmovne rdi, rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
test rax, rax
je 0x14009737d
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov esi, 0x1000
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1400972d9
mov eax, 0x8000
test word [rsp + 0x26], ax
je 0x1400972d9
mov eax, dword [rsp + 0x34]
inc eax
movsxd rsi, eax
lea rcx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140097374
mov r9, rbp
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r14, rax
mov byte [rax + rdi], 0
cmp rax, rsi
jne 0x140097352
add rsi, rsi
mov rcx, rdi
lea rdx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r15, rax
test rax, rax
je 0x14009736b
mov rbx, rsi
lea rcx, [rax + r14]
shr rbx, 1
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
mov byte [rdi + r14], 0
cmp rax, rbx
je 0x14009730f
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [r14 + 1]
mov qword [r12], rdi
mov qword [r13], rax
xor eax, eax
jmp 0x140097380
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140099bf0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002fd0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x140003110
cmp edx, 0xc0
je 0x140003090
cmp edx, 0x80
jne 0x1400031d0
mov edx, 9
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.140003207
aeskeygenassist xmm1, xmm0, 2
call fcn.140003200
aeskeygenassist xmm1, xmm0, 4
call fcn.140003200
aeskeygenassist xmm1, xmm0, 8
call fcn.140003200
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140003200
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140003200
aeskeygenassist xmm1, xmm0, 0x40
call fcn.140003200
aeskeygenassist xmm1, xmm0, 0x80
call fcn.140003200
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.140003200
aeskeygenassist xmm1, xmm0, 0x36
call fcn.140003200
movups xmmword [rax], xmm0
mov dword [rax + 0x50], edx
xor eax, eax
jmp 0x1400031d7
movq xmm2, qword [rcx + 0x10]
mov edx, 0xb
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.140003227
aeskeygenassist xmm1, xmm2, 2
call fcn.140003260
aeskeygenassist xmm1, xmm2, 4
call fcn.140003220
aeskeygenassist xmm1, xmm2, 8
call fcn.140003260
aeskeygenassist xmm1, xmm2, 0x10
call fcn.140003220
aeskeygenassist xmm1, xmm2, 0x20
call fcn.140003260
aeskeygenassist xmm1, xmm2, 0x40
call fcn.140003220
aeskeygenassist xmm1, xmm2, 0x80
call fcn.140003260
movups xmmword [rax], xmm0
mov dword [rax + 0x30], edx
xor rax, rax
jmp 0x1400031d7
movups xmm2, xmmword [rcx + 0x10]
mov edx, 0xd
lea rax, [rax + 0x10]
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.140003287
aeskeygenassist xmm1, xmm0, 1
call fcn.1400032a0
aeskeygenassist xmm1, xmm2, 2
call fcn.140003280
aeskeygenassist xmm1, xmm0, 2
call fcn.1400032a0
aeskeygenassist xmm1, xmm2, 4
call fcn.140003280
aeskeygenassist xmm1, xmm0, 4
call fcn.1400032a0
aeskeygenassist xmm1, xmm2, 8
call fcn.140003280
aeskeygenassist xmm1, xmm0, 8
call fcn.1400032a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.140003280
aeskeygenassist xmm1, xmm0, 0x10
call fcn.1400032a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.140003280
aeskeygenassist xmm1, xmm0, 0x20
call fcn.1400032a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.140003280
movups xmmword [rax], xmm0
mov dword [rax + 0x10], edx
xor rax, rax
jmp 0x1400031d7
mov rax, 0xfffffffffffffffe
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
add rsp, 8
ret
Function at 0x1400032c0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x140003490
cmp edx, 0xc0
je 0x1400033f0
cmp edx, 0x80
jne 0x140003560
mov edx, 9
movdqa xmm5, xmmword [0x1401070d0]
mov r10d, 8
movdqa xmm4, xmmword [0x1401070f0]
movdqa xmm2, xmm0
movdqu xmmword [r8], xmm0
jmp 0x140003320
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
pslld xmm4, 1
lea rax, [rax + 0x10]
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqa xmm2, xmm0
dec r10d
jne 0x140003320
movdqa xmm4, xmmword [str.eeee]
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
pslld xmm4, 1
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax], xmm0
movdqa xmm2, xmm0
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x60], edx
xor eax, eax
jmp 0x140003567
movq xmm2, qword [rcx + 0x10]
mov edx, 0xb
movdqa xmm5, xmmword [0x1401070e0]
movdqa xmm4, xmmword [0x1401070f0]
mov r10d, 8
movdqu xmmword [r8], xmm0
jmp 0x140003420
movq qword [rax], xmm2
movdqa xmm1, xmm2
pshufb xmm2, xmm5
aesenclast xmm2, xmm4
pslld xmm4, 1
lea rax, [rax + 0x18]
movdqa xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm0, xmm3
pshufd xmm3, xmm0, 0xff
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pxor xmm0, xmm2
pxor xmm2, xmm3
movdqu xmmword [rax - 0x10], xmm0
dec r10d
jne 0x140003420
mov dword [rax + 0x20], edx
xor eax, eax
jmp 0x140003567
movups xmm2, xmmword [rcx + 0x10]
mov edx, 0xd
lea rax, [rax + 0x10]
movdqa xmm5, xmmword [0x1401070d0]
movdqa xmm4, xmmword [0x1401070f0]
mov r10d, 7
movdqu xmmword [r8], xmm0
movdqa xmm1, xmm2
movdqu xmmword [r8 + 0x10], xmm2
jmp 0x1400034d0
pshufb xmm2, xmm5
aesenclast xmm2, xmm4
movdqa xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm0, xmm3
pslld xmm4, 1
pxor xmm0, xmm2
movdqu xmmword [rax], xmm0
dec r10d
je 0x140003552
pshufd xmm2, xmm0, 0xff
pxor xmm3, xmm3
aesenclast xmm2, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm1, xmm3
pxor xmm2, xmm1
movdqu xmmword [rax + 0x10], xmm2
lea rax, [rax + 0x20]
movdqa xmm1, xmm2
jmp 0x1400034d0
mov dword [rax + 0x10], edx
xor eax, eax
jmp 0x140003567
mov rax, 0xfffffffffffffffe
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
add rsp, 8
ret
Function at 0x140027360
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x1400273a6
mov r15, rbx
test r15, r15
je 0x140027482
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x140027402
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x1400273f1
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.1400d1f70
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x140027382
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x14002749e
lea rcx, [r13*8]
call fcn.140092cc0
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x140027464
lea r15, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x140027482
mov r10, qword [r14 + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x14002744c
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp rbx, r14
je 0x140027484
add rbx, 0xfffffffffffffff8
jne 0x140027477
ud2
test r12, r12
je 0x140027382
mov rcx, r12
call fcn.140092d00
mov r15, qword [rsi + 0x10]
jmp 0x140027382
call fcn.14001c890
int3
Function at 0x14002c200
Capabilities:
Delete registry key

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14013a040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002c2d9
mov ebp, r8d
mov rbx, rdx
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], r15
xor eax, eax
mov qword [rsp + 0x38], rax
mov r12d, dword [rsi + 8]
mov r9d, r12d
or r9d, 0x10001
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rsp + 0x20], rdx
mov rdx, rbx
mov r8d, 8
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002c2af
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x28], r14
and r12d, 0x300
mov dword [rsp + 0x30], r12d
test bpl, 1
je 0x14002c2e0
test r14, r14
je 0x14002c2a0
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rsi + 8]
mov rcx, qword [rsi]
mov rdx, rbx
call fcn.14002c350
mov edi, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x14013a040]
je 0x14002c2c8
call fcn.140094250
int3
mov eax, edi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, 6
jmp 0x14002c2b1
lea rdi, [rsp + 0x40]
mov qword [rdi], r15
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.14002c530
cmp byte [rdi + 4], 0
jne 0x14002c316
mov r8d, dword [rsi + 8]
lea rdx, [0x140115888]
mov rcx, r14
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
jmp 0x14002c31a
mov edi, dword [rsp + 0x40]
test r14, r14
je 0x14002c2b1
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002c2b1
mov edx, 1
call fcn.14002c860
jmp 0x14002c2b1