joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400293f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5614], 1
je 0x140029469
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, 0x15
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1b
mov r9, rax
jne 0x140029420
mov dword [0x1400d5614], 1
mov eax, 0x54c1f523
pop rsi
ret

Function at 0x14002a200
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d55f8], 1
je 0x14002a267
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe3
movzx edx, byte [r8 + r9 + 0x1d]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x37
jne 0x14002a220
mov dword [0x1400d55f8], 1
mov eax, 0xa092ff22
ret

Function at 0x14002a2e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5608], 1
je 0x14002a343
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, 0x1e
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x27
mov rdx, rsi
jne 0x14002a300
mov dword [0x1400d5608], 1
mov eax, 0x91216040
pop rsi
ret

Function at 0x14002a4a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400d578c], 1
je 0x14002a500
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl edx, 4
add edx, eax
movzx eax, byte [r8 + r9 + 0x11]
mov r11d, r9d
sub r11d, edx
movsxd rdx, r11d
xor al, byte [r8 + rdx]
mov byte [rcx + r9], al
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x18
jne 0x14002a4c0
mov dword [0x1400d578c], 1
mov eax, 0xb6b4202f
ret

Function at 0x14002a510
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d5880], 1
je 0x14002a571
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl eax, 2
lea eax, [rax + rax*4]
movzx edx, byte [r8 + r9 + 0x14]
mov r11d, r9d
sub r11d, eax
movsxd rax, r11d
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x1d
jne 0x14002a530
mov dword [0x1400d5880], 1
mov eax, 0x58156f99
ret
Function at 0x14002a730
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d55bc], 1
je 0x14002a793
mov eax, 0xaaaaaaab
xor r8d, r8d
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r9d, r8d
mov r10d, r8d
imul r10, rax
shr r10, 0x24
shl r10d, 3
lea r10d, [r10 + r10*2]
movzx r11d, byte [rdx + r8 + 0x18]
sub r9d, r10d
movsxd r9, r9d
xor r11b, byte [rdx + r9]
mov byte [rcx + r8], r11b
mov r9, r8
inc r9
mov r8, r9
cmp r9d, 0x3f
jne 0x14002a750
mov dword [0x1400d55bc], 1
mov eax, 0xf51e0f6b
ret

Function at 0x14002a920
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d42fc], 1
je 0x14002a99f
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
mov r11, rdx
mov esi, 0x1f
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
mov rdx, r9
shl r9, 5
sub rdx, r9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1f], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x30
mov r9, rax
jne 0x14002a950
mov dword [0x1400d42fc], 1
mov eax, 0x6222b80c
pop rsi
ret

Function at 0x14002a9b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4308], 1
je 0x14002aa29
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1f
mov r9, rax
jne 0x14002a9e0
mov dword [0x1400d4308], 1
mov eax, 0x68e288b1
pop rsi
ret
Function at 0x14002be80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d51cc], 1
je 0x14002bef9
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
mov r11, rdx
mov esi, 0x17
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x17], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1f
mov r9, rax
jne 0x14002beb0
mov dword [0x1400d51cc], 1
mov eax, 0xcaab6330
pop rsi
ret

Function at 0x14002bf00
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d68dc], 1
je 0x14002bf63
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
mov eax, 0x16
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x16], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2b
mov rdx, rsi
jne 0x14002bf20
mov dword [0x1400d68dc], 1
mov eax, 0xbe020fca
pop rsi
ret
Function at 0x14002c770
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x150
mov rsi, rcx
mov dword [rsp + 0x34], 0x104
lea rdi, [0x1400d42e8]
lea rdx, [0x140032efe]
mov rcx, rdi
call fcn.14002a920
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002c818
mov rdi, qword [rsp + 0x38]
lea rbx, [0x1400d4300]
lea rdx, [0x140032f3f]
mov rcx, rbx
call fcn.14002a9b0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14002c840
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov rax, rsi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14002c8fe
mov rdi, rax
mov rbx, rax
cmp rax, 0xf
ja 0x14002c88d
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
mov byte [rdi], 0
jmp 0x14002c82e
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp rax, 0xfff
jb 0x14002c8cc
lea rcx, [r15 + 0x28]
call fcn.1400300e0
test rax, rax
je 0x14002c903
mov rcx, rax
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14002c8d8
lea rcx, [r15 + 1]
call fcn.1400300e0
mov r14, rax
mov qword [rsi], r14
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r15
lea rdx, [rsp + 0x40]
mov rcx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
mov byte [rdi], 0
jmp 0x14002c82e
call fcn.1400037a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14002c910
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4768], 1
je 0x14002c973
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, 0x13
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1b
mov rdx, rsi
jne 0x14002c930
mov dword [0x1400d4768], 1
mov eax, 0x316b23c8
pop rsi
ret

Function at 0x14002c980
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d6900], 1
je 0x14002c9be
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
xor r8b, byte [rdx + r9]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x1e
jne 0x14002c990
mov dword [0x1400d6900], 1
mov eax, 0x47c92157
ret
Function at 0x14002cbb0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rsi, rcx
mov dword [rsp + 0x34], 0x100
lea rdi, [0x1400d4334]
lea rdx, [0x14003301b]
mov rcx, rdi
call fcn.14000e370
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002cc58
mov rdi, qword [rsp + 0x38]
lea rbx, [0x1400d434c]
lea rdx, [0x140033068]
mov rcx, rbx
call fcn.14000e3e0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14002cc80
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov rax, rsi
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14002cd3e
mov rdi, rax
mov rbx, rax
cmp rax, 0xf
ja 0x14002cccd
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
mov byte [rdi], 0
jmp 0x14002cc6e
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp rax, 0xfff
jb 0x14002cd0c
lea rcx, [r15 + 0x28]
call fcn.1400300e0
test rax, rax
je 0x14002cd43
mov rcx, rax
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14002cd18
lea rcx, [r15 + 1]
call fcn.1400300e0
mov r14, rax
mov qword [rsi], r14
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r15
lea rdx, [rsp + 0x40]
mov rcx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
mov byte [rdi], 0
jmp 0x14002cc6e
call fcn.1400037a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14002d610
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d475c], 1
je 0x14002d671
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl eax, 3
lea eax, [rax + rax*2]
movzx edx, byte [r8 + r9 + 0x18]
mov r11d, r9d
sub r11d, eax
movsxd rax, r11d
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x19
jne 0x14002d630
mov dword [0x1400d475c], 1
mov eax, 0x793b5eca
ret
Function at 0x14002d680
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140043040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [0x1400d42e8]
lea rdx, [0x140032efe]
mov rcx, rdi
call fcn.14002a920
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14002d748
lea rsi, [0x1400d4300]
lea rdx, [0x140032f3f]
mov rcx, rsi
call fcn.14002a9b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov rdx, rsi
call fcn.14000ca20
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
jmp 0x14002d79e
mov ebx, dword [rsi + 0x10]
inc ebx
cmp qword [rsi + 0x18], 0x10
jb 0x14002d757
mov rsi, qword [rsi]
mov r14, rsi
mov rsi, qword [rsp + 0x58]
lea rdi, [0x1400d4300]
lea rdx, [0x140032f3f]
mov rcx, rdi
call fcn.14002a9b0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140030980
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002d7c0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d4410], 1
je 0x14002d827
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe7
movzx edx, byte [r8 + r9 + 0x19]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x24
jne 0x14002d7e0
mov dword [0x1400d4410], 1
mov eax, 0x5d189640
ret

Function at 0x14002d830
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4424], 1
je 0x14002d893
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x27
mov rdx, rsi
jne 0x14002d850
mov dword [0x1400d4424], 1
mov eax, 0xb49da104
pop rsi
ret
Function at 0x14002d8a0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movups xmmword [rsp + 0x180], xmm6
mov rdi, rcx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14002daa0
mov rsi, rax
mov dword [rsp + 0x50], 0x130
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14002da9c
lea rbx, [rsp + 0x7c]
xorps xmm6, xmm6
lea r14, [rsp + 0x20]
lea r15, [rsp + 0x50]
mov qword [rsp + 0x48], rdi
nop dword [rax + rax]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14002dacf
mov r12, rax
mov r13, rax
cmp rax, 0xf
ja 0x14002d960
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], 0xf
mov rcx, r14
mov rdx, rbx
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + r12]
add rax, 0x20
jmp 0x14002d9ed
mov rdi, rsi
mov rsi, r14
mov r14, r15
mov rax, r12
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp rax, 0xfff
jb 0x14002d9b0
lea rcx, [r15 + 0x28]
call fcn.1400300e0
test rax, rax
je 0x14002dad4
mov rcx, rax
mov rbp, rax
add rbp, 0x27
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x14002d9bc
lea rcx, [r15 + 1]
call fcn.1400300e0
mov rbp, rax
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r15
mov rcx, rbp
mov rdx, rbx
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
add r12, rbp
mov rax, r12
mov r15, r14
mov r14, rsi
mov rsi, rdi
mov rdi, qword [rsp + 0x48]
mov byte [rax], 0
mov r8, qword [rdi + 0x10]
mov r12, qword [rsp + 0x38]
cmp qword [rsp + 0x30], r8
jne 0x14002da30
mov rcx, r14
cmp r12, 0x10
jb 0x14002da0e
mov rcx, qword [rsp + 0x20]
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x14002da1b
mov rdx, qword [rdi]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete al
jmp 0x14002da32
xor eax, eax
mov ebp, eax
cmp r12, 0x10
jb 0x14002da6d
mov rcx, qword [rsp + 0x20]
lea rdx, [r12 + 1]
cmp rdx, 0x1000
jb 0x14002da68
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14002dad4
add r12, 0x28
mov rdx, r12
mov rcx, rax
call fcn.140030124
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
test bpl, bpl
jne 0x14002daa4
mov rcx, rsi
mov rdx, r15
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14002d910
xor eax, eax
jmp 0x14002daa6
xor eax, eax
jmp 0x14002dab3
mov al, 1
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
movups xmm6, xmmword [rsp + 0x180]
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400037a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002dae0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d438c], 1
je 0x14002db3d
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 3
mov eax, edx
imul eax, edx, 0xffffffe6
movzx edx, byte [r8 + r9 + 0x1a]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x28
jne 0x14002db00
mov dword [0x1400d438c], 1
mov eax, 0x22b33009
ret

Function at 0x14002db50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4398], 1
je 0x14002dbc9
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1f
mov r9, rax
jne 0x14002db80
mov dword [0x1400d4398], 1
mov eax, 0x97f31bb3
pop rsi
ret

Function at 0x14002dc40
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d43ac], 1
je 0x14002dcbf
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
mov r11, rdx
mov esi, 0x1f
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
mov rdx, r9
shl r9, 5
sub rdx, r9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1f], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x2e
mov r9, rax
jne 0x14002dc70
mov dword [0x1400d43ac], 1
mov eax, 0xeb5bef8e
pop rsi
ret

Function at 0x14002dcd0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400d43c4], 1
je 0x14002dd30
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
add eax, edx
lea eax, [rax + rax*8]
movzx edx, byte [r8 + r9 + 0x12]
mov r11d, r9d
sub r11d, eax
movsxd rax, r11d
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x13
jne 0x14002dcf0
mov dword [0x1400d43c4], 1
mov eax, 0x1392c8ca
ret

Function at 0x14002dd40
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d43e8], 1
je 0x14002dda1
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl eax, 2
lea eax, [rax + rax*4]
movzx edx, byte [r8 + r9 + 0x14]
mov r11d, r9d
sub r11d, eax
movsxd rax, r11d
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x20
jne 0x14002dd60
mov dword [0x1400d43e8], 1
mov eax, 0x2b54c57e
ret
Function at 0x14002e240
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x150
mov rsi, rcx
mov dword [rsp + 0x34], 0x104
lea rdi, [0x1400d4334]
lea rdx, [0x14003301b]
mov rcx, rdi
call fcn.14000e370
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002e2e8
mov rdi, qword [rsp + 0x38]
lea rbx, [0x1400d4ec4]
lea rdx, [0x1400347c8]
mov rcx, rbx
call fcn.14000e880
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14002e310
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov rax, rsi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14002e3ce
mov rdi, rax
mov rbx, rax
cmp rax, 0xf
ja 0x14002e35d
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
mov byte [rdi], 0
jmp 0x14002e2fe
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp rax, 0xfff
jb 0x14002e39c
lea rcx, [r15 + 0x28]
call fcn.1400300e0
test rax, rax
je 0x14002e3d3
mov rcx, rax
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14002e3a8
lea rcx, [r15 + 1]
call fcn.1400300e0
mov r14, rax
mov qword [rsi], r14
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r15
lea rdx, [rsp + 0x40]
mov rcx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
mov byte [rdi], 0
jmp 0x14002e2fe
call fcn.1400037a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3