joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025cb0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x238
mov r14, rcx
mov rax, qword [0x1400f6398]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14008ea40
mov word [rdi], 0
lea rcx, str.PROGRAMFILES
mov rdx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140025d44
mov esi, eax
test rsi, rsi
je 0x140025d44
mov rbx, rsi
dec rsi
cmp word [rsp + rbx*2 + 0x1e], 0x5c
je 0x140025d0e
cmp byte [r14 + 0x17], 0
mov rcx, r14
jns 0x140025d2e
mov rcx, qword [r14]
lea r8, [rsi + 1]
lea rdx, [rsp + 0x20]
call fcn.14008a578
test eax, eax
je 0x140025e2b
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x103
jae 0x140025da7
mov ebx, eax
inc rbx
cmp rbx, 1
je 0x140025da7
mov rsi, rbx
dec rbx
cmp word [rsp + rsi*2 + 0x1c], 0x5c
je 0x140025d71
cmp byte [r14 + 0x17], 0
mov rcx, r14
jns 0x140025d92
mov rcx, qword [r14]
lea rdx, [rsp + 0x20]
mov r8, rbx
call fcn.14008a578
test eax, eax
je 0x140025e5d
lea rdx, [rsp + 0x20]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140025e0a
mov esi, eax
inc rsi
cmp rsi, 1
je 0x140025e0a
mov rbx, rsi
dec rsi
cmp word [rsp + rbx*2 + 0x1c], 0x5c
je 0x140025dd4
cmp byte [r14 + 0x17], 0
mov rcx, r14
jns 0x140025df5
mov rcx, qword [r14]
lea rdx, [rsp + 0x20]
mov r8, rsi
call fcn.14008a578
test eax, eax
je 0x140025e90
xor edi, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14008b870
mov eax, edi
add rsp, 0x238
pop rbx
pop rdi
pop rsi
pop r14
ret
movzx eax, byte [r14 + 0x17]
mov rcx, rax
test al, al
jns 0x140025e3b
mov rcx, qword [r14 + 8]
dec rcx
mov dil, 1
cmp rcx, rsi
je 0x140025e0c
mov rcx, r14
test al, al
jns 0x140025e50
mov rcx, qword [r14]
cmp word [rcx + rbx*2], 0x5c
jne 0x140025d44
jmp 0x140025e0c
movzx eax, byte [r14 + 0x17]
mov rcx, rax
test al, al
jns 0x140025e6d
mov rcx, qword [r14 + 8]
mov dil, 1
cmp rcx, rbx
je 0x140025e0c
mov rcx, r14
test al, al
jns 0x140025e7f
mov rcx, qword [r14]
cmp word [rcx + rsi*2 - 2], 0x5c
jne 0x140025da7
jmp 0x140025e0c
movzx eax, byte [r14 + 0x17]
mov rcx, rax
test al, al
jns 0x140025ea0
mov rcx, qword [r14 + 8]
mov dil, 1
cmp rcx, rsi
je 0x140025e0c
test al, al
jns 0x140025eb3
mov r14, qword [r14]
cmp word [r14 + rbx*2 - 2], 0x5c
jne 0x140025e0a
jmp 0x140025e0c
Function at 0x1400289c0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x1400289f5
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14008a104
xor ebx, ebx
test rsi, rsi
jle 0x140028a1a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x140028a1a
inc rbx
cmp rsi, rbx
jne 0x1400289fc
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140028a30
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140028a65
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14008a104
xor ebx, ebx
test rsi, rsi
jle 0x140028a8b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x140028a8b
inc rbx
cmp rsi, rbx
jne 0x140028a6c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140032d10
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
mov rax, qword [0x1400f6398]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14b, 1
cmp qword [0x1400f9a50], 0
je 0x140032d61
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14008b870
mov eax, r14d
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rdi, qword [0x1400f9a30]
test rdi, rdi
je 0x140032e06
test byte [0x1400f6338], 1
je 0x140032d3e
cmp byte [rdi + 0x17], 0
jns 0x140032d83
mov rdi, qword [rdi]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov rcx, rdi
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400f9a50], rax
inc rax
cmp rax, 1
ja 0x140032d3e
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.14008ea40
mov word [rsi], 0
mov ecx, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140032dfe
cmp eax, 0x104
jbe 0x140032f09
xor r14d, r14d
jmp 0x140032d3e
movabs r15, 0x7fffffffffffffef
mov ecx, 0x18
call fcn.140089790
mov rdi, rax
lea rsi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.14008ea40
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov rcx, rsi
call fcn.140089a28
cmp rax, r15
ja 0x140032fc4
mov rbx, rax
cmp rax, 0xb
jae 0x140032e78
mov byte [rdi + 0x17], bl
mov rsi, rdi
test rbx, rbx
jne 0x140032ea0
jmp 0x140032eb3
lea rbp, [rbx + 8]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
call fcn.140089790
mov rsi, rax
mov qword [rdi], rax
add r15, 0x11
or r15, rbp
mov qword [rdi + 0x10], r15
mov qword [rdi + 8], rbx
mov r8, rbx
add r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14008e630
mov word [rsi + rbx*2], 0
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x140032ec7
mov r8, qword [rdi + 8]
mov rcx, rdi
mov dx, 0x5c
call fcn.14000c3b0
cmp rax, 0xffffffffffffffff
je 0x140032eee
inc rax
mov rcx, rdi
mov rdx, rax
mov r8, 0xffffffffffffffff
call fcn.140009d00
lea rdx, [0x1400bfd84]
mov rcx, rdi
call fcn.14000fbf0
mov qword [0x1400f9a30], rdi
jmp 0x140032d71
mov rcx, qword [0x1400f9a30]
lea rdx, [rsp + 0x40]
call fcn.140014070
mov rcx, qword [0x1400f9a30]
movzx eax, byte [rcx + 0x17]
test al, al
js 0x140032fb8
mov rdx, rcx
cmp word [rdx + rax*2 - 2], 0x5c
je 0x140032f4b
lea rdx, [0x1400bfd80]
call fcn.14000fbf0
mov rcx, qword [0x1400f9a30]
lea rdx, [0x1400bfd84]
call fcn.14000fbf0
mov rcx, qword [0x1400f9a30]
cmp byte [rcx + 0x17], 0
jns 0x140032f67
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400f9a50], rax
inc rax
cmp rax, 1
ja 0x140032d3e
mov qword [0x1400f9a50], 0
jmp 0x140032dfe
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
jmp 0x140032f30
mov rcx, rdi
call fcn.1400263a0
int3
Function at 0x1400348d0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1400f6398]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x140034967
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14003496c
test bl, bl
je 0x14003492b
cmp byte [rdi + 8], 0
je 0x1400349e5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
jne 0x1400349f2
mov rcx, qword [rdi]
call fcn.14001d210
mov rcx, qword [0x1400f9b80]
mov dil, 1
test rcx, rcx
jne 0x140034a00
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14008b870
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rdi]
jmp 0x1400348fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x140034994
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140034999
xor edi, edi
jmp 0x140034950
mov rcx, qword [rdi]
jmp 0x140034981
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
je 0x1400349ed
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400349c3
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
jne 0x140034a0f
mov rcx, qword [rdi]
call fcn.14001d210
mov rcx, qword [0x1400f9b80]
test rcx, rcx
jne 0x140034a1a
mov dil, 1
jmp 0x140034950
mov rcx, qword [rdi]
jmp 0x140034920
mov rcx, qword [rdi]
jmp 0x1400349b0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140034938
mov edx, eax
mov r8d, esi
call fcn.140034ba0
jmp 0x140034950
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400349cc
mov edx, eax
mov r8d, esi
call fcn.140034ba0
jmp 0x1400349dd
Function at 0x140043820
Capabilities:
Set registry value

Disassembly:
xor r8d, r8d
test edx, edx
cmovns r8d, edx
lea rdx, str.PWALauncherResult
jmp 0x140059010
push rsi
sub rsp, 0x40
mov rax, qword [0x1400f6398]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008b870
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x140044b50
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1400f6398]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14008a104
cmp rax, rbx
jne 0x140044bec
cmp edi, 1
je 0x140044b94
cmp edi, 2
je 0x140044bec
mov rcx, qword [rsi + 0x40]
call fcn.14008a09c
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14008b870
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140044c10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1400f6398]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp edx, 0xffffffff
je 0x140044c7d
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x140044c88
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.14008a104
mov esi, 0xffffffff
cmp rax, 1
je 0x140044c80
jmp 0x140044d3d
xor r15d, r15d
mov esi, r15d
jmp 0x140044d3d
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140044d38
mov ebp, eax
cmp eax, 3
je 0x140044d17
cmp ebp, 1
ja 0x140044d38
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14008a104
cmp rax, rsi
jne 0x140044d38
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140044ca0
jmp 0x140044c80
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14008a104
cmp rax, 1
je 0x140044c80
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008b870
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140044da0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1400f6398]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp dx, 0xffff
je 0x140044e0d
mov r15d, edx
mov rdi, rcx
mov word [rsp + 0x56], dx
cmp byte [rcx + 0x58], 0
je 0x140044e18
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.14008a104
mov si, 0xffff
cmp rax, 1
je 0x140044e10
jmp 0x140044ecc
xor r15d, r15d
mov esi, r15d
jmp 0x140044ecc
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x56]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140044ec8
mov ebp, eax
cmp eax, 3
je 0x140044ea7
cmp ebp, 1
ja 0x140044ec8
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14008a104
cmp rax, rsi
jne 0x140044ec8
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x140044e30
jmp 0x140044e10
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14008a104
cmp rax, 1
je 0x140044e10
mov si, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008b870
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140059010
Capabilities:
Set registry value

Disassembly:
xor r8d, r8d
test edx, edx
cmovns r8d, edx
lea rdx, str.PWALauncherResult
jmp 0x140059010
push rsi
sub rsp, 0x40
mov rax, qword [0x1400f6398]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008b870
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x14005a540
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r12, r8
mov ebx, edx
mov edi, ecx
mov rax, qword [0x1400f6398]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx eax, byte [r8 + 0x17]
test al, al
jns 0x14005a574
mov rax, qword [r12 + 8]
test rax, rax
je 0x14005a5a1
mov eax, 0x300
mov ecx, ebx
and ecx, eax
cmp ecx, eax
je 0x14005a5a1
cmp edi, 2
lea rax, [0x1400fba90]
lea rcx, [0x1400fbc90]
cmove rcx, rax
cmp word [rcx], 0
je 0x14005a5c0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14008b870
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x14005a5a1
cmp byte [0x1400fba80], 0
setne al
bt ebx, 8
jb 0x14005a5a1
shr ebx, 9
and ebx, 1
or bl, al
je 0x14005a5a1
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.D__f_
cmove rsi, rax
movzx ebp, byte [r12 + 0x17]
test bpl, bpl
js 0x14005a621
mov rdi, r12
jmp 0x14005a62a
mov rdi, qword [r12]
mov rbp, qword [r12 + 8]
mov r14d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
mov rbx, qword [rsi + 8]
mov r13, rbp
sub r13, rbx
jb 0x14005a667
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.14008a578
test eax, eax
je 0x14005a675
add rsi, 0x28
inc r15
cmp r15, r14
jb 0x14005a649
jmp 0x14005a6f2
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x14005a684
test dx, dx
jne 0x14005a667
lea rcx, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rax, str.WOW6432Node_
cmp ebp, 1
je 0x14005a6b2
cmp ebp, 2
jne 0x14005a6a8
mov rdi, rcx
lea rax, str.WOW6432Node
jmp 0x14005a6b2
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x14005a6cf
lea rdx, [rcx + 2]
dec r13
cmp word [rcx + 2], 0x5c
mov rcx, rdx
je 0x14005a6bc
jmp 0x14005a6d2
mov rdx, rcx
mov r14, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r13
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rax
xor r15d, r15d
mov rdi, rdx
jmp 0x14005a66e
cmp dword [rsp + 0x2c], 0
je 0x14005a5a1
cmp byte [r12 + 0x17], 0
js 0x14005a70a
mov rax, r12
jmp 0x14005a70e
mov rax, qword [r12]
mov rdx, qword [rsp + 0x30]
sub rdx, rax
sar rdx, 1
mov rcx, r12
mov r8, qword [rsp + 0x38]
call fcn.140017380
jmp 0x14005a5a1
Function at 0x14005d660
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14005d680
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x14005d6c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14005d6e0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x14005d720
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14005d743
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x14005d7a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14005d7c3
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x14005d820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14005d849
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x14005d8b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14005d8d9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x14005d940
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14005d99f

Function at 0x14005d990
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.14005d990
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x14005da20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14005da7f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14005da70
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret