joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a89a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4a8a74
jb 0x4a8ad3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004a8880
aeskeygenassist xmm1, xmm0, 1
call fcn.004a88a0
aeskeygenassist xmm1, xmm2, 2
call fcn.004a8880
aeskeygenassist xmm1, xmm0, 2
call fcn.004a88a0
aeskeygenassist xmm1, xmm2, 4
call fcn.004a8880
aeskeygenassist xmm1, xmm0, 4
call fcn.004a88a0
aeskeygenassist xmm1, xmm2, 8
call fcn.004a8880
aeskeygenassist xmm1, xmm0, 8
call fcn.004a88a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004a8880
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004a88a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004a8880
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004a88a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004a8880
jmp 0x4a8b41
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004a87e0
aeskeygenassist xmm1, xmm2, 2
call fcn.004a8840
aeskeygenassist xmm1, xmm2, 4
call fcn.004a87e0
aeskeygenassist xmm1, xmm2, 8
call fcn.004a8840
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004a87e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004a8840
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004a87e0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004a8840
jmp 0x4a8b41
aeskeygenassist xmm1, xmm0, 1
call fcn.004a87a0
aeskeygenassist xmm1, xmm0, 2
call fcn.004a87a0
aeskeygenassist xmm1, xmm0, 4
call fcn.004a87a0
aeskeygenassist xmm1, xmm0, 8
call fcn.004a87a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004a87a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004a87a0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004a87a0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004a87a0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004a87a0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004a87a0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4a8b4e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret

Function at 0x4a8f20
Capabilities:
Execute syscall

Disassembly:
xor rax, rax
mov ax, word [rsp + 8]
push rcx
mov rcx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rdi, qword gs:[0x30]
mov dword [rdi + 0x68], 0
sub rsp, 0x80
cmp ecx, 4
jle 0x4a8f60
cmp ecx, 0x10
jle 0x4a8f56
int 3
mov rdi, rsp
cld
rep movsq qword [rdi], qword [rsi]
mov rsi, rsp
sub rsp, 8
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
mov r9, qword [rsi + 0x18]
movq xmm0, rcx
movq xmm1, rdx
movq xmm2, r8
movq xmm3, r9
mov r10, rcx
syscall
add rsp, 0x88
pop rcx
mov dword [rsp + 0x28], eax
ret
Function at 0x4ab140
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4ab157
inc rax
cmp rax, 4
jge 0x4ab16f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4ab154
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4ab180
inc rax
cmp rax, 4
jge 0x4ab18e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4ab1b7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4ab19b
jmp 0x4ab17d
Function at 0x4b54a0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4b5739
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], rax
nop
lea rax, [0x004d1cc0]
call fcn.0040c6a0
mov qword [rsp + 0x70], rax
mov qword [rax + 8], 9
lea rcx, [0x004dd6ea]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004d1cc0]
call fcn.0040c6a0
mov qword [rsp + 0x68], rax
mov qword [rax + 8], 8
lea rcx, [0x004dd47a]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004d1c00]
call fcn.0040c6a0
cmp dword [0x005f2030], 0
jne 0x4b5537
mov rcx, qword [rsp + 0x70]
jmp 0x4b5544
call fcn.00461320
mov rcx, qword [rsp + 0x70]
mov qword [r11], rcx
mov qword [rsp + 0x60], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xd
lea rcx, [0x004de4f7]
mov qword [rax], rcx
nop
lea rax, [0x004d1c00]
call fcn.0040c6a0
cmp dword [0x005f2030], 0
jne 0x4b5580
mov rcx, qword [rsp + 0x68]
jmp 0x4b558d
call fcn.00461320
mov rcx, qword [rsp + 0x68]
mov qword [r11], rcx
mov qword [rsp + 0x58], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xc
lea rcx, [0x004de077]
mov qword [rax], rcx
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x50], rcx
lea rax, [0x004c2680]
call fcn.0040c6a0
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0x3000
mov qword [rax + 0x18], 0x40
mov rbx, rax
mov edi, 4
mov rax, qword [rsp + 0x58]
mov rcx, rdi
call fcn.004ae580
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
jbe 0x4b572e
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rcx
lea rax, [0x004c2620]
call fcn.0040c6a0
mov rcx, qword [rsp + 0x48]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 0x10], rcx
mov rbx, rax
mov ecx, 3
mov rdi, rcx
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.004ae580
movzx ecx, word [0x005f1dc4]
mov word [rsp + 0x3e], cx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x80], rdx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x78], rdx
lea rax, [0x004c26e0]
nop dword [rax]
call fcn.0040c6a0
mov qword [rax], 0xffffffffffffffff
mov rcx, qword [rsp + 0x88]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0x20
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
movzx ecx, word [rsp + 0x3e]
mov word [rsp], cx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 5
mov qword [rsp + 0x18], 5
call fcn.004a8f20
xorps xmm15, xmm15
mov r14, qword [0x005f1ff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x48]
xor ebx, ebx
mov rcx, rbx
mov rdi, rcx
mov rsi, rcx
nop dword [rax]
call fcn.0045dd60
add rsp, 0x98
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.004616a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f420
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004b54a0
Function at 0x140021860
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400218f6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1401f0da0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140022fd0
test rdi, rdi
je 0x140021985
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14002199e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140021a96
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140021b18
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140021aa3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140021960
cmp r9, 8
jae 0x140021aac
jmp 0x140021b18
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140022fd0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140021b18
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x140021b18
mov r8, rcx
cmp r9, 8
jb 0x140021b18
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140021ab0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140022fd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140023012
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14002301a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14002302b
jmp 0x140023042
xor r10d, r10d
jmp 0x1400230cd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140023042
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140023059
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140023079
add r11, r8
jmp 0x1400231aa
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140023142
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400230f0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140023160
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140023172
jmp 0x14002318c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14002318c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400231a6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140027640
Capabilities:
Get hostname

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp - 0xc], 0
lea r8, [rbp - 0xc]
mov ecx, 5
xor edx, edx
call sub.kernel32.dll_GetComputerNameExW
mov eax, dword [rbp - 0xc]
test rax, rax
mov qword [rbp - 0x20], rax
je 0x1400276a9
lea rdi, [rax + rax]
movzx eax, byte [0x1402f8ff1]
mov edx, 2
mov rcx, rdi
call fcn.1400275d0
mov rdx, rax
test rax, rax
jne 0x1400276ae
mov ecx, 2
mov rdx, rdi
call fcn.1401ea780
ud2
mov edx, 2
lea r8, [rbp - 0xc]
mov ecx, 5
mov qword [rbp - 0x18], rdx
call sub.kernel32.dll_GetComputerNameExW
test eax, eax
je 0x140027709
mov r8d, dword [rbp - 0xc]
lea rcx, [rbp - 0x40]
mov rdx, qword [rbp - 0x18]
call fcn.1401b4ca0
movups xmm0, xmmword [rbp - 0x40]
movups xmm1, xmmword [rbp - 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp - 0x20]
test edx, edx
mov rcx, qword [rbp - 0x18]
je 0x1400276fe
add rdx, rdx
mov r8d, 2
call fcn.1400275e0
mov rax, rsi
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
mov rdx, qword [rbp - 0x20]
test edx, edx
mov rcx, qword [rbp - 0x18]
jne 0x1400276f0
jmp 0x1400276fe
Function at 0x1400333c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x9a8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x910], xmm7
movaps xmmword [rbp + 0x900], xmm6
mov qword [rbp + 0x8f8], 0xfffffffffffffffe
mov r15, rdx
mov qword [rbp + 0x890], rcx
mov rcx, qword [rdx + 0x130]
test rcx, rcx
mov qword [rbp + 0x6d8], r8
je 0x140033428
mov rdx, r8
call fcn.1401654a0
mov r8, qword [rbp + 0x6d8]
test al, al
je 0x140035792
lea rdx, [r15 + 0x118]
lea rax, [r15 + 0x20]
mov qword [rbp + 0x6e0], rax
lea rax, [r15 + 0x88]
mov qword [rbp + 0x6f8], rax
lea rax, [r15 + 0xe0]
mov qword [rbp + 0x700], rax
lea rax, [r15 + 0xe3]
mov qword [rbp + 0x528], rax
lea r12, [rbp + 0x193]
xorps xmm6, xmm6
movaps xmm7, xmmword [0x1401f2c70]
lea rax, [r15 + 0x28]
mov qword [rbp + 0x768], rax
lea rax, [r15 + 0x50]
mov qword [rbp + 0x3c8], rax
lea rax, [r15 + 0x68]
mov qword [rbp + 0x3d0], rax
lea rax, [r15 + 0x98]
mov qword [rbp + 0x788], rax
lea rax, [r15 + 0xc8]
mov qword [rbp + 0x770], rax
lea rax, [r15 + 0xf8]
mov qword [rbp + 0x3d8], rax
lea rcx, [rbp + 0x320]
lea rdi, [rbp + 0x5d0]
lea r14, [rbp + 0x790]
lea r13, [rbp + 0x3e0]
lea rax, fcn.14000f880
mov qword [rbp + 0x6e8], rax
mov qword [rbp + 0x8a8], r15
mov qword [rbp + 0x520], rdx
call fcn.140105110
mov rax, qword [rbp + 0x320]
cmp rax, 3
je 0x140034ce0
mov word [rbp + 0x7f8], 1
mov qword [rbp + 0x7e8], 1
lea rax, fcn.14000f880
mov qword [rbp + 0x7f0], rax
mov dword [rbp + 0x790], 2
movzx eax, byte [0x1402f8ff1]
mov ecx, 0x70
mov edx, 8
call fcn.1400275d0
test rax, rax
je 0x14003606f
mov rsi, rax
movups xmm0, xmmword [rbp + 0x7f0]
movups xmmword [rax + 0x60], xmm0
movups xmm0, xmmword [rbp + 0x7e0]
movups xmmword [rax + 0x50], xmm0
movups xmm0, xmmword [rbp + 0x7d0]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rbp + 0x790]
movups xmm1, xmmword [rbp + 0x7a0]
movups xmm2, xmmword [rbp + 0x7b0]
movups xmm3, xmmword [rbp + 0x7c0]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov qword [rbp + 0x240], rax
lea rdx, [r15 + 0x98]
lea rcx, [rbp + 0x790]
call fcn.1401d1d20
movups xmm6, xmmword [r15 + 0xb4]
movups xmm0, xmmword [r15 + 0xc8]
movzx eax, byte [r15 + 0xd8]
mov byte [rbp + 0x3f0], al
jmp 0x140035cae
mov ecx, 8
mov edx, 0x70
call fcn.1401ea780
jmp 0x140036203
Function at 0x14003ca50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r8
add r8, 0xb
mov qword [rbp - 0x20], r8
mov word [rbp - 0x18], 0
mov dword [rbp - 0x10], 1
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x28]
call fcn.140062aa0
mov dword [rbp - 4], 0x800
mov dword [rbp - 8], 0
movzx eax, byte [0x1402f8ff1]
mov ecx, 0x800
mov edx, 1
call fcn.1400275d0
test rax, rax
je 0x14003cbe4
mov rbx, rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 0x800
mov qword [rbp - 0x18], 0
mov rdi, qword [rbp - 0x50]
lea r12, [rbp - 4]
lea r15, [rbp - 8]
mov rsi, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov r13, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
sub r13, rax
nop word cs:[rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call rsi
cmp eax, 0xea
jne 0x14003cb4b
mov r8d, dword [rbp - 4]
cmp r13, r8
jae 0x14003cb10
lea rcx, [rbp - 0x28]
mov rdx, qword [rbp - 0x38]
call fcn.1401e10e0
mov rbx, qword [rbp - 0x28]
jmp 0x14003caf7
test eax, eax
jne 0x14003cb6a
mov eax, dword [rbp - 4]
mov qword [rbp - 0x18], rax
mov eax, dword [rbp - 8]
cmp eax, 0xb
jbe 0x14003cbc3
movabs rax, 0xde00000002
jmp 0x14003cb72
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp - 0x30]
mov qword [rcx], rax
mov byte [rcx + 0x18], 0xc
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14003cb94
mov r8d, 1
mov rcx, rbx
call fcn.1400275e0
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x14003cbae
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.1400275e0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x30]
mov qword [rdx + 0x10], rcx
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdx], xmm0
mov byte [rdx + 0x18], al
mov rdx, qword [rbp - 0x48]
test rdx, rdx
jne 0x14003cb9d
jmp 0x14003cbae
mov ecx, 1
mov edx, 0x800
call fcn.1401ea780
ud2
Function at 0x140040aa0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm9
movaps xmmword [rsp + 0xa0], xmm8
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm6
call fcn.1401a86d0
cmp qword [rax], 0
je 0x140040adf
add rax, 8
jmp 0x140040ae9
mov rcx, rax
xor edx, edx
call fcn.140038290
movdqu xmm6, xmmword [rax]
inc qword [rax]
pshufd xmm7, xmm6, 0x44
pxor xmm7, xmmword [str.uespemosarenegylmodnarodsetybdet]
pshufd xmm8, xmm6, 0xee
pxor xmm8, xmmword [0x1401f0da0]
mov ebx, 1
lea r14, [rsp + 0x60]
xorps xmm9, xmm9
lea rsi, [rsp + 0x30]
lea rdi, [rsp + 0x28]
nop word cs:[rax + rax]
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm6
movaps xmmword [r14], xmm9
mov qword [r14 + 0x10], 0
mov qword [rsp + 0x28], rbx
mov r8d, 8
mov rcx, rsi
mov rdx, rdi
call fcn.140022fd0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x30]
add rax, rcx
rol rcx, 0xd
xor rdx, r9
xor rcx, rax
rol rax, 0x20
mov r8, qword [rsp + 0x38]
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rdx, rax
xor rcx, r8
rol r8, 0x20
xor rax, r9
add rax, rcx
rol rcx, 0xd
xor rcx, rax
rol rax, 0x20
xor r8, 0xff
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rcx, r8
rol r8, 0x20
xor rdx, rax
add rax, rcx
rol rcx, 0xd
xor rcx, rax
rol rax, 0x20
add r8, rdx
rol rdx, 0x10
xor rdx, r8
add rax, rdx
rol rdx, 0x15
add r8, rcx
rol rcx, 0x11
xor rcx, r8
rol r8, 0x20
xor rdx, rax
add rax, rcx
rol rcx, 0xd
add r8, rdx
rol rdx, 0x10
xor rdx, r8
rol rdx, 0x15
xor rcx, rax
add r8, rcx
rol rcx, 0x11
mov rax, r8
rol rax, 0x20
xor rax, rcx
xor rax, rdx
inc rbx
xor rax, r8
je 0x140040b30
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm9, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400fef50
Capabilities:
Get remote cert context via schannel

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
mov edx, 0x53
call qword [sym.imp.secur32.dll_QueryContextAttributesW]
mov edx, eax
xor eax, eax
test edx, edx
setne cl
jne 0x1400fef84
mov rdx, qword [rsp + 0x20]
mov al, cl
add rsp, 0x28
ret
shl rdx, 0x20
or rdx, 2
mov al, cl
add rsp, 0x28
ret
Function at 0x14011cbb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
cmp dword [rcx], 2
jne 0x14011cc46
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
pshufd xmm2, xmm0, 0xee
pxor xmm2, xmmword [0x1401f0da0]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rsi, qword [rdx]
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140022fd0
test rdi, rdi
je 0x14011ccd5
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14011ccee
mov rcx, qword [rdx]
mov r8, qword [rcx]
xor edx, edx
test r8, r8
setne dl
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x1efac7090aef4a21
imul rax, rdx
test r8, r8
je 0x14011cde6
mov r9, qword [rcx + 0x10]
test r9, r9
je 0x14011ce68
mov rcx, qword [rcx + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14011cdf3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14011ccb0
cmp r9, 8
jae 0x14011cdfc
jmp 0x14011ce68
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140022fd0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14011ce68
movzx ecx, byte [rcx + 8]
xor rax, rcx
imul rax, rdx
jmp 0x14011ce68
mov r8, rcx
cmp r9, 8
jb 0x14011ce68
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14011ce00
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret