joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402d6d00
Capabilities:
Manipulate user privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
xor r14d, r14d
mov rbp, rdx
cmp qword [0x14069d718], r14
mov rsi, rcx
jne 0x1402d6ea6
test rdx, rdx
je 0x1402d6ea6
call fcn.1402d68f0
test eax, eax
je 0x1402d6d44
mov al, 1
jmp 0x1402d6ea0
mov rbx, r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0xb8]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1402d6e9e
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0xb0]
xor r9d, r9d
mov dword [rsp + 0xb0], r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r9d, dword [rsp + 0xb0]
test r9d, r9d
je 0x1402d6dbe
mov edx, r9d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rsp + 0xb0]
mov rbx, rax
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0xb0]
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, 1
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1402d6e9e
xorps xmm0, xmm0
lea r9, [rsp + 0x30]
mov r8d, 0xf0fff
lea rdx, [rsp + 0x50]
xor ecx, ecx
mov edi, r14d
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.ADVAPI32.dll_LsaOpenPolicy]
test eax, eax
jne 0x1402d6e84
mov rdx, qword [rbx]
lea rax, str.SeLockMemoryPrivilege
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov r9d, 1
mov dword [rsp + 0x40], 0x2c002a
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ADVAPI32.dll_LsaAddAccountRights]
test eax, eax
jne 0x1402d6e79
lea rdx, str.Huge_pages_support_was_successfully_enabled__but_reboot_required_to_use_it
lea ecx, [rax + 5]
call fcn.1402ac040
mov edi, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_LsaClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x1402d6e9e
call fcn.1402d68f0
test eax, eax
je 0x1402d6e9e
mov al, 1
jmp 0x1402d6ea0
xor al, al
mov byte [0x14069b46b], al
mov ecx, 0x28
call fcn.14026e684
mov rbx, rax
lea rax, [0x1403da0d8]
mov qword [rbx], rax
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], r14
test rsi, rsi
je 0x1402d6f41
mov ecx, 0x28
call fcn.14026e684
mov rdi, rax
shl rsi, 0x15
mov dword [rax + 8], r14d
lea rcx, [rsi + 0xffffff]
and rcx, 0xffffffffffe00000
add rcx, 0x200000
mov qword [rax], rcx
mov qword [rax + 0x10], rcx
xor eax, eax
mov dword [rdi + 0x18], eax
mov qword [rdi + 0x20], r14
test rbp, rbp
je 0x1402d6f1d
mov rcx, rdi
call fcn.1402d6290
test al, al
jne 0x1402d6f2e
mov rcx, qword [rdi]
mov edx, 0x40
call fcn.14027f554
mov qword [rdi + 0x20], rax
mov qword [rbx + 0x20], rdi
mov eax, dword [rdi + 0x20]
neg rax
and eax, 0xffffff
mov qword [rbx + 0x18], rax
lea r11, [rsp + 0x80]
mov qword [0x14069d718], rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1402d81a0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1402d828d
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x1402d8274
xorps xmm0, xmm0
mov byte [rsp + 0x20], dil
xor edx, edx
mov word [rsp + 0x21], 0x100
mov r8d, 0xf0
mov byte [rsp + 0x23], 1
movups xmmword [rsp + 0x32], xmm0
mov dword [rsp + 0x24], 0
movups xmmword [rsp + 0x42], xmm0
mov word [rsp + 0x30], 0
call fcn.140270e70
movaps xmm0, xmmword [0x1403d5270]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x1403d5280]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x1403d5290]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x1403d52a0]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
cmp byte [rcx + 0xe8], 0
je 0x1402d8285
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov rbx, qword [rsp + 0x70]
mov eax, 0xffffffff
add rsp, 0x60
pop rdi
ret

Function at 0x1402e2050
Capabilities:
Allocate or change rwx memory

Disassembly:
test r9, r9
je 0x1402e2106
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov qword [rsp + 0x40], rbx
mov edi, r12d
mov rbp, r9
mov r14, r8
mov rsi, rdx
mov r15, rcx
nop dword [rax]
mov edx, 0x1000
mov ecx, 0x1c0
call fcn.14027f554
xor ecx, ecx
mov edx, 0x4000
mov r8d, 0x3000
mov rbx, rax
mov qword [rax + 0xe0], rsi
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [rbx + 0x120], r12d
add rsi, r14
mov qword [rbx + 0x118], rax
mov qword [rbx + 0x128], 0xffffffffffffffff
mov qword [r15 + rdi*8], rbx
inc rdi
cmp rdi, rbp
jb 0x1402e2090
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1402e25f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 8
mov ecx, r8d
ror ecx, 8
xor ecx, 8
movd xmm2, r8d
movd xmm0, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm2, r8d
movd xmm1, eax
punpckldq xmm2, xmm1
movd xmm0, ecx
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
pxor xmm0, xmm4
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xaa
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1402e28a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 4
mov ecx, r8d
ror ecx, 8
xor ecx, 4
movd xmm2, r8d
movd xmm0, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm2, r8d
movd xmm1, eax
punpckldq xmm2, xmm1
movd xmm0, ecx
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
pxor xmm0, xmm4
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xaa
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1402e2b50
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 2
mov ecx, r8d
ror ecx, 8
xor ecx, 2
movd xmm2, r8d
movd xmm0, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm2, r8d
movd xmm1, eax
punpckldq xmm2, xmm1
movd xmm0, ecx
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
pxor xmm0, xmm4
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xaa
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1402e2e00
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11, rcx
movaps xmmword [rsp], xmm6
movdqu xmm6, xmmword [rdx]
lea rdi, str.cw
pshufd xmm0, xmm6, 0x55
mov rbx, rdx
movd eax, xmm0
movdqu xmm5, xmmword [r11]
pshufd xmm0, xmm6, 0xff
mov r9d, eax
shr rax, 0x10
movzx r8d, al
mov eax, r9d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r10d, byte [r8 + rdi]
movzx eax, byte [rax + rdi]
pxor xmm4, xmmword [r11]
shl eax, 8
or r10d, eax
mov eax, r9d
shr rax, 8
movzx ecx, al
shl r10d, 8
movzx eax, byte [rcx + rdi]
or r10d, eax
movzx eax, r9b
shl r10d, 8
movzx ecx, byte [rax + rdi]
or r10d, ecx
movd eax, xmm0
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r10d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
mov eax, r10d
or r8d, ecx
ror eax, 8
xor eax, 1
mov ecx, r8d
ror ecx, 8
xor ecx, 1
movd xmm2, r8d
movd xmm0, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, ecx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqu xmmword [r11], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
movdqa xmm5, xmm6
or r9d, eax
pshufd xmm0, xmm1, 0xff
shl r9d, 8
mov eax, edx
shr rax, 8
movzx ecx, al
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
pxor xmm4, xmm6
movaps xmm6, xmmword [rsp]
movzx eax, byte [rcx + rdi]
or r9d, eax
movzx eax, dl
shl r9d, 8
movzx ecx, byte [rax + rdi]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rdi]
movzx eax, byte [rax + rdi]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rdi]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rdi]
or r8d, ecx
mov ecx, r9d
mov eax, r8d
ror eax, 8
ror ecx, 8
movd xmm2, r8d
movd xmm1, eax
punpckldq xmm2, xmm1
movd xmm0, ecx
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
pxor xmm0, xmm4
punpcklqdq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xaa
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret
Function at 0x1403011b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ecx, ecx
mov edx, 0x20000
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x50], rax
mov r9d, 0x1ffff0
mov qword [0x14069aba0], rax
lea rdx, [fcn.1406cc880]
mov rcx, rax
mov r8d, 0x40000
lea rbx, [rax + 0x1000]
lea rdi, [rax + 0x2000]
mov qword [0x14069abc0], rbx
lea rsi, [rax + 0x3000]
mov qword [0x14069ab48], rdi
lea rbp, [rax + 0x8000]
mov qword [0x14069ab20], rsi
lea r14, [rax + 0x9000]
mov qword [0x14069ab10], rbp
lea r15, [rax + 0xa000]
mov qword [0x14069ab78], r14
lea r12, [rax + 0xb000]
mov qword [0x14069abd0], r15
lea r13, [rax + 0xc000]
mov qword [0x14069ab58], r12
add rax, 0xd000
mov qword [0x14069ab70], r13
mov qword [0x14069abe0], rax
lea rax, [rcx + 0xe000]
mov qword [0x14069ab40], rax
lea rax, [rcx + 0xf000]
mov qword [0x14069abb8], rax
call fcn.1402feb10
mov r9d, 0x1ffff0
lea rdx, [fcn.1406ccb80]
mov r8d, 0x40000
mov rcx, rbx
call fcn.1402feb10
mov r9d, 0x1ffff0
lea rdx, [fcn.1406cce40]
mov r8d, 0x40000
mov rcx, rdi
call fcn.1402feb10
mov r9d, 0x1ffff0
lea rdx, [fcn.1406cd100]
mov r8d, 0x40000
mov rcx, rsi
call fcn.1402feb10
mov r9d, 0x1ffff0
lea rdx, [fcn.1406cc880]
mov r8d, 0x60000
mov rcx, rbp
call fcn.1402feb10
mov r9d, 0x1ffff0
lea rdx, [fcn.1406ccb80]
mov r8d, 0x60000
mov rcx, r14
call fcn.1402feb10
mov r9d, 0x1ffff0
lea rdx, [fcn.1406cce40]
mov r8d, 0x60000
mov rcx, r15
call fcn.1402feb10
mov r9d, 0x1ffff0
lea rdx, [fcn.1406cd100]
mov r8d, 0x60000
mov rcx, r12
call fcn.1402feb10
mov r9d, 0x1ffff0
lea rdx, [fcn.1406cc880]
mov r8d, 0x100000
mov rcx, r13
call fcn.1402feb10
mov rbx, qword [rsp + 0x50]
lea rdx, [fcn.1406ccb80]
mov r9d, 0x1ffff0
mov r8d, 0x100000
lea rcx, [rbx + 0xd000]
call fcn.1402feb10
mov r9d, 0x1ffff0
mov r8d, 0x100000
lea rdx, [fcn.1406cce40]
lea rcx, [rbx + 0xe000]
call fcn.1402feb10
mov r9d, 0x1ffff0
lea rdx, [fcn.1406cd100]
mov r8d, 0x100000
lea rcx, [rbx + 0xf000]
call fcn.1402feb10
lea r9, [rsp + 0x50]
mov edx, 0x20000
mov r8d, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x20000
mov rdx, rbx
mov rcx, rax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
Function at 0x180001084
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18004b2a0]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
lea r8, [rsp + 0x20]
mov edx, 0x1004
lea r9d, [rbx + 0xa]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp eax, ebx
jle 0x1800010c4
lea rcx, [rsp + 0x20]
call fcn.180021574
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180021590
add rsp, 0x40
pop rbx
ret

Function at 0x180002550
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r14, rdx
mov rdi, rcx
cmp rcx, rbx
jne 0x180002580
xor eax, eax
jmp 0x18000261b
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rax + rcx + 0x88]
add rcx, rdi
mov r13d, dword [rcx + 0x1c]
mov r12d, dword [rcx + 0x20]
mov esi, dword [rcx + 0x24]
add r13, rdi
add r12, rdi
add rsi, rdi
test edx, 0xffff0000
jne 0x1800025b2
movzx eax, dx
sub eax, dword [rcx + 0x10]
jmp 0x180002610
mov ebp, dword [rcx + 0x18]
jmp 0x180002607
mov r15d, dword [r12]
mov ecx, 0x5f5e100
dec ebp
add r15, rdi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rsp + 0x50], rax
cmp rax, rbx
je 0x1800025f0
xor edx, edx
mov r8d, 0x5f5e100
mov rcx, rax
call fcn.180021c30
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, r14
mov rcx, r15
call fcn.1800223f0
cmp eax, ebx
je 0x18000260d
add r12, 4
add rsi, 2
cmp ebp, ebx
jne 0x1800025b7
jmp 0x180002618
movzx eax, word [rsi]
mov ebx, dword [r13 + rax*4]
add rbx, rdi
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180008350
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CAboutDlg.virtual_640
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
test rdx, 0xffffffffffff0000
jne 0x180010553
cmp dword [rcx + 0xa8], 0
jne 0x180010553
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.180018f60
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1800104b8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180008450
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0xe8]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x3ed
call fcn.1800192f0
lea r8, [rbx + 0x190]
mov edx, 0x3ee
mov rcx, rdi
call fcn.1800192f0
lea r8, [rbx + 0x238]
mov edx, 0x3ec
mov rcx, rdi
call fcn.1800192f0
lea r8, [rbx + 0x2e0]
mov edx, 0x3eb
mov rcx, rdi
call fcn.1800192f0
lea r8, [rbx + 0x388]
mov edx, 0x3ea
mov rcx, rdi
call fcn.1800192f0
lea r8, [rbx + 0x430]
mov edx, 0x3e8
mov rcx, rdi
call fcn.1800192f0
lea r8, [rbx + 0x4f0]
mov edx, 0x3ef
mov rcx, rdi
call fcn.1800192f0
lea r8, [rbx + 0x4d8]
mov edx, 0x3e8
mov rcx, rdi
call fcn.1800193a8
lea r8, [rbx + 0x4e0]
mov edx, 0x3ea
mov rcx, rdi
call fcn.1800193a8
lea r8, [rbx + 0x4e8]
mov edx, 0x3eb
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800193a8

Function at 0x180010514
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CAboutDlg.virtual_640
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
test rdx, 0xffffffffffff0000
jne 0x180010553
cmp dword [rcx + 0xa8], 0
jne 0x180010553
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.180018f60
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.1800104b8
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret