joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400113f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov qword [rbp - 0x38], rcx
mov r14, qword [rdx]
add r9, r8
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], r9
mov word [rbp - 0x20], 0
mov dword [rbp - 0x18], 1
lea rcx, [rbp - 0x50]
lea rdx, [rbp - 0x30]
call fcn.14000e470
mov dword [rbp + 0xc], 0x800
mov dword [rbp + 8], 0
movzx eax, byte [0x1400e8f01]
mov ecx, 0x800
mov edx, 1
call fcn.140011aa0
test rax, rax
je 0x1400115bc
mov rbx, rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], 0x800
mov qword [rbp], 0
mov rdi, qword [rbp - 0x50]
lea r12, [rbp + 0xc]
lea r15, [rbp + 8]
mov rsi, qword [rbp - 8]
mov r13, qword [rbp]
sub rsi, r13
nop word [rax + rax]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400114dd
mov r8d, dword [rbp + 0xc]
cmp rsi, r8
jae 0x1400114a0
lea rcx, [rbp - 0x10]
mov rdx, r13
call fcn.1400b8bf0
mov rbx, qword [rbp - 0x10]
jmp 0x14001148f
test eax, eax
jne 0x140011502
mov eax, dword [rbp + 0xc]
mov qword [rbp], rax
mov r14d, dword [rbp + 8]
cmp r14d, 0xb
jbe 0x140011597
movabs rax, 0xde00000002
jmp 0x14001150a
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x30], rax
mov byte [rbp - 0x18], 0xc
mov rdx, qword [rbp - 8]
mov r14b, 0xc
test rdx, rdx
je 0x14001152c
mov r8d, 1
mov rcx, rbx
call fcn.140011ab0
mov rdx, qword [rbp - 0x48]
test rdx, rdx
je 0x140011546
add rdx, rdx
mov r8d, 2
mov rcx, rdi
call fcn.140011ab0
cmp r14b, 0xc
jne 0x140011561
mov rax, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x38]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x140011580
lea rdx, [rbp - 0x30]
mov rsi, qword [rbp - 0x38]
mov rcx, rsi
call fcn.140023470
cmp byte [rbp - 0x18], 0xc
je 0x140011580
lea rcx, [rbp - 0x30]
call fcn.140010d60
mov rax, rsi
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [rbp]
mov qword [rbp - 0x20], rax
vmovups xmm0, xmmword [rbp - 0x10]
vmovaps xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x18], r14b
mov rdx, qword [rbp - 0x48]
test rdx, rdx
jne 0x140011535
jmp 0x140011546
mov ecx, 1
mov edx, 0x800
call fcn.1400b9dc0
ud2
Function at 0x1400116b0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
lea rcx, [rbp - 0x18]
mov rdx, r9
call fcn.1400240a0
mov rdi, qword [rdi]
add rsi, rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rsi
mov word [rbp - 0x40], 0
mov dword [rbp - 0x38], 1
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x50]
call fcn.14000e470
movzx r9d, byte [rbp]
mov rdx, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x18]
mov eax, dword [rbp - 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov qword [rbp + 8], rdx
xor r8d, r8d
call sub.ADVAPI32.dll_RegSetValueExW
mov edi, eax
mov rdx, qword [rbp - 0x28]
test rdx, rdx
je 0x14001174d
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 8]
call fcn.140011ab0
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x140011764
mov r8d, 1
mov rcx, rsi
call fcn.140011ab0
mov rcx, rdi
shl rcx, 0x20
or rcx, 2
xor eax, eax
test edi, edi
cmovne rax, rcx
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x140011af0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x30], ymm0
vmovups ymmword [rsp + 0x20], ymm0
lea rcx, [rsp + 0x20]
vzeroupper
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140015130
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov r8d, 0xc
mov rcx, rdi
call fcn.140014e20
test rax, rax
je 0x140015179
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140015237
mov eax, dword [rdi + 0x20]
mov ecx, dword [rdi + 0x18]
mov edx, dword [rdi + 0x1c]
xor r9d, r9d
lea r8, [0x1400bfb40]
nop dword [rax]
mov r11d, eax
or r11d, 3
mov r10d, r11d
and r10d, 0xfffffffe
imul r10d, r11d
shr r10d, 8
xor r10b, byte [rsp + r9 + 0x20]
mov byte [rsp + r9 + 0x20], r10b
lea r11, [r9 + 1]
mov r9d, ecx
xor r9b, r10b
movzx r9d, r9b
shr ecx, 8
xor ecx, dword [r8 + r9*4]
movzx r9d, cl
add r9d, edx
imul edx, r9d, 0x8088405
inc edx
mov r9d, edx
shr r9d, 0x18
movzx r10d, al
xor r10d, r9d
shr eax, 8
xor eax, dword [r8 + r10*4]
mov r9, r11
cmp r11, 0xc
jne 0x140015190
mov dword [rdi + 0x20], eax
mov dword [rdi + 0x18], ecx
mov dword [rdi + 0x1c], edx
movzx eax, byte [rsp + 0x2b]
test bx, bx
je 0x140015227
shr ebx, 0x18
cmp al, bl
jne 0x14001522f
mov rax, qword [rdi + 0x20]
mov qword [rsi + 0x28], rax
vmovups ymm0, ymmword [rdi]
vmovups ymmword [rsi + 8], ymm0
mov qword [rsi], 0
jmp 0x140015237
shr rbx, 0x38
cmp al, bl
je 0x14001520d
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
vzeroupper
ret
Function at 0x140015250
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx + 0x10]
test r15, r15
je 0x1400152b2
cmp rbx, r15
mov r9, r15
cmovb r9, rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
lea rcx, [rsp + 0x20]
mov r8, r14
call qword [rax + 0x18]
cmp qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
mov ecx, 1
jne 0x1400152b6
sub r15, rax
jb 0x140015360
mov qword [rdi + 0x10], r15
xor ecx, ecx
jmp 0x1400152b6
xor ecx, ecx
xor eax, eax
test rbx, rbx
je 0x140015347
mov r8d, dword [rdi + 0x20]
mov edx, dword [rdi + 0x18]
mov r9d, dword [rdi + 0x1c]
xor r10d, r10d
lea r11, [0x1400bfb40]
nop word cs:[rax + rax]
mov r15d, r8d
or r15d, 3
mov ebp, r15d
and ebp, 0xfffffffe
imul ebp, r15d
shr ebp, 8
xor bpl, byte [r14 + r10]
mov r15d, edx
xor r15b, bpl
movzx r15d, r15b
shr edx, 8
xor edx, dword [r11 + r15*4]
movzx r15d, dl
add r15d, r9d
imul r9d, r15d, 0x8088405
inc r9d
mov r15d, r9d
shr r15d, 0x18
movzx r12d, r8b
xor r12d, r15d
shr r8d, 8
xor r8d, dword [r11 + r12*4]
mov byte [r14 + r10], bpl
inc r10
cmp rbx, r10
jne 0x1400152e0
mov dword [rdi + 0x20], r8d
mov dword [rdi + 0x18], edx
mov dword [rdi + 0x1c], r9d
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rax, str.number_of_read_bytes_exceeds_limit
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
lea rax, str.number_of_read_bytes_exceeds_limit
mov qword [rsp + 0x30], rax
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x38], xmm0
lea rdx, str._rustc_cd674d61790607dfb6faa9d754bd3adfa13aea7clibrary_std_srciomod.rs_rustc_cd674d61790607dfb6faa9d754bd3adfa13aea7clibrary_std_srcio_readbuf.rs
lea rcx, [rsp + 0x20]
call fcn.1400b9ea0
ud2
Function at 0x140017ae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
vmovaps xmmword [rsp + 0x40], xmm10
vmovaps xmmword [rsp + 0x30], xmm9
vmovaps xmmword [rsp + 0x20], xmm8
vmovaps xmmword [rsp + 0x10], xmm7
vmovaps xmmword [rsp], xmm6
vaesimc xmm0, xmmword [rdx + 0x10]
vaesimc xmm1, xmmword [rdx + 0x20]
vaesimc xmm2, xmmword [rdx + 0x30]
vaesimc xmm3, xmmword [rdx + 0x40]
vaesimc xmm4, xmmword [rdx + 0x50]
vaesimc xmm5, xmmword [rdx + 0x60]
vaesimc xmm6, xmmword [rdx + 0x70]
vaesimc xmm7, xmmword [rdx + 0x80]
vaesimc xmm8, xmmword [rdx + 0x90]
vmovaps xmm9, xmmword [rdx]
vmovaps xmm10, xmmword [rdx + 0xa0]
vmovaps xmmword [rcx], xmm9
vmovdqa xmmword [rcx + 0x10], xmm0
vmovdqa xmmword [rcx + 0x20], xmm1
vmovdqa xmmword [rcx + 0x30], xmm2
vmovdqa xmmword [rcx + 0x40], xmm3
vmovdqa xmmword [rcx + 0x50], xmm4
vmovdqa xmmword [rcx + 0x60], xmm5
vmovdqa xmmword [rcx + 0x70], xmm6
vmovdqa xmmword [rcx + 0x80], xmm7
vmovdqa xmmword [rcx + 0x90], xmm8
vmovaps xmmword [rcx + 0xa0], xmm10
vmovaps xmm6, xmmword [rsp]
vmovaps xmm7, xmmword [rsp + 0x10]
vmovaps xmm8, xmmword [rsp + 0x20]
vmovaps xmm9, xmmword [rsp + 0x30]
vmovaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x140017bb0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x78
vmovaps xmmword [rsp + 0x60], xmm12
vmovaps xmmword [rsp + 0x50], xmm11
vmovaps xmmword [rsp + 0x40], xmm10
vmovaps xmmword [rsp + 0x30], xmm9
vmovaps xmmword [rsp + 0x20], xmm8
vmovaps xmmword [rsp + 0x10], xmm7
vmovaps xmmword [rsp], xmm6
vaesimc xmm0, xmmword [rdx + 0x10]
vaesimc xmm1, xmmword [rdx + 0x20]
vaesimc xmm2, xmmword [rdx + 0x30]
vaesimc xmm3, xmmword [rdx + 0x40]
vaesimc xmm4, xmmword [rdx + 0x50]
vaesimc xmm5, xmmword [rdx + 0x60]
vaesimc xmm6, xmmword [rdx + 0x70]
vaesimc xmm7, xmmword [rdx + 0x80]
vaesimc xmm8, xmmword [rdx + 0x90]
vaesimc xmm9, xmmword [rdx + 0xa0]
vaesimc xmm10, xmmword [rdx + 0xb0]
vmovaps xmm11, xmmword [rdx]
vmovaps xmm12, xmmword [rdx + 0xc0]
vmovaps xmmword [rcx], xmm11
vmovdqa xmmword [rcx + 0x10], xmm0
vmovdqa xmmword [rcx + 0x20], xmm1
vmovdqa xmmword [rcx + 0x30], xmm2
vmovdqa xmmword [rcx + 0x40], xmm3
vmovdqa xmmword [rcx + 0x50], xmm4
vmovdqa xmmword [rcx + 0x60], xmm5
vmovdqa xmmword [rcx + 0x70], xmm6
vmovdqa xmmword [rcx + 0x80], xmm7
vmovdqa xmmword [rcx + 0x90], xmm8
vmovdqa xmmword [rcx + 0xa0], xmm9
vmovdqa xmmword [rcx + 0xb0], xmm10
vmovaps xmmword [rcx + 0xc0], xmm12
vmovaps xmm6, xmmword [rsp]
vmovaps xmm7, xmmword [rsp + 0x10]
vmovaps xmm8, xmmword [rsp + 0x20]
vmovaps xmm9, xmmword [rsp + 0x30]
vmovaps xmm10, xmmword [rsp + 0x40]
vmovaps xmm11, xmmword [rsp + 0x50]
vmovaps xmm12, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140017cc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
vmovaps xmmword [rsp + 0x80], xmm14
vmovaps xmmword [rsp + 0x70], xmm13
vmovaps xmmword [rsp + 0x60], xmm12
vmovaps xmmword [rsp + 0x50], xmm11
vmovaps xmmword [rsp + 0x40], xmm10
vmovaps xmmword [rsp + 0x30], xmm9
vmovaps xmmword [rsp + 0x20], xmm8
vmovaps xmmword [rsp + 0x10], xmm7
vmovaps xmmword [rsp], xmm6
vaesimc xmm0, xmmword [rdx + 0x10]
vaesimc xmm1, xmmword [rdx + 0x20]
vaesimc xmm2, xmmword [rdx + 0x30]
vaesimc xmm3, xmmword [rdx + 0x40]
vaesimc xmm4, xmmword [rdx + 0x50]
vaesimc xmm5, xmmword [rdx + 0x60]
vaesimc xmm6, xmmword [rdx + 0x70]
vaesimc xmm7, xmmword [rdx + 0x80]
vaesimc xmm8, xmmword [rdx + 0x90]
vaesimc xmm9, xmmword [rdx + 0xa0]
vaesimc xmm10, xmmword [rdx + 0xb0]
vaesimc xmm11, xmmword [rdx + 0xc0]
vaesimc xmm12, xmmword [rdx + 0xd0]
vmovaps xmm13, xmmword [rdx]
vmovaps xmm14, xmmword [rdx + 0xe0]
vmovaps xmmword [rcx], xmm13
vmovdqa xmmword [rcx + 0x10], xmm0
vmovdqa xmmword [rcx + 0x20], xmm1
vmovdqa xmmword [rcx + 0x30], xmm2
vmovdqa xmmword [rcx + 0x40], xmm3
vmovdqa xmmword [rcx + 0x50], xmm4
vmovdqa xmmword [rcx + 0x60], xmm5
vmovdqa xmmword [rcx + 0x70], xmm6
vmovdqa xmmword [rcx + 0x80], xmm7
vmovdqa xmmword [rcx + 0x90], xmm8
vmovdqa xmmword [rcx + 0xa0], xmm9
vmovdqa xmmword [rcx + 0xb0], xmm10
vmovdqa xmmword [rcx + 0xc0], xmm11
vmovdqa xmmword [rcx + 0xd0], xmm12
vmovaps xmmword [rcx + 0xe0], xmm14
vmovaps xmm6, xmmword [rsp]
vmovaps xmm7, xmmword [rsp + 0x10]
vmovaps xmm8, xmmword [rsp + 0x20]
vmovaps xmm9, xmmword [rsp + 0x30]
vmovaps xmm10, xmmword [rsp + 0x40]
vmovaps xmm11, xmmword [rsp + 0x50]
vmovaps xmm12, xmmword [rsp + 0x60]
vmovaps xmm13, xmmword [rsp + 0x70]
vmovaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x14001cfd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x18
vmovdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x14001d189
vmovdqu xmm2, xmmword [rdx + 0x10]
vmovdqu xmm1, xmmword [rdx + 0x20]
vmovdqu xmm0, xmmword [rdx + 0x30]
not ecx
vmovd xmm3, ecx
vpxor xmm3, xmm3, xmmword [rdx]
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
vmovq xmm4, rax
vpbroadcastq xmm5, qword [0x1400cb8c0]
nop
vpclmulqdq xmm6, xmm3, xmm4, 0
vpxor xmm6, xmm6, xmmword [rdx]
vpclmulqdq xmm3, xmm3, xmm5, 0x11
vpxor xmm3, xmm6, xmm3
vpclmulqdq xmm6, xmm2, xmm4, 0
vpclmulqdq xmm2, xmm2, xmm5, 0x11
vpxor xmm6, xmm6, xmmword [rdx + 0x10]
vpxor xmm2, xmm6, xmm2
vpclmulqdq xmm6, xmm1, xmm4, 0
vpclmulqdq xmm1, xmm1, xmm5, 0x11
vpxor xmm6, xmm6, xmmword [rdx + 0x20]
vpxor xmm1, xmm6, xmm1
vpclmulqdq xmm6, xmm0, xmm4, 0
vpclmulqdq xmm0, xmm0, xmm5, 0x11
vpxor xmm6, xmm6, xmmword [rdx + 0x30]
vpxor xmm0, xmm6, xmm0
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x14001d020
movabs rax, 0x1751997d0
vmovq xmm4, rax
vpclmulqdq xmm5, xmm3, xmm4, 0
vpbroadcastq xmm6, qword [0x1400cb8c8]
vpclmulqdq xmm3, xmm3, xmm6, 0x11
vpxor xmm3, xmm5, xmm3
vpxor xmm2, xmm3, xmm2
vpclmulqdq xmm3, xmm2, xmm4, 0
vpclmulqdq xmm2, xmm2, xmm6, 0x11
vpxor xmm2, xmm3, xmm2
vpxor xmm1, xmm2, xmm1
vpclmulqdq xmm2, xmm1, xmm4, 0
vpclmulqdq xmm1, xmm1, xmm6, 0x11
vpxor xmm1, xmm2, xmm1
vpxor xmm0, xmm1, xmm0
cmp r8, 0x10
jb 0x14001d112
vpbroadcastq xmm1, qword [0x1400cb8c8]
nop word cs:[rax + rax]
add r8, 0xfffffffffffffff0
vpclmulqdq xmm2, xmm0, xmm4, 0
vpxor xmm2, xmm2, xmmword [rdx]
vpclmulqdq xmm0, xmm0, xmm1, 0x11
add rdx, 0x10
vpxor xmm0, xmm2, xmm0
cmp r8, 0xf
ja 0x14001d0f0
vpclmulqdq xmm1, xmm0, xmmword [0x1400cb8a0], 0x10
vpsrldq xmm0, xmm0, 8
vpxor xmm0, xmm1, xmm0
vpxor xmm1, xmm1, xmm1
vpblendw xmm2, xmm1, xmm0, 3
movabs rax, 0x163cd6124
vmovq xmm3, rax
vpclmulqdq xmm2, xmm2, xmm3, 0
vpsrldq xmm0, xmm0, 4
vpxor xmm0, xmm2, xmm0
vpblendw xmm2, xmm1, xmm0, 3
vpclmulqdq xmm2, xmm2, xmmword [0x1400cb8b0], 0x10
vpblendw xmm1, xmm1, xmm2, 3
movabs rax, 0x1db710641
vmovq xmm2, rax
vpclmulqdq xmm1, xmm1, xmm2, 0
vpxor xmm0, xmm0, xmm1
vpextrd ecx, xmm0, 1
not ecx
test r8, r8
je 0x14001d197
vmovaps xmm6, xmmword [rsp]
add rsp, 0x18
jmp fcn.14001cae0
mov eax, ecx
vmovaps xmm6, xmmword [rsp]
add rsp, 0x18
ret

Function at 0x140020f80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vaeskeygenassist xmm0, xmmword [rdx], 2
vmovdqa xmmword [rcx], xmm0
ret
Function at 0x140023170
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
vmovdqa xmmword [rsp + 0x30], xmm7
vmovdqa xmmword [rsp + 0x20], xmm6
cmp rdx, r9
jne 0x14002330c
test rdx, rdx
je 0x14002319e
cmp rdx, 0x10
jae 0x1400231a5
xor eax, eax
xor r9d, r9d
jmp 0x1400232e0
xor eax, eax
jmp 0x1400232f8
cmp rdx, 0x80
jae 0x1400231b8
xor eax, eax
xor r9d, r9d
jmp 0x140023277
mov r9, rdx
and r9, 0xffffffffffffff80
vpxor xmm0, xmm0, xmm0
xor eax, eax
vpxor xmm1, xmm1, xmm1
vpxor xmm2, xmm2, xmm2
vpxor xmm3, xmm3, xmm3
nop word cs:[rax + rax]
vmovdqu ymm4, ymmword [r8 + rax]
vmovdqu ymm5, ymmword [r8 + rax + 0x20]
vmovdqu ymm6, ymmword [r8 + rax + 0x40]
vmovdqu ymm7, ymmword [r8 + rax + 0x60]
vpxor ymm4, ymm4, ymmword [rcx + rax]
vpor ymm0, ymm4, ymm0
vpxor ymm4, ymm5, ymmword [rcx + rax + 0x20]
vpor ymm1, ymm4, ymm1
vpxor ymm4, ymm6, ymmword [rcx + rax + 0x40]
vpxor ymm5, ymm7, ymmword [rcx + rax + 0x60]
vpor ymm2, ymm4, ymm2
vpor ymm3, ymm5, ymm3
sub rax, 0xffffffffffffff80
cmp r9, rax
jne 0x1400231e0
vpor ymm0, ymm1, ymm0
vpor ymm0, ymm2, ymm0
vpor ymm0, ymm3, ymm0
vextracti128 xmm1, ymm0, 1
vpor xmm0, xmm0, xmm1
vpshufd xmm1, xmm0, 0xee
vpor xmm0, xmm0, xmm1
vpshufd xmm1, xmm0, 0x55
vpor xmm0, xmm0, xmm1
vpsrld xmm1, xmm0, 0x10
vpor xmm0, xmm0, xmm1
vpsrlw xmm1, xmm0, 8
vpor xmm0, xmm0, xmm1
vmovd eax, xmm0
cmp r9, rdx
je 0x1400232f8
test dl, 0x70
je 0x1400232e0
mov r10, r9
mov r9, rdx
and r9, 0xfffffffffffffff0
movzx eax, al
vmovd xmm0, eax
nop dword [rax + rax]
vmovdqu xmm1, xmmword [r8 + r10]
vpxor xmm1, xmm1, xmmword [rcx + r10]
vpor xmm0, xmm1, xmm0
add r10, 0x10
cmp r9, r10
jne 0x140023290
vpshufd xmm1, xmm0, 0xee
vpor xmm0, xmm0, xmm1
vpshufd xmm1, xmm0, 0x55
vpor xmm0, xmm0, xmm1
vpsrld xmm1, xmm0, 0x10
vpor xmm0, xmm0, xmm1
vpsrlw xmm1, xmm0, 8
vpor xmm0, xmm0, xmm1
vmovd eax, xmm0
cmp r9, rdx
je 0x1400232f8
nop word cs:[rax + rax]
movzx r10d, byte [r8 + r9]
xor r10b, byte [rcx + r9]
lea r11, [r9 + 1]
or al, r10b
mov r9, r11
cmp rdx, r11
jne 0x1400232e0
vmovaps xmm6, xmmword [rsp + 0x20]
vmovaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x48
vzeroupper
ret
lea rcx, str.assertion_failed:_a.len____b.len__C:UsersWDAGUtilityAccount.cargo_registry_srcindex.crates.io_6f17d22bba15001fconstant_time_eq_0.1.5_srclib.rs
lea r8, [0x1400cff38]
mov edx, 0x24
call fcn.1400b9f50
ud2
Function at 0x140023370
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x1060
call fcn.1400b7430
sub rsp, rax
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx]
mov ebx, dword [rdx + 8]
mov r14, qword [rax]
mov dword [rsp + 0x44], 0x800
lea r15, [rsp + 0x60]
mov r8d, 0x1000
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsp + 0x20], ymm0
lea r9, [rsp + 0x44]
mov rcx, r14
mov edx, ebx
mov r8, r15
vzeroupper
call sub.ADVAPI32.dll_RegEnumKeyExW
test eax, eax
je 0x1400233e3
cmp eax, 0x103
jne 0x140023411
mov qword [rsi], 0
jmp 0x140023444
mov r8d, dword [rsp + 0x44]
cmp r8, 0x801
jae 0x140023456
lea rcx, [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.1400491c0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002341d
mov rax, qword [rsp + 0x50]
jmp 0x140023427
shl rax, 0x20
or rax, 2
xor ecx, ecx
jmp 0x14002342c
movabs rax, 0x900000002
mov rdx, qword [rsp + 0x58]
inc ebx
mov dword [rdi + 8], ebx
mov qword [rsi], 1
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rdx
mov rax, rsi
add rsp, 0x1060
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.C:UsersWDAGUtilityAccount.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinreg_0.7.0_srclib.rsP
mov edx, 0x800
mov rcx, r8
mov r8, rax
call fcn.1400ba3a0
ud2
Function at 0x14002b040
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x14002b0d0
jmp 0x14002b0bf
jae 0x14002b190
cmp r8, 0x201
jae 0x14002b0d0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14002b128
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x14002b0ff
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.1400b9020
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14002b151
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002b1f8
mov r8d, r14d
cmp r15, r8
jne 0x14002b0b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002b21b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14002b0bf
jmp 0x14002b0d0
cmp rsi, r8
jb 0x14002b235
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14002e700
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x14002b1e1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140011ab0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x14002b1c9
jmp 0x14002b1e1
lea rcx, [0x1400d0888]
lea r8, str.2_r_
mov edx, 0x28
call fcn.1400b9f50
jmp 0x14002b24a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400ba3a0
ud2
Function at 0x14002b2a0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.14003f320
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x408], rax
test rax, rax
je 0x14002b426
mov qword [rbp + 0x400], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x14002b360
jmp 0x14002b34f
jae 0x14002b438
cmp r8, 0x201
jae 0x14002b360
mov r15d, 0x200
lea r14, [rbp - 0x60]
mov r12, r8
jmp 0x14002b3b8
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x14002b38f
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.1400b9020
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x410], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3f8], r13
mov rbx, rdi
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x14002b3e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002b50b
mov r8d, esi
cmp r12, r8
jne 0x14002b340
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14002b535
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14002b34f
jmp 0x14002b360
lea rcx, [rbp - 0x58]
call fcn.140025400
mov byte [rsi + 0x18], 2
jmp 0x14002b4ca
cmp r15, r8
jb 0x14002b54f
lea rcx, [rbp + 0x3a0]
mov rdx, r14
call fcn.14002e700
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x14002b489
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rdi
call fcn.140011ab0
cmp byte [rbp + 0x3d8], 2
jne 0x14002b4e1
mov rsi, qword [rbp + 0x400]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.140025400
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x14002b4ca
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.140011ab0
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x400]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x14002b4b5
jmp 0x14002b4ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x14002b471
jmp 0x14002b489
lea rcx, [0x1400d0888]
lea r8, str.2_r_
mov edx, 0x28
call fcn.1400b9f50
jmp 0x14002b564
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.1400ba3a0
ud2