joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140299df0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x68
call fcn.14011ddf0
sub rsp, rax
mov rax, qword [0x140378098]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0x3c]
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test eax, eax
je 0x140299f34
movups xmm0, xmmword [rcx + 0x10]
mov r15, qword [rcx + 0x20]
lea rbx, [rcx + 0x10]
dec eax
mov dword [rsp + 0x28], 1
mov dword [rcx + 0x3c], eax
xor r9d, r9d
movups xmmword [rsp + 0x48], xmm0
and byte [rsp + 0x54], 0x7f
xor r8d, r8d
psrldq xmm0, 8
xor edx, edx
movd eax, xmm0
mov rcx, r15
mov dword [rsp + 0x30], edi
and al, 0x7f
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.14014ceb0
test eax, eax
je 0x140299f34
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov r9, r14
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, r15
call fcn.14014db80
test eax, eax
je 0x140299f34
mov r9, rdi
lea rdx, [rsp + 0x38]
mov r8, rbp
mov rcx, rsi
call fcn.14029a450
test eax, eax
je 0x140299f34
lea rax, [rbx + 0xf]
xor r8d, r8d
lea rcx, [rsp + 0x38]
cmp rcx, rax
ja 0x140299f09
lea rax, [rsp + 0x47]
cmp rax, rbx
jb 0x140299f09
lea rcx, [rsp + 0x38]
mov eax, r8d
sub rbx, rcx
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x38]
add rdx, rax
inc rax
movzx ecx, byte [rbx + rdx]
xor byte [rdx], cl
cmp rax, 0x10
jl 0x140299ef0
jmp 0x140299f1d
movdqu xmm1, xmmword [rsp + 0x38]
movdqu xmm0, xmmword [rbx]
pxor xmm1, xmm0
movdqu xmmword [rsp + 0x38], xmm1
mov rax, qword [rsp + 0x38]
or rax, qword [rsp + 0x40]
je 0x140299f50
mov rdx, rdi
mov rcx, rbp
call fcn.140001240
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14011d660
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsi + 0x38], r8d
mov eax, edi
jmp 0x140299f36
Function at 0xe13cc0
Capabilities:
Terminate process

Disassembly:
adc dword [rsi + 0xe], eax
or eax, dword [rax]
invalid
cld
pop r11
jmp 0xe13ccd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xe13cdd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xe13cc5
lea eax, [rcx + 1]
jmp 0xe13ceb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xe13cfe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xe13ce4
sub eax, 3
jb 0xe13d1e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xe13d6d
sar eax, 1
movsxd rbp, eax
jb 0xe13d54
jmp 0xe13d2c
add ebx, ebx
jne 0xe13d2a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xe13d54
inc ecx
add ebx, ebx
jne 0xe13d3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xe13d54
call r11
adc ecx, ecx
add ebx, ebx
jne 0xe13d4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xe13d3c
add ecx, 2
jmp 0xe13d59
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00e13c82
jmp 0xe13ccd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x9e0000]
mov eax, dword [rdi]
or eax, eax
je 0xe13dcd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xa2cbd4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xe13d7d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xe13dc7
mov qword [rbx], rax
add rbx, 8
jmp 0xe13d9d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xe13e07
cmp al, 0xef
ja 0xe13df9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xe13dd9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0xe13de8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xe13e5b
sub rsp, 0xffffffffffffff80
jmp 0xbac690
Function at 0x14002fe50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x14002ff90
cmp edx, 0xc0
je 0x14002ff10
cmp edx, 0x80
jne 0x140030050
mov edx, 9
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm0, 1
call fcn.140030087
aeskeygenassist xmm1, xmm0, 2
call fcn.140030080
aeskeygenassist xmm1, xmm0, 4
call fcn.140030080
aeskeygenassist xmm1, xmm0, 8
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x40
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x80
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.140030080
aeskeygenassist xmm1, xmm0, 0x36
call fcn.140030080
movups xmmword [rax], xmm0
mov dword [rax + 0x50], edx
xor eax, eax
jmp 0x140030057
movq xmm2, qword [rcx + 0x10]
mov edx, 0xb
movups xmmword [r8], xmm0
aeskeygenassist xmm1, xmm2, 1
call fcn.1400300a7
aeskeygenassist xmm1, xmm2, 2
call fcn.1400300e0
aeskeygenassist xmm1, xmm2, 4
call fcn.1400300a0
aeskeygenassist xmm1, xmm2, 8
call fcn.1400300e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.1400300a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.1400300e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.1400300a0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.1400300e0
movups xmmword [rax], xmm0
mov dword [rax + 0x30], edx
xor rax, rax
jmp 0x140030057
movups xmm2, xmmword [rcx + 0x10]
mov edx, 0xd
lea rax, [rax + 0x10]
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm2
aeskeygenassist xmm1, xmm2, 1
call fcn.140030107
aeskeygenassist xmm1, xmm0, 1
call fcn.140030120
aeskeygenassist xmm1, xmm2, 2
call fcn.140030100
aeskeygenassist xmm1, xmm0, 2
call fcn.140030120
aeskeygenassist xmm1, xmm2, 4
call fcn.140030100
aeskeygenassist xmm1, xmm0, 4
call fcn.140030120
aeskeygenassist xmm1, xmm2, 8
call fcn.140030100
aeskeygenassist xmm1, xmm0, 8
call fcn.140030120
aeskeygenassist xmm1, xmm2, 0x10
call fcn.140030100
aeskeygenassist xmm1, xmm0, 0x10
call fcn.140030120
aeskeygenassist xmm1, xmm2, 0x20
call fcn.140030100
aeskeygenassist xmm1, xmm0, 0x20
call fcn.140030120
aeskeygenassist xmm1, xmm2, 0x40
call fcn.140030100
movups xmmword [rax], xmm0
mov dword [rax + 0x10], edx
xor rax, rax
jmp 0x140030057
mov rax, 0xfffffffffffffffe
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
add rsp, 8
ret
Function at 0x140030140
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
movups xmm0, xmmword [rcx]
xorps xmm4, xmm4
lea rax, [r8 + 0x10]
cmp edx, 0x100
je 0x140030310
cmp edx, 0xc0
je 0x140030270
cmp edx, 0x80
jne 0x1400303e0
mov edx, 9
movdqa xmm5, xmmword [0x140217490]
mov r10d, 8
movdqa xmm4, xmmword [0x1402174b0]
movdqa xmm2, xmm0
movdqu xmmword [r8], xmm0
jmp 0x1400301a0
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
pslld xmm4, 1
lea rax, [rax + 0x10]
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqa xmm2, xmm0
dec r10d
jne 0x1400301a0
movdqa xmm4, xmmword [str.eeee]
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
pslld xmm4, 1
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax], xmm0
movdqa xmm2, xmm0
pshufb xmm0, xmm5
aesenclast xmm0, xmm4
movdqa xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm3, xmm2
pslldq xmm2, 4
pxor xmm2, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x60], edx
xor eax, eax
jmp 0x1400303e7
movq xmm2, qword [rcx + 0x10]
mov edx, 0xb
movdqa xmm5, xmmword [0x1402174a0]
movdqa xmm4, xmmword [0x1402174b0]
mov r10d, 8
movdqu xmmword [r8], xmm0
jmp 0x1400302a0
movq qword [rax], xmm2
movdqa xmm1, xmm2
pshufb xmm2, xmm5
aesenclast xmm2, xmm4
pslld xmm4, 1
lea rax, [rax + 0x18]
movdqa xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm0, xmm3
pshufd xmm3, xmm0, 0xff
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pxor xmm0, xmm2
pxor xmm2, xmm3
movdqu xmmword [rax - 0x10], xmm0
dec r10d
jne 0x1400302a0
mov dword [rax + 0x20], edx
xor eax, eax
jmp 0x1400303e7
movups xmm2, xmmword [rcx + 0x10]
mov edx, 0xd
lea rax, [rax + 0x10]
movdqa xmm5, xmmword [0x140217490]
movdqa xmm4, xmmword [0x1402174b0]
mov r10d, 7
movdqu xmmword [r8], xmm0
movdqa xmm1, xmm2
movdqu xmmword [r8 + 0x10], xmm2
jmp 0x140030350
pshufb xmm2, xmm5
aesenclast xmm2, xmm4
movdqa xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm3, xmm0
pslldq xmm0, 4
pxor xmm0, xmm3
pslld xmm4, 1
pxor xmm0, xmm2
movdqu xmmword [rax], xmm0
dec r10d
je 0x1400303d2
pshufd xmm2, xmm0, 0xff
pxor xmm3, xmm3
aesenclast xmm2, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm1, 4
pxor xmm1, xmm3
pxor xmm2, xmm1
movdqu xmmword [rax + 0x10], xmm2
lea rax, [rax + 0x20]
movdqa xmm1, xmm2
jmp 0x140030350
mov dword [rax + 0x10], edx
xor eax, eax
jmp 0x1400303e7
mov rax, 0xfffffffffffffffe
pxor xmm0, xmm0
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
add rsp, 8
ret
Function at 0x140039c00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140039d20
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140039c60
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140039c60
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140039c60
Function at 0x1400d0630
Capabilities:
Query service status

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14026c040]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor ecx, ecx
xor edx, edx
mov r8d, 1
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x1400d0738
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.14013e120
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [rbx + 0x17], 0
jns 0x1400d068d
mov rbx, qword [rbx]
mov rcx, rdi
mov rdx, rbx
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x1400d0720
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.14013e120
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movups xmmword [rdx + 0xc], xmm0
movaps xmmword [rdx], xmm0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400d0719
mov eax, dword [rsp + 0x24]
mov dword [rsi], eax
mov al, 1
mov byte [rsi + 4], al
call fcn.14013e120
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call fcn.14013e120
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
cmp rcx, qword [0x14026c040]
je 0x1400d0729
call fcn.140169190
int3
mov byte [rsi], 0
xor eax, eax
jmp 0x1400d06e0
xor eax, eax
mov byte [rsi], al
mov byte [rsi + 4], al
jmp 0x1400d06f1
mov rax, rsi
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str....._bravecomponents_brave_vpncommonwinutils.cc
mov edx, 0x35
call fcn.14013de20
test eax, eax
jle 0x1400d07ec
lea rdx, str....._bravecomponents_brave_vpncommonwinutils.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x23
mov r9d, 0xffffffff
call fcn.1400e3120
lea rcx, [rsp + 0x30]
lea rdx, str.::OpenSCManager_failed._service_name:
mov r8d, 0x26
call fcn.14011f4a0
mov rcx, rax
mov rdx, rbx
call fcn.1400dfe70
lea rdx, str.__error:
mov r8d, 9
mov rcx, rax
call fcn.14011f4a0
mov rbx, rax
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov ecx, dword [rbx + rax + 8]
and ecx, 0xffffffb5
or ecx, 8
mov dword [rbx + rax + 8], ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov edx, 0x80004005
cmovne edx, ecx
mov rcx, rbx
call fcn.1400c2d60
mov rcx, rdi
call fcn.1400e3710
xor eax, eax
mov byte [rsi], al
mov byte [rsi + 4], al
jmp 0x1400d06ff
Function at 0x1400d0800
Capabilities:
Modify service

Disassembly:
sub rsp, 0x78
mov rax, qword [0x14026c040]
xor rax, rsp
mov qword [rsp + 0x70], rax
movaps xmm0, xmmword [0x140242a30]
lea rax, [rsp + 0x50]
movaps xmmword [rax], xmm0
movabs rdx, 0x100000000
mov qword [rax + 0x10], rdx
movaps xmm0, xmmword [0x14023d9f0]
lea r8, [rsp + 0x20]
movaps xmmword [r8], xmm0
movaps xmmword [r8 + 0x10], xmm0
mov dword [r8], 0
xorps xmm0, xmm0
movups xmmword [r8 + 8], xmm0
mov dword [r8 + 0x18], 3
mov qword [r8 + 0x20], rax
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
setne al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
cmp rcx, qword [0x14026c040]
je 0x1400d0887
call fcn.140169190
int3
add rsp, 0x78
ret

Function at 0x1400d0ac0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x1400d0b06
mov r15, rbx
test r15, r15
je 0x1400d0be2
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x1400d0b62
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x1400d0b51
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.1401a2ec0
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x1400d0ae2
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x1400d0bfe
lea rcx, [r13*8]
call fcn.140167c6c
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x1400d0bc4
lea r15, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x1400d0be2
mov r10, qword [r14 + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x1400d0bac
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp rbx, r14
je 0x1400d0be4
add rbx, 0xfffffffffffffff8
jne 0x1400d0bd7
ud2
test r12, r12
je 0x1400d0ae2
mov rcx, r12
call fcn.140167ca8
mov r15, qword [rsi + 0x10]
jmp 0x1400d0ae2
call fcn.1401a40e0
int3
Function at 0x1400d7fd0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x1400d7fe0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x1400d8001
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400d8021
cmp byte [r14 + 0x50], 1
je 0x1400d80ac
or edi, 0x20000000
test dil, 8
jne 0x1400d80b7
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x1400d803f
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x1400d8050
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
je 0x1400d80de
cmp byte [r14 + 0x18], 1
je 0x1400d80ef
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x1400d80ff
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x1400d80d4
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x1400d8021
cmp byte [r14 + 0x68], 1
jne 0x1400d80c9
or edi, 0x40000000
jmp 0x1400d802b
or edi, 0x10000000
jmp 0x1400d802b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400d8097
lea rcx, [r14 + 0x20]
call fcn.1400d7770
mov r15, rax
jmp 0x1400d805b
mov rcx, r14
call fcn.1400d7770
mov r9, rax
jmp 0x1400d8069
cmp ebx, 4
jne 0x1400d810e
mov edx, 6
jmp 0x1400d8076
lea eax, [rbx - 2]
cmp eax, 2
jae 0x1400d8120
mov edx, 7
jmp 0x1400d8076
cmp ebx, 1
jne 0x1400d812f
mov edx, 4
jmp 0x1400d8076
xor edx, edx
jmp 0x1400d8076
Function at 0x1400d7fe0
Capabilities:
Inspect section memory permissions

Disassembly:
mov r9d, r8d
xor r8d, r8d
jmp 0x1400d7fe0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp byte [rdx + 0x17], 0
jns 0x1400d8001
mov rsi, qword [rsi]
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400d8021
cmp byte [r14 + 0x50], 1
je 0x1400d80ac
or edi, 0x20000000
test dil, 8
jne 0x1400d80b7
xor r15d, r15d
cmp byte [r14 + 0x60], 0
mov r12d, 0
je 0x1400d803f
mov r12, qword [r14 + 0x58]
cmp byte [r14 + 0x48], 0
mov r13d, 0
je 0x1400d8050
mov r13, qword [r14 + 0x40]
cmp byte [r14 + 0x38], 1
je 0x1400d80de
cmp byte [r14 + 0x18], 1
je 0x1400d80ef
xor r9d, r9d
mov edx, 1
test ebx, ebx
jne 0x1400d80ff
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov esi, eax
test eax, eax
jne 0x1400d80d4
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
or edi, 0x80000000
jmp 0x1400d8021
cmp byte [r14 + 0x68], 1
jne 0x1400d80c9
or edi, 0x40000000
jmp 0x1400d802b
or edi, 0x10000000
jmp 0x1400d802b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400d8097
lea rcx, [r14 + 0x20]
call fcn.1400d7770
mov r15, rax
jmp 0x1400d805b
mov rcx, r14
call fcn.1400d7770
mov r9, rax
jmp 0x1400d8069
cmp ebx, 4
jne 0x1400d810e
mov edx, 6
jmp 0x1400d8076
lea eax, [rbx - 2]
cmp eax, 2
jae 0x1400d8120
mov edx, 7
jmp 0x1400d8076
cmp ebx, 1
jne 0x1400d812f
mov edx, 4
jmp 0x1400d8076
xor edx, edx
jmp 0x1400d8076

Function at 0x1400d8140
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov ebx, r8d
mov rsi, rdx
mov r15, rcx
mov edi, r9d
and edi, 0xfffffff
test r9b, 4
je 0x1400d8178
cmp byte [r15 + 0x50], 1
je 0x1400d820f
or edi, 0x20000000
test dil, 8
jne 0x1400d821a
xor r14d, r14d
cmp byte [r15 + 0x60], 0
mov r12d, 0
je 0x1400d8196
mov r12, qword [r15 + 0x58]
cmp byte [r15 + 0x48], 0
mov r13d, 0
je 0x1400d81a7
mov r13, qword [r15 + 0x40]
cmp byte [r15 + 0x38], 1
je 0x1400d8241
cmp byte [r15 + 0x18], 1
je 0x1400d8252
xor r9d, r9d
cmp ebx, 4
jne 0x1400d8200
mov edx, 6
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov esi, eax
test eax, eax
jne 0x1400d8237
test esi, esi
sete al
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea eax, [rbx - 2]
cmp eax, 2
jae 0x1400d8262
mov edx, 7
jmp 0x1400d81ca
or edi, 0x80000000
jmp 0x1400d8178
cmp byte [r15 + 0x68], 1
jne 0x1400d822c
or edi, 0x40000000
jmp 0x1400d8182
or edi, 0x10000000
jmp 0x1400d8182
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400d81eb
lea rcx, [r15 + 0x20]
call fcn.1400d7770
mov r14, rax
jmp 0x1400d81b2
mov rcx, r15
call fcn.1400d7770
mov r9, rax
jmp 0x1400d81c0
mov edx, 1
test ebx, ebx
je 0x1400d81ca
cmp ebx, 1
jne 0x1400d827e
mov edx, 4
jmp 0x1400d81ca
xor edx, edx
jmp 0x1400d81ca
Function at 0x1400d89a0
Capabilities:
Delete registry key

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x14026c040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400d8a79
mov ebp, r8d
mov rbx, rdx
movabs r15, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x30], r15
xor eax, eax
mov qword [rsp + 0x38], rax
mov r12d, dword [rsi + 8]
mov r9d, r12d
or r9d, 0x10001
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rsp + 0x20], rdx
mov rdx, rbx
mov r8d, 8
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d8a4f
mov r14, qword [rsp + 0x40]
mov qword [rsp + 0x28], r14
and r12d, 0x300
mov dword [rsp + 0x30], r12d
test bpl, 1
je 0x1400d8a80
test r14, r14
je 0x1400d8a40
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, dword [rsi + 8]
mov rcx, qword [rsi]
mov rdx, rbx
call fcn.1400d8af0
mov edi, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x14026c040]
je 0x1400d8a68
call fcn.140169190
int3
mov eax, edi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edi, 6
jmp 0x1400d8a51
lea rdi, [rsp + 0x40]
mov qword [rdi], r15
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.1400d8cd0
cmp byte [rdi + 4], 0
jne 0x1400d8ab6
mov r8d, dword [rsi + 8]
lea rdx, [0x140243476]
mov rcx, r14
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
jmp 0x1400d8aba
mov edi, dword [rsp + 0x40]
test r14, r14
je 0x1400d8a51
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400d8a51
mov edx, 1
call fcn.1400d9060
jmp 0x1400d8a51