joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000311f
Capabilities:
Print debug messages

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rsi, r9
mov ebp, r8d
mov r14d, edx
mov rbx, rcx
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140003199
mov rdi, rax
lea rdx, str.CreateWebViewEnvironmentWithOptionsInternal
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000322e
mov rcx, qword [rsp + 0xb8]
mov r9, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rcx
mov ecx, r14d
mov edx, ebp
mov r8, rsi
call qword [str.P_b_]
mov esi, eax
mov dword [rsp + 0x54], eax
jmp 0x1400032b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rbp, [rsp + 0x54]
mov dword [rbp], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x30]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [0x14027e6a0]
movaps xmmword [rdi], xmm0
mov rcx, rdi
call fcn.14000257c
mov edx, 4
mov rcx, rbp
mov r8b, 1
mov r9, rdi
call fcn.140003070
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_LoadLibrary:_hr0x
mov rbp, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call rbp
mov rcx, rdi
call fcn.140002840
mov rcx, rax
call rbp
lea rcx, str._path
call rbp
mov rcx, rbx
call rbp
lea rcx, [0x14027ed52]
call rbp
mov rcx, rdi
call fcn.14000258e
jmp 0x1400032ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rbp, [rsp + 0x54]
mov dword [rbp], esi
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x30]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x14027e6a0]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.14000257c
mov edx, 4
mov rcx, rbp
mov r8b, 1
mov r9, rbx
call fcn.140003070
lea rcx, str.WebView2:_CoreWebView2Environment_failed_when_trying_to_call_into_EmbeddedBrowserWebView.dll._hr0x
mov rbp, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call rbp
mov rcx, rbx
call fcn.140002840
mov rcx, rax
call rbp
lea rcx, [0x14027ed52]
call rbp
mov rcx, rbx
call fcn.14000258e
lea rdx, str.DllCanUnloadNow
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400032ce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e6b50
mov eax, esi
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140003338
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000338c
mov ebx, eax
mov edx, eax
mov rcx, rsi
call fcn.1400025ea
test al, al
je 0x14000338c
mov rcx, rsi
call fcn.140002840
mov rcx, rdi
mov rdx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, eax
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140002734
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140015c20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
test rcx, rcx
je 0x140015c3f
cmp rcx, 0x20
jae 0x140015c47
xor r9d, r9d
xor r10d, r10d
jmp 0x140015d50
mov r10b, 1
jmp 0x140015d65
mov r9, rcx
and r9, 0xffffffffffffffe0
lea rax, [r9 - 0x20]
mov r11, rax
shr r11, 5
add r11, 1
mov r10d, r11d
and r10d, 1
test rax, rax
je 0x140015d7e
sub r11, r10
pxor xmm0, xmm0
xor eax, eax
pxor xmm1, xmm1
nop word [rax + rax]
movdqu xmm2, xmmword [rdx + rax]
movdqu xmm3, xmmword [rdx + rax + 0x10]
movdqu xmm4, xmmword [rdx + rax + 0x20]
movdqu xmm5, xmmword [rdx + rax + 0x30]
movdqu xmm6, xmmword [r8 + rax]
pxor xmm6, xmm2
por xmm6, xmm0
movdqu xmm2, xmmword [r8 + rax + 0x10]
pxor xmm2, xmm3
por xmm2, xmm1
movdqu xmm0, xmmword [r8 + rax + 0x20]
pxor xmm0, xmm4
por xmm0, xmm6
movdqu xmm1, xmmword [r8 + rax + 0x30]
pxor xmm1, xmm5
por xmm1, xmm2
add rax, 0x40
add r11, 0xfffffffffffffffe
jne 0x140015c80
test r10, r10
je 0x140015d09
movdqu xmm2, xmmword [r8 + rax]
movdqu xmm3, xmmword [r8 + rax + 0x10]
movdqu xmm4, xmmword [rdx + rax]
pxor xmm4, xmm2
por xmm0, xmm4
movdqu xmm2, xmmword [rdx + rax + 0x10]
pxor xmm2, xmm3
por xmm1, xmm2
por xmm0, xmm1
pshufd xmm1, xmm0, 0x4e
por xmm1, xmm0
pshufd xmm0, xmm1, 0xe5
por xmm0, xmm1
movdqa xmm1, xmm0
psrld xmm1, 0x10
por xmm1, xmm0
movdqa xmm0, xmm1
psrlw xmm0, 8
por xmm0, xmm1
movd r10d, xmm0
cmp r9, rcx
je 0x140015d65
nop word cs:[rax + rax]
nop dword [rax]
movzx eax, byte [r8 + r9]
xor al, byte [rdx + r9]
or r10b, al
add r9, 1
cmp rcx, r9
jne 0x140015d50
movzx ecx, r10b
mov eax, 0xffffffff
add rax, rcx
shr rax, 0x20
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
pxor xmm0, xmm0
xor eax, eax
pxor xmm1, xmm1
test r10, r10
jne 0x140015ce1
jmp 0x140015d09
Function at 0x14001a700
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
sub rsp, 0xd0
movapd xmmword [rsp + 0xc0], xmm6
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov esi, 0xffffffff
cmp dword [0x14034d304], 0xd1d
je 0x14001a842
call fcn.140022730
mov qword [0x14037eb08], rax
lea rdx, [0x14037eb08]
mov qword [0x14037eb10], 0x20
movabs rax, 0x100000001
mov qword [0x14037eb18], rax
lea rcx, [0x14037eb20]
call fcn.1400227a0
cmp qword [0x14037eb20], 0x501
jb 0x14001a791
lea rcx, [0x1402ed460]
call fcn.140024c90
jmp 0x14001a842
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_profile_l1_1_0.dll_QueryPerformanceFrequency]
cvtsi2sd xmm0, qword [rsp + 0x50]
movsd xmm6, qword [0x140276b20]
divsd xmm6, xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_profile_l1_1_0.dll_QueryPerformanceCounter]
movsd xmm0, qword [rsp + 0x50]
unpcklps xmm0, xmmword [0x1402ed440]
subpd xmm0, xmmword [0x1402ed450]
movapd xmm1, xmm0
unpckhpd xmm1, xmm0
addsd xmm1, xmm0
mulsd xmm1, xmm6
movsd xmm0, qword [0x14028cb80]
movapd xmm2, xmm1
subsd xmm2, xmm0
cvttsd2si rax, xmm2
movabs rcx, 0x8000000000000000
xor rcx, rax
cvttsd2si rax, xmm1
ucomisd xmm1, xmm0
cmovae rax, rcx
mov qword [0x14034d310], rax
lea rdx, [rsp + 0x90]
mov ecx, 0x20
call fcn.140024ca0
mov esi, eax
test eax, eax
jne 0x14001a842
lea rdx, [rsp + 0x50]
mov ecx, 0x40
call fcn.140024ca0
mov esi, eax
test eax, eax
je 0x14001a8a0
lea rdx, [rsp + 0x50]
mov ecx, 0x40
call fcn.140016010
mov dword [0x14034d300], esi
mov dword [0x14034d304], 0xd1d
xor eax, eax
test esi, esi
lea rcx, [0x14001a960]
cmove rax, rcx
mov dword [0x14034d308], esi
mov qword [0x14037eb50], rax
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400e6b50
mov eax, esi
movaps xmm6, xmmword [rsp + 0xc0]
add rsp, 0xd0
pop rsi
ret
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x90]
mov ecx, 0x20
call fcn.140015c20
mov esi, 0xfffffff6
test eax, eax
je 0x14001a842
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
mov ecx, 0x20
call fcn.140015c20
test eax, eax
je 0x14001a842
lea rcx, [rsp + 0x90]
call qword [sym.imp.api_ms_win_core_profile_l1_1_0.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rcx, [0x14037eb20]
xorpd xmm0, xmm0
movupd xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 8
lea rdx, [0x14034ccf8]
lea r9, [rsp + 0x50]
mov r8d, 0x40
call qword [0x14037eb28]
mov esi, eax
test eax, eax
jne 0x14001a842
xor ecx, ecx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x14034d318], rax
cmp rax, 1
sbb esi, esi
jmp 0x14001a842
Function at 0x140024ca0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0xf0000040
lea rcx, [rsp + 0x30]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.api_ms_win_security_cryptoapi_l1_1_0.dll_CryptAcquireContextW]
mov ebx, eax
cmp eax, 1
jne 0x140024d00
mov rcx, qword [rsp + 0x30]
mov edx, edi
mov r8, rsi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor esi, esi
cmp ebx, 1
setne sil
neg esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400e6b50
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400299b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x90
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov r14, r9
mov r12, rdx
mov r13, rcx
and r9d, 0x3f
call fcn.14002b2e0
test r13, r13
je 0x140029b9f
shr r14, 6
lea rax, [r12 + 0x10]
xor r9d, r9d
mov r15d, 0xffffffff
movdqa xmm8, xmmword [0x1402a3f30]
movdqa xmm9, xmmword [reloc.OLEAUT32.dll_SysReAllocString]
movdqa xmm12, xmmword [0x1402ee2a0]
pcmpeqd xmm11, xmm11
movdqa xmm10, xmmword [reloc.OLEAUT32.dll_SysReAllocStringLen]
mov r8, r13
jmp 0x140029a69
mov qword [r12 + r9*8], rdx
add r9, 1
add rax, 8
add r8, 0xffffffffffffffff
cmp r9, r13
je 0x140029b9f
mov r10, r13
sub r10, r9
lea rsi, [r9 + r14]
cmp r10, 4
jae 0x140029a90
xor edx, edx
mov rbx, r9
jmp 0x140029b70
mov rdx, r8
and rdx, 0xfffffffffffffffc
mov r11, r10
and r11, 0xfffffffffffffffc
lea rbx, [r9 + r11]
movq xmm0, r9
pshufd xmm4, xmm0, 0x44
paddq xmm4, xmm8
movq xmm0, rsi
pshufd xmm0, xmm0, 0x44
pxor xmm6, xmm6
xor edi, edi
pxor xmm7, xmm7
nop word cs:[rax + rax]
nop
movdqa xmm5, xmm4
paddq xmm5, xmm9
movdqa xmm1, xmm4
pxor xmm1, xmm0
pxor xmm5, xmm0
movdqa xmm3, xmm1
pand xmm3, xmm12
movdqa xmm2, xmm5
pand xmm2, xmm12
psrlq xmm1, 0x20
por xmm1, xmm3
psrlq xmm5, 0x20
por xmm5, xmm2
paddq xmm1, xmm12
paddq xmm5, xmm12
psrlq xmm1, 0x20
psrlq xmm5, 0x20
movdqu xmm2, xmmword [rax + rdi*8 - 0x10]
movdqu xmm3, xmmword [rax + rdi*8]
paddq xmm1, xmm11
pand xmm1, xmm2
por xmm6, xmm1
paddq xmm5, xmm11
pand xmm5, xmm3
por xmm7, xmm5
add rdi, 4
paddq xmm4, xmm10
cmp rdx, rdi
jne 0x140029ad0
por xmm7, xmm6
pshufd xmm0, xmm7, 0x4e
por xmm0, xmm7
movq rdx, xmm0
cmp r10, r11
je 0x140029a50
nop dword [rax + rax]
mov rcx, rbx
xor rcx, rsi
mov edi, ecx
shr rcx, 0x20
or rcx, rdi
add rcx, r15
shr rcx, 0x20
add rcx, 0xffffffffffffffff
and rcx, qword [r12 + rbx*8]
or rdx, rcx
add rbx, 1
cmp r13, rbx
jne 0x140029b70
jmp 0x140029a50
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
movaps xmm10, xmmword [rsp + 0x60]
movaps xmm11, xmmword [rsp + 0x70]
movaps xmm12, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14002aad0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov r10, rdx
mov r11d, 1
mov rsi, qword [rsp + 0x58]
nop word cs:[rax + rax]
lea rax, [r11 - 1]
xor edx, edx
div r8
movzx eax, byte [rsi + rdx]
xor al, byte [r9 + rdx]
xor al, byte [r10 + r11 - 1]
mov byte [rcx + r11 - 1], al
mov rax, r11
xor edx, edx
div r8
movzx eax, byte [rsi + rdx]
xor al, byte [r9 + rdx]
xor al, byte [r10 + r11]
mov byte [rcx + r11], al
add r11, 2
cmp r11, 0x11
jne 0x14002aaf0
cmp r8, 0x11
jb 0x14002ac3c
lea r10, [r8 - 0x10]
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
cmp r10, 0x20
jb 0x14002abe7
lea rdx, [r8 - 0x11]
cmp rdx, 0x10
jae 0x14002abe7
lea rdx, [r9 + 0x10]
lea r11, [r9 + r8]
lea rdi, [r8 + rcx]
add rdi, 0xfffffffffffffff0
lea rbp, [rsi + 0x10]
lea r14, [rsi + r8]
cmp rdx, rdi
setb r15b
cmp r11, rcx
seta bl
cmp rbp, rdi
setb dl
cmp r14, rcx
seta r11b
test r15b, bl
jne 0x14002abe7
and dl, r11b
jne 0x14002abe7
mov r11, r10
and r11, 0xffffffffffffffe0
lea rax, [r11 + 0x10]
movups xmm1, xmmword [rcx]
movups xmm0, xmmword [rcx + 0x10]
xor edx, edx
nop dword [rax + rax]
movups xmm2, xmmword [r9 + rdx + 0x10]
movups xmm3, xmmword [r9 + rdx + 0x20]
movups xmm4, xmmword [rsi + rdx + 0x10]
xorps xmm4, xmm2
xorps xmm1, xmm4
movups xmm2, xmmword [rsi + rdx + 0x20]
xorps xmm2, xmm3
xorps xmm0, xmm2
add rdx, 0x20
cmp r11, rdx
jne 0x14002abb0
movups xmmword [rcx], xmm1
movups xmmword [rcx + 0x10], xmm0
cmp r10, r11
je 0x14002ac3c
mov edx, r8d
sub edx, eax
mov r10, rax
not r10
test dl, 1
je 0x14002ac04
mov dl, byte [rsi + rax]
xor dl, byte [r9 + rax]
xor byte [rcx], dl
add rax, 1
add r10, r8
je 0x14002ac3c
nop dword [rax]
mov edx, eax
movzx ebx, byte [rsi + rax]
xor bl, byte [r9 + rax]
and edx, 0xf
xor byte [rcx + rdx], bl
lea edx, [rax + 1]
movzx ebx, byte [rsi + rax + 1]
xor bl, byte [r9 + rax + 1]
and edx, 0xf
xor byte [rcx + rdx], bl
add rax, 2
cmp r8, rax
jne 0x14002ac10
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140035e30
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x20], xmm6
mov r14, r9
mov rdi, rdx
mov r15, rcx
and r9d, 0x3f
call fcn.140036050
test r15, r15
je 0x14003600f
shr r14, 6
lea r10, [r15 - 1]
xor r8d, r8d
mov r11d, 0xffffffff
movdqa xmm8, xmmword [0x1402a3f30]
movdqa xmm9, xmmword [reloc.OLEAUT32.dll_SysReAllocString]
movdqa xmm12, xmmword [0x1402ee2a0]
pcmpeqd xmm11, xmm11
movdqa xmm10, xmmword [reloc.OLEAUT32.dll_SysReAllocStringLen]
mov r12, r15
jmp 0x140035ee9
mov qword [rdi + r10*8], rdx
add r10, 0xffffffffffffffff
add r8, 1
add r12, 0xffffffffffffffff
cmp r10, r15
jae 0x14003600f
mov r9, r15
sub r9, r8
mov rax, r10
sub rax, r14
cmp r9, 4
jae 0x140035f10
xor edx, edx
xor esi, esi
jmp 0x140035fe0
mov rbx, r12
and rbx, 0xfffffffffffffffc
mov rsi, r9
and rsi, 0xfffffffffffffffc
movq xmm0, rax
pshufd xmm7, xmm0, 0x44
pxor xmm5, xmm5
xor edx, edx
pxor xmm6, xmm6
movdqa xmm4, xmm8
nop word [rax + rax]
movdqa xmm0, xmm4
paddq xmm0, xmm9
movdqa xmm1, xmm4
pxor xmm1, xmm7
pxor xmm0, xmm7
movdqa xmm3, xmm1
pand xmm3, xmm12
movdqa xmm2, xmm0
pand xmm2, xmm12
psrlq xmm1, 0x20
por xmm1, xmm3
psrlq xmm0, 0x20
por xmm0, xmm2
paddq xmm1, xmm12
paddq xmm0, xmm12
psrlq xmm1, 0x20
psrlq xmm0, 0x20
movdqu xmm2, xmmword [rdi + rdx*8]
movdqu xmm3, xmmword [rdi + rdx*8 + 0x10]
paddq xmm1, xmm11
pand xmm1, xmm2
por xmm5, xmm1
paddq xmm0, xmm11
pand xmm0, xmm3
por xmm6, xmm0
add rdx, 4
paddq xmm4, xmm10
cmp rbx, rdx
jne 0x140035f40
por xmm6, xmm5
pshufd xmm0, xmm6, 0x4e
por xmm0, xmm6
movq rdx, xmm0
cmp r9, rsi
je 0x140035ed0
nop dword [rax + rax]
mov rcx, rsi
xor rcx, rax
mov ebx, ecx
shr rcx, 0x20
or rcx, rbx
add rcx, r11
shr rcx, 0x20
add rcx, 0xffffffffffffffff
and rcx, qword [rdi + rsi*8]
or rdx, rcx
add rsi, 1
cmp r12, rsi
jne 0x140035fe0
jmp 0x140035ed0
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
movaps xmm10, xmmword [rsp + 0x60]
movaps xmm11, xmmword [rsp + 0x70]
movaps xmm12, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14003b440
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
test rcx, rcx
je 0x14003b475
cmp rcx, 3
ja 0x14003b485
xor edi, edi
xor eax, eax
add eax, 1
nop word cs:[rax + rax]
nop
mov rsi, qword [r8 + rdi*8]
not rsi
mov qword [rdx + rdi*8], rsi
mov edi, eax
add eax, 1
cmp rdi, rcx
jb 0x14003b460
mov r9d, 1
mov r8, rdx
pop rdi
pop rsi
jmp fcn.140026150
lea rax, [rcx - 1]
xor edi, edi
cmp eax, 0xffffffff
je 0x14003b44f
shr rax, 0x20
mov eax, 0
jne 0x14003b451
lea rax, [r8 + rcx*8]
cmp rax, rdx
jbe 0x14003b4ad
lea rax, [rdx + rcx*8]
cmp rax, r8
ja 0x14003b44d
mov rdi, rcx
and rdi, 0xfffffffffffffffc
lea rax, [rdi - 4]
mov r11, rax
shr r11, 2
add r11, 1
mov r10d, r11d
and r10d, 1
test rax, rax
je 0x14003b56b
sub r11, r10
xor r9d, r9d
pcmpeqd xmm0, xmm0
nop dword [rax]
movdqu xmm1, xmmword [r8 + r9*8]
movdqu xmm2, xmmword [r8 + r9*8 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdx + r9*8], xmm1
movdqu xmmword [rdx + r9*8 + 0x10], xmm2
movdqu xmm1, xmmword [r8 + r9*8 + 0x20]
movdqu xmm2, xmmword [r8 + r9*8 + 0x30]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rdx + r9*8 + 0x20], xmm1
movdqu xmmword [rdx + r9*8 + 0x30], xmm2
add r9, 8
add r11, 0xfffffffffffffffe
jne 0x14003b4e0
test r10, r10
je 0x14003b55b
movdqu xmm0, xmmword [r8 + r9*8]
movdqu xmm1, xmmword [r8 + r9*8 + 0x10]
pcmpeqd xmm2, xmm2
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqu xmmword [rdx + r9*8], xmm0
movdqu xmmword [rdx + r9*8 + 0x10], xmm1
mov eax, edi
cmp rdi, rcx
jne 0x14003b451
jmp 0x14003b475
xor r9d, r9d
test r10, r10
jne 0x14003b535
jmp 0x14003b55b
Function at 0x1400518e0
Capabilities:
Check mutex on windows
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x380
mov rax, qword [0x1403486d0]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0x104
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x160]
mov ecx, 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x140051b36
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], ax
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], ax
jne 0x140051954
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.1400523d0
nop
lea rax, [rsp + 0x160]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140051980
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x38]
call fcn.140052250
mov r14d, 0x100
lea r15, [0x14026f672]
mov r12d, 0x5c
lea rdi, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140051aa9
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14026f670]
movzx eax, word [rcx]
cmp ax, r14w
jae 0x140051a30
movzx eax, al
mov byte [rsp + rax + 0x60], 1
add rcx, 2
cmp rcx, r15
jne 0x1400519e5
lea rcx, [rdi + rbx*2]
mov rdx, rdi
cmp rdi, rcx
jae 0x140051aa9
movzx eax, word [rdx]
cmp ax, r14w
jae 0x140051a1f
cmp byte [rsp + rax + 0x60], 0
jne 0x140051a28
add rdx, 2
cmp rdx, rcx
jmp 0x140051a09
sub rdx, rdi
sar rdx, 1
jmp 0x140051a7e
lea r9, [rdi + rbx*2]
mov rdx, rdi
cmp rdi, r9
jae 0x140051a77
nop dword [rax]
mov eax, 1
movzx r8d, word [rdx]
lea rcx, [0x14026f670]
cmp r12w, r8w
je 0x140051a28
cmp rax, 1
je 0x140051a6e
dec rax
add rcx, 2
cmp word [rcx], r8w
jne 0x140051a56
test rcx, rcx
jne 0x140051a28
add rdx, 2
cmp rdx, r9
jb 0x140051a40
mov rdx, 0xffffffffffffffff
cmp rdx, 0xffffffffffffffff
je 0x140051aa9
mov qword [rsp + 0x20], 1
lea r9, [0x14026f754]
mov r8d, 1
lea rcx, [rsp + 0x38]
call fcn.140052500
jmp 0x1400519b0
lea r8, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae r8, qword [rsp + 0x38]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1403754a0], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140051aea
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x140051aea
mov bl, 1
jmp 0x140051aec
xor bl, bl
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140051b31
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051b2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051b2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e6a28
movzx eax, bl
jmp 0x140051b38
xor al, al
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1400e6b50
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x140051d30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rdi, rcx
xor bl, bl
mov byte [rsp + 0x88], bl
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREApple_Inc.Internet_Services
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140051de5
mov dword [rsp + 0x90], 0x104
mov esi, 1
mov dword [rsp + 0x98], esi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.SignedIn
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, bl
test eax, eax
cmove ebx, esi
mov byte [rsp + 0x88], bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
movzx eax, bl
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140054730
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1400547e6
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x1400547b2
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400547d1
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400547d1
mov qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x1400547d1
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x1403754e0], 0
jne 0x140054831
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140054821
lea rdx, [0x14026fb30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403754d8], rax
mov byte [0x1403754e0], 1
jmp 0x140054838
mov rax, qword [0x1403754d8]
mov byte [0x1403754e0], 1
jmp 0x140054838
mov rax, qword [0x1403754d8]
mov rdx, rsi
mov rcx, qword [rbx]
test rax, rax
je 0x1400547bb
xor r9d, r9d
mov r8d, dword [rbx + 8]
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret