joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079b90
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140079bb8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140079bb8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400ba8e0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [r8]
mov r8d, dword [r8 + 8]
mov r10, qword [rdx]
mov edx, dword [rdx + 8]
mov r9d, edx
mov r11d, r8d
cmp r9d, r11d
mov r9d, r8d
cmovle r9d, edx
sar r9d, 4
movups xmm0, xmmword [rcx + 0xb0]
xor r11d, r11d
test r9d, r9d
jle 0x1400ba99d
movups xmm1, xmmword [r10]
pxor xmm0, xmm1
movups xmm1, xmmword [rcx]
pxor xmm0, xmm1
movups xmm1, xmmword [rcx + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x90]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0xa0]
aesenclast xmm0, xmm1
movups xmmword [rax], xmm0
add r10, 0x10
add rax, 0x10
inc r11d
cmp r11d, r9d
jl 0x1400ba914
movups xmmword [rcx + 0xb0], xmm0
cmp edx, r8d
cmovg edx, r8d
mov eax, edx
and eax, 0xfffffff0
ret

Function at 0x1400bb060
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rdx + 8]
mov r10d, dword [r8 + 8]
cmp eax, r10d
cmovg eax, r10d
sar eax, 4
mov rdx, qword [rdx]
mov r8, qword [r8]
xor r10d, r10d
test eax, eax
jle 0x1400bb107
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rcx]
pxor xmm0, xmm1
movups xmm1, xmmword [rcx + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0x90]
aesenc xmm0, xmm1
movups xmm1, xmmword [rcx + 0xa0]
aesenclast xmm0, xmm1
movups xmmword [r8], xmm0
add rdx, 0x10
add r8, 0x10
inc r10d
cmp r10d, eax
jl 0x1400bb082
ret
Function at 0x1400bbcc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [rcx], cl
mov rax, rcx
mov rdx, qword [rdx]
movups xmm0, xmmword [rdx]
movups xmmword [rax], xmm0
aeskeygenassist xmm1, xmm0, 1
pshufd xmm1, xmm1, 0xff
movaps xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movaps xmm0, xmm2
pslldq xmm0, 8
pxor xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax + 0x10], xmm0
aeskeygenassist xmm1, xmm0, 2
pshufd xmm1, xmm1, 0xff
movaps xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movaps xmm0, xmm2
pslldq xmm0, 8
pxor xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax + 0x20], xmm0
aeskeygenassist xmm1, xmm0, 4
pshufd xmm1, xmm1, 0xff
movaps xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movaps xmm0, xmm2
pslldq xmm0, 8
pxor xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax + 0x30], xmm0
aeskeygenassist xmm1, xmm0, 8
pshufd xmm1, xmm1, 0xff
movaps xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movaps xmm0, xmm2
pslldq xmm0, 8
pxor xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax + 0x40], xmm0
aeskeygenassist xmm1, xmm0, 0x10
pshufd xmm1, xmm1, 0xff
movaps xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movaps xmm0, xmm2
pslldq xmm0, 8
pxor xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax + 0x50], xmm0
aeskeygenassist xmm1, xmm0, 0x20
pshufd xmm1, xmm1, 0xff
movaps xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movaps xmm0, xmm2
pslldq xmm0, 8
pxor xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax + 0x60], xmm0
aeskeygenassist xmm1, xmm0, 0x40
pshufd xmm1, xmm1, 0xff
movaps xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movaps xmm0, xmm2
pslldq xmm0, 8
pxor xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax + 0x70], xmm0
aeskeygenassist xmm1, xmm0, 0x80
pshufd xmm1, xmm1, 0xff
movaps xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movaps xmm0, xmm2
pslldq xmm0, 8
pxor xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax + 0x80], xmm0
aeskeygenassist xmm1, xmm0, 0x1b
pshufd xmm1, xmm1, 0xff
movaps xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movaps xmm0, xmm2
pslldq xmm0, 8
pxor xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax + 0x90], xmm0
aeskeygenassist xmm1, xmm0, 0x36
pshufd xmm1, xmm1, 0xff
movaps xmm2, xmm0
pslldq xmm2, 4
pxor xmm2, xmm0
movaps xmm0, xmm2
pslldq xmm0, 8
pxor xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [rax + 0xa0], xmm0
test r8b, r8b
je 0x1400bbf1b
lea rax, [rcx + 0x10]
movups xmm0, xmmword [rax]
aesimc xmm0, xmm0
movups xmmword [rax], xmm0
lea rax, [rcx + 0x20]
movups xmm0, xmmword [rax]
aesimc xmm0, xmm0
movups xmmword [rax], xmm0
lea rax, [rcx + 0x30]
movups xmm0, xmmword [rax]
aesimc xmm0, xmm0
movups xmmword [rax], xmm0
lea rax, [rcx + 0x40]
movups xmm0, xmmword [rax]
aesimc xmm0, xmm0
movups xmmword [rax], xmm0
lea rax, [rcx + 0x50]
movups xmm0, xmmword [rax]
aesimc xmm0, xmm0
movups xmmword [rax], xmm0
lea rax, [rcx + 0x60]
movups xmm0, xmmword [rax]
aesimc xmm0, xmm0
movups xmmword [rax], xmm0
lea rax, [rcx + 0x70]
movups xmm0, xmmword [rax]
aesimc xmm0, xmm0
movups xmmword [rax], xmm0
lea rax, [rcx + 0x80]
movups xmm0, xmmword [rax]
aesimc xmm0, xmm0
movups xmmword [rax], xmm0
add rcx, 0x90
movups xmm0, xmmword [rcx]
aesimc xmm0, xmm0
movups xmmword [rcx], xmm0
ret
Function at 0x1400d0bb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140005180
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.1400051d0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.14000207d
mov dword [rax + 0xb0], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400d6780
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.140005180
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.1400051d0
test ebx, ebx
jne 0x1400d67f4
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, 0xc0000017
jne 0x1400d681b
lea rcx, [0x14021a2f8]
call fcn.140003510
mov rbx, rax
mov rcx, rbx
call fcn.1400ed200
mov rcx, rbx
call fcn.140004380
lea rcx, [0x140219d10]
call fcn.140003510
mov rbx, rax
mov rcx, rbx
call fcn.1400e8520
mov rcx, rbx
call fcn.140004380
int3
Function at 0x1400ead00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x30
xor eax, eax
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov ebx, edx
mov rsi, r8
mov ecx, 1
test ebx, ebx
cmovle ebx, ecx
mov rcx, rdi
neg rcx
lea rdx, [0x1402b6808]
mov rax, rcx
or rax, 1
bsr r8, rax
lzcnt rax, rax
xor eax, 0x3f
test dword [0x1403678b0], 0x1000
cmovne r8d, eax
movsxd rax, r8d
movzx edx, byte [rdx + rax]
mov eax, edx
shl rax, 3
lea r8, [0x1402ba7a0]
add rax, r8
cmp rcx, qword [rax]
setb cl
movzx ecx, cl
sub edx, ecx
cmp ebx, edx
mov ebp, edx
cmovge ebp, ebx
mov r14d, dword [rsi + 8]
add ebp, r14d
lea rcx, [0x140218250]
mov edx, ebp
call fcn.1400035d0
mov r15, rax
test r15, r15
jne 0x1400ead9f
xor eax, eax
jmp 0x1400eadad
lea rax, [r15 + 0xc]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movsxd rdx, ebp
lea rbp, [rax + rdx*2]
neg rdi
cmp rdi, 0x64
jb 0x1400eae86
lea rax, [0x14020c1f8]
cmp qword [rax - 8], 0
jne 0x1400eaebb
mov rcx, qword [0x14035e968]
add rbp, 0xfffffffffffffffc
add ebx, 0xfffffffe
movabs rdx, 0x28f5c28f5c28f5c3
mov rax, rdi
shr rax, 2
mul rdx
shr rdx, 2
imul rax, rdx, 0x64
sub rdi, rax
mov r13, rdx
mov rax, qword [rcx + 0x38]
cmp byte [rax], al
shl edi, 2
mov edx, edi
mov eax, dword [rax + rdx + 0x10]
mov dword [rbp], eax
cmp r13, 0x64
jae 0x1400eae7e
test r13, r13
je 0x1400eae56
dec ebx
movabs rdx, 0xcccccccccccccccd
mov rax, r13
mul rdx
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
mov rcx, r13
sub rcx, rax
mov r13, rdx
add rbp, 0xfffffffffffffffe
add ecx, 0x30
mov word [rbp], cx
test r13, r13
jne 0x1400eae20
test ebx, ebx
jg 0x1400eae20
mov rax, rbp
lea ecx, [r14 - 1]
test ecx, ecx
jl 0x1400eaea2
cmp r14d, ecx
jle 0x1400eae8b
add rax, 0xfffffffffffffffe
mov edx, ecx
movzx edx, word [rsi + rdx*2 + 0xc]
mov word [rax], dx
dec ecx
jns 0x1400eae6a
jmp 0x1400eaea2
mov rdi, r13
jmp 0x1400eadda
mov r13, rdi
jmp 0x1400eae1b
add rax, 0xfffffffffffffffe
cmp ecx, r14d
jae 0x1400eaec5
mov edx, ecx
movzx edx, word [rsi + rdx*2 + 0xc]
mov word [rax], dx
dec ecx
jns 0x1400eae8b
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, r15
add rsp, 0x30
pop rbx
pop rbp
pop rsi
pop rdi
pop r13
pop r14
pop r15
ret
call fcn.1400014f7
jmp 0x1400eadd3
call fcn.1400efe40
int3
Function at 0x140101130
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
lea rdi, [0x14020c5b8]
cmp qword [rdi - 8], 0
jne 0x1401011a6
cmp byte [rdi], 0
je 0x14010115b
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
lea rbp, [0x14020c270]
cmp qword [rbp - 8], 0
jne 0x1401011ad
cmp byte [rbp], 0
jne 0x140101181
mov rcx, rbx
mov edx, esi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp 0x140101ba0
mov edx, esi
mov ecx, edx
or ecx, 0x80000000
cmp byte [rbx + 0x1b8], 0
cmove edx, ecx
mov rcx, qword [rbx + 8]
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.1401022c0
call fcn.1400012f2
jmp 0x14010114b
call fcn.1400010cb
jmp 0x140101169
sub rsp, 0x28
cmp edx, 0x1009
jne 0x140101bb3
xor eax, eax
add rsp, 0x28
ret
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x20]
call fcn.140144a00
mov eax, dword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x1401011c0
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
lea rdi, [0x14020c5b8]
cmp qword [rdi - 8], 0
jne 0x140101241
cmp byte [rdi], 0
je 0x1401011eb
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
lea rbp, [0x14020c270]
cmp qword [rbp - 8], 0
jne 0x140101248
cmp byte [rbp], 0
jne 0x14010121c
movzx ecx, byte [rbx + 0x1b8]
test ecx, ecx
jne 0x14010121c
mov rcx, rbx
mov edx, esi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp 0x140101ba0
mov edx, esi
mov ecx, edx
or ecx, 0x80000000
cmp byte [rbx + 0x1b8], 0
cmove edx, ecx
mov rcx, qword [rbx + 8]
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.1401022c0
call fcn.1400012f2
jmp 0x1401011db
call fcn.1400010cb
jmp 0x1401011f9

Function at 0x1401021f0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x140360440]
mov qword [rbp + 0x48], rax
test dword [rsp], esp
sub rsp, 0x430
lea rbx, [rsp + 0x20]
test rcx, rcx
je 0x140102230
add rcx, 0xc
jmp 0x140102232
xor ecx, ecx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov r8, rbx
mov qword [rbp + 0x30], r8
mov r9d, 0x212
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.140005180
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov esi, eax
lea rcx, [rbp + 8]
call fcn.1400051d0
xor ecx, ecx
mov qword [rbp + 0x50], rcx
test esi, esi
jle 0x14010228a
mov rcx, rbx
call fcn.1400dbbc0
jmp 0x14010228c
xor eax, eax
lea rcx, [0x140360440]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x1401022a1
call fcn.140005000
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401022c0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x1401022f6
add rcx, 0xc
jmp 0x1401022f8
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.140005180
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.1400051d0
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140141df0
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x140141e1c
add rcx, 0xc
mov rbx, rcx
jmp 0x140141e1e
xor ebx, ebx
mov qword [rbp - 0x40], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.140005180
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.dll_DeleteFileW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.1400051d0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
test ebx, ebx
setne bl
movzx ebx, bl
call fcn.14000207d
mov dword [rax + 0xb0], esi
movzx eax, bl
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140143ca0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov ebx, r8d
mov qword [rbp - 0x40], rdx
mov rsi, rdx
test rcx, rcx
je 0x140143cda
add rcx, 0xc
mov rdi, rcx
jmp 0x140143cdc
xor edi, edi
mov qword [rbp - 0x48], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x54], rcx
mov rdx, rsi
mov qword [rbp - 0x5c], rdx
mov r8d, ebx
mov dword [rbp - 0x4c], r8d
lea rcx, [rbp - 0x88]
call fcn.140005180
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.1400051d0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
call fcn.14000207d
mov dword [rax + 0xb0], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140144d40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov edi, edx
mov rbx, r8
mov rsi, r9
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14013bae0
nop
lea rcx, [r13 + 0x10]
xor edx, edx
test r13, r13
cmove rcx, rdx
mov qword [rbp - 0x50], rcx
lea rdx, [r15 + 0x10]
xor r8d, r8d
test r15, r15
cmove rdx, r8
mov qword [rbp - 0x58], rdx
lea r8, [r14 + 0x10]
xor r9d, r9d
test r14, r14
cmove r8, r9
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x68], rsi
mov r9, rsi
lea rax, [rbx + 0x10]
xor r10d, r10d
test rbx, rbx
cmove rax, r10
mov qword [rbp - 0x70], rax
mov r10, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [r10 + 8]
mov qword [rbp - 0x7c], rcx
mov edx, edi
mov dword [rbp - 0x74], edx
mov r8, rax
mov qword [rbp - 0x84], r8
mov qword [rbp - 0x8c], r9
lea rcx, [rbp - 0xb8]
call fcn.140005180
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
mov r8, qword [rbp - 0x84]
mov r9, qword [rbp - 0x8c]
call sub.ADVAPI32.dll_RegEnumValueW
mov ebx, eax
lea rcx, [rbp - 0xb8]
call fcn.1400051d0
nop
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x140144e89
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.14013bb20
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140145150
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14013bae0
nop
test rbx, rbx
je 0x1401451a6
add rbx, 0xc
mov rdx, rbx
jmp 0x1401451a8
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov r8, rsi
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140005180
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.1400051d0
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x140145225
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.14013bb20
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401d93c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x1401d945d
xor eax, eax
cmp r8d, 4
jl 0x1401d9411
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x1401d9458
nop dword [rax]
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
je 0x1401d9451
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
je 0x1401d9449
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
je 0x1401d9441
add rax, 4
test r8d, r8d
jle 0x1401d963a
movsx r9, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
je 0x1401d9458
inc rax
test r8d, r8d
jg 0x1401d9420
jmp 0x1401d963a
add eax, 3
jmp 0x1401d9635
add eax, 2
jmp 0x1401d9635
inc eax
jmp 0x1401d9635
jmp 0x1401d9635
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r10, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x1401d9576
add rax, 0x10
cmp rax, r10
jbe 0x1401d9480
mov eax, r8d
test al, 7
je 0x1401d963a
movups xmm1, xmmword [r10]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1401d963a
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x1401d962c
mov ecx, 0x20
jmp 0x1401d962f
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
jne 0x1401d961d
mov r8d, 0x20
jmp 0x1401d9621
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x1401d9635
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret