joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076aa0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140076aea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140076aea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140076aea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140076aea
cmp dword [rcx + 0x84], 0xe
jbe 0x140076aea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140076aec
xor al, al
add rsp, 0x28
ret
Function at 0x140002c34
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002c7e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002c7e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002c7e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002c7e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002c7e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002c80
xor al, al
add rsp, 0x28
ret

Function at 0x140007a60
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000785c
Function at 0x14000e710
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000e740
xor eax, eax
jmp 0x14000e803
mov rbp, rbx
cmp word [rax], si
je 0x14000e765
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000e74c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000e748
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000d040
movsxd r14, eax
test eax, eax
jne 0x14000e7a3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000e739
mov rcx, r14
call fcn.14000bfe4
mov rdi, rax
test rax, rax
jne 0x14000e7bc
xor ecx, ecx
call fcn.14000b5d4
jmp 0x14000e798
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000d040
test eax, eax
jne 0x14000e7ed
mov rcx, rdi
call fcn.14000b5d4
jmp 0x14000e7f7
xor ecx, ecx
call fcn.14000b5d4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140010864
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140008758
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400108ee
cmp byte [rbp - 0x21], r15b
je 0x1400108e9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140010924
call fcn.14000bb08
test eax, eax
jne 0x140010910
cmp byte [rbp - 0x21], r15b
je 0x140010908
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140010924
cmp byte [rbp - 0x21], r15b
je 0x140010921
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.1400088e8
test eax, eax
jne 0x1400109c4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140008758
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140010963
cmp byte [rbp - 0x21], r15b
je 0x140010998
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140010998
call fcn.14000bb08
test eax, eax
jne 0x140010984
cmp byte [rbp - 0x21], r15b
je 0x14001097d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140010998
cmp byte [rbp - 0x21], r15b
je 0x140010995
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400088e8
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400109c4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400109c7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400109d5
mov rcx, rdi
call fcn.14000b5d4
cmp byte [rbp + 0x3f], r15b
je 0x1400109e4
mov rcx, qword [rbp + 0x27]
call fcn.14000b5d4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140013800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14022b040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8, qword [rcx]
mov r9, qword [rcx + 8]
cmp r9, 2
jb 0x14001393f
cmp word [r8 + 2], 0x3a
jne 0x14001393f
movzx eax, word [r8]
and eax, 0xffffffdf
add eax, 0xffffffbf
cmp ax, 0x1a
jae 0x14001393f
mov ebx, 2
xor eax, eax
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
cmp rdx, 2
jb 0x140013948
cmp word [rcx + 2], 0x3a
jne 0x140013948
movzx r10d, word [rcx]
and r10d, 0xffffffdf
add r10d, 0xffffffa5
cmp r10w, 0xffe6
setae r10b
not al
test al, r10b
je 0x140013948
cmp r9, rbx
cmovae r9, rbx
lea rdx, [rsp + 0x38]
mov qword [rdx], rcx
mov qword [rdx + 8], 2
lea rcx, [rsp + 0x28]
mov qword [rcx], r8
mov qword [rcx + 8], r9
mov r8d, 1
call fcn.1400ff310
test al, al
je 0x1400138e9
mov rax, qword [rdi + 8]
mov rcx, rax
sub rcx, rbx
jb 0x14001397d
mov rdx, qword [rsi + 8]
cmp rdx, 1
jbe 0x14001397d
add rdx, 0xfffffffffffffffe
cmp rcx, rdx
je 0x14001390a
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
cmp rcx, qword [0x14022b040]
je 0x140013902
call fcn.1401335a0
int3
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
test rcx, rcx
je 0x140013976
lea ecx, [rbx + rbx]
add rcx, qword [rdi]
mov rdx, qword [rsi]
not rbx
add rbx, rax
xor r8d, r8d
movzx eax, word [rcx + r8*2]
cmp ax, word [rdx + r8*2 + 4]
sete al
jne 0x1400138eb
lea r9, [r8 + 1]
cmp rbx, r8
mov r8, r9
jne 0x140013921
jmp 0x1400138eb
mov al, 1
xor ebx, ebx
jmp 0x140013854
cmp r9, rdx
jne 0x1400138e9
test r9, r9
je 0x140013976
dec r9
xor edx, edx
movzx eax, word [r8 + rdx*2]
cmp ax, word [rcx + rdx*2]
sete al
jne 0x1400138eb
lea r10, [rdx + 1]
cmp r9, rdx
mov rdx, r10
jne 0x140013957
jmp 0x1400138eb
mov al, 1
jmp 0x1400138eb
lea rcx, str.string_view::substr
call fcn.14016cbb0
int3
Function at 0x14002dae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
test r8d, r8d
je 0x14002dc28
mov ebx, r8d
mov dword [rsi], 0
test dl, 1
jne 0x14002dc9e
xor edi, edi
movzx edx, dx
shr edx, 1
inc edi
mov ebp, edx
test dl, 1
je 0x14002db0a
bsr r8d, ebp
xor r8d, 0x1f
mov eax, 0x20
sub eax, r8d
imul eax, ebx
cmp eax, 0xde3
jg 0x14002dca8
mov ecx, 1
mov eax, ecx
lea ecx, [rax + rax]
cmp eax, ebx
jle 0x14002db3b
mov r14d, eax
sar r14d, 2
movzx r9d, dx
cmp eax, 4
jae 0x14002dc48
xor eax, eax
mov rdx, r9
test rdx, rdx
je 0x14002db8c
xor ecx, ecx
mov r8, rdx
mov r9d, edx
and r9d, 0xfffffff
mov dword [rsi + rcx*4 + 4], r9d
shr r8, 0x1c
inc rcx
cmp rdx, 0xfffffff
mov rdx, r8
ja 0x14002db67
mov word [rsi], cx
test al, 1
jne 0x14002dcad
test r14d, r14d
jne 0x14002dcbc
movzx edx, word [rsi]
test rdx, rdx
je 0x14002dc1d
imul edi, ebx
movsxd rax, edi
imul rax, rax, 0xffffffff92492493
shr rax, 0x20
add eax, edi
mov ecx, eax
shr ecx, 0x1f
sar eax, 4
add eax, ecx
add word [rsi + 2], ax
cmp dx, 0x7f
jg 0x14002dca8
test dx, dx
jle 0x14002dc1d
lea ecx, [rax + rax*8]
lea ecx, [rcx + rcx*2]
add ecx, eax
sub edi, ecx
mov eax, 0x1c
sub eax, edi
xor r8d, r8d
xor r9d, r9d
mov r10d, r9d
mov r11d, dword [rsi + r8*4 + 4]
mov r9d, r11d
mov ecx, eax
shr r9d, cl
mov ecx, edi
shl r11d, cl
add r11d, r10d
and r11d, 0xfffffff
mov dword [rsi + r8*4 + 4], r11d
inc r8
cmp rdx, r8
jne 0x14002dbec
test r9d, r9d
jne 0x14002dc3e
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov word [rsi + 2], 0
mov dword [rsi + 4], 1
mov ax, 1
mov word [rsi], ax
jmp 0x14002dc1d
mov dword [rsi + rdx*4 + 4], r9d
lea eax, [rdx + 1]
jmp 0x14002dc39
xor eax, eax
mov rdx, r9
mov r10d, r14d
imul rdx, rdx
test r10d, ebx
je 0x14002dc7c
mov ecx, r8d
or cl, 0x20
mov r14, rdx
shr r14, cl
mov r11d, 1
test r14, r14
setne cl
jne 0x14002dc76
mov r11, r9
imul rdx, r11
or al, cl
mov r14d, r10d
sar r14d, 1
cmp r10d, 2
jb 0x14002db5d
mov rcx, rdx
shr rcx, 0x20
mov r10d, r14d
jne 0x14002db5d
jmp 0x14002dc50
movzx ebp, dx
xor edi, edi
jmp 0x14002db18
call fcn.140192e00
mov rcx, rsi
mov edx, ebp
call fcn.14002d360
jmp 0x14002db94
mov rcx, rsi
call fcn.1401b4080
test r14d, ebx
je 0x14002dcd3
mov rcx, rsi
mov edx, ebp
call fcn.14002d360
mov eax, r14d
sar eax, 1
cmp r14d, 1
mov r14d, eax
jbe 0x14002db9d
jmp 0x14002dcbc
Function at 0x1400308d0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
cmp rbx, qword [rcx + 0x18]
je 0x140030916
mov r15, rbx
test r15, r15
je 0x1400309f2
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [rsi]
mov r14, qword [rsi + 8]
mov rax, r14
sub rax, r12
jbe 0x140030972
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r12, rax
neg r12
shl rax, 3
mov r15, r14
sub r15, rax
sub rbx, r14
je 0x140030961
mov rcx, r15
mov rdx, r14
mov r8, rbx
call fcn.1401671f0
mov r14, qword [rsi + 8]
add r15, rbx
mov qword [rsi + 0x10], r15
lea rax, [r14 + r12*8]
mov qword [rsi + 8], rax
jmp 0x1400308f2
mov rax, rbx
sub rax, r12
sar rax, 2
cmp rbx, r12
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x140030a0e
lea rcx, [r13*8]
call fcn.140130ce8
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, rbx
mov r15, rcx
sub rdx, r14
je 0x1400309d4
lea r15, [rdx + rcx]
xor r8d, r8d
mov r9, rcx
add r9, r8
je 0x1400309f2
mov r10, qword [r14 + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x1400309bc
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
cmp rbx, r14
je 0x1400309f4
add rbx, 0xfffffffffffffff8
jne 0x1400309e7
ud2
test r12, r12
je 0x1400308f2
mov rcx, r12
call fcn.140130d24
mov r15, qword [rsi + 0x10]
jmp 0x1400308f2
call fcn.14016cc10
int3
Function at 0x14003b5d0
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1048
call fcn.140133540
sub rsp, rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14022b040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
lea r14, [rsp + 0x840]
mov r8d, 0x800
mov rcx, r14
mov dl, 0xaa
call fcn.140167890
lea r9, [rsp + 0x3c]
mov dword [r9], 1
lea rax, [rsp + 0x38]
mov dword [rax], 0x800
mov rcx, qword [rbx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rdx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003b664
mov eax, dword [rsp + 0x3c]
cmp eax, 1
jne 0x14003b68b
lea rdx, [rsp + 0x840]
mov rcx, rsi
call fcn.14003b6f0
xor eax, eax
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
cmp rcx, qword [0x14022b040]
je 0x14003b67e
call fcn.1401335a0
int3
add rsp, 0x1048
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp eax, 2
jne 0x14003b6d3
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rcx, rdi
mov dl, 0xaa
call fcn.140167890
lea rcx, [rsp + 0x840]
mov rdx, rdi
mov r8d, 0x400
call qword [0x14021fa08]
mov dword [rsp + 0x38], eax
add eax, 0xfffffbff
cmp eax, 0xfffffc00
jb 0x14003b6da
lea rdx, [rsp + 0x40]
jmp 0x14003b65a
mov eax, 0x3f4
jmp 0x14003b664
mov eax, 0xea
jmp 0x14003b664
Function at 0x14004dea0
Capabilities:
Get token privileges

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
movdqa xmmword [rsp + 0x60], xmm8
movdqa xmmword [rsp + 0x50], xmm7
movdqa xmmword [rsp + 0x40], xmm6
mov rdi, rcx
mov rax, qword [0x14022b040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, qword [rcx]
lea r15, [rsp + 0x34]
mov dword [r15], 0
mov qword [rsp + 0x20], r15
mov rcx, r14
mov edx, 3
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14004e104
mov ebx, dword [rsp + 0x34]
test ebx, ebx
je 0x14004e104
mov rcx, rbx
call fcn.140130ce8
mov rsi, rax
xor eax, eax
mov rcx, rsi
add rcx, rax
je 0x14004e0f9
mov byte [rcx], 0
inc rax
cmp rbx, rax
jne 0x14004df19
mov qword [rsp + 0x20], r15
mov rcx, r14
mov edx, 3
mov r8, rsi
mov r9d, ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14004e0ff
cmp ebx, 0x10
jb 0x14004e0fb
mov ecx, dword [rsi]
lea rax, [rcx*4]
lea rdx, [rax + rax*2]
add rdx, 4
cmp rdx, rbx
ja 0x14004e0fb
test ecx, ecx
je 0x14004e096
lea rax, [rax + rax*2]
add rax, 0xfffffffffffffff4
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
movq xmm0, rdx
shr rdx, 3
add rdx, 4
and rdx, 0xfffffffffffffffc
pshufd xmm0, xmm0, 0x44
psrlq xmm0, 3
lea rax, [rsi + 0x30]
xor ecx, ecx
movdqa xmm1, xmmword [0x140200da0]
movdqa xmm2, xmmword [0x140200db0]
movdqa xmm3, xmmword [0x1401f0f10]
pxor xmm0, xmm3
pcmpeqd xmm4, xmm4
movq xmm5, rcx
pshufd xmm5, xmm5, 0x44
movdqa xmm6, xmm5
por xmm6, xmm2
pxor xmm6, xmm3
movdqa xmm7, xmm6
pcmpgtd xmm7, xmm0
pcmpeqd xmm6, xmm0
pshufd xmm8, xmm6, 0xf5
pand xmm8, xmm7
pshufd xmm6, xmm7, 0xf5
por xmm6, xmm8
movd r8d, xmm6
not r8d
test r8b, 1
je 0x14004e01f
mov dword [rax - 0x24], 4
pxor xmm6, xmm4
pextrw r8d, xmm6, 4
test r8b, 1
je 0x14004e036
mov dword [rax - 0x18], 4
por xmm5, xmm1
pxor xmm5, xmm3
movdqa xmm6, xmm5
pcmpgtd xmm6, xmm0
pcmpeqd xmm5, xmm0
pshufd xmm7, xmm5, 0xf5
pand xmm7, xmm6
pshufd xmm5, xmm6, 0xf5
por xmm5, xmm7
pxor xmm5, xmm4
pextrw r8d, xmm5, 0
test r8b, 1
je 0x14004e073
mov dword [rax - 0xc], 4
pextrw r8d, xmm5, 4
test r8b, 1
je 0x14004e085
mov dword [rax], 4
add rcx, 4
add rax, 0x30
cmp rdx, rcx
jne 0x14004dfd3
mov rcx, qword [rdi]
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor edx, edx
mov r8, rsi
mov r9d, ebx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
setne dil
test rsi, rsi
je 0x14004e0c4
mov rcx, rsi
call fcn.140130d24
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
cmp rcx, qword [0x14022b040]
je 0x14004e0db
call fcn.1401335a0
int3
mov eax, edi
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
ud2
xor edi, edi
jmp 0x14004e0b7
test rsi, rsi
jne 0x14004e108
xor edi, edi
jmp 0x14004e0c4
mov rcx, rsi
call fcn.140130d24
jmp 0x14004e104
Function at 0x140051cc0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x14022b040]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140167890
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140051d5f
cmp word [rsp + 0x70], 0
je 0x140051d5f
lea rbx, [rsp + 0x60]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.140131148
mov qword [rbx + 8], rax
mov rcx, rsi
mov rdx, rbx
call fcn.1400f2100
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
cmp rcx, qword [0x14022b040]
je 0x140051d51
call fcn.1401335a0
int3
mov rax, rsi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
call fcn.140053250
test al, al
jne 0x140051dad
lea rax, [0x14020a850]
lea rdx, [rsp + 0x30]
mov qword [rdx], rax
mov qword [rdx + 8], 3
mov rcx, rsi
call fcn.1400f2100
cmp byte [rsp + 0x57], 0
jns 0x140051d37
mov rcx, qword [rsp + 0x40]
call fcn.140130d24
jmp 0x140051d37
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
jmp 0x140051d37
Function at 0x140061c40
Capabilities:
Get token privileges

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rax, qword [0x14022b040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [rcx]
lea r15, [rsp + 0x2c]
mov dword [r15], 0
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov edx, 3
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140061e6e
mov r14d, dword [rsp + 0x2c]
test r14d, r14d
je 0x140061e6e
mov rcx, r14
call fcn.140130ce8
mov rdi, rax
xor eax, eax
mov rcx, rdi
add rcx, rax
je 0x140061d8b
mov byte [rcx], 0
inc rax
cmp r14, rax
jne 0x140061cad
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov edx, 3
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140061e69
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov eax, dword [rdi]
test rax, rax
je 0x140061d53
shl rax, 2
lea r14, [rax + rax*2]
mov rcx, r14
call fcn.140130ce8
mov rbx, rax
add r14, rax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], r14
lea r15, [rdi + 0xc]
xor r12d, r12d
mov r13, qword [r15 - 8]
mov rcx, qword [rsi + 0x10]
cmp rbx, rcx
jae 0x140061d9b
test rbx, rbx
je 0x140061d8b
mov eax, dword [r15]
mov qword [rbx], r13
mov dword [rbx + 8], eax
add rbx, 0xc
mov qword [rsi + 8], rbx
inc r12
mov eax, dword [rdi]
add r15, 0xc
cmp r12, rax
jb 0x140061d22
test rdi, rdi
je 0x140061d60
mov rcx, rdi
call fcn.140130d24
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
cmp rcx, qword [0x14022b040]
je 0x140061d77
call fcn.1401335a0
int3
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
call fcn.14016d350
call fcn.14016cc10
xor eax, eax
jmp 0x140061e09
movabs rax, 0x1555555555555555
mov r8, qword [rsi]
sub rbx, r8
sar rbx, 2
movabs r9, 0xaaaaaaaaaaaaaaab
imul rbx, r9
lea rdx, [rbx + 1]
cmp rdx, rax
ja 0x140061d8d
sub rcx, r8
sar rcx, 2
imul rcx, r9
lea rbp, [rcx + rcx]
cmp rbp, rdx
ja 0x140061ddd
mov rbp, rdx
movabs rdx, 0xaaaaaaaaaaaaaaa
cmp rcx, rdx
cmovae rbp, rax
test rbp, rbp
je 0x140061d97
cmp rbp, rax
ja 0x140061d92
lea rax, [rbp*4]
lea rcx, [rax + rax*2]
call fcn.140130ce8
lea r14, [rbx + rbx*2]
shl r14, 2
add r14, rax
je 0x140061d8b
lea rcx, [rbp*2]
add rcx, rbp
lea rbp, [rax + rcx*4]
mov eax, dword [r15]
mov qword [r14], r13
mov dword [r14 + 8], eax
lea rbx, [r14 + 0xc]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rdx
sub r14, r8
mov rcx, r14
call fcn.1401671f0
mov rcx, qword [rsi]
mov qword [rsi], r14
mov qword [rsi + 0x10], rbp
test rcx, rcx
je 0x140061d41
call fcn.140130d24
jmp 0x140061d41
test rdi, rdi
jne 0x140061e81
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x140061d60
mov rcx, rdi
call fcn.140130d24
jmp 0x140061e6e

Function at 0x140069060
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x14006908f
test r8d, r8d
jne 0x140069088
lea rcx, [0x140240208]
lea rdx, [0x14009c590]
xor r8d, r8d
xor r9d, r9d
call qword [0x14021fc98]
xor eax, eax
add rsp, 0x28
ret
mov r8d, r8d
add rsp, 0x28
jmp fcn.1400c7fa0
Function at 0x14006e8e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14006e900
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret

Function at 0x14006e940
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14006e960
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x14006e9a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14006e9c3
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
ret

Function at 0x14006ea20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14006ea43
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x14006eaa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x14006eac9
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
ret