joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043060
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140127190]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rbx, rcx
xor eax, eax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [r11 - 0x58]
call fcn.1400432f0
nop
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
sub rax, rdi
cmp rax, r14
jne 0x1400430e7
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.14009b210
test eax, eax
je 0x14004327a
mov rcx, rbx
call fcn.140042df0
mov rbp, rax
test rax, rax
je 0x14004327a
mov r9, rbx
mov r10, qword [rbx + 0x18]
cmp r10, 8
jb 0x14004310b
mov r9, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rdx, 0xffffffffffffffff
test r8, r8
je 0x140043131
mov rcx, r8
mov rax, r9
cmp word [rax], 0x5c
je 0x140043195
add rax, 2
sub rcx, 1
jne 0x140043121
mov rax, rdx
inc rax
movdqa xmm0, xmmword [0x1401087a0]
movdqu xmmword [rsp + 0x70], xmm0
xor r12d, r12d
mov word [rsp + 0x60], r12w
cmp r8, rax
jb 0x1400432db
sub r8, rax
cmp r8, rdx
cmovb rdx, r8
cmp r10, 8
jb 0x14004316a
mov rbx, qword [rbx]
lea r9, [rbx + rax*2]
lea rcx, [rsp + 0x60]
cmp rdx, 7
ja 0x1400431a2
mov qword [rsp + 0x70], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.14009a510
mov word [rsp + rbx + 0x60], r12w
jmp 0x1400431a7
test rax, rax
je 0x140043131
sub rax, r9
sar rax, 1
jmp 0x140043134
call fcn.14002d410
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140043224
cmp qword [rsi + 0x18], 8
jb 0x1400431f6
mov rsi, qword [rsi]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x100]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140043266
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400432e1
call fcn.1400765f0
movdqa xmm0, xmmword [0x1401087a0]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], r12w
test rdi, rdi
je 0x1400432b3
mov rdx, qword [rsp + 0x90]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400432ab
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400432d5
mov rcx, rdi
call fcn.1400765f0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140076590
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400a3864
nop
call fcn.14002cb90
nop
call fcn.1400a3864
int3
Function at 0x1400477c0
Capabilities:
Check for time delay via gettickcount
Enumerate services
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x140127190]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x30], rsp
mov rbx, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r15, rax
test rax, rax
je 0x1400479e6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x1400479e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1400479e6
mov ecx, dword [rsp + 0x80]
call fcn.1400a63ac
mov r14, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400479e6
lea rax, [rsp + 0x84]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesW]
test eax, eax
jne 0x1400478bd
lea rdx, [0x1400479e6]
mov rcx, rsp
call fcn.1400de5c0
xor edi, edi
mov dword [rsp + 0x38], edi
cmp edi, dword [rsp + 0x84]
jae 0x1400479de
lea rcx, [rdi + rdi*2]
add rcx, rcx
movups xmm0, xmmword [r14 + rcx*8 + 0x10]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [r14 + rcx*8 + 0x20]
movups xmmword [rsp + 0x70], xmm1
mov r8d, 0x24
mov rdx, qword [r14 + rcx*8]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14004791f
lea rdx, [0x1400479e6]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
nop
lea r8, [rsp + 0x88]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140047950
lea rdx, [0x1400479e6]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
nop word [rax + rax]
cmp dword [rsp + 0x8c], 1
je 0x1400479ce
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x88]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400479a2
lea rdx, [0x1400479e6]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
cmp dword [rsp + 0x8c], 1
je 0x1400479ce
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x7530
jbe 0x1400479cc
lea rdx, [0x1400479e6]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
jmp 0x140047950
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc edi
jmp 0x1400478bf
mov rcx, r14
call fcn.1400a60f0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140076590
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140047a10
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
mov rax, qword [0x140127190]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x30], rsp
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140047c51
cmp qword [rbx + 0x18], 8
jb 0x140047a72
mov rbx, qword [rbx]
mov r8d, 0x2c
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140047c48
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140047aca
lea rdx, [0x140047c51]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
mov eax, dword [rsp + 0x54]
cmp eax, 1
jne 0x140047ae4
lea rdx, [0x140047c51]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
mov r14d, 0x2710
nop word [rax + rax]
cmp eax, 3
jne 0x140047b99
mov eax, 0xcccccccd
mul dword [rsp + 0x68]
shr edx, 3
cmp edx, 0x3e8
jae 0x140047b14
mov edx, 0x3e8
jmp 0x140047b1b
cmp edx, r14d
cmova edx, r14d
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140047b58
lea rdx, [0x140047c51]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
cmp dword [rsp + 0x54], 1
jne 0x140047b70
lea rdx, [0x140047c51]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7530
jbe 0x140047b90
lea rdx, [0x140047c51]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
mov eax, dword [rsp + 0x54]
jmp 0x140047af0
mov rcx, rbx
call fcn.1400477c0
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140047bd0
lea rdx, [0x140047c51]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
nop dword [rax]
cmp dword [rsp + 0x54], 1
je 0x140047c3f
mov ecx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x140047c16
lea rdx, [0x140047c51]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
cmp dword [rsp + 0x54], 1
je 0x140047c3f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7530
jbe 0x140047c3d
lea rdx, [0x140047c51]
mov rcx, qword [rsp + 0x30]
call fcn.1400de5c0
jmp 0x140047bd0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140076590
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400556d0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x140127190]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140055773
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140055773
mov dword [rsp + 0x20], 0x28
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140055797
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140076590
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x38]
call fcn.140022cc0
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.140055810
lea rdx, [0x140123c10]
lea rcx, [rsp + 0x60]
call fcn.14009a418
int3

Function at 0x140055e20
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x140127190]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x140132790]
mov rax, qword gs:[0x58]
mov edx, 0x120
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140131488], ecx
jg 0x140055f0c
mov eax, ebx
cmp rbx, rax
jne 0x140055ece
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x140055ece
mov r8, rdi
mov edx, ebx
mov rcx, qword [0x140131480]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140055f4f
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140076590
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x28]
call fcn.140022cc0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140055810
lea rdx, [0x140123c10]
lea rcx, [rsp + 0x50]
call fcn.14009a418
nop
lea rcx, [0x140131488]
call fcn.140077030
cmp dword [0x140131488], 0xffffffff
jne 0x140055e79
lea rcx, [0x140131480]
call fcn.1400556d0
lea rcx, [0x1400e2710]
call fcn.1400769b4
nop
lea rcx, [0x140131488]
call fcn.140076fd0
jmp 0x140055e79
lea rdx, [0x1400e5010]
lea rcx, [rsp + 0x28]
call fcn.140022cc0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.140055810
lea rdx, [0x140123c10]
lea rcx, [rsp + 0x50]
call fcn.14009a418
int3
Function at 0x1400675f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r11, rdx
mov r9, rcx
mov r10d, ebx
cmp r8, 8
jb 0x140067637
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9]
add r9, 8
xor rax, qword [r11]
add r11, 8
or r10, rax
sub rcx, 1
jne 0x140067620
mov rdx, r10
shr rdx, 0x20
or edx, r10d
mov eax, edx
mov ecx, edx
shr eax, 8
or eax, edx
shr ecx, 0x10
and eax, 0xff00
or eax, ecx
movzx ecx, dl
shr eax, 8
or eax, ecx
test r8, r8
je 0x140067747
cmp r8, 8
jb 0x140067714
mov rdx, r8
mov rcx, r9
and rdx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rcx, r11
xorps xmm3, xmm3
mov r10, r11
nop word [rax + rax]
movd xmm2, dword [rcx + r10]
xorps xmm0, xmm0
movd xmm1, dword [r10]
lea r10, [r10 + 8]
punpcklbw xmm2, xmm0
add rbx, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r10 - 4]
punpcklbw xmm1, xmm0
por xmm2, xmm4
punpcklwd xmm1, xmm0
movdqa xmm4, xmm2
movd xmm2, dword [rcx + r10 - 4]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
pxor xmm2, xmm1
por xmm2, xmm3
movdqa xmm3, xmm2
cmp rbx, rdx
jb 0x140067690
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or eax, ecx
cmp rbx, r8
jae 0x140067747
sub r9, r11
lea r10, [rbx + r11]
sub r8, rbx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r10 + r9]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
xor edx, ecx
or eax, edx
sub r8, 1
jne 0x140067730
mov rbx, qword [rsp + 8]
test eax, eax
sete al
ret
Function at 0x140067760
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x1400678a4
cmp r9, 4
jb 0x1400677aa
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x140067790
xor r11d, r11d
test r9, r9
je 0x1400678a4
cmp r9, 0x40
jb 0x140067878
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1400677dc
cmp rdx, r8
jae 0x140067878
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x1400677f1
cmp rdx, r10
jae 0x140067878
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
mov rbx, rcx
sub rdx, r8
mov rax, r8
sub rbx, r8
movdqu xmm0, xmmword [rax]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax]
movdqu xmm2, xmmword [rdx + rax + 0x10]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm2, xmmword [rdx + rax - 0x10]
movdqu xmmword [rbx + rax - 0x20], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x10], xmm2
cmp r11, rdi
jb 0x140067810
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x1400678a4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x140067890
add rsp, 8
ret
Function at 0x1400a90bc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400a8e20
Function at 0x1400c4360
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400c4373
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400ce264
lea rdx, [0x140124248]
lea rcx, [rsp + 0x20]
call fcn.14009a418
int3

Function at 0x1400cebfc
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140134568]
xor edx, edx
jmp fcn.1400c4360

Function at 0x1400cf594
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140134568]
jmp fcn.1400c4360

Function at 0x1400db150
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400db20c]
mov r9, qword [r9 + 8]
jmp fcn.1400cc3c0

Function at 0x1400db1e4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400db21c]
mov r9, qword [r9 + 8]
jmp fcn.1400cc3c0
Function at 0x140005aa4
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
sub rsp, 0x10
xorps xmm0, xmm0
movaps xmmword [rsp], xmm0
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx]
add r9d, eax
xor r10d, r10d
test r10, r10
je 0x140005aca
mov r11d, dword [rdx + r10]
mov rsi, r10
jmp 0x140005acf
mov r11d, r9d
xor esi, esi
mov dword [rsp + rsi], r11d
add r10, 4
cmp r10, 0x10
jne 0x140005abc
movdqa xmm0, xmmword [rsp]
pxor xmm0, xmmword [rcx]
aesenc xmm0, xmmword [rcx + 0x10]
aesenc xmm0, xmmword [rcx + 0x20]
aesenc xmm0, xmmword [rcx + 0x30]
aesenc xmm0, xmmword [rcx + 0x40]
aesenc xmm0, xmmword [rcx + 0x50]
aesenc xmm0, xmmword [rcx + 0x60]
aesenc xmm0, xmmword [rcx + 0x70]
aesenc xmm0, xmmword [rcx + 0x80]
aesenc xmm0, xmmword [rcx + 0x90]
aesenc xmm0, xmmword [rcx + 0xa0]
aesenc xmm0, xmmword [rcx + 0xb0]
inc eax
aesenc xmm0, xmmword [rcx + 0xc0]
mov dword [rdx + 0x10], eax
aesenc xmm0, xmmword [rcx + 0xd0]
aesenclast xmm0, xmmword [rcx + 0xe0]
movdqu xmmword [r8], xmm0
add rsp, 0x10
pop rsi
ret
Function at 0x140005b5f
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140005b95
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140005b9d
mov esi, dword [rdx]
mov r9d, 4
jmp 0x140005ba2
xor r10d, r10d
jmp 0x140005c50
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140005bc5
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140005bdc
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140005bfc
add r11, r8
jmp 0x140005d20
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140005cc4
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140005c72
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140005cd6
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x140005cdc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140005d02
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140005d1c
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140018b5d
Capabilities:
Delete file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
lea rax, [rsp + 0x48]
mov qword [rax], rcx
lea rcx, [rsp + 0x50]
mov qword [rcx], rdx
xor edx, edx
lea r8, [rsp + 0x58]
mov qword [r8], rdx
mov qword [r8 + 8], 8
mov qword [r8 + 0x10], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
lea rcx, [0x140001af8]
call fcn.14004c8d7
test rax, rax
jne 0x140018be7
call fcn.14004cebe
mov rdi, qword [rax]
lea rsi, [rdi + 0x80]
lea rcx, [0x140001af8]
call fcn.14004c8d7
test rax, rax
je 0x140018d9c
cmp qword [rax + 0x110], rdi
jne 0x140018dae
lea rcx, [rsp + 0x28]
mov rdx, rax
call fcn.1400010e6
mov rax, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbp, rcx
shl rbp, 5
add rbp, r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbp
test rcx, rcx
je 0x140018d65
add r13, 0x20
movabs rdi, 0x8000000000000000
mov qword [rsp + 0x20], rbp
mov rsi, qword [r13 - 0x20]
cmp rsi, rdi
je 0x140018d65
lea rbx, [r13 - 0x20]
mov r14, qword [r13 - 0x18]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.14005a7f0
mov rax, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
cmp rax, rdi
je 0x140018cc5
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], rcx
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x88]
call fcn.140060540
mov rax, rdi
mov rdi, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov rbp, rax
cmp rdi, rax
jne 0x140018cff
mov rdi, rbp
mov rbp, qword [rsp + 0x20]
mov r12, r15
test r15, r15
je 0x140018cd5
mov rcx, r12
call fcn.140028d4a
test rsi, rsi
je 0x140018cec
mov rcx, qword [0x1400a54b0]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
add r13, 0x20
add rbx, 0x20
cmp rbx, rbp
jne 0x140018c38
jmp 0x140018d62
mov rcx, r15
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x140018d2d
test rdi, rdi
mov rdi, rbp
mov rbp, qword [rsp + 0x20]
je 0x140018cd5
mov rcx, qword [0x1400a54b0]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140018cd5
call qword [sym.imp.kernel32.dll_GetLastError]
mov r12d, eax
shl r12, 0x20
or r12, 2
test rdi, rdi
je 0x140018d55
mov rcx, qword [0x1400a54b0]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdi, rbp
mov rbp, qword [rsp + 0x20]
jmp 0x140018ccd
mov r13, rbp
lea rcx, [rsp + 0x28]
mov qword [rcx + 8], r13
call fcn.140001f8e
lea rcx, [rsp + 0x50]
call fcn.14000212b
lea rcx, [rsp + 0x48]
call fcn.1400022b3
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140076d47
jmp 0x140018bf4
lea r8, [rsp + 0x28]
mov rcx, rsi
mov rdx, rax
call fcn.140077014
jmp 0x140018bf4