joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010d40
Capabilities:
Access peb ldr_data

Disassembly:
cmp qword [rcx + 0x30], 0
jne 0x180010d5e
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
jmp 0x180010d62
mov rdx, qword [rcx + 0x10]
movups xmm0, xmmword [rdx - 0x10]
movaps xmmword [rcx], xmm0
movups xmm1, xmmword [rdx]
movaps xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x10]
movaps xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x20]
movaps xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x30]
movaps xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x40]
movaps xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x60], xmm0
mov rax, qword [rcx + 0x30]
ret

Function at 0x180010da0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x180010de4
nop word [rax + rax]
cmp qword [rax + 0x30], rcx
je 0x180010dcf
mov rax, qword [rax]
test rax, rax
jne 0x180010dc0
ret
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
ret

Function at 0x180010df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x180010e01
mov ecx, edx
jmp 0x180010e46
mov ecx, 1
call fcn.180010c50
mov rcx, rax
call fcn.180010e70
mov rcx, rax
mov rdx, rbx
call fcn.180010f00
test rax, rax
jne 0x180010e63
lea ecx, [rax + 3]
call fcn.180010c50
mov rcx, rax
call fcn.180010e70
mov rcx, rax
mov rdx, rbx
call fcn.180010f00
test rax, rax
jne 0x180010e63
lea ecx, [rax + 2]
call fcn.180010c50
mov rcx, rax
call fcn.180010e70
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.180010f00
add rsp, 0x20
pop rbx
ret

Function at 0x180010f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r11, rcx
mov rbx, rdx
mov ecx, dword [rax + rcx + 0x88]
add rcx, r11
mov esi, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x24]
add rsi, r11
add rbp, r11
cmp rdx, 0xffff
ja 0x180010f54
sub bx, word [rcx + 0x10]
movzx eax, bx
cmp eax, dword [rcx + 0x14]
jae 0x180010f8e
movzx eax, bx
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x180010f90
mov r10d, dword [rcx + 0x20]
xor r9d, r9d
mov edi, dword [rcx + 0x18]
add r10, r11
test edi, edi
je 0x180010f8e
nop word [rax + rax]
mov edx, dword [r10]
mov rcx, rbx
add rdx, r11
call 0x1800155b0
test eax, eax
je 0x180010fa5
inc r9d
add r10, 4
cmp r9d, edi
jb 0x180010f70
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x180010f90
Function at 0x180011230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [0x180021250]
lea rcx, [rbp - 0x30]
xor edx, edx
mov dword [rbp - 0x20], 0x74706563
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x1c], 0x486e6f69
mov dword [rbp - 0x18], 0x6c646e61
mov word [rbp - 0x14], 0x7265
mov byte [rbp - 0x12], 0
call fcn.180010df0
lea rdx, [0x180011220]
mov ecx, 1
call rax
movdqa xmm0, xmmword [0x180021200]
lea rcx, [rbp - 0x30]
xor edx, edx
mov qword [rbp - 0x10], 0
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x69666974
mov dword [rbp - 0x1c], 0x69746163
mov word [rbp - 0x18], 0x6e6f
mov byte [rbp - 0x16], 0
call fcn.180010df0
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x180010810]
xor ecx, ecx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800156d0
add rsp, 0x50
pop rbp
ret
Function at 0x180012830
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x180012851
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18001287e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180012880
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1800128d9
test ecx, ecx
jle 0x1800128b9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1800128d9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1800128d9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x180012900
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180012922
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x180012931
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180012954
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180012956
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180012992
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180012a2e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1800129cd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180012a0e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180012a2e
cmp rbx, rax
ja 0x1800129e0
test rbx, rbx
je 0x180012a2e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
Function at 0x180012e60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180012e8d
xor eax, eax
jmp 0x180012ff9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180012ec7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180012ec7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180012ff9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180012fec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180012f0a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180012f35
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180012ff1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180012fa4
sub eax, 1
je 0x180012fa4
cmp eax, 2
jne 0x180012fec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180012ff1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180012fd2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180012fec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180012ff1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800156d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1800131e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800132b3
cmp byte [rcx + 0x71], 0
je 0x1800132b3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800132af
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180013274
sub eax, 1
je 0x180013278
cmp eax, 2
jne 0x1800132af
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800156d0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1800132a6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800132af
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18001325c
xor al, al
jmp 0x18001325c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800156d0
add rsp, 0x60
pop rbx
ret
Function at 0x180013f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov dword [rbp - 0x10], 0x61657243
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x69466574
xor edx, edx
mov dword [rbp - 8], 0x57656c
call fcn.180010df0
mov rcx, rbx
mov r10, rax
call fcn.180010cd0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call r10
xor edx, edx
mov dword [rbp - 0x10], 0x46746547
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x53656c69
mov rsi, rax
mov dword [rbp - 8], 0x657a69
call fcn.180010df0
xor edx, edx
mov rcx, rsi
call rax
mov edx, eax
mov r8d, 4
mov ebx, eax
call fcn.180010fc0
xor edx, edx
mov dword [rbp - 0x10], 0x64616552
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x656c6946
mov rdi, rax
mov byte [rbp - 8], 0
call fcn.180010df0
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call rax
mov dword [rbp + 0x18], 0x6c43744e
lea rcx, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x65736f
xor edx, edx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x18], rax
call fcn.180010df0
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x60]
mov rax, rdi
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x180015090
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 8
movzx r11d, byte [rcx]
xor r10d, r10d
mov r8d, r10d
mov r9d, r10d
cmp r11b, 0xcc
je 0x1800150d4
mov qword [rsp], rbx
mov ebx, r10d
nop
cmp r11b, byte [rbx + rdx]
lea eax, [r8 + 1]
cmovne eax, r8d
inc r9d
mov r8d, eax
mov ebx, r9d
movzx r11d, byte [r9 + rcx]
cmp r11b, 0xcc
jne 0x1800150b0
mov rbx, qword [rsp]
cmp r8d, r9d
sete r10b
mov eax, r10d
add rsp, 8
ret
Function at 0x140018300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x140018420
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x140018360
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x140018360
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x140018360

Function at 0x14001ac50
Capabilities:
Set registry value

Disassembly:
xor r8d, r8d
test edx, edx
cmovg r8d, edx
lea rdx, str.PWALauncherResult
jmp 0x140041df0
push rsi
sub rsp, 0x40
mov rax, qword [0x1400e4040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], r8d
mov rcx, qword [rcx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140087ae0
mov eax, esi
add rsp, 0x40
pop rsi
ret
Function at 0x140022d30
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x140022d57
mov r15, r12
jmp 0x140022e98
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x140022db9
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r15, rbx
sub r15, rax
mov r14, r12
sub r14, rbx
je 0x140022da5
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1400b87f0
mov r12, qword [rsi + 8]
add r15, r14
mov qword [rsi + 0x10], r15
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x140022e98
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x140022ee4
lea rcx, [r13*8]
call fcn.1400866a0
mov rcx, r13
and rcx, 0xfffffffffffffffc
mov rdx, r12
sub rdx, rbx
mov r8, r12
lea rcx, [rax + rcx*2]
mov r15, rcx
sub r8, rbx
je 0x140022e3c
sar rdx, 3
lea r15, [r8 + rcx]
shl rdx, 3
xor r8d, r8d
nop word cs:[rax + rax]
mov r9, rcx
add r9, r8
je 0x140022eb8
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x140022e20
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], rdx
nop
cmp r12, rbx
je 0x140022e87
add r12, 0xfffffffffffffff8
jne 0x140022e50
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.14001c2cc
test r14, r14
je 0x140022e98
mov rcx, r14
call fcn.1400866dc
mov r15, qword [rsi + 0x10]
test r15, r15
je 0x140022eb8
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 0x10], 8
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.14001c2cc
call fcn.14001aba5
int3
Function at 0x140032f76
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
call fcn.14003e7ce
mov ebp, eax
test rdi, rdi
je 0x140032fab
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x140032fc0
movzx eax, word [rax]
jmp 0x140032fd0
xor r15d, r15d
mov eax, 6
test bpl, bpl
jne 0x14003305a
xor edi, edi
jmp 0x140032fe8
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x14010c008]
xor r15d, r15d
cmp ax, 0xffff
sete cl
cmove rdi, r15
mov eax, 6
cmp bpl, cl
je 0x14003305a
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x140032ffa
movzx ebp, word [rax]
jmp 0x140033009
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x14010c008]
mov ebp, eax
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov dx, 4
mov r8d, ebp
call qword [0x14010c008]
test al, al
je 0x140033052
mov rax, qword [rbx]
mov rax, qword [rax + 0x68]
mov rcx, rbx
mov edx, ebp
xor r8d, r8d
call qword [0x14010c008]
mov ebp, eax
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x14003306e
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x14003307b
xor r15d, r15d
mov eax, 4
or dword [rsi], eax
mov eax, r15d
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x14010c008]
mov r12d, dword [rsp + 0x80]
movsx r15d, bpl
mov rcx, r14
call fcn.14003e7ce
mov ebp, eax
test rdi, rdi
je 0x1400330a5
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x1400330a9
movzx eax, word [rax]
jmp 0x1400330b9
mov al, 1
jmp 0x1400330c2
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x14010c008]
cmp ax, 0xffff
sete al
jne 0x1400330c4
xor edi, edi
add r15d, 0xffffffd0
cmp bpl, al
je 0x14003316a
cmp r12d, 2
jl 0x14003316a
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400330ed
movzx ebp, word [rax]
jmp 0x1400330fc
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x14010c008]
mov ebp, eax
mov rax, qword [rbx]
mov rax, qword [rax + 0x18]
mov rcx, rbx
mov dx, 4
mov r8d, ebp
call qword [0x14010c008]
test al, al
je 0x14003305c
mov rax, qword [rbx]
mov rax, qword [rax + 0x68]
mov rcx, rbx
mov edx, ebp
xor r8d, r8d
call qword [0x14010c008]
mov ebp, eax
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x140033149
add rax, 2
mov qword [rcx + 0x18], rax
jmp 0x140033156
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x14010c008]
lea eax, [r15 + r15*4]
movsx ecx, bpl
lea r15d, [rcx + rax*2]
dec r12d
jmp 0x140033087
mov rcx, r14
call fcn.14003e7ce
mov ebx, eax
test rdi, rdi
je 0x140033188
mov rax, qword [rdi + 0x18]
cmp rax, qword [rdi + 0x20]
je 0x14003319a
movzx eax, word [rax]
jmp 0x1400331aa
mov eax, 2
test bl, bl
jne 0x14003305a
jmp 0x14003305c
mov rax, qword [rdi]
mov rax, qword [rax + 0x40]
mov rcx, rdi
call qword [0x14010c008]
cmp ax, 0xffff
sete al
xor bl, al
mov eax, 2
je 0x14003305a
jmp 0x14003305c