joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100085894
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
movdqu xmm0, xmmword [0x10041c748]
xor esi, esi
lea r8, [rax + 0x18]
and qword [rax + 0x18], rsi
movdqu xmmword [rax - 0x40], xmm0
mov qword [rax - 0x40], rsi
call fcn.10008df88
mov r12, qword [rsp + 0x90]
mov edi, eax
test eax, eax
js 0x100085a4b
mov r15, 0xffffffff80000003
lea r8, [rsp + 0x90]
mov rdx, r12
mov rcx, r15
call fcn.10008fb68
mov edi, eax
test eax, eax
js 0x100085a4b
mov ebp, dword [rsp + 0x90]
lea r14d, [rsi + 1]
cmp ebp, r14d
jne 0x100085a41
and qword [rsp + 0x30], rsi
lea r9, [rsp + 0x30]
mov r8d, r14d
mov rdx, r12
mov rcx, r15
call fcn.1000948a0
mov rbx, qword [rsp + 0x30]
mov edi, eax
test eax, eax
js 0x10008598d
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x98]
lea rdx, [0x100050dd8]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
test eax, eax
je 0x100085984
cmp eax, 2
je 0x100085987
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x100085987
jmp 0x100085989
mov ecx, r14d
mov ebp, ecx
test edi, edi
jns 0x1000859be
mov rcx, qword [0x1003fe1c8]
lea rax, [0x1003fe1c8]
cmp rcx, rax
je 0x1000859be
test byte [rcx + 0x3c], 2
je 0x1000859be
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e890]
mov edx, 0x2d
mov r9d, edi
call fcn.10006e778
test rbx, rbx
je 0x1000859cc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
js 0x100085a4b
cmp ebp, r14d
jne 0x100085a41
lea rdx, [0x100050d80]
lea rcx, [rsp + 0x38]
mov r8d, 0x2710
call fcn.1000739a4
mov edi, eax
test eax, eax
js 0x100085ad5
mov rdx, r12
mov rcx, r15
call fcn.100091408
mov edi, eax
test eax, eax
jns 0x100085a38
mov rcx, qword [0x1003fe1c8]
lea rax, [0x1003fe1c8]
cmp rcx, rax
je 0x100085a38
test byte [rcx + 0x3c], 2
je 0x100085a38
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e890]
mov edx, 0x1c
mov r9d, edi
call fcn.10006e778
mov rsi, qword [rsp + 0x38]
test edi, edi
js 0x100085a4b
test ebp, ebp
cmove edi, r14d
test edi, edi
jns 0x100085a7c
mov rcx, qword [0x1003fe1c8]
lea rax, [0x1003fe1c8]
cmp rcx, rax
je 0x100085a7c
test byte [rcx + 0x3c], 2
je 0x100085a7c
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e718]
mov edx, SafeArrayGetDim
mov r9d, edi
call fcn.10006e778
test r12, r12
je 0x100085a97
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r12 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [rsp + 0x40], 0
je 0x100085aac
test rsi, rsi
je 0x100085aba
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test rsi, rsi
je 0x100085aba
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rsi, qword [rsp + 0x38]
jmp 0x100085a4b
Function at 0x100091408
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x100404bb0]
xor rax, rsp
mov qword [rsp + 0x280], rax
and qword [rsp + 0x68], 0
lea r9, [rsp + 0x68]
mov r8d, 0x2000000
mov rbp, rdx
mov rsi, rcx
call fcn.1000955f0
mov rbx, qword [rsp + 0x68]
mov edi, eax
test eax, eax
js 0x100091508
and qword [rsp + 0x58], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x60]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x1000914b3
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x10009158e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x10009156c
dec eax
lea r8, [rsp + 0x70]
mov r9d, 0x105
mov edx, eax
mov rcx, rbx
mov dword [rsp + 0x60], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1000914f5
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x10009158e
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.100091408
mov edi, eax
test eax, eax
jns 0x1000914b3
lea rsi, [0x1003fe1c8]
mov rcx, qword [0x1003fe1c8]
cmp rcx, rsi
je 0x100091539
test byte [rcx + 0x3c], 2
je 0x100091539
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e890]
mov edx, 0x2e
mov r9d, edi
call fcn.10006e778
test rbx, rbx
je 0x100091547
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1003005f0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
test rbx, rbx
je 0x10009157c
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x10009159e
xor edi, edi
lea rsi, [0x1003fe1c8]
test edi, edi
jns 0x100091539
jmp 0x10009150f
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x10009158e
mov rcx, qword [0x1003fe1c8]
lea rsi, [0x1003fe1c8]
cmp rcx, rsi
je 0x100091595
test byte [rcx + 0x3c], 2
je 0x100091595
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004e890]
mov edx, 0x2c
mov r9d, edi
call fcn.10006e778
jmp 0x100091595
Function at 0x100092c34
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rsi, r9
lea rax, [r11 + 8]
and qword [r11 + 8], rbx
lea r9d, [rbx + 2]
xor r8d, r8d
mov rcx, 0xffffffff80000003
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100092c79
xor edi, edi
jmp 0x100092c8b
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jne 0x100092c99
mov rbx, qword [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
jmp 0x100092c9e
mov rcx, qword [rsp + 0x40]
lea rbp, [0x1003fe1c8]
test edi, edi
jns 0x100092cd8
mov rax, qword [0x1003fe1c8]
cmp rax, rbp
je 0x100092cdf
test byte [rax + 0x3c], 2
je 0x100092cdf
mov rcx, qword [rax + 0x30]
lea r8, [0x10004e890]
mov edx, 0x29
mov r9d, edi
call fcn.10006e778
mov rcx, qword [rsp + 0x40]
mov rax, qword [0x1003fe1c8]
test rcx, rcx
je 0x100092cf7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x40], 0
mov rax, qword [0x1003fe1c8]
test edi, edi
js 0x100092d42
mov eax, dword [rsp + 0x60]
lea rdx, [0x100050dd8]
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100092d29
xor edi, edi
jmp 0x100092d65
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x100092d65
mov rax, qword [0x1003fe1c8]
cmp rax, rbp
je 0x100092d65
test byte [rax + 0x3c], 2
je 0x100092d65
mov rcx, qword [rax + 0x30]
lea r8, [0x10004e890]
mov edx, 0x24
mov r9d, edi
call fcn.10006e778
test rbx, rbx
je 0x100092d73
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x10010717c
Capabilities:
Access the windows event log

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x88
mov eax, dword [r11 + 0x28]
xor ebx, ebx
movzx r13d, cx
lea ecx, [rbx + 5]
mov r12d, edx
mov rsi, r9
cmp eax, ecx
mov ebp, r8d
lea rdx, [r11 + 0x30]
cmova eax, ecx
mov dword [r11 + 0x28], eax
test eax, eax
je 0x1001071d4
lea rcx, [rdx - 8]
mov r8d, eax
lea rdx, [r11 - 0x68]
add rcx, 8
mov rax, qword [rcx]
mov qword [rdx], rax
add rdx, 8
sub r8, 1
jne 0x1001071c0
lea rdx, [0x10004db60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rdi, rax
test rax, rax
jne 0x100107201
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10010725a
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
movzx eax, word [rsp + 0xe0]
mov dword [rsp + 0x30], ebp
mov word [rsp + 0x28], ax
and qword [rsp + 0x20], rbx
mov r9d, r12d
movzx edx, r13w
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x100107251
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test ebx, ebx
jns 0x10010728f
mov rcx, qword [0x1003fe1c8]
lea rax, [0x1003fe1c8]
cmp rcx, rax
je 0x10010728f
test byte [rcx + 0x3c], 2
je 0x10010728f
mov rcx, qword [rcx + 0x30]
lea r8, [0x10004dbb0]
mov edx, 0xa
mov r9d, ebx
call fcn.10006e778
mov eax, ebx
add rsp, 0x88
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1003005f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100404e70]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
xor r8d, r8d
mov r11, qword [0x100404f68]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x58], r11
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10005c839
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], 0
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100404e70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10005c85b
mov rax, qword [rsp + 0x88]
mov qword [0x100404f68], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100404f08], rax
xor ecx, ecx
mov rax, qword [0x100404f68]
mov qword [0x1003ff120], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100404ef0], rax
mov dword [0x1003ff110], 0xc0000409
mov dword [0x1003ff114], 1
mov rax, qword [0x100404bb0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100406070]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100077208]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
cmp rcx, qword [0x100404bb0]
jne 0x10030060b
rol rcx, 0x10
test cx, 0xffff
jne 0x100300607
ret 0
ror rcx, 0x10
jmp 0x10005c7b4
Function at 0x100369578
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
rdtsc
shl rdx, 0x20
or rax, rdx
cdqe
mov qword [0x1003fe198], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor ebx, ebx
lea rbp, [0x100000000]
and eax, 0x80000000
mov dword [0x1003fe928], eax
cmp dword [0x10041beb0], ebx
jne 0x1003695d6
lea rcx, [0x100405c40]
call fcn.1004c8000
cmp eax, ebx
jl 0x1003697c5
mov dword [0x10041beb0], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [0x100000000]
mov rdi, qword [rsp + 0x28]
mov r8d, 0x80000000
lea rax, [rdi + r8]
movsxd rdx, dword [0x10000003c]
mov edx, dword [rdx + rbp + 0x50]
add rdx, rcx
cmp rdx, rax
jb 0x100369611
lea rdi, [rdx - 0x80000000]
lea rdx, [rdi + 0xffff]
mov rdi, qword [rsp + 0x30]
lea rax, [rdi - 0x80000000]
and rdx, 0xffffffffffff0000
cmp rcx, rax
mov qword [0x10041cd78], rdx
jbe 0x100369640
mov qword [0x1003fee98], rdi
jmp 0x10036964a
add rcx, r8
mov qword [0x1003fee98], rcx
mov word [0x1003fee98], bx
mov rax, qword [0x1003fee98]
sub rax, rdx
shr rax, 0x10
mov qword [0x100405548], rax
mov eax, ebx
cmp eax, ebx
jl 0x1003697c5
mov rax, qword [0x10041cb68]
cmp rax, 3
jae 0x1003696b6
lea rax, [rax + rax*4]
lea rcx, [rbp + rax*8 + 0x3fef30]
call fcn.10011146c
mov edx, eax
cmp eax, ebx
jl 0x1003696af
mov rax, qword [0x10041cb68]
inc rax
mov qword [0x10041cb68], rax
cmp rax, 3
jb 0x10036967d
cmp edx, ebx
jge 0x1003696b6
mov eax, edx
jmp 0x1003697c5
mov eax, dword [0x10028bf00]
cmp eax, ebx
je 0x100369750
mov r8d, 0x40
lea rsi, section..data
mov rcx, rsi
lea r9, [rsp + 0x78]
mov edx, dword [0x100015964]
mov eax, dword [0x10028bf00]
imul edx, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, ebx
jne 0x100369712
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov ecx, 0x54f
cmove eax, ecx
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
jmp 0x100369752
mov eax, dword [0x10028bf00]
cmp eax, ebx
mov r8, rbx
jbe 0x100369750
mov edi, dword [0x100015964]
xor eax, eax
imul rdi, r8
add rdi, rsi
mov ecx, dword [0x100015964]
mov dword [rbp + r8*4 + 0x4059e0], 0xef0b
inc r8
rep stosb byte [rdi], al
mov eax, dword [0x10028bf00]
cmp r8, rax
jb 0x10036971f
mov ecx, ebx
cmp ecx, ebx
jge 0x10036975a
mov eax, ecx
jmp 0x1003697c5
mov ecx, dword [0x1003feae0]
cmp ecx, ebx
je 0x1003697ac
lea rdi, [0x1003feb08]
mov edx, dword [0x1003fead8]
lea rax, [rdx + rbp + 0x3feb08]
mov qword [0x1003feae8], rdi
mov qword [0x1003feaf0], rax
mov eax, dword [0x1003feadc]
add rdx, rax
lea rax, [rdx + rbp + 0x3feb08]
add rcx, rdx
add rcx, rdi
mov qword [0x1003feaf8], rax
mov qword [0x1003feb00], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
mov eax, 0x50381023
cmp dword [rsp + 0x70], ebx
cmovl ebx, dword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400010a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
invalid
test ecx, ebx

Function at 0x140001160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
cmp ah, bl
shl byte [rsi + 0xf], 1
cmp ah, bl
fsub dword [rsi + 0xf]
cmp ah, bl
loopne 0x1400011b9
adc byte [rcx + rax - 0x10], al
jne 0x140001183
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x14000119c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
cmp ah, bl
shl byte [rsi + 0xf], 1
cmp ah, bl
fsub dword [rsi + 0xf]
cmp ah, bl
loopne 0x1400011b9
adc byte [rcx + rax - 0x10], al
jne 0x140001183
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x140001260
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140001289
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x140001380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400013df
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400013d0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x140001540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
adc byte [r15], cl
push rdi
ror byte [rdi], 1
push rdi
fsub dword [rsi + 0xf]
out dx, eax
loopne 0x1400015bb
pxor mm5, mm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14000159a
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
invalid
invalid

Function at 0x140001650
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400016aa
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400016a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret
Function at 0x14003b5b0
Capabilities:
Get file version info

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa0
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x98], rax
cmp byte [rdx + 0x17], 0
mov rcx, rdx
jns 0x14003b5e1
mov rcx, qword [rbx]
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x14003b6d5
mov ebp, eax
mov ecx, eax
call fcn.14014c42c
mov rdi, rax
cmp byte [rbx + 0x17], 0
jns 0x14003b605
mov rbx, qword [rbx]
mov rcx, rbx
xor edx, edx
mov r8d, ebp
mov r9, rdi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14003b6d5
movabs r14, 0xaaaaaaaaaaaaaaaa
lea r8, [rsp + 0x38]
mov qword [r8], r14
lea r9, [rsp + 0x34]
mov dword [r9], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14003b6d5
cmp dword [rsp + 0x34], 3
jbe 0x14003b6d5
mov rax, qword [rsp + 0x38]
movzx r8d, word [rax]
movzx r9d, word [rax + 2]
movaps xmm0, xmmword [0x14020b860]
lea rbx, [rsp + 0x40]
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdx, str.StringFileInfo_04x_04xInternalName
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x28]
mov qword [r8], r14
lea r9, [rsp + 0x24]
mov dword [r9], 0xaaaaaaaa
mov rcx, rdi
mov rdx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14003b6d5
mov r8d, dword [rsp + 0x24]
test r8d, r8d
je 0x14003b6d5
dec r8d
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.14003b710
jmp 0x14003b6e3
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14014ced0
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14003d360
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14022f038]
xor rax, rsp
mov qword [rsp + 0x58], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rcx, [rsp + 0x40]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [0x14020b860]
movaps xmmword [rcx], xmm0
lea rdx, str.GROUP:
call fcn.140189870
test rdi, rdi
je 0x14003d511
mov rcx, rdi
call fcn.1401740e0
lea r15, [rsp + 0x40]
mov rcx, r15
mov rdx, rdi
mov r8, rax
call fcn.140092050
lea rdx, str.__NAME:
mov r8d, 8
mov rcx, r15
call fcn.140092050
test r14, r14
je 0x14003d511
mov rcx, r14
call fcn.1401740e0
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, r14
mov r8, rax
call fcn.140092050
lea rdx, str.__DURATION:
mov r8d, SafeArrayDestroy
mov rcx, rdi
call fcn.140092050
mov rdx, qword [rbx + 8]
test rdx, rdx
jne 0x14003d43e
lea rdx, str.unknown_unfinished
lea rcx, [rsp + 0x40]
mov r8d, shutdown
jmp 0x14003d498
sub rdx, qword [rbx]
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.140093c60
movzx r8d, byte [rbx + 0x17]
test r8b, r8b
jns 0x14003d464
mov r8, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
jmp 0x14003d468
and r8d, 0x7f
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140092050
cmp byte [rsp + 0x3f], 0
jns 0x14003d486
mov rcx, qword [rsp + 0x28]
call fcn.14014c3ec
lea rdx, str.__us_
lea rcx, [rsp + 0x40]
mov r8d, 5
call fcn.140092050
lea rdx, [0x14020bf25]
mov r8d, 2
mov rcx, rdi
call fcn.140092050
movzx r8d, byte [rsp + 0x57]
test r8b, r8b
jns 0x14003d4c9
mov r8d, dword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
jmp 0x14003d4cd
and r8d, 0x7f
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x20], 0
mov rdx, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp byte [rsp + 0x57], 0
jns 0x14003d4f7
mov rcx, qword [rsp + 0x40]
call fcn.14014c3ec
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14014ced0
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, str.string::append_received_nullptr
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_string
lea r9, str.__s___nullptr
mov r8d, 0xb21
call fcn.14018a2b0
int3