joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ddf0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov rcx, qword [rcx]
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov dword [rbp + 4], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 0
lea r9, [rbp + 4]
call qword [sym.imp.ws2_32.dll_WSASend]
mov esi, eax
cmp esi, 0xffffffff
jne 0x14006de40
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
xor ecx, ecx
cmp esi, 0xffffffff
sete cl
mov edx, dword [rbp + 4]
cmove rdx, rax
mov rax, rcx
add rsp, 0x48
pop rsi
pop rbp
ret

Function at 0x14006e0d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
movaps xmmword [rbp - 0x60], xmm0
mov dword [rbp + 0x34], 0x80
lea rdx, [rbp - 0x60]
lea r8, [rbp + 0x34]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x14006e17a
mov eax, dword [rbp + 0x34]
movzx ecx, word [rbp - 0x60]
cmp ecx, 2
je 0x14006e18a
cmp ecx, 0x17
jne 0x14006e1a8
cmp eax, 0x1b
jbe 0x14006e1c2
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov edx, dword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rbp + 0x24], xmm0
mov word [rsi], 1
movups xmm0, xmmword [rbp + 0x22]
movups xmmword [rsi + 2], xmm0
movzx r8d, word [rbp + 0x32]
mov word [rsi + 0x12], r8w
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
jmp 0x14006e1b8
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x14006e1af
cmp eax, 0xf
jbe 0x14006e1da
movzx eax, word [rbp - 0x5e]
rol ax, 8
mov ecx, dword [rbp - 0x5c]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
jmp 0x14006e1b8
lea rax, str.invalid_argument
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb8
pop rsi
pop rbp
ret
lea rcx, str.assertion_failed:_len___mem::size_of::_c::sockaddr_in6___
lea r8, str.library_std_src_sys_common_net.rsassertion_failed:_len___mem::size_of::_c::sockaddr_in___
mov edx, 0x3a
call fcn.1400d6310
lea rcx, [0x14061e029]
lea r8, str.library_std_src_sys_common_net.rsassertion_failed:_len___mem::size_of::_c::sockaddr_in___
mov edx, 0x39
call fcn.1400d6310
int3

Function at 0x14006e330
Capabilities:
Set socket configuration

Disassembly:
push rbp
sub rsp, 0x30
sub esp, 0x30
lea rbp, [rsp + 0x30]
movzx eax, dl
mov dword [rbp - 4], eax
lea r8, [rbp - 4]
cld
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
sub ecx, eax
invalid
invalid
cmp eax, 0xffffffff
je 0x14006e358
invalid
xor eax, eax
jmp 0x14006e366
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
or eax, 2
add rsp, 0x30
pop rbp
ret

Function at 0x14006e370
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
insb byte [rdi], dx
and al, 0x20
Function at 0x14006e3c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14006e3f2
movsxd rdx, eax
xor ecx, ecx
jmp 0x14006e416
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
xor edx, edx
mov ecx, 0
cmp eax, 0x274a
je 0x14006e416
shl rax, 0x20
or rax, 2
mov ecx, 1
mov rdx, rax
mov rax, rcx
add rsp, 0x20
pop rbp
ret

Function at 0x14006e5e0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1406a72b1]
mov edx, 0x10
xor ecx, ecx
call fcn.14006ef50
test rax, rax
je 0x14006e6d3
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14006e790]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14006e6c5
mov rcx, qword [rbx]
mov qword [rbp - 0x20], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x18], rax
call qword [rax]
mov rax, qword [rbp - 0x18]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x20]
je 0x14006e69e
cmp qword [rax + 0x10], 0x11
jae 0x14006e687
mov r8, qword [rbp - 0x10]
jmp 0x14006e68f
mov r8, qword [rbp - 0x10]
mov r8, qword [r8 - 8]
mov rcx, qword [0x1406a7220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x1406a7220]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
call qword [sym.imp.kernel32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400d6100
ud2

Function at 0x140072fd0
Capabilities:
Connect socket

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov eax, 1
test rcx, rcx
jne 0x14007307e
mov rax, qword [0x1406a7228]
cmp rax, 3
jne 0x1400730a7
mov rsi, rdx
movzx ecx, word [rdx]
call fcn.14006da10
test rax, rax
je 0x140073012
mov eax, 1
jmp 0x14007307e
cmp word [rsi], 0
je 0x140073034
movups xmm0, xmmword [rsi + 4]
mov eax, dword [rsi + 0x14]
mov r9d, dword [rsi + 0x18]
movzx ecx, word [rsi + 0x1c]
mov r8d, 0x1c
mov r10w, 0x17
jmp 0x140073049
mov eax, dword [rsi + 2]
movzx ecx, word [rsi + 6]
xorps xmm0, xmm0
mov r8d, 0x10
mov r10w, 2
rol cx, 8
mov word [rbp - 0x1c], r10w
mov word [rbp - 0x1a], cx
mov dword [rbp - 0x18], eax
movups xmmword [rbp - 0x14], xmm0
mov dword [rbp - 4], r9d
lea rax, [rbp - 0x1c]
mov rsi, rdx
mov rcx, rdx
mov rdx, rax
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140073086
xor eax, eax
mov rdx, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rdx, rdi
jmp 0x14007300b
mov rsi, rdx
call fcn.1400d7eb0
mov rdx, rsi
jmp 0x140072ffb
Function at 0x140075b2e
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movdqa xmmword [rsp + 0x50], xmm8
movdqa xmmword [rsp + 0x40], xmm7
movdqa xmmword [rsp + 0x30], xmm6
cmp qword [r8 + 0x18], 0
je 0x140075cab
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [r8 + 0x20]
mov rdx, qword [r8 + 0x28]
mov r8, rdi
mov r9, rsi
call fcn.140032d76
mov rcx, qword [rbx]
mov rbx, qword [rbx + 8]
mov r15, rbx
and r15, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm6, xmm0, 0
lea r12, [rcx - 0x30]
xor eax, eax
mov qword [rsp + 0x28], rax
pcmpeqd xmm7, xmm7
mov r13, rcx
movdqu xmm8, xmmword [rcx + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm6
pmovmskb ebp, xmm0
test bp, bp
je 0x140075c00
bsf eax, ebp
lea ecx, [rbp - 1]
and ecx, ebp
mov ebp, ecx
add rax, r15
and rax, rbx
neg rax
lea r14, [rax + rax*2]
shl r14, 4
cmp qword [r12 + r14 + 0x10], rsi
jne 0x140075bc0
lea rax, [r12 + r14]
mov rdx, qword [rax + 8]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140075bc0
jmp 0x140075c32
pcmpeqb xmm8, xmm7
pmovmskb eax, xmm8
test eax, eax
jne 0x140075cab
mov rcx, r13
mov rax, qword [rsp + 0x28]
add r15, rax
add r15, 0x10
add rax, 0x10
mov qword [rsp + 0x28], rax
and r15, rbx
jmp 0x140075baa
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov rbx, qword [r13 + r14 - 8]
test rbx, rbx
je 0x140075cab
mov esi, eax
mov r14, qword [r13 + r14 - 0x10]
shl rbx, 2
xor r15d, r15d
mov r12, qword [sym.imp.kernel32.dll_OpenProcess]
mov r13, qword [sym.imp.kernel32.dll_GetLastError]
mov rbp, qword [sym.imp.kernel32.dll_CloseHandle]
mov r8d, dword [r14 + r15]
cmp r8d, esi
je 0x140075ca2
mov ecx, 1
xor edx, edx
call r12
mov rdi, rax
inc rax
cmp rax, 2
jb 0x140075c9f
mov rcx, rdi
xor edx, edx
call qword [sym.imp.kernel32.dll_TerminateProcess]
test eax, eax
jne 0x140075c96
call r13
mov rcx, rdi
call rbp
test eax, eax
jne 0x140075ca2
call r13
add r15, 4
cmp rbx, r15
jne 0x140075c65
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140075ccc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe0
mov rbx, r9
mov rsi, rcx
test r8, r8
je 0x140075d2e
add r8, rdx
lea rax, [rsp + 0x70]
mov qword [rax], rdx
mov qword [rax + 8], r8
mov word [rax + 0x10], 0
mov dword [rax + 0x18], 1
lea r14, [rsp + 0x50]
mov rcx, r14
mov rdx, rax
call fcn.1400731dd
mov rdi, qword [r14 + 8]
cmp qword [r14], 0
je 0x140075d30
mov rcx, qword [0x1406a7220]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140075d30
xor edi, edi
mov bpl, byte [rsp + 0x130]
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140075d8c
mov rcx, qword [rbx + 8]
add rax, rcx
lea rdx, [rsp + 0x70]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea r14, [rsp + 0x50]
mov rcx, r14
call fcn.1400731dd
mov rbx, qword [r14 + 8]
cmp qword [r14], 0
je 0x140075d8e
mov rcx, qword [0x1406a7220]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x140075d8e
xor ebx, ebx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
xor eax, eax
mov qword [rsp + 0x60], rax
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xd0], rax
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
lea rax, [rsp + 0x50]
test bpl, bpl
je 0x140075e2b
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
jne 0x140075e75
jmp 0x140075e7d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
je 0x140075e7d
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov byte [rsi + 1], 1
xor eax, eax
jmp 0x140075e9e
call qword [sym.imp.kernel32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov al, 1
mov byte [rsi], al
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140078c1b
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x108
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x80], 0xfffffffffffffffe
mov qword [rbp + 0x58], rdx
mov rsi, rcx
mov byte [rbp + 0x7f], 1
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x140078d7c
mov byte [rbp + 0x7f], 1
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 3
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x140078d89
lea rax, [rbp + 0x40]
mov qword [rax], 0
mov byte [rbp + 0x7f], 1
mov qword [rsp + 0x20], rax
lea rcx, [0x14061ea0c]
lea r9, [0x14061e888]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140078d96
mov r12, qword [rbp + 0x40]
mov r14b, 1
test r12, r12
je 0x140078de4
mov qword [rbp + 0x68], r12
lea rdx, [0x14061ea1c]
lea rcx, [rbp + 0x40]
mov r8d, 0x1f
call fcn.140073d90
lea rdi, [rbp + 0x40]
mov rcx, rdi
call fcn.1400acc0c
xor r8d, r8d
mov qword [rbp + 0x40], r8
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x18]
mov qword [rsp + 0x40], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], r8
mov dword [rsp + 0x28], 0
mov qword [rbp + 0x70], rax
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call r10
test eax, eax
js 0x140078de8
mov rax, qword [rbp + 0x40]
xor ebx, ebx
mov qword [rbp + 0x60], rax
test rax, rax
setne dil
je 0x140078df7
xor ebx, ebx
mov rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x140078e06
call qword [sym.imp.oleaut32.dll_SysFreeString]
jmp 0x140078e06
mov byte [rbp + 0x7f], 1
mov ecx, eax
call fcn.1400ab759
jmp 0x140078da1
mov byte [rbp + 0x7f], 1
mov ecx, eax
call fcn.1400ab759
jmp 0x140078da1
mov byte [rbp + 0x7f], 1
mov ecx, eax
call fcn.1400ab759
mov r12, rax
mov ebx, edx
mov r14b, 1
xor ebx, ebx
jmp 0x140078da9
mov ecx, eax
call fcn.1400ab759
mov qword [rbp + 0x60], rax
mov ebx, edx
xor edi, edi
mov rcx, qword [rbp + 0x70]
test rcx, rcx
je 0x140078e06
call qword [sym.imp.oleaut32.dll_SysFreeString]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov byte [rbp + 0x7f], 1
call rax
test dil, dil
je 0x140078f4b
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov rcx, qword [rbp + 0x60]
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140078f54
mov qword [rbp + 0x28], 0
mov byte [rbp + 0x7e], 1
lea rdx, str.9B7__
lea rcx, [rbp + 0x40]
mov r8d, 0x11
call fcn.140073d90
mov byte [rbp + 0x7e], 1
lea rcx, [rbp + 0x40]
call fcn.1400acc0c
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rcx]
mov r10, qword [rdx + 0x30]
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov qword [rbp + 0x68], rax
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
xor ecx, ecx
mov r12, qword [rbp + 0x60]
mov ecx, eax
call fcn.1400ab759
mov r12, rax
mov ebx, edx
jmp 0x140078f90
Function at 0x1400796b9
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rsi, rcx
lea rdx, [0x14061eaad]
lea rcx, [rbp - 0x48]
mov r8d, 0x28
call fcn.140073d90
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x38]
add rax, rcx
lea rdi, [rbp - 0x18]
mov qword [rbp + 0x18], rcx
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov word [rdi + 0x10], 0
mov dword [rdi + 0x18], 1
lea rcx, [rbp - 0x30]
mov rdx, rdi
call fcn.1400acc95
cmp qword [rbp - 0x48], 0
je 0x140079742
mov rcx, qword [0x1406a7220]
xor edx, edx
mov r8, qword [rbp + 0x18]
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rbp - 0x18], 0
mov rdx, qword [rbp - 0x28]
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
mov qword [rbp + 8], rdx
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140079779
mov rax, qword [rbp - 0x18]
jmp 0x140079784
mov rax, rdi
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x18], rax
cmp qword [rbp - 0x30], 0
je 0x1400797a2
mov rcx, qword [0x1406a7220]
xor edx, edx
mov r8, qword [rbp + 8]
call qword [sym.imp.kernel32.dll_HeapFree]
test edi, edi
je 0x1400797b6
mov rax, qword [rbp + 0x18]
mov qword [rsi + 8], rax
mov byte [rsi], 1
jmp 0x14007999d
lea rax, str.Startt
lea rdx, [rbp - 0x18]
mov qword [rdx], rax
lea rax, [0x14061eada]
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
mov dword [rdx + 0x18], 1
lea rcx, [rbp - 0x30]
call fcn.1400acc95
mov qword [rbp + 8], rsi
mov dword [rbp + 0x14], 0x800
mov dword [rbp - 0x48], 0
mov al, byte [0x1406a72b1]
mov edx, 0x800
xor ecx, ecx
call fcn.14006ef50
test rax, rax
je 0x1400799be
mov r15, rax
lea rax, [rbp - 0x18]
mov qword [rax], 0x800
mov qword [rax + 8], r15
mov qword [rax + 0x10], 0
mov r14, qword [rbp - 0x28]
lea rsi, [rbp + 0x14]
lea r12, [rbp - 0x48]
mov rbx, qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov r13, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
mov qword [rbp - 0x50], rax
sub r13, rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov rcx, qword [rbp + 0x18]
mov rdx, r14
xor r8d, r8d
mov r9, r12
call rbx
mov edi, eax
cmp eax, 0xea
jne 0x14007988c
mov r8d, dword [rbp + 0x14]
cmp r13, r8
jae 0x14007984e
lea rcx, [rbp - 0x18]
mov rdx, qword [rbp - 0x50]
call fcn.1400d6c55
mov r15, qword [rbp - 0x10]
jmp 0x14007983f
movabs r14, 0x8000000000000000
test edi, edi
jne 0x1400798b9
mov eax, dword [rbp + 0x14]
mov qword [rbp - 8], rax
mov esi, dword [rbp - 0x48]
mov rbx, qword [rbp - 0x18]
cmp esi, 0xb
jbe 0x1400798e2
movabs rdi, 0xde00000002
jmp 0x1400798c5
shl rdi, 0x20
or rdi, 2
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x1400798dd
mov r8, qword [rbp - 0x10]
mov rcx, qword [0x1406a7220]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, r14
mov rdi, qword [rbp - 0x10]
cmp eax, 4
sete r15b
mov ecx, 1
mov edx, 0x800
call fcn.1400d60e0
ud2
Function at 0x14008cc60
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
movabs rdx, 0xaaaaaaaaaaaaaaab
mov rax, r8
mul rdx
mov rax, r8
shr rax, 0x3e
cmp eax, 2
ja 0x14008d35f
mov rdi, r8
shr rdx, 1
lea rax, [rdx + rdx*2]
mov r15, r8
sub r15, rax
shl rdx, 2
test r15, r15
je 0x14008ccc9
add rdx, 4
jb 0x14008d35f
mov qword [rbp - 0x10], rcx
lea r14, [rbp - 0x28]
mov rcx, r14
call fcn.140034437
mov r8, qword [r14 + 8]
mov rdx, qword [r14 + 0x10]
xor ecx, ecx
mov r10, rdi
mov eax, 0
sub r10, 0x1a
cmovb r10, rcx
jbe 0x14008cfc2
mov r9d, 0x20
xor eax, eax
lea r11, [0x140643960]
lea rcx, str.integer_overflow_when_calculating_buffer_sizeC:UsersDevelopUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_base64_0.21.7_srcenginemod.rs
lea r8, [0x140642aa0]
mov edx, 0x2d
call fcn.1400d6640
Function at 0x1400ad880
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1400ad9a0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1400ad8e0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1400ad8e0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1400ad8e0
Function at 0x1400ae6bd
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
xchg rcx, rdx
test rcx, rcx
je 0x1400ae831
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [r8]
movdqa xmm8, xmmword [0x14065d8e0]
sub rsi, rdi
call fcn.1400ae840
movdqa xmm6, xmm0
pshufb xmm6, xmmword [0x14065d8d0]
test rcx, 1
je 0x1400ae77a
movdqu xmm7, xmmword [rdi]
call fcn.1400adec0
pxor xmm0, xmm7
paddd xmm6, xmm8
movdqu xmmword [rsi + rdi], xmm0
sub rcx, 1
lea rdi, [rdi + 0x10]
je 0x1400ae7e6
movdqa xmm14, xmm6
movdqa xmm15, xmm6
paddd xmm15, xmm8
movdqa xmm1, xmmword [0x14065d8d0]
movdqa xmm0, xmm14
movdqa xmm6, xmm15
pshufb xmm0, xmm1
pshufb xmm6, xmm1
call fcn.1400ae020
movdqu xmm1, xmmword [rdi]
movdqu xmm2, xmmword [rdi + 0x10]
movdqa xmm3, xmmword [0x14065d8f0]
pxor xmm0, xmm1
pxor xmm6, xmm2
paddd xmm14, xmm3
paddd xmm15, xmm3
movdqu xmmword [rsi + rdi], xmm0
movdqu xmmword [rsi + rdi + 0x10], xmm6
sub rcx, 2
lea rdi, [rdi + 0x20]
jne 0x1400ae789
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret

Function at 0x1400aeb90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1400aeb90
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret
Function at 0x1400aec9a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400aec70
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret