joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f3780
Capabilities:
Hash data via bcrypt

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov esi, r8d
mov edi, r9d
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1800c1aa0
nop
mov rdx, qword [rbx]
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x68], rdx
mov r8d, esi
mov dword [rbp - 0x54], r8d
mov r9d, edi
mov dword [rbp - 0x58], r9d
lea rcx, [rbp - 0x90]
call fcn.1800064d0
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x68]
mov r8d, dword [rbp - 0x54]
mov r9d, dword [rbp - 0x58]
call sub.bcrypt.dll_BCryptHashData
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.180006520
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1800f3833
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1800c1ae0
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x180113720
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x28
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x18011375c
lea r10, [rdx + rax*8 + 0x10]
mov r10, qword [r10]
test r10, r10
jne 0x180113741
xor r9d, r9d
jmp 0x180113745
mov r9d, dword [r10 + 0x14]
mov r10d, ecx
rol r10d, 0xd
add r10d, ecx
mov ecx, r10d
xor ecx, r9d
inc eax
cmp r8d, eax
jg 0x18011372f
mov eax, ecx
rol eax, 0xf
add eax, ecx
add rsp, 0x28
ret

Function at 0x1801254c0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
mov esi, edx
xor edi, edi
mov ebp, dword [rbx + 8]
test ebp, ebp
jle 0x1801254f2
mov rcx, qword [rbx + rdi*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ecx, esi
rol ecx, 0xd
add ecx, esi
mov esi, eax
xor esi, ecx
inc edi
cmp ebp, edi
jg 0x1801254d6
mov eax, esi
rol eax, 0xf
add eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x14006718c
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rbx, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
je 0x1400671d4
lea edi, [rsi + 0xd]
jmp 0x14006728f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xea
jne 0x14006728f
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
mov r8, qword [rbp - 0x18]
mov rcx, r8
mov rdi, qword [rbp - 0x20]
sub rcx, rdi
sar rcx, 1
cmp rdx, rcx
jae 0x140067214
lea rax, [rdi + rdx*2]
mov qword [rbp - 0x18], rax
jmp 0x140067255
jbe 0x140067255
mov rax, qword [rbp - 0x10]
sub rax, rdi
sar rax, 1
cmp rdx, rax
jbe 0x140067238
lea r8, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.140043124
mov rdi, qword [rbp - 0x20]
jmp 0x140067255
sub rdx, rcx
je 0x140067251
movzx eax, si
mov rdi, r8
mov rcx, rdx
rep stosw word [rdi], ax
lea r8, [r8 + rdx*2]
mov rdi, qword [rbp - 0x20]
mov qword [rbp - 0x18], r8
lea r8, [rbp + 0x30]
mov rdx, rdi
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
nop dword [rax + rax]
test eax, eax
jne 0x140067281
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
jmp 0x14006728f
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.140004374
mov edi, esi
lea rcx, [rbp - 0x20]
call fcn.140020b54
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140067cf0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400b4480], eax
call fcn.140068190
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400b4480], 0
jne case.default.0x140067d46
mov ecx, 1
call fcn.140068190
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
xchg byte [rdi + 0x74f71aef], ch
mov ecx, 0xbd38b7f7
jg 0x140122115
sti
push 0x661e0828
test dword [rdi - 0x2be946d7], 0xffc88e49
fcmovu st(0), st(7)
out dx, eax
sub eax, 0xa48baaed
mov esi, 0xdaab0528
jno 0x140122165
mov bl, 0xfc
scasb al, byte [rdi]
in al, dx
sub al, 0x23
test dword [rdx + 0x14dfff5b], 0x83cd2247
cli
push qword [rsi - 0x42b4018a]
stosd dword [rdi], eax
invalid
mov bh, 0x76
and eax, 0x10d8a67c
cmp al, 0xea
int1
mov dl, 0x3c
mov ch, 0x67
sar ch, cl
out dx, al
invalid
out dx, eax
retf 0xc052
Function at 0x140001200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rdi, rcx
mov byte [rcx], 0
mov byte [rcx + 4], 1
mov dword [rcx + 8], 0x2d
mov dword [rcx + 0xc], 1
add rcx, 0x10
mov dword [rsp + 0x20], 0xff
mov r9d, 0xc8
xor r8d, r8d
lea edx, [r9 + 0x37]
call fcn.14000b470
mov qword [rdi + 0x14], 1
xor r12d, r12d
mov ecx, 0x3f800000
call fcn.14002fc50
movss dword [rdi + 0x1c], xmm0
mov byte [rdi + 0x20], r12b
lea r14, [rdi + 0x28]
mov qword [rsp + 0x90], r14
movabs rax, 0xca3685b5f0b47f85
mov qword [rsp + 0x40], rax
movabs rcx, 0xe709dcd4652d0632
mov qword [rsp + 0x48], rcx
movabs rax, 0xca36e2dc96da10e6
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
mov dword [r14], r12d
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
lea rbx, [rsp + 0x30]
movq rax, xmm0
test al, al
je 0x1400012e8
nop dword [rax]
inc rbx
cmp byte [rbx], 0
jne 0x1400012e0
lea rax, [rsp + 0x30]
sub rbx, rax
mov dword [rsp + 0x40], r12d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
lea rdx, [rbx + 1]
test rdx, rdx
je 0x140001320
lea rcx, [rsp + 0x48]
call fcn.140002010
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rbp, rax
mov dword [rsp + 0x40], ebp
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
sub r8, rsi
xor edx, edx
mov rcx, rsi
call fcn.14007c690
mov r8d, r12d
test rbx, rbx
je 0x140001373
mov r9, r12
movzx eax, r8b
add al, al
lea edx, [rax + r8]
add dl, bpl
xor dl, byte [rsp + r9 + 0x30]
mov byte [r9 + rsi], dl
inc r8d
movsxd r9, r8d
cmp r9, rbx
jb 0x140001352
lea rdx, [rsp + 0x48]
lea rcx, [r14 + 8]
call fcn.140001f70
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400013bc
mov rax, qword [rsp + 0x58]
sub rax, rcx
mov rdx, rcx
cmp rax, 0x1000
jb 0x1400013b6
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14000141a
call fcn.14000d9d0
nop
mov dword [rdi + 0x48], r12d
mov qword [rdi + 0x50], r12
mov qword [rdi + 0x58], r12
mov qword [rdi + 0x60], r12
mov qword [rdi + 0x70], r12
mov qword [rdi + 0x68], r12
mov qword [rdi + 0x80], r12
mov qword [rdi + 0x88], r12
mov qword [rdi + 0x90], r12
mov qword [rdi + 0x98], r12
mov qword [rdi + 0xa0], r12
mov qword [rdi + 0xa8], r12
mov rax, rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400804f4
nop
Function at 0x14000b8d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov rbp, rcx
mov rdi, qword [rcx + 0x10]
sub rdi, qword [rcx + 8]
je 0x14000b9cc
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x14000ba0d
cmp rdi, 0x1000
jb 0x14000b943
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14000ba13
call fcn.14000d720
test rax, rax
je 0x14000ba07
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000b94e
mov rcx, rdi
call fcn.14000d720
mov rsi, rax
lea r14, [rsi + rdi]
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.14007c690
mov r8, r14
sub r8, rsi
xor edx, edx
mov rcx, rsi
call fcn.14007c690
xor r8d, r8d
mov rax, qword [rbp + 0x10]
sub rax, qword [rbp + 8]
cmp rax, 1
je 0x14000b9bf
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbp + 8]
movzx eax, r8b
add al, al
lea ecx, [rax + r8]
add cl, byte [rbp]
xor cl, byte [rdx + r9]
mov byte [r9 + rsi], cl
inc r8d
mov rax, qword [rbp + 0x10]
sub rax, qword [rbp + 8]
movsxd r9, r8d
dec rax
cmp r9, rax
jb 0x14000b990
mov qword [rbx], rsi
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
jmp 0x14000b9e9
mov ecx, 1
call fcn.14000d720
lea rcx, [rax + 1]
xor edx, edx
mov byte [rax], dl
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rcx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.1400804f4
int3
call fcn.140001ed0
int3
call fcn.140001160
int3
Function at 0x14001baa0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rax - 0x228]
sub rsp, 0x310
xor r14d, r14d
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov ecx, 0x7f7fffff
mov qword [rsp + 0x30], r14
xorps xmm7, xmm7
mov qword [rsp + 0x38], r14
movaps xmm6, xmm2
mov dword [rsp + 0x40], r14d
mov rsi, rdx
mov byte [rsp + 0x60], r14b
mov dword [rsp + 0x64], r14d
call fcn.14002fc50
mov ecx, 0x3f800000
movss dword [rsp + 0x68], xmm0
mov byte [rsp + 0x6c], r14b
mov dword [rsp + 0x70], r14d
call fcn.14002fc50
mov ecx, 0x3f733333
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x4c], 1
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x48], 1
call fcn.14002fc50
movss dword [rsp + 0x74], xmm0
lea rcx, [rbp - 0x20]
movabs rax, 0x64bf0d6af4060637
xor edx, edx
mov qword [rbp - 0x80], rax
mov r8d, 0x200
movabs rax, 0x4375b0d3ecff3ed0
mov qword [rbp - 0x78], rax
movabs rax, 0x64d10d05f440066b
movdqa xmm0, xmmword [rbp - 0x80]
mov qword [rsp + 0x20], rax
movabs rax, 0x4375b08fec8c3ea4
mov qword [rsp + 0x28], rax
pxor xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.14007c690
lea rax, [rbp - 0x20]
mov rbx, 0xffffffffffffffff
mov qword [rbp + 0x1e0], rax
mov edx, 0x7ffe0030
mov rdi, rbx
inc rdi
cmp word [rdx + rdi*2], r14w
jne 0x14001bbb2
add rdi, rdi
lea rcx, [rbp - 0x20]
mov r8, rdi
call fcn.14007bfe0
mov rcx, qword [rbp + 0x1e0]
lea rax, [rsp + 0x20]
add rcx, rdi
mov rdi, rbx
mov qword [rbp + 0x1e0], rcx
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x14001bbe4
add rdi, rdi
lea rdx, [rsp + 0x20]
mov r8, rdi
call fcn.14007bfe0
mov rcx, qword [rbp + 0x1e0]
add rcx, rdi
mov qword [rbp + 0x1e0], rcx
nop
inc rbx
cmp word [rsi + rbx*2], r14w
jne 0x14001bc10
add rbx, rbx
mov rdx, rsi
mov r8, rbx
call fcn.14007bfe0
add qword [rbp + 0x1e0], rbx
lea r8, [rbp + 0x238]
mov r9b, 1
mov qword [rbp + 0x230], r14
lea rdx, [rbp + 0x230]
mov qword [rbp + 0x238], r14
lea rcx, [rbp - 0x20]
call fcn.14002d9d0
mov rdx, qword [rbp + 0x230]
test rdx, rdx
je 0x14001bcce
mov rcx, qword [rbp + 0x238]
test rcx, rcx
je 0x14001bcce
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
mov rax, qword [0x1401c0190]
movups xmmword [rbp - 0x70], xmm0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x60], xmm1
movups xmm1, xmmword [rsp + 0x70]
mov qword [rbp - 0x70], rdx
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x68], ecx
mov rcx, qword [rax + 0x40]
movups xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x40], r14b
movss dword [rbp - 0x60], xmm6
movups xmmword [rbp - 0x50], xmm7
movups xmmword [rbp - 0x30], xmm1
call fcn.140022020
mov rcx, qword [0x1401c0190]
cmp qword [rcx + 0x78], r14
jne 0x14001bcd1
mov qword [rcx + 0x78], rax
jmp 0x14001bcd1
mov rax, r14
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140022500
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov rdi, rcx
mov qword [rsp + 0x48], r14
movsxd r14, dword [rcx + 0x28]
mov ecx, dword [rcx + 0x2c]
mov qword [rsp + 0x40], r15
movzx r15d, dx
movaps xmmword [rsp + 0x30], xmm6
movaps xmm6, xmm3
lea esi, [r14 + 1]
movaps xmmword [rsp + 0x20], xmm7
movaps xmm7, xmm2
cmp esi, ecx
jle 0x1400225a1
test ecx, ecx
je 0x14002254f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140022554
mov eax, 8
cmp eax, esi
mov ebx, esi
cmovg ebx, eax
cmp ebx, ecx
jle 0x1400225a1
movsxd rax, ebx
imul rcx, rax, 0x2c
mov qword [rsp + 0x60], rbp
call fcn.14000d720
mov rdx, qword [rdi + 0x30]
mov rbp, rax
test rdx, rdx
je 0x140022595
movsxd rcx, dword [rdi + 0x28]
imul r8, rcx, 0x2c
mov rcx, rax
call fcn.14007bfe0
mov rcx, qword [rdi + 0x30]
call fcn.14000d9d0
mov qword [rdi + 0x30], rbp
mov rbp, qword [rsp + 0x60]
mov dword [rdi + 0x2c], ebx
movss xmm0, dword [rsp + 0x80]
movss xmm1, dword [rsp + 0x88]
mov dword [rdi + 0x28], esi
mov rsi, qword [rsp + 0x68]
imul rbx, r14, 0x2c
mov r14, qword [rsp + 0x48]
add rbx, qword [rdi + 0x30]
movss dword [rbx + 0x14], xmm0
movss xmm0, dword [rsp + 0x90]
movss dword [rbx + 0x18], xmm1
movss xmm1, dword [rsp + 0x98]
movss dword [rbx + 0x1c], xmm0
movss xmm0, dword [rsp + 0xa0]
movss dword [rbx + 0x20], xmm1
movss xmm1, dword [rsp + 0xa8]
movss dword [rbx + 0x24], xmm0
movss xmm0, dword [rsp + 0xb0]
movss dword [rbx + 0xc], xmm7
movaps xmm7, xmmword [rsp + 0x20]
movss dword [rbx + 0x10], xmm6
movaps xmm6, xmmword [rsp + 0x30]
mov word [rbx + 4], r15w
mov r15, qword [rsp + 0x40]
movss dword [rbx + 0x28], xmm1
mov rax, qword [rdi + 0x50]
addss xmm0, dword [rax + 0x20]
movss dword [rbx + 8], xmm0
mov rax, qword [rdi + 0x50]
cmp byte [rax + 0x1c], 0
je 0x140022668
mov ecx, 0x3f000000
call fcn.14002fc50
addss xmm0, dword [rbx + 8]
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 8], xmm0
mov byte [rdi + 0x64], 1
xor r8d, r8d
mov rdi, qword [rsp + 0x70]
nop dword [rax]
nop dword [rax + rax]
movzx eax, r8b
movsxd rdx, r8d
add al, al
lea ecx, [rax + r8]
inc r8d
add cl, byte [rbx]
xor byte [rdx + rbx + 4], cl
cmp r8d, 0x28
jb 0x140022680
add rsp, 0x50
pop rbx
ret
Function at 0x140037f30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor r14d, r14d
mov dword [rbp + 0x20], r14d
cmp qword [r8 + 0x18], 8
jb 0x140037f5f
mov r8, qword [r8]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor edx, edx
lea r9d, [rdx + 2]
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140037f90
mov dword [rbx], eax
mov byte [rbx + 0x20], r14b
jmp 0x140038117
mov edx, dword [rbp + 0x20]
shr rdx, 1
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r14w
mov r8d, 0x20
lea rcx, [rbp - 0x20]
call fcn.140052470
nop
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
cmp qword [rdi + 0x18], 8
jb 0x140037fd3
mov rdi, qword [rdi]
lea rcx, [rbp + 0x20]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 2
mov r8, rdi
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140038049
mov dword [rbx], eax
mov byte [rbx + 0x20], 0
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x140038117
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14003803e
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003812f
call fcn.14000d9d0
nop
jmp 0x140038117
mov ecx, dword [rbp + 0x20]
shr rcx, 1
dec rcx
mov r8, qword [rbp - 0x10]
cmp rcx, r8
ja 0x140038074
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
mov qword [rbp - 0x10], rcx
mov word [rax + rcx*2], r14w
jmp 0x1400380cf
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp - 8]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x1400380b8
mov qword [rbp - 0x10], rcx
lea r9, [rbp - 0x20]
cmp rdi, 8
cmovae r9, qword [rbp - 0x20]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x1400380ad
movzx eax, r14w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r14w
jmp 0x1400380cf
mov word [rsp + 0x20], r14w
mov r9, rdx
movzx r8d, byte [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.140056f90
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.14004fe50
mov byte [rbx + 0x20], 1
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x140038117
lea rax, [rax*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rdx, rcx
cmp rax, 0x1000
jb 0x140038111
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14003812f
call fcn.14000d9d0
nop
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1400804f4
int3
Function at 0x14003ae10
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rsi, rdx
movabs rax, 0x54582e3d00efae85
mov qword [rsp + 0x30], rax
movabs rax, 0xc4de4aa888f26952
mov qword [rsp + 0x38], rax
movabs rax, 0x54362e5200a9aed9
mov qword [rsp + 0x20], rax
movabs rax, 0xc4de4af488816926
mov qword [rsp + 0x28], rax
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x40]
call fcn.14007c690
lea rax, [rsp + 0x40]
mov qword [rbp + 0x140], rax
mov edx, 0x7ffe0030
mov rbx, 0xffffffffffffffff
mov rdi, rbx
nop
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x14003aeb0
add rdi, rdi
mov r8, rdi
lea rcx, [rsp + 0x40]
call fcn.14007bfe0
mov rcx, qword [rbp + 0x140]
add rcx, rdi
mov qword [rbp + 0x140], rcx
lea rax, [rsp + 0x20]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14003aee0
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.14007bfe0
mov rcx, qword [rbp + 0x140]
add rcx, rbx
mov qword [rbp + 0x140], rcx
mov rbx, qword [rsi + 0x10]
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14003af1c
mov rdx, qword [rsi]
add rbx, rbx
mov r8, rbx
call fcn.14007bfe0
add qword [rbp + 0x140], rbx
xor edi, edi
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x180], rdi
mov r9b, 1
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x40]
call fcn.14002d9d0
test al, al
je 0x14003af6a
mov rcx, qword [rbp + 0x170]
call fcn.14000d9d0
nop
cmp qword [rbp + 0x170], 0
setne bl
mov rax, qword [rsi + 0x18]
cmp rax, 8
jb 0x14003afac
mov rcx, qword [rsi]
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x14003afa6
mov rdx, qword [rcx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003afd1
mov rcx, rdx
call fcn.14000d9d0
nop
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
movzx eax, bl
mov rbx, qword [rsp + 0x288]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
call fcn.1400804f4
int3
Function at 0x140055d30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rsi, qword [0x1401c01b8]
xor edi, edi
cmp qword [rsi + 0x10], 0x80
jne 0x140055dc1
mov rbp, qword [rsi]
lea rax, [rbp + 1]
and eax, 0x7f
mov qword [rsi], rax
mov qword [rsi + 0x10], 0x7f
lea rbx, [rbp + 1]
shl rbx, 5
add rbx, rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140055dcb
mov rax, qword [rbx + 0x10]
sub rax, rcx
cmp rax, 0x1000
jb 0x140055dae
mov rdx, qword [rcx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140055efc
mov rcx, rdx
call fcn.14000d9d0
nop
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
jmp 0x140055dcb
mov rbp, qword [rsi + 8]
inc rbp
and ebp, 0x7f
mov rax, rbp
shl rax, 5
lea r15, [rsi + 0x18]
add r15, rax
mov qword [rsp + 0x90], r15
mov dword [r15], edi
mov qword [r15 + 8], rdi
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], rdi
mov rbx, r14
cmp byte [r14], 0
je 0x140055e08
nop dword [rax]
inc rbx
cmp byte [rbx], 0
jne 0x140055e00
sub rbx, r14
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rdi
lea rdx, [rbx + 1]
test rdx, rdx
je 0x140055e30
lea rcx, [rsp + 0x28]
call fcn.140002010
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x20], eax
mov r8, qword [rsp + 0x30]
mov r13, qword [rsp + 0x28]
sub r8, r13
xor edx, edx
mov rcx, r13
call fcn.14007c690
test rbx, rbx
je 0x140055e8d
mov r8, rdi
mov rcx, qword [rsp + 0x80]
nop dword [rax]
movzx eax, dil
add al, al
lea edx, [rax + rdi]
add dl, cl
xor dl, byte [r8 + r14]
mov byte [r8 + r13], dl
inc edi
movsxd r8, edi
cmp r8, rbx
jb 0x140055e70
lea rdx, [rsp + 0x28]
lea rcx, [r15 + 8]
call fcn.140001f70
mov eax, dword [rsp + 0x20]
mov dword [r15], eax
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140055ed6
mov rax, qword [rsp + 0x38]
sub rax, rcx
mov rdx, rcx
cmp rax, 0x1000
jb 0x140055ed0
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140055ef6
call fcn.14000d9d0
nop
mov qword [rsi + 8], rbp
inc qword [rsi + 0x10]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400804f4
nop
call fcn.1400804f4
int3
Function at 0x140065030
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
rdtsc
shl rdx, 0x20
lea r9, [0x1401bb9ec]
or rax, rdx
imul ecx, eax, 0xa69e7
imul eax, ecx, 0x42e194
mov dword [0x1401bb9e0], ecx
mov dword [0x1401bb9e4], eax
imul eax, ecx, 0x9b551bdc
xor r8d, r8d
mov dword [0x1401bb9e8], eax
nop word [rax + rax]
mov eax, r8d
lea r9, [r9 + 4]
mov ecx, r8d
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
and al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
and cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
and dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
and cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
and dl, 1
cmove eax, ecx
inc r8d
mov dword [r9 - 4], eax
cmp r8d, 0x100
jb 0x140065070
ret

Function at 0x140065120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov ebp, edx
mov rdi, rcx
shr ebp, 0xb
mov r11d, dword [0x1401bb9e8]
mov esi, dword [0x1401bb9e4]
mov ebx, dword [0x1401bb9e0]
nop
mov byte [rsp + 0x40], 0
xor r8d, r8d
lea r9, [rsp + 0x20]
nop dword [rax]
mov ecx, ebx
shl ecx, 0x10
xor ecx, ebx
mov eax, ecx
shr eax, 5
xor eax, ecx
lea ecx, [rax + rax]
xor ecx, eax
mov ebx, esi
mov esi, r11d
xor r11d, ebx
xor r11d, ecx
mov eax, 0xae4c415d
mul r11d
shr edx, 6
movsx eax, dl
imul ecx, eax, 0x5e
movzx eax, r11b
sub al, cl
add al, 0x20
mov byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x20
jb 0x140065160
mov dword [0x1401bb9e8], r11d
mov dword [0x1401bb9e0], ebx
mov dword [0x1401bb9e4], esi
lea rcx, [rsp + 0x20]
call fcn.140064da0
shr eax, 0xb
cmp ebp, eax
jne 0x140065150
mov qword [rdi], 0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400651f1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14002b8a0
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret