joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065d00
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov rsi, rcx
mov eax, dword [0x1400c5418]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1400c541c], 0xa
setl cl
or cl, al
nop dword [rax]
mov eax, 0x20
call fcn.14008c4b0
sub rsp, rax
mov rdi, rsp
mov eax, reloc.WS2_32.dll_recv
call fcn.14008c4b0
sub rsp, rax
mov r15, rsp
test cl, cl
je 0x140065d30
mov al, 1
cmp qword [rsi + 0x68], 0
je 0x140065f04
cmp byte [rsi + 0x71], 0
je 0x140065f04
nop dword [rax + rax]
mov rax, qword [rsi]
sub rsp, 0x20
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
add rsp, 0x20
cmp dword [0x1400c541c], 0xa
jl 0x140065db8
mov ecx, dword [0x1400c5418]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140065db8
mov rax, qword [rsi]
sub rsp, 0x20
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
add rsp, 0x20
jmp 0x140065d70
cmp eax, 0xffffffff
je 0x140065f02
lea rbx, [rdi + 0x20]
lea r14, [rsi + 0x74]
nop dword [rax]
mov rcx, qword [rsi + 0x68]
mov rax, qword [rcx]
sub rsp, 0x30
mov qword [rsp + 0x20], r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call qword [rax + 0x40]
add rsp, 0x30
cmp dword [0x1400c541c], 0xa
jl 0x140065e2c
mov ecx, dword [0x1400c5418]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140065e2c
mov rcx, qword [rsi + 0x68]
mov rax, qword [rcx]
sub rsp, 0x30
mov qword [rsp + 0x20], r15
mov rdx, r14
mov r8, rdi
mov r9, rbx
call qword [rax + 0x40]
add rsp, 0x30
jmp 0x140065dd0
cmp eax, 3
je 0x140065f11
cmp eax, 1
je 0x140065e46
test eax, eax
jne 0x140065f02
mov byte [rsi + 0x71], 0
mov rbx, qword [r15]
sub rbx, rdi
je 0x140065ef9
mov r9, qword [rsi + 0x80]
sub rsp, 0x20
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rsp, 0x20
cmp dword [0x1400c541c], 0xa
jl 0x140065ef4
mov ecx, dword [0x1400c5418]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140065ef4
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
nop word cs:[rax + rax]
mov r9, qword [rsi + 0x80]
sub rsp, 0x20
mov edx, 1
mov rcx, rdi
mov r8, rbx
call r14
add rsp, 0x20
mov r9, qword [rsi + 0x80]
sub rsp, 0x20
mov edx, 1
mov rcx, rdi
mov r8, rbx
call r14
add rsp, 0x20
cmp dword [0x1400c541c], 0xa
jl 0x140065ef4
mov ecx, dword [0x1400c5418]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
jne 0x140065ea0
cmp rbx, rax
jne 0x140065f02
cmp byte [rsi + 0x71], 0
sete al
jmp 0x140065f04
xor eax, eax
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov byte [rsi + 0x71], 0
mov al, 1
jmp 0x140065f04
Function at 0x140076120
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
sub r9, rdx
je 0x140076147
mov rax, rdx
not rax
add rax, r8
mov ecx, r9d
and ecx, 3
cmp rax, 3
jae 0x14007614d
mov eax, 0x84222325
xor r8d, r8d
jmp 0x1400761a8
mov eax, 0x84222325
ret
and r9, 0xfffffffffffffffc
mov eax, 0x84222325
xor r8d, r8d
nop dword [rax]
movzx r10d, byte [rdx + r8]
xor r10d, eax
imul eax, r10d, 0x1b3
movzx r10d, byte [rdx + r8 + 1]
xor r10d, eax
imul eax, r10d, 0x1b3
movzx r10d, byte [rdx + r8 + 2]
xor r10d, eax
imul eax, r10d, 0x1b3
movzx r10d, byte [rdx + r8 + 3]
xor r10d, eax
imul eax, r10d, 0x1b3
add r8, 4
cmp r9, r8
jne 0x140076160
test rcx, rcx
je 0x1400761d7
add rdx, r8
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, byte [rdx + r8]
xor r9d, eax
imul eax, r9d, 0x1b3
inc r8
cmp rcx, r8
jne 0x1400761c0
ret
Function at 0x140089740
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x28
mov r12d, r9d
mov r15, r8
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x14008991b
test rdx, rdx
je 0x14008991b
movabs rax, 0x7fffffffffffffff
cmp r8, rax
ja 0x14008991b
cmp dword [rcx], 0
mov qword [rsp + 0x20], r14
mov r14, qword [rsp + 0x70]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
jne 0x1400897af
mov r8, r14
mov edx, 0x100
call fcn.140089aa0
test al, al
je 0x140089840
movzx eax, byte [rsi]
mov rcx, rsi
mov edi, 0x1505
test al, al
je 0x1400897d5
nop
imul rdi, rdi, 0x21
movzx eax, al
lea rcx, [rcx + 1]
add rdi, rax
movzx eax, byte [rcx]
test al, al
jne 0x1400897c0
xor edx, edx
mov eax, edi
div dword [rbp]
mov rax, qword [rbp + 0x10]
mov r13d, edx
mov rbx, qword [rax + rdx*8]
test rbx, rbx
je 0x140089820
nop dword [rax]
cmp dword [rbx + 0x20], edi
jne 0x140089817
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140089813
inc rax
test ecx, ecx
jne 0x140089800
test edx, edx
je 0x140089861
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x1400897f0
mov ecx, 0x28
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbx, rax
test rax, rax
jne 0x140089882
xor r8d, r8d
lea edx, [rax + 0xe]
mov rcx, r14
call fcn.140085940
xor al, al
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
test r12b, 8
je 0x14008986e
cmp qword [rbx + 8], 0xffffffffffffffff
jne 0x140089879
cmp qword [rbx + 0x10], 0xffffffffffffffff
je 0x140089906
xor r8d, r8d
lea edx, [r8 + 0xa]
jmp 0x140089838
mov qword [rax], rsi
xorps xmm1, xmm1
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + r13*8]
mov qword [rbx + 0x18], rcx
mov rax, qword [rbp + 0x10]
mov qword [rax + r13*8], rbx
mov dword [rbx + 0x20], edi
mov qword [rbx + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rcx, qword [rbp + 8]
mov edx, dword [rbp]
test rcx, rcx
js 0x1400898be
cvtsi2sd xmm1, rcx
jmp 0x1400898d3
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x1400a9e50]
comisd xmm1, xmm0
jbe 0x140089906
cmp edx, 0x80000000
jae 0x140089906
add edx, edx
mov r8, r14
mov rcx, rbp
call fcn.140089aa0
test al, al
je 0x140089840
test r12b, 8
je 0x140089910
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x140089842
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
lea edx, [r8 + 0x12]
call fcn.140085940
xor al, al
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
Function at 0x14008d1ec
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14008d226
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14008d22b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14008d274
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400a9e90]
cmp byte [rcx + rax], 0
je 0x14008d274
dec r8
sub rdx, 1
jne 0x14008d25a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14009118c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400911d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400911d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400911d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400911d6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400911d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400911d8
xor al, al
add rsp, 0x28
ret

Function at 0x140092440
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x14009257e
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x48], rdi
mov rbp, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
test rdx, rdx
je 0x140092502
mov qword [rsp + 0x40], rsi
sub r15, rdx
nop dword [rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x58]
movzx esi, byte [r14 + r15]
not ecx
movzx edi, word [rbx + 8]
mov r8d, 1
or di, 2
mov byte [rsp + 0x58], sil
call fcn.14008d500
not eax
lea rdx, [rsp + 0x58]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x58], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.14008d500
not eax
lea r14, [r14 + 1]
mov dword [rbx + 8], eax
movzx eax, di
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, sil
mov byte [r14 - 1], cl
sub rbp, 1
jne 0x140092480
mov rsi, qword [rsp + 0x40]
jmp 0x14009256b
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x58]
movzx eax, byte [r15 + rdi]
not ecx
mov r8d, 1
mov byte [rsp + 0x58], al
call fcn.14008d500
not eax
lea rdx, [rsp + 0x58]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x58], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.14008d500
inc rdi
not eax
mov dword [rbx + 8], eax
cmp rdi, rbp
jb 0x140092510
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
Function at 0x140092580
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x14009269e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r9
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x140092622
sub rsi, rdx
movzx eax, word [rbx + 8]
lea rdx, [rsp + 0x48]
or eax, 2
mov r8d, 1
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, byte [rdi + rsi]
mov byte [rdi], cl
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx]
not ecx
call fcn.14008d500
not eax
lea rdx, [rsp + 0x48]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.14008d500
lea rdi, [rdi + 1]
not eax
mov dword [rbx + 8], eax
sub rbp, 1
jne 0x1400925b1
jmp 0x14009268a
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx]
lea rdx, [rsp + 0x48]
movzx eax, byte [rsi + rdi]
not ecx
mov r8d, 1
mov byte [rsp + 0x48], al
call fcn.14008d500
not eax
lea rdx, [rsp + 0x48]
mov dword [rbx], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbx + 4]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 4], ecx
shr ecx, 0x18
mov byte [rsp + 0x48], cl
mov ecx, dword [rbx + 8]
not ecx
call fcn.14008d500
inc rdi
not eax
mov dword [rbx + 8], eax
cmp rdi, rbp
jb 0x140092630
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400926c0
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x28
movzx r8d, dx
mov r9d, 2
mov rdx, rcx
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
shr eax, 0x1f
xor al, 1
add rsp, 0x28
ret

Function at 0x1400928e0
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
sub rsp, 0x58
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x60]
xor r9d, r9d
mov dword [rsp + 0x48], r9d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], r8
lea r8d, [r9 + 0x10]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r9
call sub.bcrypt.dll_BCryptEncrypt
shr eax, 0x1f
xor al, 1
add rsp, 0x58
ret

Function at 0x140092c20
Capabilities:
Hash data via bcrypt

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140092c49
mov eax, 0xffffffff
cmp r8, rax
ja 0x140092c49
mov rcx, qword [rcx + 8]
xor r9d, r9d
call sub.bcrypt.dll_BCryptHashData
shr eax, 0x1f
xor al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1400938e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.1400938d0
mov ecx, 2
mov rbx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
lea rdx, str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to:_bzip2_devel_sourceware.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks._n_n
mov r9, rbx
mov r8d, edi
call fcn.140093040
cmp edi, 0x3ef
jne 0x140093934
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
lea rdx, str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
call fcn.140093040
mov ecx, 3
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
Function at 0x1400939c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x60]
movzx r8d, byte [rcx + 0x5c]
test eax, eax
jle 0x1400939fc
mov edx, dword [rcx + 0x288]
lea r11, [0x1400c2ee0]
mov r9d, eax
nop dword [rax]
mov eax, edx
shr rax, 0x18
xor rax, r8
shl edx, 8
xor edx, dword [r11 + rax*4]
mov dword [rcx + 0x288], edx
sub r9, 1
jne 0x1400939e0
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r9, dword [rcx + 0x60]
mov edx, r9d
sub edx, 1
je 0x140093ade
sub edx, 1
je 0x140093ad0
cmp edx, 1
je 0x140093a90
mov byte [r9 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
jmp 0x140093aaf
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
inc dword [rcx + 0x6c]
ret
Function at 0x1400a2ea0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov r10, qword [rcx + 0x40]
mov qword [rax + 0x10], rbx
mov rbx, qword [rcx + 0x38]
mov qword [rax + 0x18], rbp
mov ebp, dword [rcx + 0x290]
mov qword [rax + 0x20], rsi
mov esi, dword [rcx + 0x6c]
mov qword [rax - 8], rdi
mov rdi, rcx
mov qword [rax - 0x18], r15
mov r15, qword [rcx + 0x28]
mov ecx, dword [rcx + 0x58]
cmp esi, 0x2710
jl 0x1400a2fc1
mov qword [rax - 0x10], r14
mov eax, esi
and eax, 1
add eax, 0x22
add eax, esi
movsxd r8, eax
add r8, r10
cmp ecx, 1
jge 0x1400a2f02
mov ecx, 1
jmp 0x1400a2f0c
mov eax, 0x64
cmp ecx, eax
cmovg ecx, eax
dec ecx
mov eax, 0x55555556
imul ecx
lea rax, [rsp + 0x70]
mov r9, r15
mov r14d, edx
mov qword [rsp + 0x30], rax
shr r14d, 0x1f
mov rcx, rbx
add r14d, edx
mov dword [rsp + 0x28], ebp
imul r14d, esi
mov rdx, r10
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x70], r14d
call fcn.1400a4770
cmp ebp, 3
jl 0x1400a2f97
sub r14d, dword [rsp + 0x70]
mov ecx, 2
movd xmm0, esi
cvtdq2ps xmm0, xmm0
movd xmm1, r14d
cvtdq2ps xmm1, xmm1
movaps xmmword [rsp + 0x40], xmm6
divss xmm1, xmm0
cvtps2pd xmm6, xmm1
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov r9d, esi
lea rdx, str._______d_work___d_block__ratio__5.2f_n
mov r8d, r14d
movsd qword [rsp + 0x20], xmm6
call fcn.140093040
movaps xmm6, xmmword [rsp + 0x40]
cmp dword [rsp + 0x70], 0
mov r14, qword [rsp + 0x58]
jge 0x1400a2fd8
cmp ebp, 2
jl 0x1400a2fc1
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
lea rdx, str.____too_repetitive__using_fallback_sorting_algorithm_n
call fcn.140093040
mov rdx, qword [rdi + 0x20]
mov r9d, esi
mov rcx, qword [rdi + 0x18]
mov r8, r15
mov dword [rsp + 0x20], ebp
call fcn.1400a33e0
mov ecx, dword [rdi + 0x6c]
xor eax, eax
mov r15, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov dword [rdi + 0x30], 0xffffffff
test ecx, ecx
jle 0x1400a3014
nop dword [rax]
cmp dword [rbx], 0
je 0x1400a3011
inc eax
add rbx, 4
cmp eax, ecx
jl 0x1400a3000
jmp 0x1400a3014
mov dword [rdi + 0x30], eax
cmp dword [rdi + 0x30], 0xffffffff
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x78]
jne 0x1400a3032
mov ecx, 0x3eb
add rsp, 0x68
jmp fcn.1400938e0
add rsp, 0x68
ret
Function at 0x140001540
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12, r9
mov r13, r8
mov rbx, rdx
mov r14, rcx
call fcn.14000ddf0
xor edi, edi
lea r8d, [rdi + 5]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x140001659
mov r8d, 0xf0
mov rdx, rbx
mov rcx, r14
mov qword [rsp + 0x68], r15
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15d, edi
test rax, rax
je 0x1400015b7
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x60], rbp
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14000163b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x14000163b
mov rdx, r15
mov rcx, rax
call fcn.14000c420
mov r9, r12
mov r8, r13
mov rsi, rax
mov rax, qword [rsp + 0x80]
mov rcx, r14
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov rdi, rax
test rax, rax
jne 0x14000161d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rsi, rbp
je 0x140001643
test rsi, rsi
je 0x140001643
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x140001643
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r15, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
test ebx, ebx
je 0x140001659
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400063a0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1400063ce
mov r8, rdx
mov rdx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14000aae0
cmp byte [0x14003af10], 0
jne 0x140006419
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006409
lea rdx, [0x140028238]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x14003af10], 1
mov qword [0x14003af08], rax
jmp 0x140006420
mov rax, qword [0x14003af08]
mov byte [0x14003af10], 1
jmp 0x140006420
mov rax, qword [0x14003af08]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14000643f
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000ab54
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x14000ab6f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x14000ab6f
mov rcx, qword [rbx]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rcx + 8], 0
je case.default.0x14000ab6f
mov rdx, r8
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret
fdivp st(7)
invalid
Function at 0x14000a630
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400382d0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor eax, eax
xor ebp, ebp
mov rsi, rdx
mov r8, rdx
mov rdx, qword [rcx]
mov rdi, rcx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
or r9d, 0x2001f
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x50], rbp
call fcn.1400092f0
mov ebx, eax
test eax, eax
jne 0x14000a757
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14000a731
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.14000a630
mov ebx, eax
test eax, eax
jne 0x14000a757
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000a6e0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000a746
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov rcx, rdi
mov dword [rsp + 0x48], ebp
call fcn.1400063a0
mov ebx, eax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000a767
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140013750
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret