joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140081ef0
Capabilities:
Check internet connectivity via wininet

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x160
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov dword [r11 - 0x18], 0
xor edx, edx
lea rcx, [r11 - 0x18]
call qword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x140081f3f
test byte [rsp + 0x150], 7
je 0x140081f3f
mov al, 1
jmp 0x140082085
call fcn.1400bd640
mov rcx, qword [rax]
mov r8, qword [rcx + 0x10]
mov edx, 1
mov rcx, rax
call r8
cmp al, 1
jne 0x140082083
movdqa xmm0, xmmword [0x1401f5810]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov r8d, 0x3e
lea rdx, str.d:jenkins.jenkinsworkspace_tabx_tabxmainv2mainframemgr.cpp
lea rcx, [rsp + 0x40]
call fcn.14000d6b0
nop
movdqa xmm0, xmmword [0x1401f5810]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov r8d, 3
lea rdx, [0x1401f5428]
lea rcx, [rsp + 0x20]
call fcn.14000d6b0
nop
mov r9d, 0x1b4
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.14000b740
mov rbx, rax
lea rdx, [0x1402067a8]
mov rcx, rax
call fcn.14000aa40
call fcn.1400bd640
mov r8, qword [rax]
mov rdx, rbx
mov rcx, rax
call qword [r8 + 0x38]
nop
lea rcx, [rsp + 0x68]
call fcn.14000c6a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140082037
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082032
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400820a4
call fcn.1401606e8
movdqa xmm0, xmmword [0x1401f5810]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140082083
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008207e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008209e
call fcn.1401606e8
xor al, al
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x160
pop rbx
ret
call fcn.1401b3260
nop
call fcn.1401b3260
nop
int3
Function at 0x1400887b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rcx, qword [rcx + 0x440]
test rcx, rcx
jne fcn.1400ac2c0
ret
Function at 0x14008c5b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x10
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp], rax
mov r12, qword [r8 + 0x18]
mov rdi, r8
mov rsi, qword [r8 + 0x10]
mov r14, rdx
mov r11, rcx
mov r10, r8
cmp r12, 8
jb 0x14008c5f4
mov r10, qword [r8]
lea r8, [rsi + rsi]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x14008c634
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r10]
inc rdx
xor r9, rax
imul r9, rcx
cmp rdx, r8
jb 0x14008c620
mov rax, qword [r11 + 0x18]
mov r8, qword [r11 + 0x30]
mov rdx, qword [r11 + 8]
and r8, r9
add r8, r8
mov rbp, qword [rax + r8*8]
lea r15, [rax + r8*8]
mov rcx, rbp
cmp rbp, rdx
jne 0x14008c65b
mov rax, rdx
jmp 0x14008c662
mov rax, qword [r15 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14008c764
lea r11, [rcx + 0x10]
mov rax, rdi
cmp r12, 8
jb 0x14008c67b
mov rax, qword [rdi]
cmp qword [r11 + 0x18], 8
mov r8, qword [r11 + 0x10]
jb 0x14008c689
mov r11, qword [r11]
cmp r8, rsi
jne 0x14008c6c7
test r8, r8
je 0x14008c6cc
movzx r9d, word [r11]
movzx r10d, word [rax]
cmp r9w, r10w
jb 0x14008c6c7
sub r11, rax
cmp r9w, r10w
ja 0x14008c6c7
cmp r8, 1
je 0x14008c6cc
movzx r9d, word [rax + r11 + 2]
add rax, 2
dec r8
movzx r10d, word [rax]
cmp r9w, r10w
jae 0x14008c6a8
mov rcx, qword [rcx]
jmp 0x14008c651
mov qword [rsp + 0x30], rbx
mov r8, rcx
cmp rbp, rdx
jne 0x14008c6de
mov rax, rdx
jmp 0x14008c6e5
mov rax, qword [r15 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14008c749
cmp qword [rcx + 0x28], 8
lea rax, [rcx + 0x10]
mov r9, qword [rax + 0x10]
jb 0x14008c6fc
mov rax, qword [rax]
mov rbx, rdi
cmp r12, 8
jb 0x14008c708
mov rbx, qword [rdi]
cmp rsi, r9
jne 0x14008c749
mov r11, rsi
test rsi, rsi
je 0x14008c75c
movzx r9d, word [rbx]
movzx r10d, word [rax]
cmp r9w, r10w
jb 0x14008c749
sub rbx, rax
cmp r9w, r10w
ja 0x14008c749
cmp r11, 1
je 0x14008c75c
movzx r9d, word [rax + rbx + 2]
add rax, 2
dec r11
movzx r10d, word [rax]
cmp r9w, r10w
jae 0x14008c72a
mov rbx, qword [rsp + 0x30]
cmp r8, rcx
je 0x14008c764
mov qword [r14], r8
mov qword [r14 + 8], rcx
jmp 0x14008c76b
mov rcx, qword [rcx]
jmp 0x14008c6d4
mov qword [r14], rdx
mov qword [r14 + 8], rdx
mov rax, r14
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.140160a40
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x10
pop r15
pop r14
pop r12
ret
Function at 0x14008c7a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rdi, r8
mov rsi, rdx
mov r8, qword [r8 + 0x20]
mov r10, rcx
cmp qword [rdi + 0x28], 8
lea r9, [rdi + 0x10]
jb 0x14008c7da
mov r9, qword [rdi + 0x10]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r8, r8
je 0x14008c814
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rbx
cmp rcx, r8
jb 0x14008c800
mov r8, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and r8, rdx
shl r8, 4
add rcx, r8
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x14008c854
cmp rax, rdi
jne 0x14008c84a
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r8 + rcx + 8], rax
jmp 0x14008c85f
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x14008c85f
cmp rax, rdi
jne 0x14008c85f
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdx, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rdx], rbx
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [r8 + 8], rdx
dec qword [r10 + 0x10]
call fcn.14000d500
mov edx, SHGetSetSettings
mov rcx, rdi
call fcn.1401606e8
mov rax, rsi
mov qword [rsi], rbx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14008c8c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rdi, r8
mov rsi, rdx
mov r8, qword [r8 + 0x20]
mov r10, rcx
cmp qword [rdi + 0x28], 8
lea r9, [rdi + 0x10]
jb 0x14008c8fa
mov r9, qword [rdi + 0x10]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r8, r8
je 0x14008c934
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rbx
cmp rcx, r8
jb 0x14008c920
mov r8, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and r8, rdx
shl r8, 4
add rcx, r8
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x14008c974
cmp rax, rdi
jne 0x14008c96a
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r8 + rcx + 8], rax
jmp 0x14008c97f
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x14008c97f
cmp rax, rdi
jne 0x14008c97f
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdx, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rdx], rbx
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [r8 + 8], rdx
dec qword [r10 + 0x10]
call fcn.14000d500
mov edx, 0x30
mov rcx, rdi
call fcn.1401606e8
mov rax, rsi
mov qword [rsi], rbx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140092be0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rsi
mov r15, rdx
mov r12, rcx
call fcn.140066660
mov rcx, rax
call fcn.14000a290
mov rdi, qword [rax]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140092d98
mov r13d, 2
nop
mov rcx, qword [0x1402b7e88]
test rcx, rcx
jne 0x140092ca1
lea rcx, [0x14029e168]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x1402b7e88], 0
jne 0x140092c8d
mov ecx, 0x60
call fcn.1401606ac
mov rsi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140092c81
xor edx, edx
lea r8d, [rdx + 0x60]
mov rcx, rax
call fcn.1401afc90
mov rcx, rsi
call fcn.14004f670
nop
lock or dword [rsp], 0
mov qword [0x1402b7e88], rax
lea rcx, [0x14029e168]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x1402b7e88]
lea rdx, [rbx + 0x30]
call fcn.140050fa0
test al, al
jne 0x140092d37
movzx r14d, byte [rbx + 0x38]
movzx ebp, byte [rbx + 0x39]
test r14b, r14b
jne 0x140092cc5
test bp, bp
je 0x140092d37
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
test ax, ax
cmovs esi, r13d
mov ecx, ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140092cec
or esi, 1
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140092cff
or esi, 4
cmp esi, ebp
jne 0x140092d37
movzx eax, r14b
cmp qword [r15 + 0x10], rax
jne 0x140092d37
movsxd rsi, dword [rbx + 0x20]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x40]
mov rcx, rax
call fcn.1400592e0
xor r9d, r9d
mov r8, rsi
mov edx, 0x445
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140092d68
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140092d63
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x140092d63
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140092d50
mov rbx, rax
jmp 0x140092d8f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140092d8f
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140092d80
cmp rbx, rdi
jne 0x140092c30
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400964e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rsi, [rcx - 0x5d0]
mov rcx, rsi
call fcn.140094db0
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14009652e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
nop
test rbx, rbx
je 0x140096595
xor edi, edi
mov dword [rsp + 0x30], edi
mov rax, qword [rbx]
lea r8, [rsp + 0x30]
mov edx, 0x400000
mov rcx, rbx
call qword [rax + 0x30]
test dword [rsp + 0x30], 0x400000
jne 0x140096595
mov dword [rsp + 0x30], edi
mov rax, qword [rbx]
lea r8, [rsp + 0x30]
mov edx, 0x20000000
mov rcx, rbx
call qword [rax + 0x30]
test dword [rsp + 0x30], 0x20000000
je 0x140096595
lea ecx, [rdi + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140096595
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.140093a80
jmp 0x14009659a
mov edi, 1
test rbx, rbx
je 0x1400965a9
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + ILClone]
nop
mov eax, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400987d0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
mov qword [r11 - 0x68], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, rcx
lea rcx, [r11 - 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x58]
mov rcx, qword [rbp + 0x618]
call qword [sym.imp.USER32.dll_ScreenToClient]
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov rcx, qword [rbp + 0x620]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x58]
call qword [rax + reloc.SHELL32.dll_ILGetSize]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140098901
mov dword [rsp + 0x48], ebx
mov rax, qword [rcx]
lea r8, [rsp + 0x48]
mov edx, 0x80000000
call qword [rax + 0x30]
mov esi, dword [rsp + 0x48]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x68]
call fcn.140026c60
nop
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rbp + 0x620]
mov rcx, qword [rbp + 0x628]
call fcn.14005f3e0
and esi, 0x80000000
setne cl
mov byte [rsp + 0x38], cl
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x618]
mov r8, qword [rsp + 0x50]
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.140027eb0
nop
lea rcx, [rsp + 0x68]
call fcn.14000a910
mov bl, 1
mov rcx, qword [rsp + 0x50]
jmp 0x140098903
xor bl, bl
test rcx, rcx
je 0x14009890f
mov rdx, qword [rcx]
call qword [rdx + ILClone]
nop
movzx eax, bl
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140160a40
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14009ec30
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rdi, rdx
add rcx, 0x1a0
cmp qword [rsi + 0x1b8], 8
jb 0x14009ec5d
mov rcx, qword [rsi + 0x1a0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14009ec6f
mov rcx, rsi
call fcn.14009e140
lea rdx, [rsi + 0x1a0]
mov rcx, rdi
call fcn.140010ce0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14009fe60
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rdi, rdx
add rcx, 0x1c0
cmp qword [rsi + 0x1d8], 8
jb 0x14009fe8d
mov rcx, qword [rsi + 0x1c0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14009fe9f
mov rcx, rsi
call fcn.14009e140
lea rdx, [rsi + 0x1c0]
mov rcx, rdi
call fcn.140010ce0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a5770
Capabilities:
Check if file exists

Disassembly:
cmp byte [rcx], 0
jne 0x1400a5794
cmp dword [rcx + 8], 0
jne 0x1400a578c
cmp dword [rcx + 0xe4], 0xffffffff
je 0x1400a578c
mov r8d, 3
jmp 0x1400a579a
mov r8d, 2
jmp 0x1400a579a
mov r8d, 1
lea rdx, [rcx + 0xe0]
add rcx, 8
jmp fcn.1400a38b0

Function at 0x1400a6470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400a649d
xor eax, eax
jmp 0x1400a65e3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400a64d7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400a64d7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400a65e3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400a65d6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400a651a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400a6529
movsx ecx, dil
jmp 0x1400a657d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x1400a65d6
cmp eax, 1
jle 0x1400a6597
cmp eax, 3
jne 0x1400a65d6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1401c7e0c
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400a65db
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400a65c4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1401c871c
cmp rsi, rax
jne 0x1400a65d6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400a65db
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400a7010
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400a70ab
mov rdi, r8
test r8, r8
jle 0x1400a70a0
mov rcx, rbx
call fcn.14000d2a0
test rax, rax
jle 0x1400a7080
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1401b00b0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400a7098
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400a70a0
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400a7042
sub r14, rdi
mov rax, r14
jmp 0x1400a715a
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400a70c2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400a70c4
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x1400a7154
test ecx, ecx
jle 0x1400a70fc
cmp r14, rdi
mov rcx, rsi
cmovl rdi, r14
mov r8, rdi
call fcn.1401b00b0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x1400a7154
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x1400a7154
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400a7141
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rsi
call fcn.1401c81b8
sub r14, rax
sub rbp, r14
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400a7180
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400a721a
mov rbx, r8
test r8, r8
jle 0x1400a7212
mov rcx, rdi
call fcn.14000d4e0
test rax, rax
jle 0x1400a71f0
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.1401b00b0
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x1400a720a
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + ILCombine]
cmp eax, 0xffffffff
je 0x1400a7212
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x1400a71b2
sub r14, rbx
mov rax, r14
jmp 0x1400a7291
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x1400a7231
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400a7233
xor ecx, ecx
movsxd rbx, ecx
test r14, r14
jle 0x1400a728b
test ecx, ecx
jle 0x1400a7267
cmp r14, rbx
mov rcx, r9
cmovl rbx, r14
mov r8, rbx
call fcn.1401b00b0
mov rax, qword [rdi + 0x58]
add rbp, rbx
sub r14, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x40]
movsxd rax, ebx
add qword [rcx], rax
test r14, r14
jle 0x1400a728b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400a728b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.1401c871c
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400a8710
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [r8 + 0x28], 8
lea r9, [r8 + 0x10]
mov r10, qword [r9 + 0x10]
mov rbx, rdx
mov r11, rcx
jb 0x1400a872e
mov r9, qword [r9]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r10, r10
je 0x1400a8769
mov qword [rsp + 0x40], rdi
movabs rdi, 0x100000001b3
nop
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rdi
cmp rcx, r10
jb 0x1400a8750
mov rdi, qword [rsp + 0x40]
mov r9, qword [r11 + 0x30]
and r9, rdx
mov rdx, qword [r11 + 0x18]
shl r9, 4
add rdx, r9
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x1400a87a9
cmp rax, r8
jne 0x1400a879f
mov rax, qword [r11 + 8]
mov qword [rdx], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
mov qword [r9 + rcx + 8], rax
jmp 0x1400a87b4
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x1400a87b4
cmp rax, r8
jne 0x1400a87b4
mov rcx, qword [r8]
mov qword [rdx], rcx
lea rcx, [r11 + 8]
mov rdx, rbx
call fcn.1400a9320
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400b3e20
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov qword [r11 - 0x58], rdx
mov qword [r11 - 0x50], r9
mov rbp, qword [rsp + 0xc0]
xor r15d, r15d
mov dword [r11 - 0x68], r15d
mov qword [r11 - 0x40], r15
xor eax, eax
mov qword [rdx], rax
call fcn.14000a6a0
mov rcx, rax
test rax, rax
je 0x1400b3ff0
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rsi], rax
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rdi, [r15 - 1]
test eax, eax
jne 0x1400b3fb1
mov qword [rsp + 0x60], r15
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b3fa0
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x1400b3fb1
add eax, 0x10
mov dword [rsp + 0x50], eax
mov ecx, eax
lea rdx, [0x1402b83a0]
call fcn.140160c44
mov rbx, rax
test rax, rax
je 0x1400b3fb1
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
call fcn.1401afc90
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400b3f62
mov rcx, rbx
call fcn.1401606e8
jmp 0x1400b3fb1
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400b3f65
test rax, rax
je 0x1400b3f98
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400b3f80
mov r8d, eax
mov rdx, rbx
mov rcx, rsi
call fcn.14000cfe0
mov rcx, rbx
call fcn.1401606e8
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400b3fb1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400b3fcc
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000ca90
int3