joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cd0c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x50
lea rax, [r11 - 0x18]
xor ebx, ebx
mov qword [r11 - 0x28], rax
mov rdi, r9
lea rax, [r11 - 0x14]
mov qword [r11 - 0x30], rbx
mov rsi, r8
mov qword [r11 - 0x38], rax
lea r9d, [rbx + 2]
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000cda1
mov ecx, dword [rsp + 0x40]
lea edx, [rbx + 1]
call fcn.140002588
lea rcx, [rsp + 0x40]
mov qword [rdi], rax
mov qword [rsp + 0x30], rcx
lea r9d, [rbx + 2]
mov qword [rsp + 0x28], rax
mov r8, rsi
lea rax, [rsp + 0x44]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000cd99
lea ebx, [rax + 1]
jmp 0x14000cda1
mov rcx, qword [rdi]
call fcn.1400025b4
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x14000cf7c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x72b0
mov dword [rbp - 0x30], 0x72d572d4
mov ecx, 0x1e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x2c], 0x72d172d6
mov dword [rbp - 0x28], 0x72dc72c5
mov dword [rbp - 0x24], 0x72e072c4
mov dword [rbp - 0x20], 0x72df72c2
mov dword [rbp - 0x1c], 0x72d972d6
mov dword [rbp - 0x18], 0x72d572dc
mov dword [rbp - 0x10], 0x8fc172b0
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0xf
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000cfe3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d004
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x728372c7
mov dword [rbp - 0x2c], 0x7294728e
mov ebx, 0x72e7
mov dword [rbp - 0x28], 0x728b7297
mov dword [rbp - 0x24], 0x729e7286
mov dword [rbp - 0x20], 0x72957297
mov dword [rbp - 0x1c], 0x72817288
mov dword [rbp - 0x18], 0x728b728e
mov dword [rbp - 0x14], 0x72e77282
mov dword [rbp - 0x10], 0x8fc172e7
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d06f
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000d090
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x720b
mov dword [rbp - 0x20], 0x72447247
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x724a7248
mov dword [rbp - 0x18], 0x724a7247
mov dword [rbp - 0x14], 0x725b725b
mov dword [rbp - 0x10], 0x724a724f
mov dword [rbp - 0xc], 0x724a725f
mov dword [rbp - 4], 0x8fc1720b
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d0f0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000d110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x72b1
mov dword [rbp - 0x30], 0x729372ca
mov ecx, 0x26
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x2c], 0x72c372c1
mov dword [rbp - 0x28], 0x72d772de
mov dword [rbp - 0x24], 0x72dd72d8
mov dword [rbp - 0x20], 0x72ee72d4
mov dword [rbp - 0x1c], 0x72d072df
mov dword [rbp - 0x18], 0x72d472dc
mov dword [rbp - 0x14], 0x728b7293
mov dword [rbp - 0x10], 0x72937291
mov dword [rbp - 8], 0x8fc172b1
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d185
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d1a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x30
mov dword [rbp - 0x40], 0x729f7291
mov dword [rbp - 0x3c], 0x72917293
mov ebx, 0x72b3
mov dword [rbp - 0x38], 0x72d672d7
mov dword [rbp - 0x34], 0x72d272d5
mov dword [rbp - 0x30], 0x72df72c6
mov dword [rbp - 0x2c], 0x72ec72c7
mov dword [rbp - 0x28], 0x72c172c3
mov dword [rbp - 0x24], 0x72d572dc
mov dword [rbp - 0x20], 0x72df72da
mov dword [rbp - 0x1c], 0x729172d6
mov dword [rbp - 0x18], 0x72937289
mov dword [rbp - 0x14], 0x72b37291
mov dword [rbp - 0x10], 0x8fc172b3
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d22b
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000d24c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72c1
mov dword [rbp - 0x20], 0x72e372ba
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x72ae72a9
mov dword [rbp - 0x18], 0x72b572b2
mov dword [rbp - 0x14], 0x72fb72e3
mov dword [rbp - 0x10], 0x72e372e1
mov dword [rbp - 8], 0x8fc172c1
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d2a5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000d2c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rbp - 0x20], 0x72127230
mov dword [rbp - 0x1c], 0x7207720f
mov ebx, 0x7260
mov dword [rbp - 0x18], 0x72017212
mov dword [rbp - 0x14], 0x7224720d
mov dword [rbp - 0x10], 0x72147201
mov dword [rbp - 0xc], 0x72607201
mov dword [rbp - 8], 0x8fc17260
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xc
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d321
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000d340
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov ebx, 0x7262
mov dword [rbp - 0x60], 0x72177232
mov ecx, 0x56
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x5c], 0x7211720e
mov dword [rbp - 0x58], 0x72427207
mov dword [rbp - 0x54], 0x72077231
mov dword [rbp - 0x50], 0x72177201
mov dword [rbp - 0x4c], 0x72077210
mov dword [rbp - 0x48], 0x7221723e
mov dword [rbp - 0x44], 0x720c720d
mov dword [rbp - 0x40], 0x7207720c
mov dword [rbp - 0x3c], 0x72167201
mov dword [rbp - 0x38], 0x720d720b
mov dword [rbp - 0x34], 0x7231720c
mov dword [rbp - 0x30], 0x720d7216
mov dword [rbp - 0x2c], 0x72077210
mov dword [rbp - 0x28], 0x7201723e
mov dword [rbp - 0x24], 0x720c720d
mov dword [rbp - 0x20], 0x7211720c
mov dword [rbp - 0x1c], 0x720d7216
mov dword [rbp - 0x18], 0x72077210
mov dword [rbp - 0x14], 0x7206724c
mov dword [rbp - 0x10], 0x72167203
mov dword [rbp - 8], 0x8fc17262
call fcn.1400026b0
lea r9, [rbp - 0x60]
mov rdx, rax
sub r9, rax
mov r8d, 0x2b
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d416
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14000d444
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, 0x7208
mov dword [rbp - 0x50], 0x726b722a
mov ecx, 0x3e
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x4c], 0x727b7261
mov dword [rbp - 0x48], 0x7267726b
mov dword [rbp - 0x44], 0x7232722a
mov dword [rbp - 0x40], 0x72287273
mov dword [rbp - 0x3c], 0x7278722a
mov dword [rbp - 0x38], 0x726d727a
mov dword [rbp - 0x34], 0x726d726e
mov dword [rbp - 0x30], 0x726d727a
mov dword [rbp - 0x2c], 0x726b7266
mov dword [rbp - 0x28], 0x727b726d
mov dword [rbp - 0x24], 0x72707226
mov dword [rbp - 0x20], 0x72647265
mov dword [rbp - 0x1c], 0x7232722a
mov dword [rbp - 0x18], 0x72737228
mov dword [rbp - 0x10], 0x8fc17208
call fcn.1400026b0
lea r9, [rbp - 0x50]
mov rdx, rax
sub r9, rax
mov r8d, 0x1f
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d4e8
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14000d510
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x20
mov dword [rbp - 0x30], 0x722e727c
mov dword [rbp - 0x2c], 0x7232722b
mov ebx, 0x725e
mov dword [rbp - 0x28], 0x723b722d
mov dword [rbp - 0x24], 0x723b722d
mov dword [rbp - 0x20], 0x722b723d
mov dword [rbp - 0x1c], 0x723b722c
mov dword [rbp - 0x18], 0x7264727c
mov dword [rbp - 0x14], 0x725e7225
mov dword [rbp - 0x10], 0x8fc1725e
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x10
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d57b
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d59c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7253
mov dword [rbp - 0x30], 0x72217271
mov ecx, 0x26
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x2c], 0x72237237
mov dword [rbp - 0x28], 0x72697271
mov dword [rbp - 0x24], 0x72717228
mov dword [rbp - 0x20], 0x72367220
mov dword [rbp - 0x1c], 0x72257221
mov dword [rbp - 0x18], 0x72217236
mov dword [rbp - 0x14], 0x72717220
mov dword [rbp - 0x10], 0x72087269
mov dword [rbp - 8], 0x8fc17253
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d611
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d630
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ecx, 0x2c
mov dword [rbp - 0x30], 0x728e72de
mov dword [rbp - 0x2c], 0x729b7299
mov ebx, 0x72fc
mov dword [rbp - 0x28], 0x728f7295
mov dword [rbp - 0x24], 0x728e7288
mov dword [rbp - 0x20], 0x72a37285
mov dword [rbp - 0x1c], 0x728e728c
mov dword [rbp - 0x18], 0x729a7293
mov dword [rbp - 0x14], 0x72907295
mov dword [rbp - 0x10], 0x728f7299
mov dword [rbp - 0xc], 0x72c672de
mov dword [rbp - 8], 0x72fc72a7
mov dword [rbp - 4], 0x8fc172fc
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d6b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x14000d6d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72e2
mov dword [rbp - 0x20], 0x728c72ab
mov ecx, SafeArrayGetElement
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x1c], 0x72967291
mov dword [rbp - 0x18], 0x728e7283
mov dword [rbp - 0x14], 0x72a6728e
mov dword [rbp - 0x10], 0x7290728b
mov dword [rbp - 8], 0x8fc172e2
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xb
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d729
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14000d748
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x72c0
mov dword [rbp - 0x20], 0x72b37295
mov ecx, 0x1a
mov dword [rbp - 8], ebx
mov dword [rbp - 0x1c], 0x72b272a5
mov dword [rbp - 0x18], 0x72a172ae
mov dword [rbp - 0x14], 0x72a572ad
mov dword [rbp - 0x10], 0x72a97288
mov dword [rbp - 0xc], 0x72b472ae
mov dword [rbp - 4], 0x8fc172c0
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xd
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d7a8
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000d7c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x3c
mov dword [rbp - 0x40], 0x729372c2
mov dword [rbp - 0x3c], 0x728e728f
mov ebx, 0x72e0
mov dword [rbp - 0x38], 0x72837289
mov dword [rbp - 0x34], 0x72817297
mov dword [rbp - 0x30], 0x728c728c
mov dword [rbp - 0x2c], 0x72da72c2
mov dword [rbp - 0x28], 0x72c2729b
mov dword [rbp - 0x24], 0x728d7283
mov dword [rbp - 0x20], 0x72bf7284
mov dword [rbp - 0x1c], 0x72927290
mov dword [rbp - 0x18], 0x7286728f
mov dword [rbp - 0x14], 0x728c7289
mov dword [rbp - 0x10], 0x72937285
mov dword [rbp - 0xc], 0x72da72c2
mov dword [rbp - 8], 0x72e072bb
mov dword [rbp - 4], 0x8fc172e0
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, 0x1e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d864
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000d884
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ecx, SafeArrayGetElement
mov dword [rbp - 0x20], 0x72a172aa
mov dword [rbp - 0x1c], 0x72887287
mov ebx, 0x72e4
mov dword [rbp - 0x18], 0x72ca728d
mov dword [rbp - 0x14], 0x729c7281
mov dword [rbp - 0x10], 0x72e47281
mov dword [rbp - 0xc], 0x8fc172e4
call fcn.1400026b0
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 0xa
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d8da
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14000d8fc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x72c3
mov dword [rbp - 0x30], 0x72ef72e1
mov ecx, 0x22
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0x2c], 0x72e172e3
mov dword [rbp - 0x28], 0x72b072b6
mov dword [rbp - 0x24], 0x72b172a6
mov dword [rbp - 0x20], 0x72a272ad
mov dword [rbp - 0x1c], 0x72a672ae
mov dword [rbp - 0x18], 0x72f972e1
mov dword [rbp - 0x14], 0x72e172e3
mov dword [rbp - 0xc], 0x8fc172c3
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 0x11
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000d96a
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000d98c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ecx, 0x30
mov dword [rbp - 0x40], 0x72b372f7
mov dword [rbp - 0x3c], 0x72a772ba
mov ebx, 0x72d5
mov dword [rbp - 0x38], 0x72bc72a1
mov dword [rbp - 0x34], 0x72b072bb
mov dword [rbp - 0x30], 0x72f772a1
mov dword [rbp - 0x2c], 0x72ae72ef
mov dword [rbp - 0x28], 0x72a172f7
mov dword [rbp - 0x24], 0x72bb72a0
mov dword [rbp - 0x20], 0x72b072bb
mov dword [rbp - 0x1c], 0x72a672b9
mov dword [rbp - 0x18], 0x72ef72f7
mov dword [rbp - 0x14], 0x72d5728e
mov dword [rbp - 0x10], 0x8fc172d5
call fcn.1400026b0
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000da13
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x14000da34
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov ecx, 0x7c
mov dword [rbp - 0x39], 0x7264724e
mov dword [rbp - 0x35], 0x726e727e
mov ebx, 0x720d
mov dword [rbp - 0x31], 0x72517262
mov dword [rbp - 0x2d], 0x7264724e
mov dword [rbp - 0x29], 0x726e727e
mov dword [rbp - 0x25], 0x722d7262
mov dword [rbp - 0x21], 0x7263724c
mov dword [rbp - 0x1d], 0x724e7274
mov dword [rbp - 0x19], 0x72637262
mov dword [rbp - 0x15], 0x72687263
mov dword [rbp - 0x11], 0x7279726e
mov dword [rbp - 0xd], 0x725e722d
mov dword [rbp - 9], 0x726e7268
mov dword [rbp - 5], 0x727f7278
mov dword [rbp - 1], 0x722d7268
mov dword [rbp + 3], 0x72627240
mov dword [rbp + 7], 0x7264726f
mov dword [rbp + 0xb], 0x72647261
mov dword [rbp + 0xf], 0x72747279
mov dword [rbp + 0x13], 0x724e722d
mov dword [rbp + 0x17], 0x72647261
mov dword [rbp + 0x1b], 0x72637268
mov dword [rbp + 0x1f], 0x72517279
mov dword [rbp + 0x23], 0x727f727d
mov dword [rbp + 0x27], 0x726b7268
mov dword [rbp + 0x2b], 0x727f7268
mov dword [rbp + 0x2f], 0x72637268
mov dword [rbp + 0x33], 0x7268726e
mov dword [rbp + 0x37], 0x7223727e
mov dword [rbp + 0x3b], 0x72607275
mov dword [rbp + 0x3f], 0x720d7261
mov dword [rbp + 0x43], 0x8fc1720d
call fcn.1400026b0
lea r9, [rbp - 0x39]
mov rdx, rax
sub r9, rax
mov r8d, 0x3e
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000db56
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000db8c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x7273
mov dword [rbp - 0x30], 0x72107251
mov ecx, 0x26
mov dword [rbp - 0xc], ebx
mov dword [rbp - 0x2c], 0x721d721c
mov dword [rbp - 0x28], 0x7200721d
mov dword [rbp - 0x24], 0x721c7207
mov dword [rbp - 0x20], 0x72167201
mov dword [rbp - 0x1c], 0x7217725d
mov dword [rbp - 0x18], 0x72077212
mov dword [rbp - 0x14], 0x72497251
mov dword [rbp - 0x10], 0x72517253
mov dword [rbp - 8], 0x8fc17273
call fcn.1400026b0
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
mov r8d, SafeArrayGetElement
mov ecx, ebx
xor cx, word [r9 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14000dc01
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x14000f99c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x298]
sub rsp, 0x390
lea rax, [0x140012120]
mov rdi, rcx
movups xmm0, xmmword [rax]
lea r8, [rbp - 0x50]
mov ecx, 0x80
movups xmm1, xmmword [rax + 0x10]
xor r14d, r14d
mov rsi, rdx
movups xmmword [r8], xmm0
lea rbx, [rbp - 0x50]
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r8 + 0x50], xmm1
movups xmmword [r8 + 0x60], xmm0
add r8, rcx
movups xmm0, xmmword [rax + 0x70]
add rax, rcx
movups xmmword [r8 - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
mov rax, qword [rax + 0x40]
movups xmmword [r8 + 0x20], xmm1
movups xmmword [r8 + 0x30], xmm0
mov qword [r8 + 0x40], rax
cmp word [rbp - 0x50], r14w
je 0x14000fb2b
mov r8d, 0x208
lea rdx, [rbp + 0x80]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rsi
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.History
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x80]
call fcn.14000ff50
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000fb2b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f294
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000f8c4
test eax, eax
jne 0x14000fb2b
lea r9, [0x14000ecd0]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f3b4
mov rcx, qword [rsp + 0x30]
call fcn.1400025b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rbx, [rbx + rax*2]
cmp word [rbx], r14w
jne 0x14000fa5c
lea r11, [rsp + 0x390]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000fb4c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rbx, rdx
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..default_release
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000fc68
lea rdx, [rbp + 0x3fc]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.places.sqlite
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.14000ff50
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000fc68
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f294
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000f8c4
test eax, eax
jne 0x14000fc68
lea r9, [0x14000eef0]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f3b4
mov rcx, qword [rsp + 0x30]
call fcn.1400025b4
xor eax, eax
jmp 0x14000fc6d
mov eax, 1
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x14000fdf4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rbx, rdx
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.14000ff50
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000fe9b
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f294
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.14000f8c4
test eax, eax
jne 0x14000fe9b
lea r9, [0x14000f11c]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000f3b4
mov rcx, qword [rsp + 0x30]
call fcn.1400025b4
lea r11, [rsp + 0x2c0]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret