joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4620
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.1400046a0
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.ncrypt.dll_BCryptGenRandom
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.1400046f0
test esi, esi
jne 0x1400b4694
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp esi, 0xc0000017
jne 0x1400b46bb
lea rcx, [0x1402a6310]
call fcn.140004230
mov rsi, rax
mov rcx, rsi
call fcn.1400ea340
mov rcx, rsi
call fcn.140005640
lea rcx, [0x1402a5778]
call fcn.140004230
mov rsi, rax
mov rcx, rsi
call fcn.1400dd710
mov rcx, rsi
call fcn.140005640
int3

Function at 0x1400bfe80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 8], rax
xorps xmm4, xmm4
movaps xmmword [rbp + 0x10], xmm4
movaps xmmword [rbp + 0x20], xmm4
mov rax, qword [0x140391b58]
mov qword [rbp], rax
mov rsi, rcx
mov edi, dword [rsi + 8]
xor ebx, ebx
cmp edi, 0x40
jae 0x1400bfed3
test dword [rsp], esp
sub rsp, 0x80
lea r14, [rsp + 0x20]
mov r15d, 0x40
jmp 0x1400bfefd
call fcn.140002981
mov rcx, qword [rax + 8]
lea edx, [rdi + 1]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rbx, rax
test rbx, rbx
jne 0x1400bfef5
xor r14d, r14d
xor r15d, r15d
jmp 0x1400bfefd
lea r14, [rbx + 0x10]
mov r15d, dword [rbx + 8]
lea rcx, [rsi + 0xc]
mov edx, dword [rsi + 8]
mov edx, edi
mov qword [rbp + 0x18], rcx
mov dword [rbp + 0x20], edx
mov qword [rbp + 8], r14
mov dword [rbp + 0x10], r15d
lea rcx, [rbp + 0x18]
lea rdx, [rbp + 8]
call fcn.14010d320
cmp edi, r15d
jae 0x1400bffec
mov eax, edi
mov word [r14 + rax*2], 0
mov esi, 0x15051505
mov r12d, 0x15051505
xor eax, eax
test r15d, r15d
je 0x1400bff49
mov rax, r14
mov qword [rbp + 0x28], rax
cmp edi, 2
jle 0x1400bff84
add edi, 0xfffffffc
mov edx, esi
rol edx, 5
add esi, edx
mov edx, dword [rax]
or edx, 0x200020
xor esi, edx
mov edx, r12d
rol edx, 5
add r12d, edx
mov edx, dword [rax + 4]
or edx, 0x200020
xor r12d, edx
add rax, 8
cmp edi, 2
jg 0x1400bff52
test edi, edi
jle 0x1400bff9e
mov edx, r12d
rol edx, 5
add edx, r12d
mov r12d, dword [rax]
or r12d, 0x200020
xor r12d, edx
xor eax, eax
mov qword [rbp + 0x28], rax
test rbx, rbx
je 0x1400bffbe
call fcn.140002981
mov rcx, qword [rax + 8]
mov rdx, rbx
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x38]
imul eax, r12d, 0x5d588b65
add eax, esi
lea rcx, [0x140391b58]
mov rcx, qword [rcx]
cmp qword [rbp], rcx
je 0x1400bffdc
call fcn.140004a70
nop
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.140171270
int3
Function at 0x1400c6c00
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.14016e300
xor edx, edx
xor ecx, ecx
mov r8d, eax
sar r8d, 0x1f
and r8d, 3
add eax, r8d
sar eax, 2
test eax, eax
jle 0x1400c6c3a
mov r8d, ecx
shl r8d, 2
movsxd r8, r8d
xor edx, dword [rsi + r8]
inc ecx
cmp eax, ecx
jg 0x1400c6c26
mov eax, edx
add rsp, 0x20
pop rsi
ret

Function at 0x1400e3fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rdi, rdx
mov ebx, r9d
movzx ebp, word [rdi + 0x32]
cmp r8d, 0x40
ja 0x1400e3ff2
mov rcx, rsi
call fcn.140175e60
mov rdx, rax
xor r9d, r9d
test bl, bl
sete r9b
mov rcx, rdi
mov r8d, ebp
add rsp, 0x38
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400e3e60
mov r14d, r8d
shr r14d, 5
mov ecx, r14d
shl ecx, 5
sub r8d, ecx
mov r15d, r8d
lea r12d, [r14 - 1]
lea r13d, [r12 - 1]
mov eax, r13d
shl eax, 5
add ebp, eax
test bl, bl
sete bl
movzx ebx, bl
test r15d, r15d
jne 0x1400e4053
mov rcx, rsi
mov edx, r12d
call fcn.140175b60
mov edx, eax
shl rdx, 0x20
mov qword [rsp + 0x30], rdx
mov rcx, rsi
mov edx, r13d
call fcn.140175b60
mov edx, eax
mov rcx, qword [rsp + 0x30]
add rdx, rcx
jmp 0x1400e40da
mov eax, r15d
neg eax
add eax, 0x40
mov dword [rsp + 0x2c], eax
lea r8d, [rax - 0x20]
mov dword [rsp + 0x28], r8d
add ebp, r15d
mov rcx, rsi
mov edx, r13d
call fcn.140175b60
mov dword [rsp + 0x24], eax
mov ecx, r15d
mov r8d, eax
shr r8d, cl
mov dword [rsp + 0x20], r8d
mov rcx, rsi
mov edx, r12d
call fcn.140175b60
mov r12d, eax
mov ecx, dword [rsp + 0x28]
shl r12, cl
mov rcx, rsi
mov edx, r14d
call fcn.140175b60
mov edx, eax
mov ecx, dword [rsp + 0x2c]
shl rdx, cl
add rdx, r12
mov r14d, dword [rsp + 0x20]
mov ecx, r14d
add rdx, rcx
mov r8d, 1
mov ecx, r15d
shl r8d, cl
dec r8d
xor ecx, ecx
test dword [rsp + 0x24], r8d
sete cl
and ebx, ecx
xor r14d, r14d
test r13d, r13d
je 0x1400e40ff
cmp byte [rsi], sil
mov eax, r14d
cmp dword [rsi + rax*4 + 4], 0
sete al
movzx eax, al
and eax, ebx
mov ebx, eax
inc r14d
cmp r14d, r13d
jne 0x1400e40e5
mov rcx, rdi
mov r8d, ebp
mov r9d, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400e3e60

Function at 0x1400f55d0
Capabilities:
Hash data using sha1

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
cmp qword [rsi], 0
jne 0x1400f55fa
lea rcx, [0x1402f5638]
mov edx, 0x55
call fcn.140004350
mov rdx, rax
mov rcx, rsi
call fcn.140004570
xor eax, eax
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], eax
mov rax, qword [rsi]
cmp dword [rax + 8], 0x50
jbe 0x1400f5668
mov dword [rax + 0x150], 0x67452301
mov rax, qword [rsi]
cmp dword [rax + 8], 0x51
jbe 0x1400f5668
mov dword [rax + 0x154], 0xefcdab89
mov rax, qword [rsi]
cmp dword [rax + 8], 0x52
jbe 0x1400f5668
mov dword [rax + 0x158], 0x98badcfe
mov rax, qword [rsi]
cmp dword [rax + 8], 0x53
jbe 0x1400f5668
mov dword [rax + 0x15c], 0x10325476
mov rax, qword [rsi]
cmp dword [rax + 8], 0x54
jbe 0x1400f5668
mov dword [rax + 0x160], 0xc3d2e1f0
add rsp, 0x20
pop rsi
ret
call fcn.140171270
int3
Function at 0x1400fec60
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov rsi, rcx
mov edi, edx
call fcn.14000145b
cmp byte [rax], 0
je 0x1400fec7e
xor eax, eax
add rsp, 0x28
pop rsi
pop rdi
ret
call fcn.140001230
cmp byte [rax], 0
jne 0x1400fec98
mov rcx, rsi
mov edx, edi
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.1400ff610
mov edx, edi
cmp byte [rsi + 0x1b8], 0
jne 0x1400feca9
or edx, 0x80000000
mov rcx, qword [rsi + 8]
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.1400ffce0

Function at 0x1400fecc0
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov rsi, rcx
mov edi, edx
call fcn.14000145b
cmp byte [rax], 0
je 0x1400fecde
xor eax, eax
add rsp, 0x28
pop rsi
pop rdi
ret
call fcn.140001230
cmp byte [rax], 0
jne 0x1400fed03
movzx ecx, byte [rsi + 0x1b8]
test ecx, ecx
jne 0x1400fed03
mov rcx, rsi
mov edx, edi
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.1400ff610
mov edx, edi
cmp byte [rsi + 0x1b8], 0
jne 0x1400fed14
or edx, 0x80000000
mov rcx, qword [rsi + 8]
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.1400ffce0

Function at 0x1400ffc10
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x140391b58]
mov qword [rbp + 0x48], rax
test dword [rsp], esp
sub rsp, 0x430
lea rsi, [rsp + 0x20]
test rcx, rcx
je 0x1400ffc50
add rcx, 0xc
jmp 0x1400ffc52
xor ecx, ecx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov r8, rsi
mov qword [rbp + 0x30], r8
mov r9d, 0x212
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.1400046a0
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov edi, eax
lea rcx, [rbp + 8]
call fcn.1400046f0
xor ecx, ecx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x50], rcx
test edi, edi
jle 0x1400ffcae
mov rcx, rsi
call fcn.1400bca60
jmp 0x1400ffcb0
xor eax, eax
lea rcx, [0x140391b58]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x1400ffcc5
call fcn.140004a70
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400ffce0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x1400ffd16
add rcx, 0xc
jmp 0x1400ffd18
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.1400046a0
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.1400046f0
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140101830
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
call fcn.14000145b
cmp byte [rax], 0
jne 0x140101864
xor ecx, ecx
mov edx, 0x5c
call fcn.1400ffc10
test rax, rax
jne 0x140101878
lea rcx, [0x14036e290]
mov edx, 0x5c
add rsp, 0x28
jmp fcn.1400ffc10
call fcn.140001aff
mov rcx, qword [rax + 0x18]
cmp dword [rcx], ecx
add rsp, 0x28
jmp fcn.140100df0
add rsp, 0x28
ret
Function at 0x140128110
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov eax, 0x1505
xor edx, edx
mov r8d, dword [rcx + 8]
test r8d, r8d
jle 0x14012813d
mov r9d, eax
shl r9d, 5
add eax, r9d
mov r9d, edx
movzx r9d, word [rcx + r9*2 + 0xc]
xor eax, r9d
inc edx
cmp r8d, edx
jg 0x140128120
ret

Function at 0x140171e50
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov esi, edx
mov qword [rbp - 0x40], rcx
mov rdi, rcx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x4c], rcx
mov edx, esi
mov dword [rbp - 0x44], edx
lea rcx, [rbp - 0x78]
call fcn.1400046a0
mov rcx, qword [rbp - 0x4c]
mov edx, dword [rbp - 0x44]
call sub.KERNEL32.dll_GetSystemDirectoryW
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.1400046f0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140002fe4
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140172370
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rcx
mov rdi, rdx
mov ebx, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov qword [rbp - 0x4c], rcx
mov rdx, rdi
mov qword [rbp - 0x54], rdx
mov r8d, ebx
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.1400046a0
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.1400046f0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140002fe4
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140172700
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov esi, r8d
test rcx, rcx
je 0x140172733
add rcx, 0xc
mov rdi, rcx
jmp 0x140172735
xor edi, edi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x48], rdx
mov rbx, rdx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x54], rcx
mov rdx, rbx
mov qword [rbp - 0x5c], rdx
mov r8d, esi
mov dword [rbp - 0x4c], r8d
lea rcx, [rbp - 0x88]
call fcn.1400046a0
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.1400046f0
call sub.KERNEL32.dll_GetLastError
mov edi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
call fcn.140002fe4
mov dword [rax + 8], edi
mov eax, esi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140173730
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp + 0x10], rcx
mov ebx, edx
mov rdi, r8
mov rsi, r9
mov r14, qword [rbp + 0x30]
mov r15, qword [rbp + 0x38]
mov r12, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14014c9e0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rdi, rdi
jne 0x140173798
xor r8d, r8d
jmp 0x14017379c
lea r8, [rdi + 0x10]
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x50], rsi
mov r9, rsi
test r14, r14
jne 0x1401737b0
xor eax, eax
jmp 0x1401737b4
lea rax, [r14 + 0x10]
mov qword [rbp - 0x58], rax
test r15, r15
jne 0x1401737c2
xor r10d, r10d
jmp 0x1401737c6
lea r10, [r15 + 0x10]
mov qword [rbp - 0x60], r10
test r12, r12
jne 0x1401737d4
xor r11d, r11d
jmp 0x1401737d9
lea r11, [r12 + 0x10]
mov qword [rbp - 0x68], r11
test r13, r13
jne 0x1401737e6
xor esi, esi
jmp 0x1401737ea
lea rsi, [r13 + 0x10]
mov qword [rbp - 0x70], rsi
mov rcx, rdx
mov qword [rbp - 0x7c], rcx
mov edx, ebx
mov dword [rbp - 0x74], edx
mov qword [rbp - 0x84], r8
mov qword [rbp - 0x8c], r9
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], rsi
lea rcx, [rbp - 0xb8]
call fcn.1400046a0
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
mov r8, qword [rbp - 0x84]
mov r9, qword [rbp - 0x8c]
call sub.ADVAPI32.dll_RegEnumKeyExW
mov esi, eax
lea rcx, [rbp - 0xb8]
call fcn.1400046f0
nop
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x140173886
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.14014ca70
mov eax, esi
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401739c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0xf0]
xor eax, eax
mov qword [rbp - 0x68], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp + 0x10], rcx
mov ebx, edx
mov rdi, r8
mov rsi, r9
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14014c9e0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rdi, rdi
jne 0x140173a26
xor r8d, r8d
jmp 0x140173a2a
lea r8, [rdi + 0x10]
mov qword [rbp - 0x48], r8
mov qword [rbp - 0x50], rsi
mov r9, rsi
test r14, r14
jne 0x140173a3e
xor eax, eax
jmp 0x140173a42
lea rax, [r14 + 0x10]
mov qword [rbp - 0x58], rax
test r15, r15
jne 0x140173a50
xor r10d, r10d
jmp 0x140173a54
lea r10, [r15 + 0x10]
mov qword [rbp - 0x60], r10
test r12, r12
jne 0x140173a62
xor r11d, r11d
jmp 0x140173a67
lea r11, [r12 + 0x10]
mov qword [rbp - 0x68], r11
mov rsi, qword [rbp + 0x30]
mov rcx, rdx
mov qword [rbp - 0x74], rcx
mov edx, ebx
mov dword [rbp - 0x6c], edx
mov qword [rbp - 0x7c], r8
mov qword [rbp - 0x84], r9
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], r11
lea rcx, [rbp - 0xb0]
call fcn.1400046a0
mov rcx, qword [rbp - 0x74]
mov edx, dword [rbp - 0x6c]
mov r8, qword [rbp - 0x7c]
mov r9, qword [rbp - 0x84]
call sub.ADVAPI32.dll_RegEnumValueW
mov esi, eax
lea rcx, [rbp - 0xb0]
call fcn.1400046f0
nop
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x140173afb
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.14014ca70
mov eax, esi
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140173dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov rdi, r8
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14014c9e0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rsi, rsi
je 0x140173e11
add rsi, 0xc
jmp 0x140173e13
xor esi, esi
mov qword [rbp - 0x48], rsi
mov r14, qword [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x38]
mov qword [rsp + 0x28], r14
mov rcx, rdx
mov qword [rbp - 0x50], rcx
mov rdx, rsi
mov qword [rbp - 0x58], rdx
mov r8, rdi
mov qword [rbp - 0x60], r8
mov r9, rbx
mov qword [rbp - 0x68], r9
lea rcx, [rbp - 0x90]
call fcn.1400046a0
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
call sub.ADVAPI32.dll_RegQueryValueExW
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.1400046f0
nop
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x140173e8c
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.14014ca70
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14017ae90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rcx, [rsi + 0xc]
movsxd rdi, edx
add rdi, rsi
cmp rcx, rdi
ja 0x14017aeb6
mov eax, 0xd
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test r8d, r8d
jbe 0x14017aef1
cmp r8d, 0xa
ja 0x14017aef1
test r9b, r9b
jne 0x14017aef1
movzx edx, byte [rdi]
test edx, edx
je 0x14017aee2
lea r9, [rdi + 1]
mov rbx, r9
movzx r8d, r8b
or edx, r8d
mov byte [rdi], dl
jmp 0x14017afd2
shl r8d, 4
mov byte [rdi], r8b
mov rbx, rdi
jmp 0x14017afd2
mov edx, 4
cmp r8d, 0xff
ja 0x14017af06
mov edx, 1
jmp 0x14017af24
cmp r8d, 0xffff
ja 0x14017af16
mov edx, 2
jmp 0x14017af24
cmp r8d, 0xffffff
ja 0x14017af24
mov edx, 3
test r9b, r9b
je 0x14017af58
lea rax, [rdi + 2]
cmp rcx, rax
ja 0x14017af3f
mov eax, 0xd
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
movzx eax, byte [rdi]
test eax, eax
je 0x14017af55
mov r9, rdi
lea rdi, [r9 + 1]
or eax, 0xb
mov byte [r9], al
jmp 0x14017af58
mov byte [rdi], 0xb0
lea eax, [rdx + 0xb]
movzx r9d, byte [rdi]
test r9d, r9d
je 0x14017af76
mov r10, rdi
lea rdi, [r10 + 1]
movzx eax, al
or eax, r9d
mov byte [r10], al
jmp 0x14017af7b
shl eax, 4
mov byte [rdi], al
cmp rdi, rcx
jae 0x14017afa5
cmp byte [rdi], 0
je 0x14017afa5
cmp r8d, 0x1000
jae 0x14017afa2
mov eax, r8d
shr eax, 8
add eax, 0xc0
mov byte [rdi], al
and r8d, 0xff
inc rdi
test edx, edx
jbe 0x14017afc7
cmp rcx, rdi
jbe 0x14017afcc
mov rax, rdi
lea rdi, [rax + 1]
mov byte [rax], r8b
shr r8d, 8
dec edx
test edx, edx
ja 0x14017afa9
mov rbx, rdi
jmp 0x14017afd2
mov rbx, rdi
jmp 0x14017afd2
inc rdi
mov rbx, rdi
mov eax, dword [rsi]
add eax, dword [rsi + 4]
mov edx, dword [rsi + 8]
lea edi, [rax + rdx + 0x599d99ad]
call fcn.1400b9cf0
xor eax, edi
mov dword [rsi + 0xc], eax
mov rax, rbx
sub rax, rsi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140184540
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
mov rsi, rdx
mov rdi, r8
mov rbx, r9
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.14014c9e0
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx + 8]
test rsi, rsi
je 0x140184591
add rsi, 0xc
jmp 0x140184593
xor esi, esi
mov qword [rbp - 0x48], rsi
mov r14, qword [rbp + 0x30]
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x38]
mov qword [rsp + 0x28], r14
mov rcx, rdx
mov qword [rbp - 0x50], rcx
mov rdx, rsi
mov qword [rbp - 0x58], rdx
mov r8, rdi
mov qword [rbp - 0x60], r8
mov r9, rbx
mov qword [rbp - 0x68], r9
lea rcx, [rbp - 0x90]
call fcn.1400046a0
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x68]
call sub.ADVAPI32.dll_RegQueryValueExW
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.1400046f0
nop
xor ecx, ecx
mov qword [rbp - 0x48], rcx
cmp byte [rbp - 0x40], 0
je 0x14018460c
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.14014ca70
mov eax, esi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1401c0500
Capabilities:
Hash data using murmur3

Disassembly:
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x1401c053e
mov r9d, eax
lea r9, [rdx + r9*8 + 0x10]
mov r9, qword [r9]
mov r10, r9
test r10, r10
jne 0x1401c0523
xor r10d, r10d
jmp 0x1401c0527
mov r10d, dword [r9 + 0x14]
mov r9d, ecx
rol r9d, 0xd
add r9d, ecx
mov ecx, r9d
xor ecx, r10d
inc eax
cmp r8d, eax
jg 0x1401c050b
mov eax, ecx
rol eax, 0xf
add eax, ecx
ret

Function at 0x1401c3210
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
mov edi, edx
call fcn.14000118f
mov eax, dword [rax]
add eax, 0x165667b1
add eax, 8
imul edx, esi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
imul edx, edi, 0xc2b2ae3d
add edx, eax
rol edx, 0x11
imul eax, edx, 0x27d4eb2f
mov edx, eax
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
add rsp, 0x28
pop rsi
pop rdi
ret

Function at 0x1401c4dd0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401c4e04
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1401c4de6
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x1401c4e20
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401c4e54
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1401c4e36
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret