joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180174d30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r13, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x180174f21
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov r12, qword [r13 + 8]
lea rsi, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, r12
mov rcx, rsi
call fcn.1801207c0
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0xa8], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
cmp rdi, r12
je 0x180174edd
mov rbx, rdi
nop
mov rdi, qword [rdi]
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x10]
call fcn.180176790
movsxd rcx, dword [rax + 8]
imul r14, rcx, 0x1000193
imul rax, qword [rax], 0x100011b
xor r14, rax
and r14, qword [r13 + 0x30]
shl r14, 4
add r14, qword [rsi]
cmp qword [r14], r12
jne 0x180174e02
mov qword [r14], rbx
mov qword [r14 + 8], rbx
jmp 0x180174ed1
mov rsi, qword [r14 + 8]
lea rcx, [rsi + 0x10]
lea rdx, [rsp + 0x30]
call fcn.180176790
mov r15, rax
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x10]
call fcn.180176790
mov rcx, qword [r15]
cmp qword [rax], rcx
jne 0x180174e65
mov ecx, dword [r15 + 8]
cmp dword [rax + 8], ecx
jne 0x180174e65
mov r8, qword [rsi]
cmp r8, rbx
je 0x180174e5f
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r14 + 8], rbx
jmp 0x180174ecd
cmp qword [r14], rsi
je 0x180174ea9
nop word [rax + rax]
mov rsi, qword [rsi + 8]
lea rcx, [rsi + 0x10]
lea rdx, [rsp + 0x50]
call fcn.180176790
mov r15, rax
lea rdx, [rsp + 0x60]
lea rcx, [rbx + 0x10]
call fcn.180176790
mov rcx, qword [r15]
cmp qword [rax], rcx
jne 0x180174ea4
mov ecx, dword [r15 + 8]
cmp dword [rax + 8], ecx
je 0x180174efb
cmp qword [r14], rsi
jne 0x180174e70
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r14], rbx
lea rsi, [r13 + 0x18]
mov rbx, rdi
cmp rdi, r12
jne 0x180174dc0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x180174ecd
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1801796b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x180225b80]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov rcx, rdx
call fcn.18011b340
dec eax
cmp eax, 9
ja case.default.0x1801796ea
cdqe
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x17999c]
add rcx, rdx
jmp rcx
mov r9d, 0x11f
lea r8, str.C:_someshit_srcsprotobuf_3.21.12_srcgoogle_protobuf_map_field.h
mov edx, 3
lea rcx, [rsp + 0x28]
call fcn.180100390
nop
lea rdx, str.Unsupported
mov rcx, rax
call fcn.180100790
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.180100580
nop
lea rcx, [rsp + 0x28]
call fcn.180100510
mov r9d, 0x137
lea r8, str.C:_someshit_srcsprotobuf_3.21.12_srcgoogle_protobuf_map_field.h
mov edx, 3
lea rcx, [rsp + 0x28]
call fcn.180100390
nop
lea rdx, str.Cant_get_here.
mov rcx, rax
call fcn.180100790
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.180100580
nop
lea rcx, [rsp + 0x28]
call fcn.180100510
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180199a90
add rsp, 0x70
pop rbx
ret
mov rcx, rbx
call fcn.180115500
mov r9, rax
mov r8, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1801797a1
mov r8, qword [rax]
movabs rax, 0xcbf29ce484222325
mov r9, qword [r9 + 0x10]
xor edx, edx
test r9, r9
je 0x180179776
movabs r10, 0x100000001b3
movzx ecx, byte [r8 + rdx]
xor rax, rcx
imul rax, r10
inc rdx
cmp rdx, r9
jb 0x1801797c0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180199a90
add rsp, 0x70
pop rbx
ret
mov rcx, rbx
call fcn.180115190
mov r8, rax
mov rcx, rax
shr rcx, 8
movzx r9d, cl
movzx ecx, al
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
xor r9, rcx
imul r9, r10
mov rax, r8
shr rax, 0x10
movzx ecx, al
xor r9, rcx
imul r9, r10
mov rax, r8
shr rax, 0x18
movzx ecx, al
xor r9, rcx
imul r9, r10
mov rax, r8
shr rax, 0x20
movzx ecx, al
xor r9, rcx
imul r9, r10
mov rax, r8
shr rax, 0x28
movzx eax, al
xor rax, r9
imul rax, r10
mov rcx, r8
shr rcx, 0x30
movzx edx, cl
xor rax, rdx
imul rax, r10
shr r8, 0x38
xor rax, r8
imul rax, r10
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180199a90
add rsp, 0x70
pop rbx
ret
mov rcx, rbx
call fcn.180114f40
mov rcx, rbx
call fcn.180114f40
mov r8d, eax
movzx r9d, al
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
mov eax, r8d
shr eax, 8
movzx eax, al
xor rax, r9
imul rax, r10
mov ecx, r8d
shr ecx, 0x10
movzx edx, cl
xor rax, rdx
imul rax, r10
shr r8, 0x18
xor rax, r8
imul rax, r10
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180199a90
add rsp, 0x70
pop rbx
ret
mov rcx, rbx
call fcn.180115990
mov rcx, rbx
call fcn.180115990
jmp 0x1801797ef
mov rcx, rbx
call fcn.180115740
mov rcx, rbx
call fcn.180115740
mov r8d, eax
shr eax, 8
movzx r9d, al
movzx ecx, r8b
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs r10, 0x100000001b3
imul rax, r10
xor rax, r9
imul rax, r10
mov ecx, r8d
shr ecx, 0x10
movzx edx, cl
xor rax, rdx
imul rax, r10
shr r8, 0x18
jmp 0x18017987b
mov rcx, rbx
call fcn.180114ce0
movzx ecx, al
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs r10, 0x100000001b3
jmp 0x18017987e
Function at 0x180198ad8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x180198b12
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x180198b17
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180198b60
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1801cb1a0]
cmp byte [rcx + rax], 0
je 0x180198b60
dec r8
sub rdx, 1
jne 0x180198b46
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x180011221
Capabilities:
Terminate process

Disassembly:
jmp 0x1800142f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1800112da
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
jmp 0x180016de0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x180025218]
call fcn.1800113c0
call fcn.180011406
mov dword [rbp + 4], 0
jmp 0x180016e3f
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xa
jge 0x180016e52
mov dl, 1
lea rcx, [rbp + 4]
call fcn.180011294
jmp 0x180016e37
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
add rax, 0x21f80
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x68], rax
xor eax, eax
cmp eax, 1
je 0x180016ec6
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x180016ea0
mov dl, 1
lea rcx, [0x18001c0c0]
call fcn.18001144c
jmp 0x180016ec6
xor edx, edx
lea rcx, [0x18001b8e0]
call fcn.180011447
mov dl, 1
mov rcx, qword [rbp + 0x68]
call fcn.180011294
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180016e74
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 0x160]
lea r8, [0x180011357]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [rbp - 0x30]
lea rdx, [0x18001c0b0]
call fcn.180011343
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1800111e0
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x14000111c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rdi
mov eax, 0x2058
call fcn.14000e870
sub rsp, rax
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rcx
lea rdi, [rsp + 0x2078]
call fcn.1400010d0
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x40]
and qword [rsp + 0x28], 0
or r9, 0xffffffffffffffff
mov r8d, 0x1000
mov qword [rsp + 0x20], rbx
mov rcx, qword [rax]
call qword [sym.imp.ucrtbase_clr0400.dll___stdio_common_vsnwprintf_s]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000119f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1400011d1
mov ebx, 1
mov ecx, ebx
call qword [sym.imp.ucrtbase_clr0400.dll___acrt_iob_func]
mov rcx, rax
lea r8, [rsp + 0x40]
lea rdx, [0x1400118f0]
call fcn.1400010d8
mov ecx, ebx
call qword [sym.imp.ucrtbase_clr0400.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.ucrtbase_clr0400.dll_fflush]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14000db20
add rsp, 0x2058
pop rdi
pop rbx
ret
Function at 0x140003708
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbp
push rbx
lea rbp, [rax - 0x178]
sub rsp, 0x268
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor ebx, ebx
cmp byte [0x1400231dc], bl
jne 0x14000376f
lea r8, [rsp + 0x20]
lea rcx, str.NGenServiceDebugLog
call fcn.140005674
mov dword [0x1400231d8], eax
mov byte [0x1400231dc], 1
jmp 0x140003775
mov eax, dword [0x1400231d8]
test eax, eax
je 0x1400037e5
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x34], 0x200
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 2
mov rax, qword [rsp + 0x40]
mov word [rax], bx
lea r8, [rbp + 0x188]
mov rdx, qword [rbp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.14000938c
lea rcx, [rsp + 0x30]
call fcn.1400087cc
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
test byte [rsp + 0x38], 8
je 0x1400037e5
mov rcx, qword [rsp + 0x40]
call fcn.140005218
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.14000db20
add rsp, 0x268
pop rbx
pop rbp
ret
Function at 0x140004338
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
call fcn.140003800
and qword [rsp + 0x30], 0
lea rcx, str.Calling_StartServiceCtrlDispatcher_n
and qword [rsp + 0x38], 0
mov qword [rsp + 0x20], rax
lea rax, [0x140004270]
mov qword [rsp + 0x28], rax
call fcn.140003708
mov rbx, qword [0x1400228d8]
test rbx, rbx
jne 0x1400043ca
cmp byte [0x1400228a9], bl
jne 0x1400043c6
xor r8d, r8d
lea rcx, str.advapi32.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x1400043b3
lea rdx, str.StartServiceCtrlDispatcherW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1400228d8], rax
jmp 0x1400043ba
mov rbx, qword [0x1400228d8]
mov byte [0x1400228a9], 1
test rbx, rbx
jne 0x1400043ca
xor eax, eax
jmp 0x1400043da
mov rcx, rbx
call qword [fcn.14000e680]
lea rcx, [rsp + 0x20]
call rbx
test eax, eax
jne 0x1400043f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StartServiceCtrlDispatcher_failed_with_error__d.__Will_try_slow_path_n
call fcn.140003708
jmp 0x140004411
lea rcx, str.StartServiceCtrlDispatcher_done__exiting_n
call fcn.140003708
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x40
pop rbx
ret

Function at 0x140004418
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x178]
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x44], 0x200
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 2
mov rax, qword [rsp + 0x50]
mov word [rax], bx
lea rcx, [rsp + 0x40]
call fcn.140001844
lea rdx, str._ndpsetup.bat
lea rcx, [rsp + 0x40]
call fcn.1400014fc
lea rcx, [rsp + 0x40]
call fcn.1400087cc
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400044d5
mov dword [rsp + 0x30], ebx
lea r9, [rsp + 0x30]
lea r8, str.Install
lea rdx, str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Client
call fcn.14000b280
test eax, eax
je 0x1400044d3
cmp dword [rsp + 0x30], 1
je 0x1400044d5
mov bl, 1
test byte [rsp + 0x48], 8
je 0x1400044e6
mov rcx, qword [rsp + 0x50]
call fcn.140005218
mov al, bl
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14000db20
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rbp
ret
Function at 0x140004af4
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_WerSetFlags]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
call fcn.140008518
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.140005c98
mov ebx, dword [rsp + 0x20]
mov rdi, rax
sub ebx, 1
je 0x140004b59
cmp ebx, 1
jne 0x140004b63
mov rcx, qword [rax + 8]
lea rdx, str._private
call qword [sym.imp.ucrtbase_clr0400.dll__wcsicmp]
test eax, eax
jne 0x140004b63
test ebx, ebx
setg cl
call fcn.1400047e0
and dword [rsp + 0x20], 0
lea r8, [rsp + 0x20]
lea rdx, [rdi + 8]
mov ecx, ebx
call fcn.140003184
test al, al
je 0x140004b82
mov eax, dword [rsp + 0x20]
jmp 0x140004b8d
lea rdx, [rdi + 8]
mov ecx, ebx
call fcn.14000348c
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000a7dc
Capabilities:
Hash data using djb2
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
or rbp, 0xffffffffffffffff
mov rbx, rcx
mov r8, rbp
xor esi, esi
inc r8
cmp word [rcx + r8*2], si
jne 0x14000a811
mov eax, edx
neg eax
sbb rcx, rcx
and rcx, 0xfffffffffffffff8
add rcx, 0x3f
cmp r8, rcx
jbe 0x14000a836
xor eax, eax
jmp 0x14000a905
mov edi, 0x40
test edx, edx
je 0x14000a8a4
cmp dword [0x140022968], esi
je 0x14000a88d
movzx ecx, word [rbx]
mov r8, rbx
mov edx, 0x1505
jmp 0x14000a86c
lea eax, [rcx - 0x61]
cmp eax, 0x19
ja 0x14000a85f
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add r8, 2
movzx ecx, word [r8]
test ecx, ecx
jne 0x14000a854
movzx ecx, dl
mov eax, ecx
mov edx, ecx
shr rax, 5
lea rcx, [0x140023010]
and edx, 0x1f
mov eax, dword [rcx + rax*4]
bt eax, edx
jae 0x14000a82f
lea r8, str.COMPlus_
mov rdx, rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.ucrtbase_clr0400.dll_wcscpy_s]
jmp 0x14000a8a9
mov word [rsp + 0x20], si
mov r8, rbx
lea rcx, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.ucrtbase_clr0400.dll_wcscat_s]
xor r8d, r8d
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rdi, eax
test eax, eax
je 0x14000a82f
mov eax, 2
mul rdi
cmovo rax, rbp
mov rcx, rax
call fcn.1400051d4
mov rbx, rax
test rax, rax
je 0x14000a902
mov r8d, edi
lea rcx, [rsp + 0x20]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14000db20
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000a930
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], r9d
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x28], 0
mov rbx, r8
and dword [rbp + 0x48], 0
mov r14, rdx
mov esi, dword [rbp + 0x50]
mov r12, rcx
mov dword [rbp - 0x30], 4
test sil, 1
je 0x14000a9d7
mov edx, dword [rbp + 0x58]
call fcn.14000a7dc
mov rdi, rax
test rax, rax
je 0x14000a9d7
call qword [sym.imp.ucrtbase_clr0400.dll__errno]
mov r8d, 0x10
lea rdx, [rbp - 0x10]
mov rcx, rdi
and dword [rax], 0
call qword [sym.imp.ucrtbase_clr0400.dll_wcstoul]
mov r13d, eax
call qword [sym.imp.ucrtbase_clr0400.dll__errno]
cmp dword [rax], 0x22
je 0x14000a9bd
cmp qword [rbp - 0x10], rdi
je 0x14000a9bd
mov r15d, 1
jmp 0x14000a9c0
xor r15d, r15d
mov rcx, rdi
call fcn.140005218
test r15d, r15d
je 0x14000a9d7
mov qword [rbx], r13
xor eax, eax
jmp 0x14000ab25
test sil, 0xe
je 0x14000ab1d
mov rcx, r12
call fcn.14000afa8
test eax, eax
je 0x14000ab1d
mov r13d, 0x20019
test sil, 2
je 0x14000aa8e
mov rcx, qword [0x140022090]
xor edi, edi
mov qword [rbp - 0x20], rcx
cmp rcx, 0xffffffffffffffff
jne 0x14000aa44
lea rax, [rbp - 0x20]
mov r9d, r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoft.NETFramework
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 1
test eax, eax
jne 0x14000aa8e
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x48]
lea rax, [rbp - 0x28]
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd r15, eax
test edi, edi
je 0x14000aa77
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
jne 0x14000aa8e
cmp dword [rbp + 0x48], 4
jne 0x14000aa8e
mov rax, qword [rbp - 0x28]
mov qword [rbx], rax
jmp 0x14000a9d0
test sil, 4
je 0x14000ab1d
mov rcx, qword [0x140022088]
xor edi, edi
mov qword [rbp - 0x18], rcx
cmp rcx, 0xffffffffffffffff
jne 0x14000aadb
lea rax, [rbp - 0x18]
mov r9d, r13d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoft.NETFramework
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 1
test eax, eax
jne 0x14000ab1d
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x48]
lea rax, [rbp - 0x28]
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rsi, eax
test edi, edi
je 0x14000ab0e
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
jne 0x14000ab1d
cmp dword [rbp + 0x48], 4
je 0x14000aa82
mov qword [rbx], r14
mov eax, 0x80004005
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000afa8
Capabilities:
Hash data using djb2

Disassembly:
xor r8d, r8d
mov rdx, rcx
cmp dword [0x14002295c], r8d
je 0x14000b011
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r8w
jne 0x14000afbb
cmp rax, 0x50
ja 0x14000b011
movzx ecx, word [rcx]
mov r9d, 0x1505
jmp 0x14000afef
lea eax, [rcx - 0x61]
cmp eax, 0x19
ja 0x14000afe1
and ecx, 0xffffffdf
imul r9d, r9d, 0x21
xor r9d, ecx
add rdx, 2
movzx ecx, word [rdx]
test ecx, ecx
jne 0x14000afd6
movzx ecx, r9b
mov eax, ecx
mov edx, ecx
shr rax, 5
lea rcx, [0x140023030]
and edx, 0x1f
mov eax, dword [rcx + rax*4]
bt eax, edx
jae 0x14000b017
mov r8d, 1
mov eax, r8d
ret

Function at 0x14000b280
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
mov rbx, r9
mov rdi, r8
and qword [rbp - 0x18], 0
lea rax, [rbp - 0x18]
mov qword [r11 - 0x38], rax
mov r9d, 0x20019
call fcn.14000b798
test eax, eax
jne 0x14000b311
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x10], 4
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b311
cmp dword [rbp + 0x30], 4
jne 0x14000b311
cmp dword [rbp + 0x10], 4
jne 0x14000b311
mov eax, dword [rbp - 0x20]
mov dword [rbx], eax
mov ebx, 1
jmp 0x14000b313
xor ebx, ebx
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14000b322
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x14000bd40
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov esi, edx
mov ecx, dword [0x140022084]
cmp ecx, 0xffffffff
jne 0x14000bd8d
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
or eax, 0xffffffff
lock cmpxchg dword [0x140022084], ecx
je 0x14000bd79
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [0x140022084]
lea rax, [0x14000bd30]
mov qword [0x140022048], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x14000bdf9
test esi, esi
je 0x14000bdf9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, 0xb0
xor edx, edx
mov rcx, rax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14000bddd
cmp edi, 9
je 0x14000be0c
cmp edi, 6
je 0x14000be0c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc0000017
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov r8, rsi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140_CLR0400.dll_memset
mov ecx, dword [0x140022084]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x14000bdfc