joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a0ae0
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov esi, r8d
mov rbp, rdx
call fcn.1400a0070
mov rcx, qword [0x14032ba70]
test byte [rcx + 8], 1
je 0x1400a0b23
mov rax, qword [rcx + 8]
and rax, 0xfffffffffffffffe
mov r9, qword [rax]
jmp 0x1400a0b2b
mov r9, qword [rcx + 8]
and r9, 0xfffffffffffffffe
add rcx, 0xb8
lea r8, [0x14072c640]
xor edx, edx
call fcn.14013d4c0
mov rax, qword [0x14032ba70]
mov qword [rax + 0xd8], 2
lea rdi, [rax + 0x10]
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x1400a0b74
movsxd rcx, dword [rdi + 8]
cmp ecx, dword [rbx]
jge 0x1400a0b74
mov rbx, qword [rbx + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [rdi + 8], eax
jmp 0x1400a0b8a
mov rcx, qword [rdi]
call fcn.1400a7400
mov rdx, rax
mov rcx, rdi
call fcn.14013c300
mov rbx, rax
test rbx, rbx
je 0x1400a0be0
mov dword [rbx + 0x18], 2
mov dword [rbx + 0x1c], esi
test byte [rbx + 8], 1
je 0x1400a0bac
mov rcx, qword [rbx + 8]
and rcx, 0xfffffffffffffffe
mov rdi, qword [rcx]
jmp 0x1400a0bb4
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.14000f200
nop
lea rcx, [rbx + 0x10]
mov r9, rdi
lea r8, [rsp + 0x28]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x28]
call fcn.14000f150
call fcn.1400a05d0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
jmp fcn.1400a0140

Function at 0x1400a0c00
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov esi, r8d
mov rbp, rdx
call fcn.1400a0070
mov rcx, qword [0x14032ba70]
test byte [rcx + 8], 1
je 0x1400a0c43
mov rax, qword [rcx + 8]
and rax, 0xfffffffffffffffe
mov r9, qword [rax]
jmp 0x1400a0c4b
mov r9, qword [rcx + 8]
and r9, 0xfffffffffffffffe
add rcx, 0xb8
lea r8, [0x14072c640]
xor edx, edx
call fcn.14013d4c0
mov rax, qword [0x14032ba70]
mov qword [rax + 0xd8], 3
lea rdi, [rax + 0x10]
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x1400a0c94
movsxd rcx, dword [rdi + 8]
cmp ecx, dword [rbx]
jge 0x1400a0c94
mov rbx, qword [rbx + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [rdi + 8], eax
jmp 0x1400a0caa
mov rcx, qword [rdi]
call fcn.1400a7400
mov rdx, rax
mov rcx, rdi
call fcn.14013c300
mov rbx, rax
test rbx, rbx
je 0x1400a0d00
mov dword [rbx + 0x18], 3
mov dword [rbx + 0x1c], esi
test byte [rbx + 8], 1
je 0x1400a0ccc
mov rcx, qword [rbx + 8]
and rcx, 0xfffffffffffffffe
mov rdi, qword [rcx]
jmp 0x1400a0cd4
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.14000f200
nop
lea rcx, [rbx + 0x10]
mov r9, rdi
lea r8, [rsp + 0x28]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x28]
call fcn.14000f150
call fcn.1400a05d0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
jmp fcn.1400a0140
Function at 0x1400a0d20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov esi, r8d
mov rbp, rdx
call fcn.1400a0070
mov rcx, qword [0x14032ba70]
test byte [rcx + 8], 1
je 0x1400a0d77
mov rax, qword [rcx + 8]
and rax, 0xfffffffffffffffe
mov r9, qword [rax]
jmp 0x1400a0d7f
mov r9, qword [rcx + 8]
and r9, 0xfffffffffffffffe
add rcx, 0xb8
lea r8, [0x14072c640]
xor edx, edx
call fcn.14013d4c0
mov rax, qword [0x14032ba70]
mov qword [rax + 0xd8], 4
lea rdi, [rax + 0x10]
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x1400a0dc8
movsxd rcx, dword [rdi + 8]
cmp ecx, dword [rbx]
jge 0x1400a0dc8
mov rbx, qword [rbx + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [rdi + 8], eax
jmp 0x1400a0dde
mov rcx, qword [rdi]
call fcn.1400a7400
mov rdx, rax
mov rcx, rdi
call fcn.14013c300
mov rbx, rax
test rbx, rbx
je 0x1400a0e34
mov dword [rbx + 0x18], 4
mov dword [rbx + 0x1c], esi
test byte [rbx + 8], 1
je 0x1400a0e00
mov rcx, qword [rbx + 8]
and rcx, 0xfffffffffffffffe
mov rdi, qword [rcx]
jmp 0x1400a0e08
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x10]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
xor ecx, ecx
call fcn.14022f11c
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400c90f0
nop
lea rcx, [rsp + 0x48]
call fcn.14000f0b0
mov r8, rax
mov r9, rbx
lea rdx, str._s_lld
lea rcx, [rsp + 0x70]
call fcn.140010cc0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.14000f200
lea rcx, [rsp + 0x20]
call fcn.14000ed60
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.14000f0b0
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
test rbx, rbx
je 0x1400a0f04
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor rdx, rcx
imul rdx, r9
inc r8
cmp r8, rbx
jb 0x1400a0ef0
mov qword [0x14032ba78], rdx
lea rcx, [rsp + 0x20]
call fcn.14000f150
call fcn.1400a05d0
call fcn.1400a0140
nop
lea rcx, [rsp + 0x48]
call fcn.14000f150
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14013a450
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400a0f60
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov esi, r8d
mov rbp, rdx
call fcn.1400a0070
mov rcx, qword [0x14032ba70]
test byte [rcx + 8], 1
je 0x1400a0fa3
mov rax, qword [rcx + 8]
and rax, 0xfffffffffffffffe
mov r9, qword [rax]
jmp 0x1400a0fab
mov r9, qword [rcx + 8]
and r9, 0xfffffffffffffffe
add rcx, 0xb8
lea r8, [0x14072c640]
xor edx, edx
call fcn.14013d4c0
mov rax, qword [0x14032ba70]
mov qword [rax + 0xd8], 5
lea rdi, [rax + 0x10]
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x1400a0ff4
movsxd rcx, dword [rdi + 8]
cmp ecx, dword [rbx]
jge 0x1400a0ff4
mov rbx, qword [rbx + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [rdi + 8], eax
jmp 0x1400a100a
mov rcx, qword [rdi]
call fcn.1400a7400
mov rdx, rax
mov rcx, rdi
call fcn.14013c300
mov rbx, rax
test rbx, rbx
je 0x1400a1060
mov dword [rbx + 0x18], 5
mov dword [rbx + 0x1c], esi
test byte [rbx + 8], 1
je 0x1400a102c
mov rcx, qword [rbx + 8]
and rcx, 0xfffffffffffffffe
mov rdi, qword [rcx]
jmp 0x1400a1034
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.14000f200
nop
lea rcx, [rbx + 0x10]
mov r9, rdi
lea r8, [rsp + 0x28]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x28]
call fcn.14000f150
call fcn.1400a05d0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
jmp fcn.1400a0140
Function at 0x1400a1080
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov r15, r9
mov rbp, r8
mov rsi, rdx
mov r14, qword [rsp + 0xa0]
call fcn.1400a0070
mov rcx, qword [0x14032ba70]
test byte [rcx + 8], 1
je 0x1400a10cd
mov rax, qword [rcx + 8]
and rax, 0xfffffffffffffffe
mov r9, qword [rax]
jmp 0x1400a10d5
mov r9, qword [rcx + 8]
and r9, 0xfffffffffffffffe
add rcx, 0xb8
lea r8, [0x14072c660]
xor edx, edx
call fcn.14013d4c0
mov rax, qword [0x14032ba70]
mov qword [rax + 0xd8], 1
lea rdi, [rax + 0x28]
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x1400a111e
movsxd rcx, dword [rdi + 8]
cmp ecx, dword [rbx]
jge 0x1400a111e
mov rbx, qword [rbx + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [rdi + 8], eax
jmp 0x1400a1134
mov rcx, qword [rdi]
call fcn.1400a7480
mov rdx, rax
mov rcx, rdi
call fcn.14013c300
mov rbx, rax
test rbx, rbx
je 0x1400a1260
mov dword [rbx + 0x30], 1
test byte [rbx + 8], 1
je 0x1400a1157
mov rcx, qword [rbx + 8]
and rcx, 0xfffffffffffffffe
mov rdi, qword [rcx]
jmp 0x1400a115f
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x10]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a119e
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a11a6
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x18]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a11e5
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a11ed
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x20]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a122c
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a1234
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x28]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
call fcn.1400a05d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.1400a0140
Function at 0x1400a1280
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov r15, r9
mov rbp, r8
mov rsi, rdx
mov r14, qword [rsp + 0xa0]
call fcn.1400a0070
mov rcx, qword [0x14032ba70]
test byte [rcx + 8], 1
je 0x1400a12cd
mov rax, qword [rcx + 8]
and rax, 0xfffffffffffffffe
mov r9, qword [rax]
jmp 0x1400a12d5
mov r9, qword [rcx + 8]
and r9, 0xfffffffffffffffe
add rcx, 0xb8
lea r8, [0x14072c660]
xor edx, edx
call fcn.14013d4c0
mov rax, qword [0x14032ba70]
mov qword [rax + 0xd8], 2
lea rdi, [rax + 0x28]
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x1400a131e
movsxd rcx, dword [rdi + 8]
cmp ecx, dword [rbx]
jge 0x1400a131e
mov rbx, qword [rbx + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [rdi + 8], eax
jmp 0x1400a1334
mov rcx, qword [rdi]
call fcn.1400a7480
mov rdx, rax
mov rcx, rdi
call fcn.14013c300
mov rbx, rax
test rbx, rbx
je 0x1400a1460
mov dword [rbx + 0x30], 2
test byte [rbx + 8], 1
je 0x1400a1357
mov rcx, qword [rbx + 8]
and rcx, 0xfffffffffffffffe
mov rdi, qword [rcx]
jmp 0x1400a135f
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x10]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a139e
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a13a6
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x18]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a13e5
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a13ed
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x20]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a142c
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a1434
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x28]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
call fcn.1400a05d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.1400a0140
Function at 0x1400a1480
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov r15, r9
mov rbp, r8
mov rsi, rdx
mov r14, qword [rsp + 0xa0]
call fcn.1400a0070
mov rcx, qword [0x14032ba70]
test byte [rcx + 8], 1
je 0x1400a14cd
mov rax, qword [rcx + 8]
and rax, 0xfffffffffffffffe
mov r9, qword [rax]
jmp 0x1400a14d5
mov r9, qword [rcx + 8]
and r9, 0xfffffffffffffffe
add rcx, 0xb8
lea r8, [0x14072c660]
xor edx, edx
call fcn.14013d4c0
mov rax, qword [0x14032ba70]
mov qword [rax + 0xd8], 3
lea rdi, [rax + 0x28]
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x1400a151e
movsxd rcx, dword [rdi + 8]
cmp ecx, dword [rbx]
jge 0x1400a151e
mov rbx, qword [rbx + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [rdi + 8], eax
jmp 0x1400a1534
mov rcx, qword [rdi]
call fcn.1400a7480
mov rdx, rax
mov rcx, rdi
call fcn.14013c300
mov rbx, rax
test rbx, rbx
je 0x1400a1660
mov dword [rbx + 0x30], 3
test byte [rbx + 8], 1
je 0x1400a1557
mov rcx, qword [rbx + 8]
and rcx, 0xfffffffffffffffe
mov rdi, qword [rcx]
jmp 0x1400a155f
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x10]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a159e
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a15a6
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x18]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a15e5
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a15ed
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x20]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a162c
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a1634
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x28]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
call fcn.1400a05d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp fcn.1400a0140
Function at 0x1400a1680
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbp, r9
mov r14, r8
mov rsi, rdx
call fcn.1400a0070
mov rcx, qword [0x14032ba70]
test byte [rcx + 8], 1
je 0x1400a16bc
mov rax, qword [rcx + 8]
and rax, 0xfffffffffffffffe
mov r9, qword [rax]
jmp 0x1400a16c4
mov r9, qword [rcx + 8]
and r9, 0xfffffffffffffffe
add rcx, 0xb8
lea r8, [0x14072c7a8]
xor edx, edx
call fcn.14013d4c0
mov rdi, qword [0x14032ba70]
mov rbx, qword [rdi + 0x50]
test rbx, rbx
je 0x1400a16fe
movsxd rcx, dword [rdi + 0x48]
cmp ecx, dword [rbx]
jge 0x1400a16fe
mov rbx, qword [rbx + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [rdi + 0x48], eax
jmp 0x1400a1716
mov rcx, qword [rdi + 0x40]
call fcn.1400a7500
mov rdx, rax
lea rcx, [rdi + 0x40]
call fcn.14013c300
mov rbx, rax
test rbx, rbx
je 0x1400a17f4
test byte [rbx + 8], 1
je 0x1400a1732
mov rcx, qword [rbx + 8]
and rcx, 0xfffffffffffffffe
mov rdi, qword [rcx]
jmp 0x1400a173a
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x10]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a1779
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a1781
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x18]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
test byte [rbx + 8], 1
je 0x1400a17c0
mov rax, qword [rbx + 8]
and rax, 0xfffffffffffffffe
mov rdi, qword [rax]
jmp 0x1400a17c8
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x20]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
call fcn.1400a05d0
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.1400a0140
Function at 0x1400a1810
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rsi, r8
mov rbp, rdx
call fcn.1400a0070
mov rcx, qword [0x14032ba70]
test byte [rcx + 8], 1
je 0x1400a184b
mov rax, qword [rcx + 8]
and rax, 0xfffffffffffffffe
mov r9, qword [rax]
jmp 0x1400a1853
mov r9, qword [rcx + 8]
and r9, 0xfffffffffffffffe
add rcx, 0xb8
lea r8, [0x14072c620]
xor edx, edx
call fcn.14013d4c0
mov rdi, qword [0x14032ba70]
mov rbx, qword [rdi + 0x68]
test rbx, rbx
je 0x1400a188d
movsxd rcx, dword [rdi + 0x60]
cmp ecx, dword [rbx]
jge 0x1400a188d
mov rbx, qword [rbx + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [rdi + 0x60], eax
jmp 0x1400a18a5
mov rcx, qword [rdi + 0x58]
call fcn.1400a7580
mov rdx, rax
lea rcx, [rdi + 0x58]
call fcn.14013c300
mov rbx, rax
test rbx, rbx
je 0x1400a1938
test byte [rbx + 8], 1
je 0x1400a18c1
mov rcx, qword [rbx + 8]
and rcx, 0xfffffffffffffffe
mov rdi, qword [rcx]
jmp 0x1400a18c9
mov rdi, qword [rbx + 8]
and rdi, 0xfffffffffffffffe
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.14000f200
nop
lea rcx, [rbx + 0x10]
mov r9, rdi
lea r8, [rsp + 0x20]
xor edx, edx
call fcn.14013d4c0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
mov rax, qword [rsi]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [rax + Ordinal_74]
nop
test byte [rbx + 8], 1
je 0x1400a1917
mov rcx, qword [rbx + 8]
and rcx, 0xfffffffffffffffe
mov r9, qword [rcx]
jmp 0x1400a191f
mov r9, qword [rbx + 8]
and r9, 0xfffffffffffffffe
lea rcx, [rbx + 0x18]
mov r8, rax
xor edx, edx
call fcn.14013d4b0
nop
lea rcx, [rsp + 0x20]
call fcn.14000f150
call fcn.1400a05d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
jmp fcn.1400a0140

Function at 0x1400a1c00
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x160
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x30]
mov rdi, rdx
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x30], 0
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400a1cc9
xor edx, edx
mov qword [rsp + 0x170], rbx
mov r8d, 0x104
lea rcx, [rsp + 0x40]
call fcn.14021ee30
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402c6688]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x38], 0x104
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x170]
je 0x1400a1cd2
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x1402becd1]
jmp 0x1400a1cd7
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000f200
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14013a450
add rsp, 0x160
pop rdi
ret
Function at 0x1400adc00
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xe8]
sub rsp, 0x1e0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x14031f2d0]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rdi, r8
mov rbx, rdx
mov qword [rsp + 0x28], rdx
lea rcx, [rbp - 0x68]
call fcn.14000f250
nop
test rdi, rdi
je 0x1400add99
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
lea r8, [rbp - 0x68]
mov rdx, rdi
lea rcx, [rbp - 0x48]
call fcn.140196d80
nop
cmp dword [rbp - 0x48], 0
jne 0x1400adc91
lea rdx, [rbp - 0x68]
mov rcx, rbx
call fcn.14000f180
nop
lea rcx, [rbp - 0x40]
call fcn.14000f150
jmp 0x1400adda6
call fcn.1400a7f30
cmp byte [rax + 0x28c], 0
je 0x1400add7e
mov eax, dword [rbp - 0x48]
mov dword [rsp + 0x28], eax
mov edx, 0xe8
lea rcx, [rbp - 0x20]
call fcn.140004bc0
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rbp - 0x20]
call fcn.140074db0
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], 1
lea r9, [0x1400a9ba0]
mov edx, Ordinal_26
lea r8d, [rdx - 0x17]
lea rcx, [rsp + 0x58]
call fcn.140004ab0
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [0x1400b4070]
mov qword [rsp + 0x38], rax
lea rax, [0x1400b4180]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x58], xmm0
movsd xmm1, qword [rsp + 0x40]
movsd qword [rsp + 0x68], xmm1
mov r9d, dword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
lea rdx, str._d_r_n
lea rcx, [rbp - 0x20]
call fcn.1400aa360
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x20]
call fcn.140074cd0
nop
lea rcx, [rbp - 0x20]
call fcn.1400733f0
lea rcx, [rsp + 0x78]
call fcn.14000f0b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x78]
call fcn.14000f150
lea rdx, [0x1402becd1]
mov rcx, rbx
call fcn.14000f200
nop
lea rcx, [rbp - 0x40]
call fcn.14000f150
jmp 0x1400adda6
lea rdx, [rbp - 0x68]
mov rcx, rbx
call fcn.14000f180
nop
lea rcx, [rbp - 0x68]
call fcn.14000f150
mov rax, rbx
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.14013a450
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret