joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad660
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad877
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4ad78e
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x4ad869
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rbx, rdx
je 0x4ad702
mov rax, rdx
mov rcx, rsi
call fcn.0045ffc0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x4ad76a
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004adb00
xorps xmm15, xmm15
mov r14, qword [0x006a9ae8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x4ad861
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x4ad794
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x4ad811
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.004adb00
xorps xmm15, xmm15
mov r14, qword [0x006a9ae8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x4ad84f
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x4ad84b
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.0045ffc0
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
nop
ret
mov rax, rsi
call fcn.0045f700
mov rax, rdx
mov ecx, 0x40
call fcn.0045f700
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045cfe0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004ad660
Function at 0x140002600
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xe0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140002640
sub r9, 1
jne 0x140002630
mov bpl, 0xd
lea rdi, [rsi + 0xd0]
lea r14, [0x140062d30]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400026e0
inc r8
sub r9, 1
jne 0x1400026d0
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140002720
sub r8, 1
jne 0x140002710
mov rcx, rbx
call fcn.140002060
sub rdi, 0x10
add bpl, 0xff
jne 0x140002670
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400027c0
inc r8
sub r9, 1
jne 0x1400027b0
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400027f0
sub rdx, 1
jne 0x1400027e2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400136b0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, dword [rcx]
lea rdi, [0x140062f30]
xor r8d, r8d
mov r11, rdx
mov r10, rcx
mov r9d, r8d
mov ebx, r8d
test eax, eax
jle 0x14001370b
nop word [rax + rax]
mov rdx, qword [r11]
lea rbx, [rbx + 1]
inc r9d
movzx eax, byte [rdx + rbx - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + rbx - 1], al
mov eax, dword [r10]
cmp r9d, eax
jl 0x1400136e0
mov r9d, r8d
mov rbx, r8
test eax, eax
jle 0x14001374c
nop word [rax + rax]
mov rdx, qword [r11 + 8]
lea rbx, [rbx + 1]
inc r9d
movzx eax, byte [rdx + rbx - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + rbx - 1], al
mov eax, dword [r10]
cmp r9d, eax
jl 0x140013720
mov r9d, r8d
mov rbx, r8
test eax, eax
jle 0x14001378c
nop word [rax + rax]
mov rdx, qword [r11 + 0x10]
lea rbx, [rbx + 1]
inc r9d
movzx eax, byte [rdx + rbx - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + rbx - 1], al
mov eax, dword [r10]
cmp r9d, eax
jl 0x140013760
mov r9, r8
test eax, eax
jle 0x1400137be
mov rdx, qword [r11 + 0x18]
lea r9, [r9 + 1]
inc r8d
movzx eax, byte [rdx + r9 - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + r9 - 1], al
cmp r8d, dword [r10]
jl 0x140013793
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14001a8b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13d0
call fcn.140028c70
sub rsp, rax
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea ecx, [rdi + 0x10]
call fcn.140027fe4
mov qword [rsi], rax
mov qword [rsi + 8], rax
add rax, 0x10
mov qword [rsi + 0x10], rax
mov rax, qword [rsi]
lea rcx, [rax + 0x10]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rsi + 8], rcx
mov ebx, 1
mov dword [rsp + 0x20], ebx
call fcn.1400276a8
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, ebx
mov dword [rsp + rbx*4 + 0x34], eax
inc rbx
cmp rbx, 0x270
jb 0x14001a940
mov dword [rsp + 0x30], 0x270
nop word [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.14001c8f0
movzx edx, al
mov rcx, qword [rsi]
mov byte [rdi + rcx], dl
inc rdi
cmp rdi, 0x10
jl 0x14001a970
mov rax, rsi
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.140027f90
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14001a9c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x130
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebp, edx
mov rbx, r8
add ebp, 0xfffffff0
mov r14, rcx
test rcx, rcx
je 0x14001a9f7
movups xmm0, xmmword [rcx]
jmp 0x14001aa0a
call fcn.14003360c
mov dword [rax], 0x16
call fcn.14002e908
xorps xmm0, xmm0
mov rdx, qword [rbx]
lea rcx, [rsp + 0x20]
add r14, 0x10
call fcn.140001bf0
movaps xmmword [rsp + 0x110], xmm0
mov rbx, r14
mov esi, ebp
test ebp, ebp
je 0x14001aa99
mov qword [rsp + 0x158], rdi
lea rdi, [rsp + 0x110]
sub rdi, r14
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140002600
mov ecx, 0x10
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14001aa70
sub rdi, 0x10
movaps xmmword [rsp + 0x110], xmm0
sub rsi, 1
jne 0x14001aa50
mov rdi, qword [rsp + 0x158]
lea eax, [rbp - 1]
xor ecx, ecx
movzx eax, byte [rax + r14]
sub ebp, eax
cmp eax, 0x10
cmova ebp, ecx
mov eax, ebp
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.140027f90
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop r14
pop rsi
pop rbp
ret
Function at 0x14001aae0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x170
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [r11 + 8], rbx
xorps xmm0, xmm0
mov qword [r11 - 0x18], rdi
mov rbx, rcx
mov qword [r11 - 0x20], r14
lea rcx, [rsp + 0x20]
xor eax, eax
mov qword [r11 - 0x28], r15
mov r14, r8
mov qword [rsp + 0x30], rax
mov rdi, rdx
movups xmmword [rsp + 0x20], xmm0
call fcn.14001a8b0
mov rax, qword [r14]
mov rsi, qword [rsp + 0x20]
mov r15, qword [rbx]
test rax, rax
je 0x14001ac40
mov qword [rsp + 0x168], rbp
mov ebp, dword [rdi + 0x10]
test rsi, rsi
je 0x14001ab5b
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
jmp 0x14001ab71
xorps xmm0, xmm0
movups xmmword [rax], xmm0
call fcn.14003360c
mov dword [rax], 0x16
call fcn.14002e908
cmp qword [rdi + 0x18], 0x10
jb 0x14001ab7b
mov rdi, qword [rdi]
mov rcx, qword [r14]
mov r9, rbp
add rcx, 0x10
mov r8, rdi
mov rdx, rbp
call fcn.14001ca80
mov rcx, qword [r14]
mov eax, ebp
and eax, 0xf
add rcx, 0x10
mov edi, 0x10
mov r8d, 0x10
sub edi, eax
add rcx, rbp
movzx eax, bpl
mov edx, edi
and eax, 0xf
sub r8, rax
call fcn.14002a8b0
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140001bf0
mov rbx, qword [r14]
lea eax, [rdi + rbp]
movups xmm0, xmmword [rsi]
mov rbp, qword [rsp + 0x168]
lea r8, [rsp + 0x130]
add rbx, 0x10
mov edi, eax
movaps xmmword [rsp + 0x130], xmm0
test eax, eax
je 0x14001ac3b
dec rdi
shr rdi, 4
inc rdi
nop
mov rax, rbx
sub r8, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14001ac10
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002300
mov r8, rbx
add rbx, 0x10
sub rdi, 1
jne 0x14001ac00
mov rsi, qword [rsp + 0x20]
mov r15, qword [rsp + 0x150]
mov r14, qword [rsp + 0x158]
mov rdi, qword [rsp + 0x160]
mov rbx, qword [rsp + 0x180]
test rsi, rsi
je 0x14001ac96
mov rdx, qword [rsp + 0x30]
mov rax, rsi
sub rdx, rsi
cmp rdx, 0x1000
jb 0x14001ac8e
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001acaf
mov rcx, rsi
call fcn.140027fdc
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140027f90
add rsp, 0x170
pop rsi
ret
call fcn.14002e928
int3
Function at 0x14001ae80
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [rsp + 0x80]
xor sil, sil
cmp qword [r8 + 0x18], 0x10
mov rdi, r9
mov rax, r8
jb 0x14001aeb9
mov rax, qword [r8]
lea rcx, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001afa2
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
mov dword [rsp + 0x38], eax
jb 0x14001aef5
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001af97
mov edx, dword [rsp + 0x38]
xor r8d, r8d
dec edx
mov dword [rsp + 0x3c], 1
mov rcx, rbx
call fcn.140002820
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x14001af43
mov rax, qword [rbx]
cmp qword [rdi + 0x18], 0x10
jb 0x14001af4d
mov rdi, qword [rdi]
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x3c]
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001af97
cmp dword [rsp + 0x38], eax
jne 0x14001af94
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x14001af89
mov rax, qword [rbx]
mov qword [rbx + 0x10], 0
mov byte [rax], sil
mov sil, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140027f90
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14001c8f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14001c951
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14001c910
mov ecx, dword [r10]
jmp 0x14001ca3a
cmp ecx, 0x4e0
jb 0x14001ca3a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001c970
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001c9c0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14001d940
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rcx
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 5
test rax, rax
jne 0x14001d987
mov eax, 7
jmp 0x14001da47
xor r15d, r15d
mov edi, r15d
test rax, rax
je 0x14001da42
mov r14d, r15d
mov ebp, 0xf
nop
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rbp
mov byte [rsp + 0x48], 0
add rdx, r14
lea rcx, [rsp + 0x28]
call fcn.1400012e0
mov rbx, rax
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14001d9d1
mov rcx, qword [rax]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov rdx, qword [rbx + 0x18]
test eax, eax
je 0x14001da6e
cmp rdx, 0x10
jb 0x14001da19
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14001da14
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001dab2
mov rcx, r8
call fcn.140027fdc
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], rbp
mov byte [rbx], 0
inc rdi
add r14, 0x20
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
sub rax, rdx
sar rax, 5
cmp rdi, rax
jb 0x14001d9a0
mov eax, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140027f90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
cmp rdx, 0x10
jb 0x14001daa0
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14001da9b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001dab2
mov rcx, r8
call fcn.140027fdc
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], rbp
mov byte [rbx], 0
mov eax, 6
jmp 0x14001da47
call fcn.14002e928
int3
Function at 0x14001f130
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rcx
xor r14d, r14d
mov esi, r14d
cmp qword [rdx + 0x18], 0x10
jb 0x14001f16b
mov rdx, qword [rdx]
mov qword [rbp + 7], r14
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], sil
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], sil
jne 0x14001f190
lea rcx, [rbp + 7]
call fcn.1400019d0
nop
cmp qword [rdi + 0x18], 0x10
jb 0x14001f1ad
mov rdi, qword [rdi]
mov qword [rbp - 0x19], r14
mov qword [rbp - 9], r14
mov qword [rbp - 1], 0xf
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14001f1c0
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x19]
call fcn.1400019d0
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae rdx, qword [rbp - 0x19]
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001f260
mov dword [rbp + 0x2f], r14d
mov dword [rbp + 0x33], 4
mov dword [rbp + 0x37], 4
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae r8, qword [rbp + 7]
lea rax, [rbp + 0x33]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x37]
lea rdx, [0x140062ca8]
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
cmove esi, dword [rbp + 0x2f]
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x14001f297
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f292
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f30a
call fcn.140027fdc
mov qword [rbp - 9], r14
mov qword [rbp - 1], 0xf
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14001f2de
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f2d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f304
call fcn.140027fdc
mov eax, esi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140027f90
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14002e928
nop
call fcn.14002e928
nop
Function at 0x14001f310
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov esi, r8d
mov rdi, rcx
cmp qword [rdx + 0x18], 0x10
jb 0x14001f341
mov rdx, qword [rdx]
xor r14d, r14d
mov qword [rbp - 9], r14
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], r14b
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], r14b
jne 0x14001f362
lea rcx, [rbp - 9]
call fcn.1400019d0
nop
cmp qword [rdi + 0x18], 0x10
jb 0x14001f37f
mov rdi, qword [rdi]
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], 0xf
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14001f390
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x29]
call fcn.1400019d0
mov dword [rbp + 0x1f], esi
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae rdx, qword [rbp - 0x29]
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
mov r9d, 0x20206
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001f41c
lea r8, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae r8, qword [rbp - 9]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea rdx, [0x140062ca8]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14001f453
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f44e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f4ba
call fcn.140027fdc
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], 0xf
mov byte [rbp - 0x29], 0
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x14001f49a
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f495
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f4b4
call fcn.140027fdc
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140027f90
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002e928
nop
call fcn.14002e928
nop
Function at 0x140021980
Capabilities:
Get session information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
xor ebx, ebx
lea r9, [rsp + 0x48]
mov edi, eax
mov dword [rsp + 0x5c], ebx
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rbx
mov edx, edi
mov qword [rsp + 0x20], rax
lea r8d, [rbx + 0x18]
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x1400219e5
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400219e5
cmp dword [rcx], ebx
jne 0x1400219df
mov eax, edi
jmp 0x140021a57
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
xor edx, edx
mov dword [rsp + 0x58], ebx
lea rax, [rsp + 0x58]
xor ecx, ecx
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
test r8d, r8d
je 0x140021a49
nop word [rax + rax]
mov eax, ebx
lea rcx, [rax + rax*2]
movups xmm0, xmmword [rdx + rcx*8]
movsd xmm1, qword [rdx + rcx*8 + 0x10]
movsd qword [rsp + 0x40], xmm1
cmp dword [rsp + 0x40], 0
movups xmmword [rsp + 0x30], xmm0
je 0x140021a72
inc ebx
cmp ebx, r8d
jb 0x140021a20
mov rcx, rdx
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140027f90
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
mov rcx, rdx
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, dword [rsp + 0x30]
jmp 0x140021a57

Function at 0x140021bd0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [0x140021c00]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x38
ret