joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016510
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5bb8], 0
lea rbx, [rcx + 0x5bc0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400165b7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001656a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140018700
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140003250
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5bb8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5bc8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400b0320]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400165bf
mov rcx, rbx
call fcn.140003250
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140016b30
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400b0310]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140016b93
mov qword [rsp], rbx
lea rbx, [0x140039480]
nop dword [rax]
cmp r9b, 0x23
jne 0x140016b73
cmp byte [r8], r9b
jne 0x140016b73
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140016b60
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b68]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140016bc7
mov r10, qword [r10 + 0x5b70]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x140016bce
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140016bb4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14002a120
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.14000fec0
cmp byte [rax], 0
je 0x14002a18f
xor edx, edx
mov ecx, 0x210
call fcn.140010c20
test al, al
je 0x14002a18f
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002a18f
mov rbx, qword [0x1400b0310]
cmp byte [rbx + 0x37a9], 0
je 0x14002a17b
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.140002610
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.14000fec0
cmp byte [rax], 0
je 0x14002a1f8
xor edx, edx
mov ecx, 0x214
call fcn.140010c20
test al, al
je 0x14002a1f8
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002a1f8
mov rbx, qword [0x1400b0310]
cmp byte [rbx + 0x37a9], 0
je 0x14002a1e4
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.140002610
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.14000fec0
cmp byte [rax], 0
je 0x14002a25f
xor edx, edx
mov ecx, 0x212
call fcn.140010c20
test al, al
je 0x14002a25f
lea ecx, [rdx + 0x5b]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002a25f
mov rbx, qword [0x1400b0310]
cmp byte [rbx + 0x37a9], 0
je 0x14002a24b
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.140002610
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.14000fec0
cmp byte [rax], 0
je 0x14002a2c6
xor edx, edx
mov ecx, 0x216
call fcn.140010c20
test al, al
je 0x14002a2c6
lea ecx, [rdx + 0x5c]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002a2c6
mov rbx, qword [0x1400b0310]
cmp byte [rbx + 0x37a9], 0
je 0x14002a2b2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.140002610
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x140037054
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003709e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003709e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003709e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003709e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003709e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400370a0
xor al, al
add rsp, 0x28
ret
Function at 0x14000d580
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x14000d5b0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14000d5d8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000d5da
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000d63b
test ecx, ecx
jle 0x14000d613
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000d63b
cmp qword [rdi + 0x80], 0
je 0x14000d63b
lfence
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000d660
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000d691
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14000d6ab
lfence
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000d6ce
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000d6d0
xor ecx, ecx
mov qword [rsp + 0x30], rbx
movsxd rax, ecx
test ecx, ecx
je 0x14000d707
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000d7a4
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000d742
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rbx, rdi
cmp rdi, 0xfff
jbe 0x14000d781
nop
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x14000d7a4
cmp rdi, rax
ja 0x14000d750
test rbx, rbx
je 0x14000d7a4
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdi, rbx
sub rdi, rax
sub rbp, rdi
mov rax, rbp
lfence
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
invalid
Function at 0x14000dbf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140032050]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000dc1d
xor eax, eax
jmp 0x14000dd75
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14000dc48
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14000dc48
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14000dd75
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000dd68
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000dc8b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000dcb6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000dd6d
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000dd25
sub eax, 1
je 0x14000dd25
cmp eax, 2
jne 0x14000dd68
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000dd6d
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14000dd56
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000dd68
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x14000dd6d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140022790
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000f870
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140032050]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14000f94d
cmp byte [rcx + 0x71], 0
je 0x14000f94d
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [case.0x14001da03.0]
cmp eax, 0xffffffff
je 0x14000f949
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000f90b
sub eax, 1
je 0x14000f90f
cmp eax, 2
jne 0x14000f949
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140022790
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14000f940
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000f949
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000f8f3
xor al, al
jmp 0x14000f8f3
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140022790
add rsp, 0x60
pop rbx
ret

Function at 0x14001d6b0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x458
mov rax, qword [0x140032050]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
lea rdi, [rsp + 0x478]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
lea rcx, [0x140028ea0]
lea rbx, [0x140026ea8]
cmovne rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x470]
lea r9, str.__wt_____
mov qword [rsp + 0x28], rbx
lea rdx, str.__5d___s_s_s
mov qword [rsp + 0x20], rcx
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140021e50
call fcn.1400024b0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x240]
mov qword [rsp + 0x20], rcx
mov r9, 0xffffffffffffffff
mov rcx, qword [rax]
mov r8d, 0xff
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnwprintf_s]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140022790
add rsp, 0x458
pop rdi
pop rbx
ret
Function at 0x14001d7c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x258
mov rax, qword [0x140032050]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor edx, edx
lea rcx, [rsp + 0x140]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
lea rdi, [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
lea rcx, [0x140028edc]
lea rbx, [0x140026eaa]
cmovne rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x270]
lea r9, str.__wt_____
mov qword [rsp + 0x28], rbx
lea rdx, str.__5d___S_s_s
mov qword [rsp + 0x20], rcx
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140021df0
call fcn.1400024b0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x140]
mov qword [rsp + 0x20], rcx
mov r9, 0xffffffffffffffff
mov rcx, qword [rax]
mov r8d, 0xff
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnprintf_s]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140022790
add rsp, 0x258
pop rdi
pop rbx
ret
Function at 0x14001fb10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140032050]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r14, r9
mov rax, r8
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov rbp, qword [rsp + 0xe0]
cmp qword [r8 + 0x18], 8
jb 0x14001fb55
mov rax, qword [r8]
movzx r9d, byte [rsp + 0xe8]
inc r9d
shl r9d, 8
or r9d, 0x20019
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001fb9d
mov rdx, rbp
mov rcx, rbx
call fcn.1400020d0
jmp 0x14001fce1
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], r15w
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x14001fbc9
mov rdx, qword [r14]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001fcd5
cmp dword [rsp + 0x34], 1
jne 0x14001fcd5
mov ecx, dword [rsp + 0x30]
mov eax, 2
mul rcx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
lea rdx, [0x140026c60]
mov rcx, rax
call fcn.1400229b0
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14001fc42
mov rdx, rbp
mov rcx, rbx
call fcn.1400020d0
nop
jmp 0x14001fce1
cmp qword [r14 + 0x18], 8
jb 0x14001fc4c
mov r14, qword [r14]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001fc89
mov rdx, rbp
mov rcx, rbx
call fcn.1400020d0
nop
mov rcx, rsi
call fcn.1400227b0
jmp 0x14001fce1
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
nop dword [rax]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x14001fca0
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140002170
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rbx + 0x10], xmm1
mov rcx, rsi
call fcn.1400227b0
jmp 0x14001fce1
mov rdx, rbp
mov rcx, rbx
call fcn.1400020d0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140022790
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020710
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140032050]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp qword [rcx + 0x70], 8
lea rdi, [rcx + 0x58]
mov rbx, rcx
mov rcx, rdi
jb 0x140020743
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
cmp qword [rdi + 0x18], 8
mov r8, rdi
jb 0x140020756
mov r8, qword [rdi]
lea r9, str.mozglue.dll
lea rdx, str._s_s
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1400208d8
cmp qword [rdi + 0x18], 8
jb 0x14002078d
mov rdi, qword [rdi]
lea r9, str.nss3.dll
mov r8, rdi
lea rdx, str._s_s
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx], rax
test rax, rax
je 0x1400208d8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rcx, qword [rbx]
lea rdx, str.NSS_Init
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.PK11_GetInternalKeySlot
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.PK11_Authenticate
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.PK11SDR_Decrypt
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.PK11_CheckUserPassword
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.NSS_Shutdown
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.PK11_FreeSlot
mov qword [rbx + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SECITEM_FreeItem
mov qword [rbx + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.PK11_NeedUserInit
mov qword [rbx + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.PORT_GetError
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rbx + 8], 0
mov qword [rbx + 0x50], rax
je 0x1400208d8
cmp qword [rbx + 0x10], 0
je 0x1400208d8
cmp qword [rbx + 0x20], 0
je 0x1400208d8
cmp qword [rbx + 0x18], 0
je 0x1400208d8
cmp qword [rbx + 0x28], 0
je 0x1400208d8
cmp qword [rbx + 0x38], 0
je 0x1400208d8
cmp qword [rbx + 0x40], 0
je 0x1400208d8
cmp qword [rbx + 0x48], 0
je 0x1400208d8
cmp qword [rbx + 0x30], 0
je 0x1400208d8
test rax, rax
je 0x1400208d8
xor eax, eax
jmp 0x1400208dd
mov eax, 8
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140022790
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x1815d0108
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1815d028f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1815d0139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1815d011f
add dl, dl
jne 0x1815d0146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1815d01a6
xor eax, eax
add dl, dl
jne 0x1815d0155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1815d025d
add dl, dl
jne 0x1815d0166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1815d0173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1815d0180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1815d018d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1815d019a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1815d012e
mov eax, 1
add dl, dl
jne 0x1815d01b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1815d01c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1815d01ab
sub eax, ebx
mov ebx, 1
jne 0x1815d01fc
mov ecx, 1
add dl, dl
jne 0x1815d01de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1815d01eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1815d01d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1815d012e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1815d0218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1815d0225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1815d020d
cmp eax, 0x7d00
jae 0x1815d024b
cmp eax, 0x500
jb 0x1815d0246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1815d012e
cmp eax, 0x7f
ja 0x1815d024e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1815d012e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1815d0282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1815d012e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400083b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rbx, rdx
mov rsi, rcx
lea rdi, [rcx + 0x28]
mov qword [rbp - 0x28], rdi
mov dword [rbp - 0x20], 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
nop
lea rcx, [rsi + 0x30]
mov rdx, rbx
call fcn.140008e3c
cmp qword [rsi + 0x40], 0
jne 0x1400084d2
mov ebx, 0x12c
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
and qword [rbp - 0x30], 0
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftDDDiagnosticsHub
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400084bc
lea rcx, [rbp - 0x18]
call fcn.14000776c
mov rcx, qword [rbp - 0x30]
mov qword [rbp - 0x18], rcx
test eax, eax
jne 0x1400084bc
and dword [rbp + 0x20], eax
mov dword [rbp + 0x30], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x38]
xor r8d, r8d
lea rdx, str.CollectorService.IdleShutdownInSeconds
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400084bc
cmp dword [rbp + 0x38], 4
jne 0x1400084bc
mov ebx, dword [rbp + 0x20]
test ebx, ebx
jne 0x1400084bc
lea r8, str.Service_idle_shutdown_has_been_disabled
lea rdx, str.onecorecomdiagnostics_standardcollector_basecollection_standardcollector.service_standardcollectorhost.cpp
mov rcx, qword [0x140017848]
call fcn.14000b534
jmp 0x1400084c8
lea rcx, [rsi + 0x18]
mov edx, ebx
call fcn.140005d70
nop
lea rcx, [rbp - 0x18]
call fcn.14000776c
nop
mov rcx, rdi
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
invalid

Function at 0x140008788
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
test r8, r8
je 0x1400087b8
movzx eax, byte [r9 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x14000879a
mov rax, rcx
ret