joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086ff2
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
mov dword [rsp - 0x2c], 0x6b9963a8
nop
sub rsp, 8
mov qword [rsp], rbp
nop
push r10
mov qword [rsp], rsi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
neg rsp
sub rsp, 0xffffffffffffffd8
neg rsp
xchg rdx, r11
mov r14, r11
xchg rdx, r11
mov r13d, r8d
mov edx, 0x65d579d6
sub edx, 0x37a47ba
add edx, 0x1cd91b19
xor edx, 0x7f304d35
cmp r8d, edx
mov dword [rsp - 0x34], edi
jae 0x140086f8a
mov edx, r13d
nop
movabs rcx, 0xffffffff2ce1066f
add rcx, 0x2ca94d78
sub rcx, 0x4e09d548
xor rcx, 0x22895fff
add rcx, 0x7fffffff
xor rcx, 0x56f6dea0
mov eax, 0x649a9cdb
xor eax, 0x76c2b29a
add eax, 0x5c2df6f1
sub eax, 0x6e86252e
mul rdx
mov r14, r14
cmovo rax, rcx
xchg r11, rax
mov rcx, r11
xchg r11, rax
call fcn.1400964d0
mov dword [rsp - 0xc], 0x57d5f875
mov r15, rax
mov byte [rsp + 0x70], 0x3c
xor byte [rsp + 0x70], 0x2c
sub byte [rsp + 0x70], 7
sub byte [rsp + 0x70], 8
xchg r9, rax
mov r9, qword [rsp + 0x60]
xchg r9, rax
lea r12d, [r13 + 0xfffff]
mov dword [rsp - 0xc], ecx
xor esi, esi
shr r12d, 0xc
shr r12d, 8
mov ebp, dword [rax + 0x18]
xchg rsi, rsi
test r12d, r12d
je 0x140087148
xchg r10, rbx
mov qword [rsp + 0x68], r10
xchg r10, rbx
mov ecx, 0x3b575178
xor ecx, 0x7b4851bd
sub ecx, 0xcccfe21
add ecx, 0x2b0a4d3
sub ecx, 0x35f2a777
xchg rbx, rdi
mov qword [rsp + 0x20], rbx
xchg rdi, rbx
mov edi, esi
xchg r13, r13
mov ebx, r13d
shl edi, 0xb
shl edi, 6
shl edi, 2
shl edi, 1
mov rdx, r15
xchg rsp, rsp
sub ebx, edi
cmp ebx, ecx
cmova ebx, ecx
xchg rcx, rcx
mov rcx, rax
mov r8d, ebx
call fcn.1400839c0
test al, al
mov rdx, rdx
je 0x14008711f
shr ebx, 1
shr ebx, 1
xor eax, eax
shr edi, 2
test ebx, ebx
xchg rsp, rsp
je 0x1400870e3
xchg rbx, r9
mov rbx, r15
xchg rbx, r9
lea ecx, [rdi + rax]
mov r8d, ebp
xor r8d, dword [r9]
xchg r10, r10
lea r9, [r9 + 4]
xor r8d, 0xa0b4447
inc eax
mov r10, r10
mov dword [r14 + rcx*4], r8d
cmp eax, ebx
jb 0x1400870b7
mov dword [rsp - 0x24], edi
xchg r15, rax
mov r15, qword [rsp + 0x60]
xchg r15, rax
inc esi
mov rbx, rbx
mov ecx, 0x5bd25e19
sub ecx, 0xf78b9e0
add ecx, 0x17aaa6d6
sub ecx, 0x1a263435
sub ecx, 0x49ce16da
cmp esi, r12d
xchg r12, r12
jb 0x140087061
jmp 0x140087138
mov byte [rsp + 0x70], 0x56
add byte [rsp + 0x70], 0x1d
xor byte [rsp + 0x70], 0xf
sub byte [rsp + 0x70], 0x76
xor byte [rsp + 0x70], 6
xchg r10, rbx
mov r10, qword [rsp + 0x68]
xchg r10, rbx
mov rdi, qword [rsp + 0x20]
xchg r15, rcx
mov r15, rcx
xchg rcx, r15
call fcn.1400964e0
movzx eax, byte [rsp + 0x70]
xchg rbp, rbp
add rsp, 0x28
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
mov dword [rsp - 0x38], 0x3fd9342b
pop r12
nop
mov rsi, qword [rsp]
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400871b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rbp
mov r8, r8
mov qword [rsp + 0x20], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
xchg r12, r12
nop
sub rsp, 8
mov qword [rsp], r14
push r15
mov dword [rsp - 0x1c], 0x68cb4787
nop
sub rsp, 0x13cd1f4d
add rsp, 0x13cd1f2d
mov r14d, r8d
xchg rdx, rdi
mov rdx, rdi
xchg rdi, rdx
mov r9d, r14d
xchg r15, r13
mov r15, rcx
xchg r13, r15
cmp r8d, 0x40000
jb 0x140087244
xchg rcx, rcx
mov r9d, 0x7385a547
sub r9d, 0x53d79dec
xor r9d, 0xffeedb1
sub r9d, 0x104ceaea
nop
movabs rcx, 0xffffffff765fca43
sub rcx, 0x6e8f749f
add rcx, 0x6f677ac0
add rcx, 0x7fffffff
xor rcx, 0x8c82f9c
mov eax, 0x20cd7146
add eax, 0x3019ae02
sub eax, 0x19b32c7
sub eax, 0xd4daf3c
xor eax, 0x41fe3d41
mul r9
cmovo rax, rcx
mov dword [rsp - 0x44], ebx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400964d0
mov dword [rsp - 0xc], 0x1c5e3a55
mov esi, dword [r13 + 0x18]
lea r15d, [r14 + 0xfffff]
shr r15d, 8
shr r15d, 3
shr r15d, 6
shr r15d, 1
shr r15d, 1
shr r15d, 1
xor ebx, ebx
xchg rsi, rax
mov rbp, rsi
xchg rsi, rax
mov r12b, 0xb
add r12b, 0xb
sub r12b, 0xe
sub r12b, 7
test r15d, r15d
mov dword [rsp - 0x3c], ecx
je 0x1400873f1
nop
mov r8d, ebx
mov r10d, r14d
mov dword [rsp - 0xc], 0x8232d5c
shl r8d, 7
shl r8d, 0xb
shl r8d, 1
shl r8d, 1
xor eax, eax
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
mov dword [rsp - 0x44], edi
jbe 0x14008735d
mov r10d, 0x7f529a23
sub r10d, 0x4b48cbbd
xor r10d, 0x50ef9e06
sub r10d, 0x64d65060
mov r11d, 0x1b11754d
xor r11d, 0x59a51f87
xor r11d, 0x6bcc6ab5
sub r11d, 0x2974007f
jmp 0x14008737b
mov r11d, r10d
mov dword [rsp - 0x2c], 0x7d3ad33f
shr r11d, 1
shr r11d, 1
test r11d, r11d
mov dword [rsp - 0x24], edi
je 0x1400873b5
mov r9, rbp
nop dword [rax]
lea edx, [r8 + rax]
xchg r9, r9
mov ecx, esi
xor ecx, dword [rdi + rdx*4]
lea r9, [r9 + 4]
xchg rsi, rsi
xor ecx, 0xa0b4447
inc eax
mov dword [r9 - 4], ecx
mov dword [rsp - 0x40], 0x4ce50da1
cmp eax, r11d
jb 0x140087385
mov r8d, r10d
xchg rbp, r11
mov rdx, r11
xchg rbp, r11
xchg r13, r14
mov rcx, r14
xchg r14, r13
call fcn.140083e00
mov dword [rsp - 0x18], ebx
test al, al
je 0x1400873ee
inc ebx
mov r12, r12
cmp ebx, r15d
jb 0x1400872ea
jmp 0x1400873f1
xor r12b, r12b
xchg r9, rcx
mov r9, rbp
xchg r9, rcx
call fcn.1400964e0
mov dword [rsp - 0x34], 0x74d92b5e
mov rbx, qword [rsp + 0x50]
movzx eax, r12b
mov rbp, qword [rsp + 0x58]
xchg rsi, rbp
mov rbp, qword [rsp + 0x68]
xchg rbp, rsi
nop
add rsp, 0x744d8d3
sub rsp, 0x744d8b3
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140087460
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push rcx
mov qword [rsp], rdi
push r12
mov dword [rsp - 0x38], 0x171accd3
push r14
push r15
mov eax, 0x7aa34dfe
sub eax, 0x2f8d8715
sub eax, 0x33b5fac4
sub eax, 0x175fbc05
call fcn.140098250
sub rsp, rax
xchg r13, r13
xchg r15, rcx
mov rcx, r15
xchg r15, rcx
call fcn.140098100
mov r8, r8
mov ebp, eax
and ebp, 0x3fc
jbe 0x140087511
lea rdi, [rsp + 0x20]
mov rsp, rsp
mov esi, ebp
call fcn.140098100
movzx ebx, ax
xchg rdi, rdi
shl ebx, 0xb
shl ebx, 2
shl ebx, 1
shl ebx, 1
shl ebx, 1
call fcn.140098100
mov dword [rsp - 0x34], edx
movzx ecx, ax
lea rdi, [rdi + 4]
or ecx, ebx
mov rcx, rcx
mov dword [rdi - 4], ecx
sub rsi, 1
jne 0x1400874d4
mov dword [rsp - 0x30], esi
lea r14d, [rbp*4]
mov eax, 0xc4a61fa
sub eax, 0x1e049ab
xor eax, 0x15514072
add eax, 0x26746b0d
sub eax, 0x45afc346
mov ecx, r14d
mul rcx
mov dword [rsp - 0x14], 0x667455c1
pushf
movabs rcx, 0xffffffff73f9b416
sub rcx, 0x453ac5b0
add rcx, 0x3aa2d54
add rcx, 0x7fffffff
add rcx, 0x4d96e446
popf
cmovo rax, rcx
xchg r15, rax
mov rcx, r15
xchg r15, rax
call fcn.1400964d0
mov dword [rsp - 0x40], 0x3643f126
mov edi, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0x12
shr ebp, 1
shr ebp, 1
xor ebx, ebx
xchg rsi, r12
mov r12, rax
xchg r12, rsi
mov r12b, 0x4a
sub r12b, 0x20
add r12b, 0x3c
xor r12b, 0x67
test ebp, ebp
je 0x1400876c9
mov dword [rsp - 0xc], 0x4fdc77e3
nop
mov r8d, ebx
mov r10d, r14d
shl r8d, 0xb
shl r8d, 1
shl r8d, 5
shl r8d, 1
shl r8d, 1
shl r8d, 1
xor eax, eax
sub r10d, r8d
mov dword [rsp - 0x34], ebp
shr r8d, 2
cmp r10d, 0x100000
jbe 0x140087636
mov r10d, 0x6d3d5386
sub r10d, 0x5939bf7a
xor r10d, 0x40526086
sub r10d, 0x5441f48a
mov r11d, 0x377aedd2
sub r11d, 0x1c42fd2e
xor r11d, 0x176d3dd6
sub r11d, 0x399ec69
xor r11d, 0x8c4e109
jmp 0x14008764c
mov r11d, r10d
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x14008768d
mov dword [rsp - 0x20], esi
xchg r12, r9
mov r12, rsi
xchg r12, r9
nop dword [rax]
lea edx, [r8 + rax]
mov r12, r12
mov ecx, edi
xor ecx, dword [rsp + rdx*4 + 0x20]
lea r9, [r9 + 4]
mov r8, r8
xor ecx, 0xa0b4447
inc eax
mov dword [r9 - 4], ecx
mov dword [rsp - 0x38], 0x76555446
cmp eax, r11d
jb 0x14008765c
mov r8d, r10d
mov rdx, rsi
mov rbp, rbp
xchg rcx, r15
mov r15, rcx
xchg rcx, r15
call fcn.140083e00
test al, al
je 0x1400876c6
mov rdi, rdi
inc ebx
cmp ebx, ebp
jb 0x1400875c0
mov dword [rsp - 0x20], 0x5a3396c8
jmp 0x1400876c9
xor r12b, r12b
xchg r15, rcx
mov r15, rsi
xchg rcx, r15
call fcn.1400964e0
lea r11, [rsp + 0x1020]
movzx eax, r12b
mov dword [rsp - 0xc], 0x813eb4d
xchg rbp, rbx
mov rbp, qword [r11 + 0x38]
xchg rbx, rbp
mov rbp, qword [r11 + 0x40]
mov rsi, rsi
xchg r11, rbx
mov rsp, rbx
xchg r11, rbx
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret
Function at 0x14008a390
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg rbx, r14
xchg rbp, r10
mov qword [rsp + 0x10], r10
xchg r10, rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r10, r10
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
push 0x2fbbcffa
mov qword [rsp], r13
push r14
push rsi
mov qword [rsp], r15
movsxd rax, r8d
xchg rcx, r13
mov rcx, r13
xchg r13, rcx
xor ecx, ecx
mov dword [rsp - 0x30], 0x6e53c4e0
mov r12, r9
xchg rdx, r15
mov rbx, r15
xchg r15, rdx
mov r10d, ecx
mov dword [rsp - 0x30], 0x38a15710
lea r11, [rax + rax*2]
shl r11, 1
shl r11, 1
nop word [rax + rax]
movsxd rax, dword [r12 + r10*4]
mov edi, ecx
mov dword [rsp - 0x34], ebx
xchg r9, r14
mov r14, qword [r13 + 8]
xchg r14, r9
add r9, r11
xchg rsp, rsp
mov dword [r9 + 8], ecx
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
and eax, 3
mov qword [r9], 0x2fe68409
add qword [r9], 0x20813ece
xor qword [r9], 0x480df0fc
xor qword [r9], 0x186a322b
lea rsi, [rbx + rax*2]
mov rdx, rdx
lea rax, [rcx + 1]
and eax, 3
lea r14, [rbx + rax*2]
mov dword [rsp - 0x44], esi
lea rax, [rcx - 2]
and eax, 3
lea r15, [rbx + rax*2]
mov dword [rsp - 0x44], 0x1185fa95
lea rax, [rcx - 1]
and eax, 3
lea rbp, [rbx + rax*2]
mov eax, 0x22a28ace
sub eax, 0x18d87995
xor eax, 0x3a277369
xor eax, 0x9947c8fb
mov ecx, edi
mov dword [rsp - 0x34], 0x34a780c
mul edi
inc edi
shr edx, 1
lea eax, [rdx + rdx*2]
xchg rsi, rsi
movzx edx, word [rsi]
sub ecx, eax
and dx, 1
mov r12, r12
movsxd rax, ecx
mov ecx, dword [r9 + rax*4]
lea r8, [r9 + rax*4]
movzx eax, dx
xchg rdx, rdx
add ecx, ecx
or ecx, eax
not dx
mov dword [r8], ecx
xchg rbp, rbp
movzx eax, word [rsi]
shl dx, 4
shl dx, 1
shl dx, 0xa
shr ax, 1
or dx, ax
mov dword [rsp - 0x28], esi
mov word [rsi], dx
movzx edx, word [r14]
mov ecx, dword [r8]
and dx, 1
xchg rcx, rcx
movzx eax, dx
add ecx, ecx
or ecx, eax
mov dword [rsp - 0x44], ebp
not dx
mov dword [r8], ecx
movzx eax, word [r14]
mov rsi, rsi
shl dx, 0xc
shl dx, 2
shl dx, 1
shr ax, 1
or dx, ax
mov word [r14], dx
xchg rsp, rsp
movzx edx, word [r15]
mov ecx, dword [r8]
and dx, 1
movzx eax, dx
mov rsi, rsi
add ecx, ecx
or ecx, eax
not dx
mov dword [r8], ecx
mov dword [rsp - 0x44], ecx
movzx eax, word [r15]
shl dx, 1
shl dx, 0xb
shl dx, 1
shl dx, 1
shl dx, 1
shr ax, 1
mov dword [rsp - 0x40], ecx
or dx, ax
mov word [r15], dx
movzx edx, word [rbp]
xchg rdi, rdi
mov ecx, dword [r8]
and dx, 1
movzx eax, dx
mov r13, r13
add ecx, ecx
or ecx, eax
not dx
mov rbp, rbp
mov dword [r8], ecx
movzx eax, word [rbp]
shr ax, 1
mov dword [rsp - 0x40], 0x3d3ce88f
shl dx, 1
shl dx, 4
shl dx, 9
shl dx, 1
or dx, ax
mov word [rbp], dx
xchg rsi, rsi
cmp edi, 0xf
jl 0x14008a488
inc r10
nop
add r11, 0x14ecc975
sub r11, 0x14ecc969
mov ecx, 0x13a01371
sub ecx, 0x11043c8
add ecx, 0x5aee8824
sub ecx, 0x6d7e57cd
cmp r10, 8
jl 0x14008a410
mov dword [rsp - 0x10], 0x74ee2af1
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
xchg rbx, rsi
mov rbx, qword [rsp + 0x38]
xchg rsi, rbx
mov rdi, qword [rsp + 0x40]
xchg rbx, rbx
nop
add rsp, 8
mov r15, qword [rsp - 8]
pop r14
mov dword [rsp - 0x18], 0x7d5ba218
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
ret
Function at 0x14008a970
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg r8, rbx
mov ebx, edx
mov dword [rsp - 0x18], 0x4d52779b
mov r8d, ecx
test ecx, ecx
jne 0x14008a9a0
xor eax, eax
mov dword [rsp - 0x40], 0x40c9f3de
mov rbx, qword [rsp + 8]
ret
xor r10d, r10d
mov dword [rsp - 0x34], ebp
mov r11d, r8d
mov edx, r10d
mov r9d, r8d
xchg rcx, rcx
nop dword [rax]
nop word [rax + rax]
lea eax, [r9 + r9]
mov r10, r10
mov ecx, edx
xor ecx, r9d
mov r9d, eax
xchg r14, r14
test r11b, 1
cmove ecx, edx
xor r9d, ebx
mov r8, r8
cmp eax, 0x100
mov edx, ecx
cmovb r9d, eax
shr r11d, 1
mov dword [rsp - 0x18], 0x7d6a988
jne 0x14008a9c1
mov r11d, r8d
mov r9d, r10d
test ecx, ecx
mov dword [rsp - 0x1c], 0x67533a28
je 0x14008aa4b
lea eax, [r11 + r11]
mov ecx, r9d
xor ecx, r11d
xchg r9, r9
mov r11d, eax
test dl, 1
cmove ecx, r9d
xor r11d, ebx
mov dword [rsp - 0x1c], 0x51f3cdf4
cmp eax, 0x100
mov r9d, ecx
cmovb r11d, eax
shr edx, 1
mov rbx, rbx
jne 0x14008aa12
mov r11d, r9d
mov edx, r10d
test r9d, r9d
mov rsp, rsp
je 0x14008aaad
nop dword [rax]
nop word [rax + rax]
mov dword [rsp - 0x30], edx
lea eax, [r11 + r11]
mov ecx, edx
xor ecx, r11d
mov r11d, eax
mov dword [rsp - 0x24], 0x7186b551
test r9b, 1
cmove ecx, edx
xor r11d, ebx
cmp eax, 0x100
mov dword [rsp - 0x1c], 0x172784c6
mov edx, ecx
cmovb r11d, eax
shr r9d, 1
jne 0x14008aa6f
mov dword [rsp - 0x28], ecx
test edx, edx
je 0x14008aaf9
nop word [rax + rax]
mov ecx, r10d
mov dword [rsp - 0x14], 0x18cf559b
xor ecx, r8d
test dl, 1
cmove ecx, r10d
mov r10d, ecx
xchg r11, r11
lea ecx, [r8 + r8]
mov r8d, ecx
xor r8d, ebx
mov dword [rsp - 0x2c], esi
cmp ecx, 0x100
cmovb r8d, ecx
shr edx, 1
xchg rdx, rdx
jne 0x14008aabb
mov rbx, qword [rsp + 8]
mov eax, r10d
ret
Function at 0x140098250
Capabilities:
Encode data using xor

Disassembly:
add rsp, 0xfffffffffffffff0
mov dword [rsp - 0x20], edx
xchg r14, r10
mov qword [rsp], r14
xchg r10, r14
xchg r14, r11
mov qword [rsp + 8], r14
xchg r11, r14
xor r11, r11
xchg rbp, rbp
lea r10, [rsp + 0x18]
sub r10, rax
cmovb r10, r11
mov dword [rsp - 0x24], ecx
mov r11, qword gs:[0x10]
cmp r10, r11
bnd jae 0x1400982c5
and r10w, 0xf000
mov dword [rsp - 0x28], 0x712e852c
lea r11, [r11 - 0x1000]
mov byte [r11], 0x37
xor byte [r11], 0x72
sub byte [r11], 0x18
xor byte [r11], 0x41
sub byte [r11], 0x6c
cmp r10, r11
mov dword [rsp - 0x3c], esi
bnd jne 0x1400982a0
xchg r10, r15
mov r15, qword [rsp]
xchg r15, r10
xchg r11, rbx
mov rbx, qword [rsp + 8]
xchg r11, rbx
neg rsp
add rsp, 0xfffffffffffffff0
neg rsp
bnd ret
Function at 0x140493390
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x1404a1084]
cmp qword [0x1404a1098], 0
mov rsi, rsi
jne 0x140087740
syscall
ret
jmp 0x140088293
Function at 0x1400122a0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
mov rax, rcx
xor edi, edi
test edx, edx
cmovs edx, edi
mov cl, byte [rsp + 0x88]
mov byte [rsp + 7], cl
test r8d, r8d
cmovns edi, r8d
mov ecx, dword [rsp + 0x80]
mov ebp, dword [rax + 0x178]
lea r8d, [rbp - 1]
cmp ebp, r9d
cmovg r8d, r9d
movsxd rbx, dword [rax + 0x174]
lea r11d, [rbx - 1]
cmp ebx, ecx
cmovg r11d, ecx
cmp edi, r11d
jg 0x140012419
mov r9d, edx
shr r9d, 1
mov r13d, r8d
shr r13d, 0x1f
add r13d, r8d
sar r13d, 1
add r13d, 1
cmp r9d, r13d
mov esi, r13d
cmovg esi, r9d
mov edi, edi
cmp rdi, rbx
jge 0x140012419
mov ebx, edx
mov r15, rbx
shr r15, 1
add esi, r15d
sub esi, r9d
add esi, 1
lea r10d, [r8 + 1]
add r11d, 1
lea rcx, [r15 + r15*4]
lea r12, [rcx*4 + 4]
mov qword [rsp + 0x10], rbx
lea rcx, [rbx + rbx*4]
lea rcx, [rcx*4 + 4]
mov qword [rsp + 8], rcx
nop word cs:[rax + rax]
nop
mov rcx, qword [rax + 0x28]
mov rcx, qword [rcx + rdi*8]
test byte [rcx], 3
je 0x1400123c0
cmp r9d, r13d
jg 0x140012400
mov rbp, r12
mov rcx, r15
nop dword [rax + rax]
movsxd rbx, dword [rax + 0x178]
cmp rcx, rbx
jge 0x140012400
mov rbx, qword [rax + 0x28]
mov rbx, qword [rbx + rdi*8]
mov rbx, qword [rbx + 0x18]
or dword [rbx + rbp], 0x3ffff
add rcx, 1
add rbp, 0x14
cmp rsi, rcx
jne 0x140012390
jmp 0x140012400
cmp edx, r8d
jg 0x140012400
mov rbp, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
nop
movsxd rcx, dword [rax + 0x178]
cmp r14, rcx
jge 0x140012400
mov rcx, qword [rax + 0x28]
mov rcx, qword [rcx + rdi*8]
mov rcx, qword [rcx + 0x18]
or dword [rcx + rbp], 0x3ffff
add r14, 1
add rbp, 0x14
cmp r10, r14
jne 0x1400123d0
nop dword [rax]
add rdi, 1
cmp rdi, r11
je 0x140012419
movsxd rcx, dword [rax + 0x174]
cmp rdi, rcx
jl 0x140012370
cmp byte [rsp + 7], 0
je 0x140012438
mov rcx, rax
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14000d810
cmp byte [rax + 0x10f1], 0
je 0x140012452
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov byte [rax + 0x10f1], 1
lea rcx, [0x14001a4f0]
mov rdx, rax
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14002c930

Function at 0x1400229f0
Capabilities:
Hide graphical window

Disassembly:
push rsi
sub rsp, 0x30
mov rcx, qword [0x14012af18]
mov qword [rsp + 0x20], 0
lea r9, [fcn.140022a40]
mov edx, 0x6f
xor r8d, r8d
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rcx, rsi
add rsp, 0x30
pop rsi
jmp qword [sym.imp.USER32.dll_DestroyWindow]
Function at 0x1400236a0
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov rcx, qword [0x14012c3b8]
test rcx, rcx
jne 0x1400236f1
mov rcx, qword [0x14012af18]
mov qword [rsp + 0x20], 0
lea r9, [0x140023700]
mov edx, 0x6e
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov qword [0x14012c3b8], rax
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14012c3b8]
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_SetActiveWindow]

Function at 0x14002cb00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, r8
mov rbx, rdx
mov edi, ecx
cmp qword [0x14012d520], 0
jne 0x14002cb4d
lea rcx, [0x14002cd60]
call fcn.140044a20
mov qword [0x14012d520], rax
lea rcx, [0x14002cdc0]
call fcn.140044a20
mov qword [0x14012d528], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012d518], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012d518], eax
test edi, edi
mov esi, 1
cmovne esi, edi
add esi, eax
mov ecx, 1
mov edx, 0x18
xor r8d, r8d
call fcn.1400434f0
mov rdi, rax
mov qword [rax], rbx
mov qword [rax + 8], r14
mov dword [rax + 0x10], esi
mov eax, dword [0x14012d518]
mov dword [rdi + 0x14], eax
mov rcx, qword [0x14012d520]
mov rdx, rdi
call fcn.140044b00
cmp rdi, rax
je 0x14002cbab
mov rcx, rdi
call fcn.140043590
jmp 0x14002cbbb
mov rdx, qword [rdi + 8]
mov rcx, qword [0x14012d528]
call fcn.140044b00
mov rcx, qword [0x14012d520]
xor edx, edx
call fcn.140045270
cmp rax, rdi
jne 0x14002cbd6
mov ecx, dword [rdi + 0x10]
call fcn.140007000
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002cc00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
cmp qword [0x14012d520], 0
jne 0x14002cc46
lea rcx, [0x14002cd60]
call fcn.140044a20
mov qword [0x14012d520], rax
lea rcx, [0x14002cdc0]
call fcn.140044a20
mov qword [0x14012d528], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012d518], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14012d518], eax
mov rcx, qword [0x14012d520]
xor ebx, ebx
xor edx, edx
call fcn.140045270
test rax, rax
je 0x14002ccec
mov rdi, rax
jmp 0x14002cc9e
mov rcx, qword [0x14012d520]
xor edx, edx
call fcn.1400458d0
mov rcx, rdi
call fcn.140043590
mov rcx, qword [0x14012d520]
xor ebx, ebx
xor edx, edx
call fcn.140045270
mov rdi, rax
test rax, rax
je 0x14002ccec
mov rdx, qword [rdi + 8]
mov rcx, qword [0x14012d528]
xor r8d, r8d
call fcn.1400457e0
test rax, rax
je 0x14002cc70
mov ecx, dword [0x14012d518]
mov ebx, dword [rdi + 0x10]
mov edx, dword [rdi + 0x14]
add edx, 0xfffffff6
sub ecx, edx
mov eax, ebx
sub eax, edx
cmp ecx, eax
jbe 0x14002cce8
mov rcx, qword [0x14012d520]
xor edx, edx
call fcn.1400458d0
mov edx, dword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call qword [rdi]
jmp 0x14002cc7e
mov dword [rsi], ebx
mov bl, 1
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140036f60
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x3a
call fcn.1400414f0
cmp byte [rax], 0
je 0x140036f84
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.14004a3a0
mov rcx, rsi
mov edx, 0x3b
call fcn.1400412a0
test al, al
je 0x140036f9f
add rsp, 0x20
pop rsi
jmp fcn.14007a3e0
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140038fd0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov ebp, dword [rsp + 0x70]
mov rcx, r8
mov edx, r9d
call fcn.140041360
cmp eax, 1
je 0x14003903c
cmp eax, 2
je 0x140039045
cmp eax, 3
jne 0x14003904e
mov rcx, rbx
mov edx, ebp
call fcn.1400414f0
lea rcx, str.custom:
mov rdx, rax
xor r8d, r8d
call fcn.140042610
mov rbx, rax
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.14003cc20
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140043590
lea r8, str.implicit
jmp 0x140039055
lea r8, str.explicit
jmp 0x140039055
lea r8, str.none
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14003cc20

Function at 0x14003cc20
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14003cc2d
mov rcx, qword [rcx]
jmp fcn.140046840
ret

Function at 0x14003cc30
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14003cc3d
mov rcx, qword [rcx]
jmp fcn.1400466f0
ret

Function at 0x14003ccf0
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x14003ccfd
mov rcx, qword [rcx]
jmp fcn.140046750
xor eax, eax
ret

Function at 0x14003cfd0
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14003cfe0
mov r8, qword [r8]
mov rcx, qword [rcx]
jmp fcn.140046840
ret

Function at 0x14003d020
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp dword [0x14012de30], 6
jb 0x14002b052
jne 0x14002b007
cmp dword [0x14012de34], 0
je 0x14002b052
call fcn.14003e010
test eax, eax
je 0x14002b065
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400ef000]
lea r9, [0x1400eeff0]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14002b052
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ba340
nop
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ba340
nop
add rsp, 0x38
jmp 0x14002ab90
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x20], 0
lea r9, str.SoftwareSimonTathamPuTTYSessions
xor ecx, ecx
mov dl, 1
mov r8, 0xffffffff80000001
call fcn.140046460
test rax, rax
je 0x14003d08f
mov rdi, rax
call fcn.140043bc0
mov rbx, rax
mov rcx, rsi
mov rdx, rax
call fcn.14007a5e0
mov rdx, qword [rbx]
mov rcx, rdi
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rbx
call fcn.140043cc0
mov rcx, rdi
call sub.ADVAPI32.dll_RegCloseKey
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp 0x14002afe0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret