joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463f20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403c03
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.004098e0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403be0
cmp byte [0x006462ac], 0
je 0x463f35
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x461180
jmp 0x403be0

Function at 0x463f40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006465a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006462ac], 0
je 0x463f75
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00646860]
aesenc xmm0, xmmword [0x00646870]
aesenc xmm0, xmmword [0x00646880]
movq rax, xmm0
ret
jmp 0x409b00

Function at 0x463f80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006465a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006462ac], 0
je 0x463fb6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00646860]
aesenc xmm0, xmmword [0x00646870]
aesenc xmm0, xmmword [0x00646880]
movq rax, xmm0
ret
jmp 0x409b60

Function at 0x465ca0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x465cd4
mov rcx, 0x28
jmp 0x465cdf
shl rcx, 3
add rcx, 0x1480
mov qword [0x006464d8], rcx
pop rbp
ret
Function at 0x470540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47060a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403b00
xorps xmm15, xmm15
mov r14, qword [0x006464d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4705ef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004d7a60]
xor ebx, ebx
mov rcx, rdx
call fcn.0044a440
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00471360
inc rbx
cmp rcx, rbx
jae 0x4705de
mov edi, 1
lea rsi, [0x004d7a60]
call fcn.0044a520
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0051e608]
lea rsi, [0x0051ddc8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00470540
Function at 0x4abfc0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4abfd7
inc rax
cmp rax, 4
jge 0x4abfef
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4abfd4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4ac000
inc rax
cmp rax, 4
jge 0x4ac00e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4ac037
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4ac01b
jmp 0x4abffd

Function at 0x4ade20
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4adfd3
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rdi
lea r9, [rsi + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rbx, [r9 + rsi]
lea rbx, [rbx + 7]
sar rbx, 3
cmp rcx, rbx
jl 0x4ade65
jae 0x4adede
nop
jmp 0x4adfc7
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x50], rdi
cmp rbx, 1
jne 0x4adea9
lea rax, [0x004d7560]
mov ebx, 1
mov rcx, rbx
call fcn.0044a440
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov ebx, 1
mov ecx, 1
jmp 0x4adede
mov qword [rsp + 0x20], rbx
lea rcx, [rbx + 4]
mov qword [rsp + 0x18], rcx
lea rax, [0x004d7560]
nop
call fcn.0044a440
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x18]
mov rdx, rsi
xor r9d, r9d
jmp 0x4adef3
bswap r8
mov qword [rax + r9*8], r8
inc r9
mov r8, r10
cmp rsi, 8
jl 0x4adf25
mov r10, r8
sub r8, rsi
add r8, 8
neg r8
sar r8, 0x3f
add rsi, 0xfffffffffffffff8
and r8, rsi
nop
mov r8, qword [rdi + r8]
cmp r9, rbx
jb 0x4adee6
nop dword [rax + rax]
jmp 0x4adfbc
test rsi, rsi
jle 0x4adf32
xor r8d, r8d
xor r9d, r9d
jmp 0x4adf86
nop
jmp 0x4adf38
dec rbx
test rbx, rbx
jle 0x4adf47
mov rsi, qword [rax + rbx*8 - 8]
test rsi, rsi
je 0x4adf35
cmp rbx, rcx
ja 0x4adf52
add rsp, 0x28
pop rbp
ret
mov rdx, rcx
mov rcx, rbx
call fcn.00464440
movzx r11d, byte [rsi + rdi - 1]
mov rsi, rcx
mov rcx, r8
shl r11, cl
lea r12, [rcx + 8]
cmp rcx, 0x40
sbb r13, r13
and r11, r13
or r9, r11
mov rcx, rsi
mov rsi, r10
mov r8, r12
test rsi, rsi
jle 0x4adf96
lea r10, [rsi - 1]
cmp rdx, r10
ja 0x4adf5d
jmp 0x4adfb1
lea rsi, [rbx - 1]
cmp rbx, rsi
jbe 0x4adfa6
mov qword [rax + rbx*8 - 8], r9
jmp 0x4adf32
mov rax, rsi
mov rcx, rbx
call fcn.004643c0
mov rax, r10
mov rcx, rdx
call fcn.004643c0
mov rax, r9
mov rcx, rbx
call fcn.004643c0
mov rdx, rcx
mov rcx, rbx
call fcn.00464440
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
call fcn.00462140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp fcn.004ade20
Function at 0x4aea20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aeb1e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x4aeaa2
cmp r8, rdi
ja 0x4aeb12
cmp rsi, rbx
je 0x4aea85
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x4aea82
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x4aeaff
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x4aea85
mov rbx, rdx
test byte [rax], al
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x4aeaf7
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
jmp 0x4aeae0
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x4aeaa8
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call fcn.004643c0
lea rax, [0x004d75e0]
lea rbx, [0x0051df18]
call fcn.00435780
mov rcx, r8
mov rdx, rdi
call fcn.00464440
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call fcn.00462140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp fcn.004aea20
Function at 0x140002240
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x1400ba060]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x50]
call fcn.140031690
nop
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000227b
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
add r9, r8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140033c60
nop
lea rcx, [rsp + 0x50]
call fcn.1400315a0
cmp byte [0x1400be55a], 0
je 0x1400022bc
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400022fb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000235d
call fcn.1400623ac
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140002331
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000232c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002363
mov rcx, r8
call fcn.1400623ac
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140062280
add rsp, 0xe0
pop rbx
ret
call fcn.14006e6a8
nop
call fcn.14006e6a8
int3
Function at 0x140003d20
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, qword [rsp + 0x90]
mov rsi, r9
mov rax, qword [rdx + 0x18]
mov rbx, r8
mov rdi, rdx
test r9, r9
jne 0x140003ddb
cmp rax, 8
jb 0x140003d84
lea rdx, [rax*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140003d7f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003f15
mov rcx, r8
call fcn.1400623ac
xor esi, esi
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140003dd4
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003dcf
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003f15
mov rcx, r8
call fcn.1400623ac
xor al, al
jmp 0x140003efb
cmp rax, 8
jb 0x140003de4
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003e23
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003d84
lea rdx, [rdx*2 + 2]
jmp 0x140003d57
xor bpl, bpl
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140003e33
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], r14
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003e65
cmp dword [rsp + 0x30], 3
mov eax, 1
movzx ebp, bpl
cmove ebp, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003eab
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003ea6
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003f15
mov rcx, r8
call fcn.1400623ac
xor esi, esi
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140003ef7
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003ef2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003f15
mov rcx, r8
call fcn.1400623ac
movzx eax, bpl
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14006e6a8
int3
Function at 0x140003f20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x1400ba060]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rbx
cmp qword [rdx + 0x18], 8
jb 0x140003f5e
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000401c
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140003fc5
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140003fc0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004168
mov rcx, r8
call fcn.1400623ac
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140004015
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140004010
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000416e
mov rcx, r8
call fcn.1400623ac
xor al, al
jmp 0x140004136
xor bpl, bpl
mov dword [rsp + 0x30], 0x800
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140004034
mov rdx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000409b
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x14000409b
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140004080
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140001db0
mov bpl, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x1400040e6
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400040e1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004168
mov rcx, r8
call fcn.1400623ac
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140004132
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000412d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000416e
mov rcx, r8
call fcn.1400623ac
movzx eax, bpl
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.140062280
mov rbx, qword [rsp + 0x880]
add rsp, 0x860
pop rdi
pop rsi
pop rbp
ret
call fcn.14006e6a8
nop
call fcn.14006e6a8
int3
Function at 0x140004180
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
cmp qword [rdx + 0x18], 8
mov rbx, r9
mov r14, r8
mov rsi, rdx
jb 0x14000419c
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rbp
mov r9d, 0x20006
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400042b3
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14000420d
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004208
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004407
mov rcx, r8
call fcn.1400623ac
xor edi, edi
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
mov word [rsi], di
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x14000425d
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004258
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004407
mov rcx, r8
call fcn.1400623ac
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400042ac
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400042a7
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004407
mov rcx, r8
call fcn.1400623ac
xor al, al
jmp 0x1400043e5
cmp qword [rbx + 0x18], 8
mov dil, 1
mov eax, dword [rbx + 0x10]
lea ecx, [rax*2 + 2]
mov rax, rbx
jb 0x1400042cd
mov rax, qword [rbx]
cmp qword [r14 + 0x18], 8
mov rdx, r14
jb 0x1400042da
mov rdx, qword [r14]
mov dword [rsp + 0x28], ecx
mov r9d, 1
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x30]
movzx ebp, dil
xor edi, edi
test eax, eax
cmovne ebp, edi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x14000434c
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004347
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004407
mov rcx, r8
call fcn.1400623ac
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x140004396
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004391
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004407
mov rcx, r8
call fcn.1400623ac
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400043e1
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400043dc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004407
mov rcx, r8
call fcn.1400623ac
movzx eax, bpl
mov rbp, qword [rsp + 0x48]
mov word [rbx], di
mov qword [rbx + 0x10], rdi
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 0x18], 7
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
call fcn.14006e6a8
int3
Function at 0x140004410
Capabilities:
Delete registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x48
cmp qword [rdx + 0x18], 8
mov rbx, r8
mov rdi, rdx
jb 0x140004427
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rbp
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400044ef
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140004498
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004493
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400045c9
mov rcx, r8
call fcn.1400623ac
xor esi, esi
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400044e8
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400044e3
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400045c9
mov rcx, r8
call fcn.1400623ac
xor al, al
jmp 0x1400045a9
cmp qword [rbx + 0x18], 8
mov sil, 1
mov rdx, rbx
jb 0x1400044ff
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
movzx ebp, sil
xor esi, esi
test eax, eax
cmovne ebp, esi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14000455b
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004556
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400045c9
mov rcx, r8
call fcn.1400623ac
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400045a5
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400045a0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400045c9
mov rcx, r8
call fcn.1400623ac
movzx eax, bpl
mov rbp, qword [rsp + 0x60]
mov word [rbx], si
mov qword [rbx + 0x10], rsi
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x18], 7
add rsp, 0x48
pop rdi
pop rbx
ret
call fcn.14006e6a8
int3
Function at 0x140005c40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x1448
call fcn.1400629c0
sub rsp, rax
movaps xmmword [rsp + 0x1430], xmm6
mov rax, qword [0x1400ba060]
xor rax, rsp
mov qword [rsp + 0x1420], rax
call fcn.14003ce54
mov dword [rsp + 0x1414], 0xffffffff
mov dword [rsp + 0x94], eax
mov edx, 1
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x94], eax
inc rdx
cmp rdx, 0x270
jb 0x140005c90
mov dword [rsp + 0x90], 0x270
nop dword [rax]
lea rcx, [rsp + 0x90]
call fcn.1400092f0
mov r8d, eax
mov eax, 0x6680a41
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 9
cmp ecx, 0x419a02
jae 0x140005cc0
mov eax, 0x6680a41
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3e7
sub r8d, eax
lea edx, [r8 - 0x7fffffff]
mov r8d, 0x80000000
lea eax, [rdx + r8]
lea ecx, [rdx - 0x80000000]
cmp edx, r8d
cmovae ecx, eax
movd xmm6, ecx
cvtdq2pd xmm6, xmm6
divsd xmm6, qword [0x1400aadf0]
xor ecx, ecx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], cx
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 7
lea r8d, [rcx + 6]
lea rdx, str.DBGOUT
lea rcx, [rsp + 0x20]
call fcn.140001db0
nop
lea rdx, [0x1400bacc8]
lea rcx, [rsp + 0x50]
call fcn.140001c20
nop
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x20]
mov rdx, rax
call fcn.140003f20
mov r11, qword [rsp + 0x88]
mov r10, qword [rsp + 0x70]
test al, al
je 0x140005e20
lea r9, [rsp + 0x70]
cmp r11, 8
cmovae r9, r10
cmp qword [rsp + 0x80], 3
jne 0x140005e20
mov edx, 3
lea rax, [0x1400a75b0]
movzx ecx, word [r9]
mov r8d, 0x31
cmp cx, r8w
jb 0x140005e20
sub r9, rax
cmp cx, r8w
ja 0x140005e20
cmp rdx, 1
je 0x140005e19
dec rdx
add rax, 2
movzx ecx, word [r9 + rax]
movzx r8d, word [rax]
cmp cx, r8w
jae 0x140005df9
jmp 0x140005e20
mov byte [0x1400be55a], 1
cmp r11, 8
jb 0x140005e57
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x140005e4f
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005eaf
mov rcx, r10
call fcn.1400623ac
movzx eax, byte [0x1400be55a]
mov byte [0x1400be558], al
test al, al
jne 0x140005e88
xorps xmm0, xmm0
comisd xmm6, xmm0
jb 0x140005e7f
movsd xmm0, qword [0x1400aadd0]
comisd xmm0, xmm6
ja 0x140005e88
mov byte [0x1400be559], 0
jmp 0x140005e8f
mov byte [0x1400be559], 1
mov rcx, qword [rsp + 0x1420]
xor rcx, rsp
call fcn.140062280
movaps xmm6, xmmword [rsp + 0x1430]
add rsp, 0x1448
ret
call fcn.14006e6a8
int3
Function at 0x1400092f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140009351
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140009310
mov ecx, dword [r10]
jmp 0x14000943a
cmp ecx, 0x4e0
jb 0x14000943a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140009370
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400093c0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret