joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011140
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1402d9850]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rdx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xor ecx, ecx
mov qword [rbx + 0x1070], rcx
mov qword [rbx + 0x1078], rcx
mov qword [rbx + 0x1080], rcx
mov qword [rbx + 0x1088], rcx
mov qword [rbx + 0x1090], rcx
mov qword [rbx + 0x1098], rcx
mov qword [rbx + 0x10a0], rcx
mov qword [rbx + 0x10a8], rcx
mov qword [rbx + 0x10b0], rbp
lea rsi, [rbx + 0x10b8]
mov dword [rsi], 0x67452301
mov dword [rbx + 0x10bc], 0xefcdab89
mov dword [rbx + 0x10c0], 0x98badcfe
mov dword [rbx + 0x10c4], 0x10325476
mov r8d, r9d
mov rdx, rax
mov rcx, rbx
call fcn.1400113f0
mov r8d, ebp
lea rdx, [rsp + 0x5a]
lea r9d, [rbp + 2]
nop dword [rax + rax]
mov eax, r8d
lea rcx, [rbx + rax*4]
movzx eax, byte [rcx + 0x10b0]
mov byte [rdx - 2], al
movzx eax, byte [rcx + 0x10b1]
mov byte [rdx - 1], al
movzx eax, byte [rcx + 0x10b2]
mov byte [rdx], al
movzx eax, byte [rcx + 0x10b3]
mov byte [rdx + 1], al
inc r8d
lea rdx, [rdx + 4]
sub r9, 1
jne 0x140011200
mov eax, dword [rbx + 0x10b0]
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
lea r8d, [r9 + 0x38]
jb 0x140011256
mov r8d, 0x78
sub r8d, eax
lea rdx, [0x1402db6d0]
mov rcx, rbx
call fcn.1400113f0
mov r8d, 8
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400113f0
mov r8d, ebp
lea rdx, [rsp + 0x5a]
mov r9d, 4
nop dword [rax]
mov eax, r8d
lea rcx, [rsi + rax*4]
movzx eax, byte [rcx]
mov byte [rdx - 2], al
movzx eax, byte [rcx + 1]
mov byte [rdx - 1], al
movzx eax, byte [rcx + 2]
mov byte [rdx], al
movzx eax, byte [rcx + 3]
mov byte [rdx + 1], al
inc r8d
lea rdx, [rdx + 4]
sub r9, 1
jne 0x140011290
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
cmp qword [rdi + 0x18], 8
jb 0x1400112d6
mov rax, qword [rdi]
jmp 0x1400112d9
mov rax, rdi
mov word [rax], bp
mov dword [rsp + 0x20], 1
mov rbx, rbp
movabs rsi, 0x7fffffffffffffff
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
movzx eax, byte [rsp + rbx + 0x58]
lea rcx, [rsp + 0x38]
test al, al
jne 0x140011326
mov r8d, 2
lea rdx, [0x14025f5a0]
call fcn.140007090
jmp 0x140011341
movzx r8d, al
cmp al, 0xf
lea rdx, [0x14025f5a8]
jbe 0x14001133c
lea rdx, [0x14025f5b0]
call fcn.140006500
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.1400081f0
nop
mov rax, qword [rsp + 0x50]
cmp rax, 8
jb 0x14001139e
inc rax
mov rcx, qword [rsp + 0x38]
cmp rax, rsi
ja 0x1400113c4
add rax, rax
cmp rax, 0x1000
jb 0x140011399
test cl, 0x1f
jne 0x1400113be
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400113b8
sub rcx, rax
cmp rcx, 8
jb 0x1400113b2
cmp rcx, 0x27
ja 0x1400113ac
mov rcx, rax
call fcn.140129a9c
inc rbx
cmp rbx, 0x10
jge 0x1400113ca
jmp 0x1400112f1
call fcn.14012eec0
int3
call fcn.14012eec0
int3
call fcn.14012eec0
int3
call fcn.14012eec0
int3
call fcn.14012eec0
int3
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14012a1e0
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140011df0
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x1402d9850]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov edi, 0x270f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
mov edx, eax
mov eax, 0x10624dd3
mul edx
mov ebx, edx
shr ebx, 6
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x28]
shr rcx, 0x14
cmp ebx, 0x3c
jae 0x140011e53
cmp ecx, 0x320
jb 0x140011e70
cmp ebx, 0x64
jae 0x140011e60
cmp ecx, 0x100
jb 0x140011e70
cmp ebx, 0xc8
jae 0x140011e7a
cmp ecx, 0x80
jae 0x140011e7a
mov dword [rsi + 0x10cc], 1
movsd xmm0, qword [0x14026e3f0]
xor eax, eax
mov ecx, ecx
xorps xmm1, xmm1
cvtsi2sd xmm1, rcx
comisd xmm0, xmm1
cmova edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14012a1e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140016590
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x60
mov eax, dword [rcx + 8]
mov r10, r8
mov r11, rdx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
or eax, 0x20006
lea rcx, [rsp + 0x50]
mov rbx, r9
mov qword [rsp + 0x38], rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x30], rcx
mov rdx, r10
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, r11
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400165e8
xor al, al
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x90]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x60
pop rbx
ret

Function at 0x140016630
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov eax, dword [rcx + 8]
mov r11, r8
mov rbx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x40], rcx
mov r10, rdx
lea rcx, [rsp + 0x50]
xor esi, esi
mov qword [rsp + 0x38], rcx
or eax, 0x20006
mov qword [rsp + 0x30], rsi
mov rdi, r9
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], esi
mov rdx, r11
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400166c5
mov r8, qword [rbx + 0x18]
cmp r8, 8
jb 0x1400166a2
mov rdx, qword [rbx]
inc r8
mov rcx, rbx
call fcn.140007540
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 8
jb 0x1400166b8
mov rbx, qword [rbx]
xor al, al
mov word [rbx], si
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
cmp qword [rbx + 0x18], 8
mov rax, qword [rbx + 0x10]
jb 0x1400166d5
mov rcx, qword [rbx]
jmp 0x1400166d8
mov rcx, rbx
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
sete dil
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, qword [rbx + 0x18]
cmp r8, 8
jb 0x140016723
mov rdx, qword [rbx]
inc r8
mov rcx, rbx
call fcn.140007540
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 8
jb 0x140016739
mov rbx, qword [rbx]
movzx eax, dil
mov word [rbx], si
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140016750
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1402d9850]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov rbp, r8
mov rsi, rdx
mov dword [rsp + 0x30], 0x9c40
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
add rcx, 2
call fcn.14012a230
mov rbx, rax
mov qword [rsp + 0x40], rax
mov r8d, dword [rsp + 0x30]
add r8, 2
xor edx, edx
mov rcx, rax
call fcn.14012d3f0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016896
mov r8d, 7
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x48], di
test rbx, rbx
je 0x14001683e
cmp word [rbx], 0
jne 0x14001681d
mov r8, rdi
jmp 0x14001682c
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], 0
jne 0x140016821
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140007090
mov r8, qword [rsp + 0x60]
lea rax, [rsp + 0x48]
cmp r14, rax
je 0x14001687b
lea rdx, [rsp + 0x48]
cmp r8, 8
cmovae rdx, qword [rsp + 0x48]
cmp word [rdx], 0
je 0x14001686b
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140016861
mov r8, rdi
mov rcx, r14
call fcn.140007090
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x140016893
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140007540
mov dil, 1
mov edx, 1
mov rcx, rbx
call fcn.14012a238
movzx eax, dil
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14012a1e0
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400168c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov r10, rdx
mov dword [rsp + 0x30], 0xffffffff
mov rax, r8
mov dword [rsp + 0x34], 4
lea rcx, [rsp + 0x34]
mov rbx, r9
mov qword [rsp + 0x28], rcx
xor r9d, r9d
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rax
mov rcx, qword [r10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140016911
xor al, al
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
mov al, 1
add rsp, 0x40
pop rbx
ret
Function at 0x1400169a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, r9
mov r10, rdx
mov r9d, dword [rcx + 8]
mov rax, r8
lea rcx, [rsp + 0x38]
or r9d, 1
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [r10]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400169dc
xor al, al
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0xffffffff
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140016a2e
mov rcx, qword [rsp + 0x38]
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rsp + 0x70]
mov bl, 1
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
add rsp, 0x40
pop rbx
ret

Function at 0x140016a50
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov rdi, r9
mov ecx, 0x13880
mov rsi, r8
mov r14, rdx
call fcn.14012a230
cmp qword [rdi], 0
mov rbx, rax
jne 0x140016aa9
mov r9d, dword [rbp + 8]
xor r8d, r8d
mov rcx, qword [r14]
or r9d, 8
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016ad8
mov rsi, qword [rsp + 0x60]
mov r9d, 0x9c3f
mov rcx, qword [rdi]
mov r8, rbx
mov edx, dword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x140016ae9
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
mov qword [rdi], r8
test rbx, rbx
je 0x140016ae5
mov rcx, rbx
call fcn.14012a238
xor al, al
jmp 0x140016b24
test eax, eax
jne 0x140016ad8
cmp word [rbx], ax
jne 0x140016af7
xor r8d, r8d
jmp 0x140016b0b
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140016b00
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
call fcn.140007090
inc dword [rsi]
mov rcx, rbx
call fcn.14012a238
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140016b40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1402d9850]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r14, r9
mov r13, r8
mov r12, rdx
mov rbp, rcx
mov r15, qword [rsp + 0x100]
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x58], rcx
mov ecx, 0x13880
call fcn.14012a230
mov rsi, rax
mov dword [rsp + 0x44], 0x9c40
mov ecx, 0x9c40
call fcn.14012a230
mov rbx, rax
mov dword [rsp + 0x40], 0x9c40
mov qword [rsp + 0x80], 7
xor edi, edi
mov qword [rsp + 0x78], rdi
mov word [rsp + 0x68], di
cmp qword [r14], rdi
jne 0x140016c05
mov r9d, dword [rbp + 8]
or r9d, 1
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, r13
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016c50
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x44]
mov r8, rsi
mov edx, dword [r15]
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x140016c4c
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [r14], rdi
jmp 0x140016c50
test eax, eax
je 0x140016c71
test rsi, rsi
je 0x140016c5d
mov rcx, rsi
call fcn.14012a238
test rbx, rbx
je 0x140016c6a
mov rcx, rbx
call fcn.14012a238
xor bl, bl
jmp 0x140016d4f
cmp word [rsi], 0
jne 0x140016c7c
mov r8, rdi
jmp 0x140016c8b
or r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], 0
jne 0x140016c80
mov rdx, rsi
mov rcx, qword [rsp + 0x50]
call fcn.140007090
cmp dword [rsp + 0x40], 0
je 0x140016cf3
cmp byte [rbx], 0
je 0x140016cf3
mov eax, dword [rsp + 0x48]
cmp eax, 1
jne 0x140016cda
cmp word [rbx], 0
jne 0x140016cb8
mov r8, rdi
jmp 0x140016ccb
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140016cc0
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140007090
jmp 0x140016cf3
cmp eax, 4
jne 0x140016cf3
mov r8d, dword [rbx]
lea rdx, [0x14025f7e0]
lea rcx, [rsp + 0x68]
call fcn.140006500
lea rcx, [rsp + 0x68]
mov rax, qword [rsp + 0x58]
cmp rax, rcx
je 0x140016d35
lea rdx, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae rdx, qword [rsp + 0x68]
cmp word [rdx], 0
je 0x140016d2a
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140016d20
mov r8, rdi
mov rcx, rax
call fcn.140007090
inc dword [r15]
mov rcx, rsi
call fcn.14012a238
test rbx, rbx
je 0x140016d4d
mov rcx, rbx
call fcn.14012a238
mov bl, 1
mov r8, qword [rsp + 0x80]
cmp r8, 8
jb 0x140016d6f
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140007540
movzx eax, bl
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14012a1e0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140016da0
Capabilities:
Delete registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r9
mov rax, r8
mov r9d, dword [rcx + 8]
mov r10, rdx
lea rcx, [rsp + 0x40]
or r9d, 0xf003f
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r10
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016df0
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x140016e10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r9
mov rax, r8
mov r9d, dword [rcx + 8]
mov r10, rdx
lea rcx, [rsp + 0x30]
or r9d, 1
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, r10
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x140016eef
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x58], rbx
xor edx, edx
mov dword [rsp + 0x50], 0x9c40
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
movsxd rcx, dword [rsp + 0x50]
mov eax, 2
add rcx, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14012a230
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x50]
mov r8, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov rax, rbx
sub rdi, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rdi + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140016ec0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 2
mov rcx, rbx
call fcn.14012a238
mov rbx, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003b830
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rcx]
lea r9d, [rax + 1]
add dl, al
movsxd r8, r9d
movsxd rax, r9d
xor byte [r8 + rcx], dl
cmp rax, 0x20
jb 0x14003b840
mov byte [rcx + 0x21], 0
lea rax, [rcx + 1]
ret

Function at 0x14003b8f0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 1]
xor r9d, r9d
mov rdx, rax
nop word [rax + rax]
movzx r8d, byte [rcx]
inc r9d
xor byte [rdx], r8b
lea rdx, [rdx + 1]
movsxd r8, r9d
cmp r8, 0x20
jb 0x14003b900
mov byte [rcx + 0x21], 0
ret

Function at 0x14003bb20
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rcx]
lea r9d, [rax + 1]
add dl, al
movsxd r8, r9d
movsxd rax, r9d
xor byte [r8 + rcx], dl
cmp rax, 0x21
jb 0x14003bb30
mov byte [rcx + 0x22], 0
lea rax, [rcx + 1]
ret

Function at 0x14003bc90
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 1]
xor r9d, r9d
mov rdx, rax
nop word [rax + rax]
movzx r8d, byte [rcx]
inc r9d
xor byte [rdx], r8b
lea rdx, [rdx + 1]
movsxd r8, r9d
cmp r8, 0x21
jb 0x14003bca0
mov byte [rcx + 0x22], 0
ret

Function at 0x14003bd40
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 1]
xor r9d, r9d
mov rdx, rax
nop word [rax + rax]
movzx r8d, byte [rcx]
inc r9d
xor byte [rdx], r8b
lea rdx, [rdx + 1]
movsxd r8, r9d
cmp r8, 0x22
jb 0x14003bd50
mov byte [rcx + 0x23], 0
ret

Function at 0x14003bdf0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rcx]
lea r9d, [rax + 1]
add dl, al
movsxd r8, r9d
movsxd rax, r9d
xor byte [r8 + rcx], dl
cmp rax, 0x22
jb 0x14003be00
mov byte [rcx + 0x23], 0
lea rax, [rcx + 1]
ret

Function at 0x14003c060
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 1]
xor r9d, r9d
mov rdx, rax
nop word [rax + rax]
movzx r8d, byte [rcx]
inc r9d
xor byte [rdx], r8b
lea rdx, [rdx + 1]
movsxd r8, r9d
cmp r8, 0x23
jb 0x14003c070
mov byte [rcx + 0x24], 0
ret
Function at 0x14003cea0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r13, [0x14025eb24]
xor edi, edi
mov esi, 8
mov r11d, ntohs
mov r10d, esi
mov r14d, 0x10
sub r10, r13
sub r11, r13
sub r14, r13
mov r15d, 0x14
sub r15, r13
mov ebp, r8d
mov r12, rdx
mov rbx, rcx
mov r9d, edi
nop word [rax + rax]
mov rcx, qword [rbx]
lea r8, [r9 + r13]
mov eax, dword [r8 - 4]
lea rdx, [r10 + r8]
mov dword [r9 + rcx], eax
mov rcx, qword [rbx]
mov eax, dword [r8]
mov dword [rcx + r9 + 4], eax
add r9, 0x18
mov rcx, qword [rbx]
mov eax, dword [r8 + 4]
mov dword [rdx + rcx], eax
lea rdx, [r11 + r8]
mov rcx, qword [rbx]
mov eax, dword [r8 + 8]
mov dword [rdx + rcx], eax
lea rdx, [r14 + r8]
mov rcx, qword [rbx]
mov eax, dword [r8 + 0xc]
mov dword [rdx + rcx], eax
lea rdx, [r15 + r8]
mov rcx, qword [rbx]
mov eax, dword [r8 + 0x10]
mov dword [rdx + rcx], eax
cmp r9, 0x48
jl 0x14003cf00
lea r14, [0x14025db24]
mov r9, rdi
sub rsi, r14
nop dword [rax]
lea r10, [r9 + 0xc]
mov r11d, 0x40
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea r8, [r9 + r14]
mov eax, dword [r8 - 4]
lea rdx, [rsi + r8]
lea r10, [r10 + 0x10]
mov dword [r9 + rcx], eax
mov rcx, qword [rbx + 8]
mov eax, dword [r8]
mov dword [r9 + rcx + 4], eax
add r9, 0x10
mov rcx, qword [rbx + 8]
mov eax, dword [r8 + 4]
mov dword [rdx + rcx], eax
mov rcx, qword [rbx + 8]
mov eax, dword [r8 + 8]
mov dword [r10 + rcx - 0x10], eax
sub r11, 1
jne 0x14003cf80
cmp r9, 0x1000
jl 0x14003cf70
mov r10d, edi
mov r11, rdi
nop word [rax + rax]
mov r9, qword [rbx]
lea eax, [r10 + 1]
cdq
idiv ebp
movsxd rax, edx
movzx r8d, byte [rax + r12]
movsxd rax, r10d
movzx ecx, byte [rax + r12]
lea eax, [r10 + 2]
cdq
shl ecx, 8
idiv ebp
or r8d, ecx
movsxd rax, edx
shl r8d, 8
movzx ecx, byte [rax + r12]
lea eax, [r10 + 3]
cdq
or r8d, ecx
idiv ebp
shl r8d, 8
movsxd rax, edx
movzx ecx, byte [rax + r12]
lea eax, [r10 + 4]
cdq
or r8d, ecx
xor dword [r9 + r11], r8d
add r11, 4
idiv ebp
mov r10d, edx
cmp r11, 0x48
jl 0x14003cfe0
mov dword [rsp + 0x78], edi
mov rsi, rdi
mov dword [rsp + 0x20], edi
nop
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x78]
call fcn.14003ca60
mov rcx, qword [rbx]
mov eax, dword [rsp + 0x78]
mov dword [rsi + rcx], eax
mov rcx, qword [rbx]
mov eax, dword [rsp + 0x20]
mov dword [rsi + rcx + 4], eax
add rsi, 8
cmp rsi, 0x48
jl 0x14003d050
mov esi, 0x80
nop word [rax + rax]
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x78]
call fcn.14003ca60
mov rcx, qword [rbx + 8]
mov eax, dword [rsp + 0x78]
mov dword [rdi + rcx], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rsp + 0x20]
mov dword [rdi + rcx + 4], eax
add rdi, 8
sub rsi, 1
jne 0x14003d090
cmp rdi, 0x1000
jl 0x14003d081
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140076134
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x28], 0
lea r8, [0x140075920]
and dword [rsp + 0x20], 0
mov r9, rcx
xor ecx, ecx
xor edx, edx
call fcn.140132768
add rsp, 0x38
ret
Function at 0x1400785f0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x28], 0
lea r8, [0x140078510]
and dword [rsp + 0x20], 0
mov rbx, rcx
mov byte [rcx + 8], 1
mov r9, rcx
xor ecx, ecx
xor edx, edx
call fcn.140132768
mov qword [rbx], rax
add rsp, 0x30
pop rbx
ret

Function at 0x140078638
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x1d0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x1402d9850]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [r11 - 0x58], rdx
mov qword [r11 - 0x50], rbx
and dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 0x78
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
lea rdx, str._InitDllsMonitor::setRegValue_
lea rcx, [r11 - 0x168]
call fcn.14003fda0
nop
and qword [rsp + 0x38], 0
cmp qword [rdi + 0x18], 8
jb 0x1400786ae
mov rdx, qword [rdi]
jmp 0x1400786b1
mov rdx, rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400786fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
lea rax, str.Registry::Helper::RegOpenKeyExA
mov qword [rsp + 0x50], rax
lea rdx, [0x1402d6470]
lea rcx, [rsp + 0x48]
call fcn.14012ccc0
cmp qword [rbx + 0x18], 8
jb 0x140078708
mov rdx, qword [rbx]
jmp 0x14007870b
mov rdx, rbx
mov eax, dword [rsp + 0x210]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14007875a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
lea rax, str.Registry::Helper::setRegValue
mov qword [rsp + 0x60], rax
lea rdx, [0x1402d6470]
lea rcx, [rsp + 0x58]
call fcn.14012ccc0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [rsp + 0x34], 0
mov esi, 1
mov dword [rsp + 0x30], esi
jmp 0x140078789
lea rcx, [rsp + 0x80]
call fcn.14003fbb0
nop
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
xor r8d, r8d
mov dl, 1
mov rcx, rdi
call fcn.140006e40
nop
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.140006e40
mov eax, esi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14012a1e0
add rsp, 0x1d0
pop rdi
pop rsi
pop rbx
ret