joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053674
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, r9
mov r14, rdx
mov rsi, rcx
movzx r10d, word [r8]
mov word [rax + 0x18], r10w
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x70]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 2
jb 0x1400536b2
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r9, qword [rcx + rax*8]
cmp r9, rdi
je 0x1400536f7
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r9
je 0x140053748
mov rdi, qword [rdi + 8]
mov rdx, rdi
cmp r10w, word [rdi + 0x10]
jne 0x1400536fa
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.140051e88
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14005386d
mov qword [rsp + 0x70], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x140053782
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400537a2
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400537d1
cmp rax, rdx
jne 0x1400537ad
mov qword [r9 + r8*8], rbx
jmp 0x1400537d1
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400537d1
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140195be0]
test rax, rax
jns 0x1400537f2
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140053803
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140053862
cmp rdx, 0x200
jae 0x14005381b
shl rdx, 3
jmp 0x14005382d
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14005382d
add rdx, rdx
mov rcx, rsi
call fcn.140032944
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140053862
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140053674
cmp rdi, r15
jne 0x140053842
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140053b8c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r9]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x140053bc4
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r10, qword [rcx + rax*8]
cmp r10, rdi
je 0x140053c09
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r10
je 0x140053c53
mov rdi, qword [rdi + 8]
mov rdx, rdi
mov rax, qword [rdi + 0x10]
cmp qword [r9], rax
jne 0x140053c0c
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140053d78
mov qword [rsp + 0x20], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x140053c8d
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140053cad
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140053cdc
cmp rax, rdx
jne 0x140053cb8
mov qword [r9 + r8*8], rbx
jmp 0x140053cdc
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140053cdc
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140195be0]
test rax, rax
jns 0x140053cfd
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140053d0e
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140053d6d
cmp rdx, 0x200
jae 0x140053d26
shl rdx, 3
jmp 0x140053d38
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140053d38
add rdx, rdx
mov rcx, rsi
call fcn.140032944
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140053d6d
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140053b8c
cmp rdi, r15
jne 0x140053d4d
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140053e20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 8
jb 0x140053e3d
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140053e95
cmp qword [rcx + rdx*8], r8
jne 0x140053e8a
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x140053e8e
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140053ea2
cmp qword [rcx + rdx*8], r8
jne 0x140053ea2
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140053fb8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.140109ab0
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1478], rbx
mov qword [rsp + 0x1480], rsi
mov qword [rsp + 0x1488], rdi
mov rax, qword [0x1401d1010]
xor rax, rsp
mov qword [rbp + 0x1330], rax
mov r10, r8
mov r11, rdx
mov r15, rcx
or dword [rcx + 0x1388], 0xffffffff
mov edi, 0x1571
mov dword [rcx + 8], edi
mov ecx, edi
mov r13d, 1
mov r8d, r13d
lea rdx, [r15 + 0xc]
mov r9d, 0x26f
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, r8d
mov dword [rdx], ecx
add r8d, r13d
lea rdx, [rdx + 4]
sub r9, r13
jne 0x140054036
mov dword [r15 + 4], 0x270
mov qword [r15 + 0x1390], r11
mov qword [r15 + 0x1398], r10
lea rbx, [rsp + 0x50]
lea r14d, [r9 + 0x14]
mov esi, r14d
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbx], eax
lea rbx, [rbx + 4]
sub rsi, r13
jne 0x140054076
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
xor ecx, ecx
mov qword [rsp + 0x38], rcx
lea rbx, [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
cmp rcx, rdx
je 0x1400540b9
mov dword [rdx], eax
add rdx, 4
mov qword [rsp + 0x30], rdx
jmp 0x1400540d2
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140056a24
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
add rbx, 4
sub r14, r13
jne 0x1400540a1
or dword [rbp + 0x1324], 0xffffffff
mov dword [rbp - 0x5c], edi
mov r8d, r13d
mov rdx, r13
mov ecx, 0x270
mov eax, edi
shr eax, 0x1e
xor eax, edi
imul edi, eax, 0x6c078965
add edi, r8d
mov dword [rbp + rdx*4 - 0x5c], edi
add r8d, r13d
add rdx, r13
cmp rdx, rcx
jl 0x1400540f0
mov dword [rbp - 0x60], ecx
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x60]
call fcn.140056158
mov r8d, 0x1388
lea rdx, [rbp - 0x60]
lea rcx, [r15 + 4]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x140054172
mov rdx, rcx
mov rax, qword [rsp + 0x38]
sub rax, rcx
and rax, 0xfffffffffffffffc
cmp rax, 0x1000
jb 0x14005416c
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x14005416c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, r15
mov rcx, qword [rbp + 0x1330]
xor rcx, rsp
call fcn.140107ad0
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140056158
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x9d0
mov rax, qword [0x1401d1010]
xor rax, rsp
mov qword [rsp + 0x9c0], rax
mov rbp, qword [rdx]
lea rdi, [rsp]
mov r9, qword [rdx + 8]
mov r15d, 0x270
sub r9, rbp
mov rbx, rcx
sar r9, 2
mov r10d, r15d
cmp r9, r15
mov ecx, r15d
movabs r12, 0xa41a41a41a41a41b
lea rax, [r9 + 1]
cmovae r10, rax
xor r8d, r8d
mov eax, 0x8b8b8b8b
rep stosd dword [rdi], eax
test r10, r10
je 0x1400562bf
lea rsi, [r8 + 0x132]
mov rax, r12
mul rsi
mov rax, rsi
lea rdi, [r8 - 1]
sub rax, rdx
mov r11, r8
shr rax, 1
mov rcx, rdi
add rax, rdx
shr rax, 9
imul rax, rax, 0x270
sub rsi, rax
mov rax, r12
mul r8
mov r14d, dword [rsp + rsi*4]
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 9
imul rax, rax, 0x270
sub r11, rax
mov rax, r12
mul rdi
mov rax, rdi
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 9
imul rax, rax, 0x270
sub rcx, rax
mov edx, dword [rsp + rcx*4]
xor edx, r14d
xor edx, dword [rsp + r11*4]
mov eax, edx
shr eax, 0x1b
xor eax, edx
imul ecx, eax, 0x19660d
test r8, r8
jne 0x140056262
mov rax, r9
jmp 0x14005627b
cmp r8, r9
ja 0x140056278
xor edx, edx
mov rax, rdi
div r9
mov eax, dword [rbp + rdx*4]
add rax, r11
jmp 0x14005627b
mov rax, r11
lea edi, [rax + rcx]
lea eax, [r14 + rcx]
mov dword [rsp + rsi*4], eax
lea rcx, [r8 + 0x13d]
mov rax, r12
inc r8
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 9
imul rax, rax, 0x270
sub rcx, rax
add dword [rsp + rcx*4], edi
mov dword [rsp + r11*4], edi
cmp r8, r10
jb 0x1400561cc
lea rsi, [r10 + 0x270]
cmp r8, rsi
jae 0x1400563a9
lea rbp, [r8 - 1]
lea r10, [rbp + 0x133]
mov rax, r12
mul r10
lea r11, [rbp + 1]
mov rax, r10
sub rax, rdx
mov r9, r11
shr rax, 1
mov rcx, rbp
add rax, rdx
shr rax, 9
imul rax, rax, 0x270
sub r10, rax
mov rax, r12
mul r11
mov r8d, dword [rsp + r10*4]
mov rax, r11
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 9
imul rax, rax, 0x270
sub r9, rax
mov rax, r12
mul rbp
mov rax, rbp
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 9
imul rax, rax, 0x270
sub rcx, rax
mov edx, dword [rsp + rcx*4]
add edx, dword [rsp + r9*4]
add edx, r8d
mov eax, edx
shr eax, 0x1b
xor eax, edx
imul ecx, eax, 0x5d588b65
mov rax, r12
xor r8d, ecx
mov edi, ecx
lea rcx, [rbp + 0x13e]
mov dword [rsp + r10*4], r8d
mul rcx
sub edi, r9d
mov rax, rcx
sub rax, rdx
mov rbp, r11
shr rax, 1
add rax, rdx
shr rax, 9
imul rax, rax, 0x270
sub rcx, rax
lea rax, [r11 + 1]
xor dword [rsp + rcx*4], edi
mov dword [rsp + r9*4], edi
cmp rax, rsi
jb 0x1400562d3
xor edx, edx
lea rax, [rsp]
xor edi, edi
lea r8, [rsp]
mov r9, rbx
sub r9, rax
mov eax, dword [r8]
mov ecx, eax
or ecx, edx
mov dword [r9 + r8 + 4], eax
mov edx, eax
lea r8, [r8 + 4]
shr edx, 0x1f
test edi, edi
cmovne edx, ecx
inc edi
cmp edi, r15d
jb 0x1400563bb
test edx, edx
jne 0x1400563e4
or dword [rbx + 4], 0xffffffff
mov dword [rbx], r15d
mov rcx, qword [rsp + 0x9c0]
xor rcx, rsp
call fcn.140107ad0
lea r11, [rsp + 0x9d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140056414
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rbx, rcx
mov esi, 0x7fffffff
mov ebp, 0x9908b0df
mov r9, qword [rbx]
mov r8d, dword [r9]
cmp r8d, 0x270
jne 0x140056484
lea r8, [r9 + 8]
mov r10d, 0x270
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, esi
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140056449
mov r8d, dword [r9]
jmp 0x140056552
cmp r8d, 0x4e0
jb 0x140056552
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400564a1
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400564e6
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, esi
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
xor r8d, r8d
mov eax, r8d
mov edx, dword [r9 + rax*4 + 4]
mov ecx, edx
shr ecx, 0xb
lea eax, [r8 + 1]
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, qword [rbx + 0x10]
ja 0x140056430
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
ret
Function at 0x1400588fc
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
and qword [rax - 0x18], 0
and qword [rax + 8], 0
cmp dword [0x1401dc960], 0
jne 0x1400589c9
mov eax, dword [0x1401dc96c]
test eax, eax
jne 0x1400589c9
xor edi, edi
mov ecx, dword [0x1401dc964]
test ecx, ecx
je 0x14005895a
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x1401dc96c]
mov ecx, dword [0x1401dc964]
test eax, eax
jne 0x1400589c9
test ecx, ecx
jne 0x140058970
call fcn.140058a28
test eax, eax
jne 0x140058970
lea ebx, [rax + 1]
jmp 0x14005898c
lea rdx, [rsp + 0x40]
mov rcx, qword [0x1401d1048]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne edi, ebx
test edi, edi
jne 0x1400589c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, ebx
jbe 0x1400589ab
cmp eax, 0x78
je 0x1400589ab
cmp eax, ebx
je 0x1400589ab
cmp eax, 0x32
jne 0x1400589b3
mov dword [0x1401dc96c], ebx
mov edi, ebx
test edi, edi
jne 0x1400589c9
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rcx, str.version.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp dword [0x1401dc960], 0
je 0x1400589f0
cmp dword [0x1401dc96c], 0
jne 0x140058a22
xor edi, edi
test rbx, rbx
sete dil
test edi, edi
je 0x140058a07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140058a09
xor esi, esi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x140058a22
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
jmp 0x1400589b9
Function at 0x140058c04
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000000
lea rdx, str.CLSID
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140058cd1
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and qword [rbp + 0x28], 0
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140058cc2
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.InsecureQI
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140058cc2
cmp dword [rbp + 0x18], 4
jne 0x140058cc2
mov ebx, dword [rbp + 0x20]
cmp ebx, 3
ja 0x140058cc2
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140058cd3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140058cd3
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140058cd1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140058ce2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140059098
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp byte [0x1401deb14], 0
je 0x1400590be
mov eax, dword [0x1401deb18]
jmp 0x1400591c2
and qword [rbp + 0x18], 0
lea rax, [rbp + 0x18]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 4
lea rsi, [0x1401deb18]
test eax, eax
jne 0x14005912a
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.CLSIDInterfaceTest
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rbp + 0x10], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005912a
cmp dword [rbp + 0x10], ebx
je 0x140059199
mov rcx, qword [rbp + 0x18]
and qword [rbp + 0x18], 0
test rcx, rcx
je 0x14005913e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x18]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400591a1
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.CLSIDInterfaceTest
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rbp + 0x10], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400591a1
cmp dword [rbp + 0x10], ebx
jne 0x1400591a1
mov ebx, dword [0x1401deb18]
jmp 0x1400591aa
and dword [0x1401deb18], 0
xor ebx, ebx
mov rcx, qword [rbp + 0x18]
mov byte [0x1401deb14], 1
test rcx, rcx
je 0x1400591c0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x140061ef4
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rdx
mov r14, rcx
movzx r9d, byte [r8]
mov eax, r9d
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov rdi, qword [r14 + 0x30]
and rdi, rax
mov rax, rdi
add rax, rax
mov rcx, qword [r14 + 0x18]
mov rbx, qword [r14 + 8]
mov rdx, qword [rcx + rax*8]
cmp rdx, rbx
jne 0x140061f64
mov rax, rbx
jmp 0x140061f6c
mov rax, qword [rcx + rax*8 + 8]
mov rax, qword [rax]
mov r15, rax
cmp r15, rdx
je 0x140061f90
mov rax, qword [rax + 8]
mov r15, rax
cmp r9b, byte [rax + 0x10]
jne 0x140061f6f
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140062080
mov rbx, qword [rbx]
mov r12, qword [rbx + 8]
mov r9, r8
mov r8, r12
mov rdx, rbx
call fcn.1400624a0
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jae 0x140061fcd
lea rcx, str.list_T__too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [r12], rdx
mov rax, qword [r14 + 8]
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rdx, qword [rbx]
cmp r15, rdx
je 0x140062021
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r15
mov rax, qword [r15 + 8]
mov qword [rax], rbx
mov rcx, qword [r15 + 8]
mov rax, qword [rdx + 8]
mov qword [r15 + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
mov rax, qword [r14 + 8]
add rdi, rdi
mov rdx, qword [r14 + 0x18]
cmp qword [rdx + rdi*8], rax
jne 0x14006203d
mov qword [rdx + rdi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rdi*8 + 8], rbx
jmp 0x14006206d
cmp qword [rdx + rdi*8], r15
jne 0x140062049
mov qword [rdx + rdi*8], rbx
jmp 0x14006206d
mov rax, qword [rdx + rdi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rdi*8 + 8], rcx
cmp rcx, rbx
je 0x14006206d
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rdi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rdi*8 + 8], rcx
mov rcx, r14
call fcn.1400621b8
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret