joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400568f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14006b010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x80000000
cmp dword [rsp + 0x80], 0x80000000
jae 0x14005694a
mov eax, dword [rsp + 0x80]
add eax, 0x80000000
mov dword [rsp + 0x20], eax
jmp 0x14005695a
mov eax, dword [rsp + 0x80]
sub eax, 0x80000000
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x44], 0x80000000
cmp dword [rsp + 0x88], 0x80000000
jae 0x140056983
mov eax, dword [rsp + 0x88]
add eax, 0x80000000
mov dword [rsp + 0x24], eax
jmp 0x140056993
mov eax, dword [rsp + 0x88]
sub eax, 0x80000000
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x24]
sub ecx, eax
mov eax, ecx
cmp eax, 0xffffffff
jne 0x1400569cf
mov rcx, qword [rsp + 0x50]
call fcn.1400587b0
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xffffffff
ja 0x1400569c3
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x3c], eax
jmp 0x1400569c5
jmp 0x1400569a4
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x34], eax
jmp 0x1400569ed
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x24]
sub ecx, eax
mov eax, ecx
inc eax
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140057e00
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x48], 0x80000000
cmp dword [rsp + 0x28], 0x80000000
jae 0x140056a20
mov eax, dword [rsp + 0x28]
add eax, 0x80000000
mov dword [rsp + 0x38], eax
jmp 0x140056a2d
mov eax, dword [rsp + 0x28]
sub eax, 0x80000000
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140059490
add rsp, 0x68
ret
Function at 0x1400587b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x1400587d2
mov rcx, qword [rsp + 0x40]
call fcn.140058880
jmp 0x1400587e9
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x1400587e9
mov rcx, qword [rsp + 0x40]
call fcn.140058930
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140058880
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x1400588a1
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140058925
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x1400588f0
mov dword [rsp + 4], 0x9908b0df
jmp 0x1400588f8
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140058894
add rsp, 0x18
ret
Function at 0x140058930
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140058960
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x1400589e2
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1400589ae
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x1400589b6
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140058955
mov qword [rsp + 8], 0xe3
jmp 0x1400589fa
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140058a81
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140058a4b
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140058a53
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1400589ed
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140058ad5
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x140058add
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret

Function at 0x14005a194
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005a1de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005a1de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005a1de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005a1de
cmp dword [rcx + 0x84], 0xe
jbe 0x14005a1de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005a1e0
xor al, al
add rsp, 0x28
ret
Function at 0x180005c60
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x240
movzx ebx, byte [rsp + 0x278]
lea eax, [rdx + 0x480]
mov dword [rsp + 0x38], eax
mov r14, r9
mov r13, r8
mov esi, edx
mov r15, rcx
cmp edx, eax
jae 0x180005e71
mov rbp, qword [rsp + 0x38]
lea rdi, [0x180017e60]
mov r12d, dword [rsp + 0x278]
nop dword [rax + rax]
cmp esi, 0x11e
ja 0x180005e15
je 0x180005d5a
mov eax, esi
sub eax, 0x8e
je 0x180005d34
sub eax, 6
je 0x180005d23
sub eax, 0x4c
je 0x180005d1b
cmp eax, 0x3a
jne 0x180005e61
movzx eax, word [r13]
lea rcx, [rsp + 0x278]
xor r9d, r9d
mov word [rsp + 0x278], ax
mov r8, r14
mov edx, 0xf0
call fcn.18000e4b0
mov qword [r14], rdi
jmp 0x180005e61
mov qword [r14], r15
jmp 0x180005e61
mov rcx, r14
call qword [0x180059e98]
movzx ebx, al
jmp 0x180005e61
mov r8, qword [r14 + 0x98]
xor edx, edx
mov rbp, qword [sym.imp.SHELL32.dll_ExtractIconExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x180005e61
mov edi, 0x105
nop
mov eax, edi
sub eax, 0x101
je 0x180005ddf
sub eax, 1
je 0x180005dd0
sub eax, 1
je 0x180005dc9
sub eax, 1
je 0x180005d99
cmp eax, 1
jne 0x180005df1
lea r8d, [rax + 4]
lea rdx, str.Extradata_set_to__p__size:__d__
lea rcx, [rsp + 0x20]
call fcn.180029a60
mov byte [rsp + 0x25], 0
jmp 0x180005df1
mov r8d, 5
lea rdx, [0x1800428c5]
lea rcx, [rsp + 0x20]
call fcn.1800298b0
mov r8d, 2
lea rdx, [0x1800428ea]
lea rcx, [rsp + 0x2a]
call fcn.180029a60
jmp 0x180005df1
mov byte [rsp + 0x2c], 0
jmp 0x180005df1
mov dword [rsp + 0x2c], 0x70252078
mov byte [rsp + 0x30], 0
jmp 0x180005df1
mov r8, rbp
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180023590
dec edi
cmp edi, 0x100
ja 0x180005d60
cmp r12d, 0xb7
je 0x180005e95
lea rdi, [0x180017e60]
jmp 0x180005e61
mov eax, esi
sub eax, 0x124
je 0x180005e71
sub eax, 0x4c
je 0x180005e49
cmp eax, 0x3a
jne 0x180005e61
lea rcx, [r14 + 0xa]
cmp rcx, r15
je 0x180005e61
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x180005e3e
mov rdx, qword [r15]
mov r8, qword [r15 + 0x10]
call fcn.18001e0e0
jmp 0x180005e61
lea rdx, [r14 + 0x110]
mov qword [r14 + 0x108], r13
mov ecx, 0xd8
call fcn.18000de00
add esi, 0x90
cmp esi, dword [rsp + 0x38]
jb 0x180005cc0
lea r11, [rsp + 0x240]
movzx eax, bl
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x180014840
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea ebp, [rdx + 0xb]
xor r11d, r11d
lea r12, [0x180000000]
mov esi, edx
mov r14, rcx
cmp edx, ebp
jae 0x180014981
lea edi, [r11 + 0xb]
mov r13d, 0x6574
lea ebx, [rdx - 0x23]
lea edx, [rdi + 0x54]
lea r15d, [r11 + 0x32]
lea r8d, [r11 + 0x33]
lea r9d, [r11 + 0x78]
lea r10d, [r11 + 0x65]
nop
cmp ebx, 0x21
ja case.0x1800148ad.11
movzx eax, byte [r12 + rbx + 0x14ae4]
mov ecx, dword [r12 + rax*4 + 0x14ab4]
add rcx, r12
jmp rcx
mov dword [rsp + 0x40], 0x730077
jmp case.0x1800148ad.11
mov rdx, qword [0x180059e20]
mov r9d, 0xee
mov r8, r14
xor ecx, ecx
call fcn.180021fa0
mov edx, 0x5f
xor r11d, r11d
lea r8d, [rdx - 0x2c]
lea r9d, [rdx + 0x19]
lea r10d, [rdx + 6]
jmp case.0x1800148ad.11
xor r9d, r9d
mov r8, r14
xor ecx, ecx
lea edx, [r9 + 0x24]
call fcn.18000d130
jmp 0x1800148d3
mov word [rsp + 0x4a], r15w
jmp case.0x1800148ad.11
mov word [rsp + 0x44], r15w
jmp case.0x1800148ad.11
mov dword [r14 + 0x94], 0x3840
jmp case.0x1800148ad.11
mov word [rsp + 0x30], r13w
mov dword [rsp + 0x32], 0x652e7473
jmp case.0x1800148ad.11
mov dword [r14 + 0x90], 0x3c
jmp case.0x1800148ad.11
mov qword [rsp + 0x28], r11
lea r8, [0x1800115b0]
mov r9, r14
mov dword [rsp + 0x20], r11d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14], rax
jmp 0x1800148d3
mov dword [rsp + 0x46], 0x33005f
jmp case.0x1800148ad.11
mov word [rsp + 0x36], r9w
mov word [rsp + 0x37], r10w
inc ebx
sub rdi, 1
jne 0x180014890
movzx ebx, byte [rsp + 0xa8]
cmp esi, ebp
jae case.0x1800149b9.14
mov r15, qword [rsp + 0xb0]
lea edi, [rsi - 0x23]
mov edx, 0x6c
lea r13d, [rdx - 0x3e]
cmp edi, 0x16
ja case.0x1800149b9.6
mov ecx, dword [r12 + rdi*4 + 0x14b08]
add rcx, r12
jmp rcx
mov word [rsp + 0x4c], r13w
jmp case.0x1800149b9.6
mov dword [rsp + 0x4e], 0x6c0064
jmp case.0x1800149b9.6
lea rcx, [rsp + 0x30]
mov byte [r14 + 0xc], 1
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeA]
mov edx, 0x6c
jmp case.0x1800149b9.6
cmp qword [r14], 0
jne case.0x1800149b9.6
xor al, al
jmp 0x180014a9c
mov edx, 0x5b
mov word [rsp + 0x54], r11w
lea rcx, [rsp + 0x40]
lea r8d, [rdx - 0x58]
call fcn.180005a90
mov r15, rax
mov edx, 0x6c
jmp case.0x1800149b9.6
mov bl, 1
jmp case.0x1800149b9.6
xor r9d, r9d
xor r8d, r8d
mov edx, 0xea
xor ecx, ecx
call fcn.18000a2c0
mov qword [r14 + 0x98], rax
mov edx, 0x6c
movabs rax, 0x400c3d70a3d70a3d
mov qword [r14 + 0x88], rax
jmp case.0x1800149b9.6
xor edx, edx
mov r8d, 0xaa
mov rcx, r14
call fcn.18001e4c0
test al, al
je case.0x1800149b9.14
mov rcx, qword [r14]
call r15
mov edx, 0x6c
jmp case.0x1800149b9.6
mov qword [r14], 0xffffffffffffffff
mov dword [r14 + 8], r11d
jmp case.0x1800149b9.6
mov word [rsp + 0x52], dx
inc esi
inc edi
cmp esi, ebp
jae case.0x1800149b9.14
xor r11d, r11d
jmp 0x1800149a5
movzx eax, bl
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001f6e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18001f714
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18001f700
ret
Function at 0x1800233f0
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
mov rax, rdx
mov r9, rcx
mov rcx, rax
xor edx, edx
mov r8d, 0xdc
jmp fcn.1800206c0
Function at 0x14000ae60
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push r14
sub rsp, 0x40
and qword [rax - 0x10], 0
mov r14, r9
mov rbp, r8
lea r9, [rax - 0x10]
xor ebx, ebx
mov rcx, 0xffffffff80000002
lea r8d, [rbx + 1]
call fcn.14000d40c
mov esi, eax
test eax, eax
jns 0x14000aea7
mov ecx, eax
jmp 0x14000af6f
and dword [rsp + 0x50], ebx
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
je 0x14000aeec
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x14000af28
test rbx, rbx
jne 0x14000af33
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x14000af2c
mov ebx, eax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14000aeab
mov esi, 0x8007000e
mov ecx, esi
jmp 0x14000af6f
mov esi, 0x8000ffff
jmp 0x14000af28
cmp dword [rsp + 0x30], 0xb
je 0x14000af41
mov esi, 0x8007000d
jmp 0x14000af28
xor ebp, ebp
cmp dword [rsp + 0x50], 8
je 0x14000af5a
mov esi, 0x8007000d
mov ecx, esi
mov ebp, esi
call fcn.14000bbd0
jmp 0x14000af60
mov rax, qword [rbx]
mov qword [r14], rax
mov ecx, ebp
call fcn.14000bbf0
mov esi, ebp
test ebp, ebp
jns 0x14000af74
mov ecx, ebp
call fcn.14000bbd0
mov ecx, esi
call fcn.14000bbf0
test rbx, rbx
je 0x14000afa0
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
cmp qword [rsp + 0x38], 0
je 0x14000afb9
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x58]
mov eax, esi
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x14000afd8
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
and qword [rbp + 0x20], 0
lea r8, [rbp + 0x20]
xor ebx, ebx
lea rcx, str.D:PAI_A_OICI_FA___WD_
xor esi, esi
xor r9d, r9d
mov qword [rbp + 0x28], rsi
lea edi, [rbx + 1]
mov edx, edi
call qword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
nop dword [rax + rax]
test eax, eax
jne 0x14000b043
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000b02e
mov edi, 0x80004005
jmp 0x14000b03c
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
jmp 0x14000b120
mov rax, qword [rbp + 0x20]
lea r8, str.GlobalMicrosoft.Windows.Remediation.TelemetryUpdateHealthTools
and dword [rbp - 0x1c], ebx
lea rcx, [rbp - 0x20]
and dword [rbp - 0xc], ebx
xor edx, edx
and dword [rbp - 0x10], ebx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x20], 0x18
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000b017
mov edx, 0x2710
mov rcx, rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x14000b0d5
cmp eax, 0x102
je 0x14000b0cb
cmp eax, 0xffffffff
jne 0x14000b027
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14000b0b4
xor edi, edi
jmp 0x14000b125
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x14000b125
jmp 0x14000b03c
mov edi, 0x800705b4
jmp 0x14000b03c
lea r9, [rbp + 0x28]
lea r8, [0x14003b8d0]
lea rdx, str.SoftwareMicrosoftRemediationLocalStateTelemetryUpdateHealthTools
call fcn.14000ae60
mov rsi, qword [rbp + 0x28]
test eax, eax
cmovs rsi, rdi
call fcn.14000c480
mov edi, eax
test eax, eax
js 0x14000b11e
lea r9, [rsi + 1]
lea r8, [0x14003b8d0]
lea rdx, str.SoftwareMicrosoftRemediationLocalStateTelemetryUpdateHealthTools
call fcn.14000c38c
mov edi, eax
test eax, eax
jns 0x14000b125
mov ecx, eax
call fcn.14000bbd0
test rbx, rbx
je 0x14000b139
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
nop dword [rax + rax]
test edi, edi
jns 0x14000b14b
lea rdx, str.Failed_to_get_a_proper_GlobalEventCounter_for_telemetry__using_0
mov ecx, edi
call fcn.14000b430
test rbx, rbx
je 0x14000b15f
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14000b174
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x70]
mov rax, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c38c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, r9
mov rsi, r8
mov rdi, rdx
xor ecx, ecx
call fcn.14000bbf0
and qword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, 2
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov rcx, 0xffffffff80000002
call fcn.14000d40c
mov rbx, qword [rsp + 0x50]
mov edi, eax
test eax, eax
jns 0x14000c3e4
mov ecx, eax
jmp 0x14000c434
xor ecx, ecx
call fcn.14000bbf0
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000c420
xor edi, edi
jmp 0x14000c439
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x14000c439
mov ecx, edi
call fcn.14000bbd0
mov ecx, edi
call fcn.14000bbf0
test rbx, rbx
je 0x14000c454
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test edi, edi
jns 0x14000c45f
mov ecx, edi
call fcn.14000bbd0
mov ecx, edi
call fcn.14000bbf0
mov rbx, qword [rsp + 0x58]
mov eax, edi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14000e268
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140056920]
xor rax, rsp
mov qword [rbp + 0x140], rax
and qword [rdx], 0
mov r15, rdx
mov r8, rcx
mov edi, 0x104
mov edx, edi
lea rcx, [rsp + 0x30]
xor r14d, r14d
call fcn.140003870
lea r8, [0x140037010]
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.1400038fc
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
lea r13, [0x140036fd4]
mov rbx, rax
test rax, rax
jne 0x14000e320
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x14000e426
mov rcx, qword [rbp + 0x178]
lea edx, [rdi - 0x3b]
mov r8, r13
call fcn.140005220
mov esi, eax
jmp 0x14000e407
and dword [rsp + 0x24], r14d
lea rdx, [rsp + 0x24]
and dword [rsp + 0x20], r14d
mov rcx, rbx
call fcn.14000534c
mov esi, eax
test eax, eax
jns 0x14000e361
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov r8, r13
mov edx, 0xcf
call fcn.1400051e8
mov rcx, rbx
call fcn.1400052c4
jmp 0x14000e407
lea r8, [0x140037018]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400038fc
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14000e3ad
mov rcx, qword [rbp + 0x178]
mov r8, r13
mov edx, 0xd5
call fcn.140005220
mov esi, eax
jmp 0x14000e354
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000534c
mov esi, eax
test eax, eax
jns 0x14000e3e4
mov rcx, qword [rbp + 0x178]
mov r9d, eax
mov r8, r13
mov edx, 0xd7
call fcn.1400051e8
mov rcx, rdi
call fcn.1400052c4
jmp 0x14000e354
mov rcx, rdi
call fcn.1400052c4
movsxd rax, dword [rsp + 0x20]
mov rcx, rbx
movsxd r14, dword [rsp + 0x24]
shl rax, 0x1f
or r14, rax
call fcn.1400052c4
xor esi, esi
test esi, esi
jns 0x14000e426
mov rcx, qword [rbp + 0x178]
mov r9d, esi
mov r8, r13
mov edx, 0x62
call fcn.1400051e8
mov eax, esi
jmp 0x14000e42b
mov qword [r15], r14
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1400301c0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x14000ef38
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14000ef70
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov rdx, qword [rcx + rax*8]
cmp rdi, rdx
je 0x14000f004
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x14000f004
mov rdi, qword [rdi + 8]
mov eax, dword [rdi + 0x10]
cmp dword [r10], eax
jne 0x14000efb5
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x18]
call fcn.14000be20
mov edx, 0x38
mov rcx, rbx
call fcn.1400301e8
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14000f0a1
mov rax, qword [rbx]
cmp rdi, rax
je 0x14000f039
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov r10, r8
add r10, r10
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x14000f05f
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14000f08e
cmp rax, rdi
jne 0x14000f06a
mov qword [rdx + r8*8], rbx
jmp 0x14000f08e
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14000f08e
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.14000f0b8
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret