joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ba78
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x50
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rdi, r9
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
lea rax, [0x140039c40]
mov qword [r11 - 0x30], rax
lea rax, [r11 - 0x20]
mov qword [r11 - 0x38], rax
mov r9d, dword [rsp + 0x80]
call fcn.14003ae24
mov rbx, rax
shr rax, 0x27
not eax
test al, 1
jne 0x14001bb49
cmp qword [rdi + 0x18], 8
jb 0x14001bad3
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x38]
mov rdx, rdi
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14001bafd
movabs rbx, 0x8000000000
jmp 0x14001bb49
mov edx, MsiPreviewDialogW
lea rcx, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001bb1f
inc rax
jmp 0x14001bb26
lea rax, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
mov rdx, rax
lea rcx, [0x14017bb60]
call fcn.140007964
shl rax, 0x34
or rbx, rax
movabs rax, 0x222100000000
or rbx, rax
lea rcx, [rsp + 0x38]
call fcn.1400085d0
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x14001bd8c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [r8 + 0x18], 8
mov rdi, rdx
mov rdx, r8
mov r10d, r9d
mov rbx, r8
mov rsi, rcx
jb 0x14001bdb9
mov rdx, qword [r8]
mov rax, qword [rdi]
xor r9d, r9d
mov r8d, r10d
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
nop dword [rax + rax]
mov ebp, eax
test eax, eax
je 0x14001be26
mov edx, MsiPreviewDialogW
lea rcx, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001bdfa
inc rax
jmp 0x14001be01
lea rax, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
mov rdx, rax
lea rcx, [0x14017bb60]
call fcn.140007964
shl rax, 0x34
movabs rcx, 0x242100000000
or rax, rbp
or rax, rcx
jmp 0x14001be3e
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.14003a30c
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002285c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov rax, rdx
jb 0x14002287b
mov rax, qword [rdx]
xor esi, esi
lea r9, [rsp + 0x38]
mov qword [rdx + 0x10], rsi
xor r8d, r8d
mov word [rax], si
mov edx, 0x4000
mov qword [rsp + 0x38], rsi
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x1400228f4
lea edx, [rsi + 0x5c]
lea rcx, str.AdminAppManAppV_sharedinclude_sharedenv_utils.hpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x1400228c8
inc rax
jmp 0x1400228cf
lea rax, str.AdminAppManAppV_sharedinclude_sharedenv_utils.hpp
mov rdx, rax
lea rcx, [0x14017bb60]
call fcn.140007964
shl rax, 0x34
movabs rcx, 0xc2500000000
or rax, rdi
or rax, rcx
jmp 0x14002291c
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.14000954c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
movabs rax, 0x8000000000
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140024780
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push r14
sub rsp, 0xf0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x140178478]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov rsi, rcx
mov r8d, 0x65
lea rdx, str.AppV::Integration::IntegrationManager::Startup
lea rcx, [r11 - 0x68]
call fcn.14005e0a8
mov rdi, rax
xor ebx, ebx
mov qword [rsp + 0x60], rbx
lea r14d, [rbx + 7]
mov qword [rsp + 0x68], r14
mov word [rsp + 0x50], bx
lea rdx, str.Integration_manager_is_starting_up.
lea rcx, [rsp + 0x50]
call fcn.14000954c
nop
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], r14
mov word [rsp + 0x70], bx
lea rdx, [0x14010bbd8]
lea rcx, [rsp + 0x70]
call fcn.14000954c
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x70]
lea edx, [rbx + 4]
mov rcx, rdi
call fcn.14005e0f4
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x140024853
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
call fcn.14000c220
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], r14
mov word [rsp + 0x70], bx
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140024885
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
call fcn.14000c220
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r14
mov word [rsp + 0x50], bx
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0x10
jb 0x1400248b2
inc rdx
mov rcx, qword [rsp + 0x90]
call fcn.14000c220
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r14
mov word [rsp + 0x50], bx
lea rdx, [0x14010bbd8]
lea rcx, [rsp + 0x50]
call fcn.14000954c
cmp qword [rsp + 0x60], rbx
je 0x1400249a0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftAppVSubsystemDisabled
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
test eax, eax
je 0x140024938
test rcx, rcx
je 0x1400249a0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x1400249a0
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 4
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
test eax, eax
jne 0x140024925
cmp dword [rsp + 0x38], ebx
setne dil
test rcx, rcx
je 0x14002499d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov bl, dil
mov byte [rsi + 0x1a8], bl
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400249c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
call fcn.14000c220
movabs rax, 0x8000000000
jmp 0x1400249d4
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1400d24e0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14002e7a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140178478]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor edi, edi
mov qword [rbp + 0x3f], rdi
lea esi, [rdi + 7]
mov qword [rbp + 0x47], rsi
mov word [rbp + 0x2f], di
lea rdx, str.PreserveUserIntegrationsOnLogin
lea rcx, [rbp + 0x2f]
call fcn.14000954c
nop
mov qword [rbp + 0x1f], rdi
mov qword [rbp + 0x27], rsi
mov word [rbp + 0xf], di
lea rdx, str.SOFTWAREMicrosoftAppVClientIntegration
lea rcx, [rbp + 0xf]
call fcn.14000954c
nop
mov dword [rbp - 0x19], edi
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rdx, qword [rbp + 0xf]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14002e8c2
mov rbx, qword [rbp - 0x11]
lea ecx, [rdi + 0x18]
call fcn.1400d2508
mov qword [rbp + 7], rax
lea rcx, vtable.appv::utility::scope_guard_func_impl_class_std::_Binder_struct_std::_Unforced__long_int____cdecl___struct_HKEY______ptr64___struct_HKEY______ptr64____ptr64__.0
mov qword [rax], rcx
mov rcx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rbx
mov qword [rbp - 9], rax
mov dword [rbp - 0x15], 4
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
lea rax, [rbp - 0x15]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
lea rcx, [rbp - 9]
call fcn.140023434
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x14002e8dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
call fcn.14000c220
mov qword [rbp + 0x1f], rdi
mov qword [rbp + 0x27], rsi
mov word [rbp + 0xf], di
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x14002e904
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
call fcn.14000c220
test ebx, ebx
je 0x14002e90c
xor al, al
jmp 0x14002e912
cmp dword [rbp - 0x19], edi
setne al
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400d24e0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400322c4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov r12, rcx
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x1400324a1
mov rsi, qword [r12 + 8]
lea rax, [rdx - 1]
or rax, 1
lea rdi, [r12 + 0x18]
bsr rcx, rax
mov ebx, 1
mov r8, rsi
inc ecx
shl rbx, cl
mov rcx, rdi
lea rdx, [rbx + rbx]
call fcn.140030dd0
mov qword [r12 + 0x38], rbx
lea rax, [rbx - 1]
mov qword [r12 + 0x30], rax
mov r11, qword [r12 + 8]
mov r11, qword [r11]
mov rbx, r11
cmp r11, rsi
je 0x14003245d
mov rbx, qword [rbx]
lea r15, [r11 + 0x10]
cmp qword [r15 + 0x18], 8
mov r8, r15
mov r9, qword [r15 + 0x10]
jb 0x14003236b
mov r8, qword [r15]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r9, r9
je 0x14003239a
movzx eax, byte [rdx + r8]
movabs r10, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r10
cmp rdx, r9
jb 0x14003237c
mov r14, qword [r12 + 0x30]
mov rbp, qword [rdi]
and r14, rcx
add r14, r14
cmp qword [rbp + r14*8], rsi
jne 0x1400323be
mov qword [rbp + r14*8], r11
mov qword [rbp + r14*8 + 8], r11
jmp 0x140032451
mov rdi, qword [rbp + r14*8 + 8]
mov rcx, r15
lea rdx, [rdi + 0x10]
call fcn.140011a8c
test al, al
je 0x140032403
mov r8, qword [rdi]
cmp r8, r11
je 0x1400323fc
mov rdx, qword [r11 + 8]
mov qword [rdx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], r11
mov qword [r8 + 8], rcx
mov qword [rbx + 8], rdx
mov qword [r11 + 8], rax
mov qword [rbp + r14*8 + 8], r11
jmp 0x14003244c
mov r13, rdi
jmp 0x14003241f
mov rdi, qword [rdi + 8]
mov rcx, r15
mov r13, rdi
lea rdx, [rdi + 0x10]
call fcn.140011a8c
test al, al
jne 0x14003247b
cmp qword [rbp + r14*8], rdi
jne 0x140032408
mov rdx, qword [r11 + 8]
mov qword [rdx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], r13
mov rax, qword [r13 + 8]
mov qword [rax], r11
mov qword [r13 + 8], rcx
mov qword [rbx + 8], rdx
mov qword [r11 + 8], rax
mov qword [rbp + r14*8], r11
lea rdi, [r12 + 0x18]
mov r11, rbx
cmp rbx, rsi
jne 0x140032353
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r8, qword [rdi]
mov rdx, qword [r11 + 8]
mov qword [rdx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], r11
mov qword [r8 + 8], rcx
mov qword [rbx + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14003244c
lea rcx, str.invalid_hash_bucket_count
call fcn.140014358
int3
Function at 0x14003a204
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov rsi, rcx
mov rbx, qword [rax]
jmp 0x14003a2ec
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14003a2e5
cmp dword [rcx + 8], 1
jne 0x14003a2e5
mov rdx, qword [rbx + 0x10]
mov rdi, rbx
cmp qword [rdx + 0x18], 8
mov r10, qword [rdx + 0x10]
jb 0x14003a24e
mov rdx, qword [rdx]
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
add r10, r10
je 0x14003a27e
movzx ecx, byte [r9 + rdx]
movabs r11, 0x100000001b3
xor r8, rcx
inc r9
imul r8, r11
cmp r9, r10
jb 0x14003a260
mov rcx, qword [rsi + 0x30]
mov rdx, qword [rsi + 0x18]
and rcx, r8
add rcx, rcx
cmp qword [rdx + rcx*8 + 8], rbx
jne 0x14003a2aa
cmp qword [rdx + rcx*8], rbx
jne 0x14003a29f
mov qword [rdx + rcx*8], rax
jmp 0x14003a2a3
mov rax, qword [rbx + 8]
mov qword [rdx + rcx*8 + 8], rax
jmp 0x14003a2b7
cmp qword [rdx + rcx*8], rbx
jne 0x14003a2b7
mov rax, qword [rbx]
mov qword [rdx + rcx*8], rax
mov rbx, qword [rbx]
lea rcx, [rdi + 0x10]
dec qword [rsi + 0x10]
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rax, qword [rdi + 8]
mov qword [rbx + 8], rax
call fcn.1400085d0
mov edx, reloc.msi.dll_MsiEnumClientsA
mov rcx, rdi
call fcn.14000c220
jmp 0x14003a2e8
mov rbx, qword [rbx]
mov rax, qword [rsi + 8]
cmp rbx, rax
jne 0x14003a222
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14003a550
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov esi, r9d
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
mov ecx, MsiGetFeatureCostA
call fcn.1400d2508
mov qword [rsp + 0x60], rax
mov rdx, rbx
mov rcx, rax
call fcn.140039b28
mov rbx, rax
mov qword [rsp + 0x60], rax
mov ecx, 0x18
call fcn.1400d2508
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.std::_Ref_count_class_AppV::Integration::CachedRegistryKey_.0
mov qword [rax], rcx
mov qword [rax + 0x10], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rax
mov rdx, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x14003a5e3
mov rbx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
add rdx, rdx
je 0x14003a611
movzx eax, byte [rcx + rbx]
xor r9, rax
movabs r8, 0x100000001b3
imul r9, r8
inc rcx
cmp rcx, rdx
jb 0x14003a5f4
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x38]
mov rcx, rbp
call fcn.14003aed8
mov rax, qword [rsp + 0x38]
cmp rax, qword [rsp + 0x40]
je 0x14003a675
mov r8, qword [rax + 0x10]
mov edx, dword [r8 + 0x28]
mov ecx, edx
and ecx, esi
cmp ecx, esi
jne 0x14003a649
xor edx, esi
test edx, 0x300
je 0x14003a64e
mov rax, qword [rax]
jmp 0x14003a628
and qword [rdi], 0
and qword [rdi + 8], 0
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x14003a66c
lock inc dword [rcx + 8]
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov qword [rdi], r8
mov qword [rdi + 8], rcx
jmp 0x14003a684
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
and qword [rdi], 0
and qword [rdi + 8], 0
lea rcx, [rsp + 0x28]
call fcn.1400085d0
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x14003a940
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r8, qword [rdx]
mov r13, rcx
cmp qword [r8 + 0x18], 8
mov r10, qword [r8 + 0x10]
jb 0x14003a965
mov r8, qword [r8]
xor ecx, ecx
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
movabs rdi, 0x100000001b3
add r10, r10
je 0x14003a997
movzx eax, byte [rcx + r8]
inc rcx
xor r9, rax
imul r9, rdi
cmp rcx, r10
jb 0x14003a983
mov r8, rdx
mov rcx, r13
lea rdx, [rsp + 0x20]
call fcn.14003aed8
mov rax, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov qword [rsp + 0x90], rax
cmp r15, rax
je 0x14003ab51
mov rcx, qword [r15 + 0x10]
mov rsi, r15
mov rax, qword [r13 + 8]
mov rbp, qword [r13 + 0x18]
mov r14, qword [r15 + 8]
cmp qword [rcx + 0x18], 8
mov r9, qword [rcx + 0x10]
mov qword [rsp + 0xa0], rax
jb 0x14003a9eb
mov rcx, qword [rcx]
xor r8d, r8d
mov rdx, rbx
add r9, r9
je 0x14003aa0a
movzx eax, byte [r8 + rcx]
inc r8
xor rdx, rax
imul rdx, rdi
cmp r8, r9
jb 0x14003a9f6
mov r12, qword [r13 + 0x30]
and r12, rdx
add r12, r12
mov rax, qword [rbp + r12*8]
mov qword [rsp + 0x98], rax
mov rax, qword [rbp + r12*8 + 8]
mov qword [rsp + 0xa8], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.1400085d0
mov edx, reloc.msi.dll_MsiEnumClientsA
mov rcx, rbx
call fcn.14000c220
dec qword [r13 + 0x10]
cmp rbx, qword [rsp + 0xa8]
je 0x14003aa7d
cmp rsi, qword [rsp + 0x90]
jne 0x14003aa2e
cmp qword [rsp + 0x98], r15
jne 0x14003ab4a
mov qword [rbp + r12*8], rsi
jmp 0x14003ab4a
cmp qword [rsp + 0x98], r15
jne 0x14003aa99
mov rdx, qword [rsp + 0xa0]
mov qword [rbp + r12*8], rdx
mov rax, rdx
jmp 0x14003aa9c
mov rax, r14
mov qword [rbp + r12*8 + 8], rax
mov r12, qword [rsp + 0x90]
cmp rsi, r12
je 0x14003ab4a
mov rcx, qword [rsi + 0x10]
cmp qword [rcx + 0x18], 8
mov r9, qword [rcx + 0x10]
jb 0x14003aac4
mov rcx, qword [rcx]
xor r8d, r8d
movabs rdx, 0xcbf29ce484222325
add r9, r9
je 0x14003aafc
movabs r12, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc r8
xor rdx, rax
imul rdx, r12
cmp r8, r9
jb 0x14003aae0
mov r12, qword [rsp + 0x90]
mov r15, qword [r13 + 0x30]
and r15, rdx
add r15, r15
mov rax, qword [rbp + r15*8 + 8]
mov qword [rsp + 0x98], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.1400085d0
mov edx, reloc.msi.dll_MsiEnumClientsA
mov rcx, rbx
call fcn.14000c220
dec qword [r13 + 0x10]
cmp rbx, qword [rsp + 0x98]
je 0x14003ab68
cmp rsi, r12
jne 0x14003ab13
mov qword [rbp + r15*8], rsi
mov qword [r14], rsi
mov qword [rsi + 8], r14
mov rax, qword [rsp + 0x30]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rsp + 0xa0]
mov qword [rbp + r15*8], rax
mov qword [rbp + r15*8 + 8], rax
jmp 0x14003aaa9
Function at 0x14003b308
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov r13, rcx
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x14003b4f9
mov r12, qword [r13 + 8]
lea rax, [rdx - 1]
or rax, 1
lea rdi, [r13 + 0x18]
bsr rcx, rax
mov ebx, 1
mov r8, r12
inc ecx
shl rbx, cl
mov rcx, rdi
lea rdx, [rbx + rbx]
call fcn.14001cd98
lea rax, [rbx - 1]
mov qword [r13 + 0x38], rbx
mov qword [r13 + 0x30], rax
mov rbx, qword [r13 + 8]
mov rbx, qword [rbx]
cmp rbx, r12
je 0x14003b4cb
mov r11, rbx
mov r14, qword [r11 + 0x10]
mov rbx, qword [rbx]
mov r8, r14
cmp qword [r14 + 0x18], 8
mov r9, qword [r14 + 0x10]
jb 0x14003b3aa
mov r8, qword [r14]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r9, r9
je 0x14003b3d9
movzx eax, byte [rdx + r8]
movabs r10, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r10
cmp rdx, r9
jb 0x14003b3bb
mov rsi, qword [r13 + 0x30]
mov rbp, qword [rdi]
and rsi, rcx
add rsi, rsi
cmp qword [rbp + rsi*8], r12
jne 0x14003b3f7
mov qword [rbp + rsi*8], r11
jmp 0x14003b4ba
mov rdi, qword [rbp + rsi*8 + 8]
mov rdx, qword [rdi + 0x10]
cmp r14, rdx
je 0x14003b48d
mov rcx, r14
call fcn.140011a8c
test al, al
jne 0x14003b48d
mov r15, rdi
cmp qword [rbp + rsi*8], rdi
je 0x14003b465
mov rdi, qword [rdi + 8]
mov r15, rdi
mov rdx, qword [rdi + 0x10]
cmp r14, rdx
je 0x14003b43b
mov rcx, r14
call fcn.140011a8c
test al, al
je 0x14003b418
mov r8, qword [rdi]
mov rdx, qword [r11 + 8]
mov qword [rdx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], r11
mov qword [r8 + 8], rcx
mov qword [rbx + 8], rdx
mov qword [r11 + 8], rax
lea rdi, [r13 + 0x18]
jmp 0x14003b4bf
mov rdx, qword [r11 + 8]
mov qword [rdx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], r15
mov rax, qword [r15 + 8]
mov qword [rax], r11
mov qword [r15 + 8], rcx
mov qword [rbx + 8], rdx
mov qword [r11 + 8], rax
mov qword [rbp + rsi*8], r11
jmp 0x14003b45f
mov r8, qword [rdi]
cmp r8, r11
je 0x14003b4b6
mov rdx, qword [r11 + 8]
mov qword [rdx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], r11
mov qword [r8 + 8], rcx
mov qword [rbx + 8], rdx
mov qword [r11 + 8], rax
lea rdi, [r13 + 0x18]
mov qword [rbp + rsi*8 + 8], r11
mov r11, rbx
cmp rbx, r12
jne 0x14003b392
and qword [rsp + 0x58], 0
lea rcx, [rsp + 0x58]
call fcn.14003b50c
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.140014358
int3
Function at 0x14004ba2c
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x80
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbp, r9
mov rbx, r8
mov rsi, rdx
mov r14, rcx
movabs rdi, 0x8000000000
mov byte [rax - 0x20], 0
and qword [rax - 0x18], 0
xor r8d, r8d
lea rcx, [rax - 0x18]
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
nop dword [rax + rax]
test eax, eax
setne byte [rsp + 0x68]
test eax, eax
jne 0x14004baec
lea edx, [rax + 0x5c]
lea rsi, str.AdminAppManAppVclientintegration_notifier_process.hpp
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14004bab0
inc rax
jmp 0x14004bab3
mov rax, rsi
mov rdx, rax
lea rcx, [0x14017bb60]
call fcn.140007964
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
or rdi, rbx
movabs rax, 0x132100000000
or rdi, rax
jmp 0x14004bc09
cmp qword [rbx + 0x18], 8
jb 0x14004baf6
mov rbx, qword [rbx]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], rbp
and qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x400
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
nop dword [rax + rax]
lea rsi, str.AdminAppManAppVclientintegration_notifier_process.hpp
movabs rbp, 0x142100000000
test eax, eax
jne 0x14004bb99
lea edx, [rax + 0x5c]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14004bb6c
inc rax
jmp 0x14004bb6f
mov rax, rsi
mov rdx, rax
lea rcx, [0x14017bb60]
call fcn.140007964
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
or rdi, rbx
or rdi, rbp
mov al, byte [rsp + 0x68]
test al, al
je 0x14004bc0d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
nop dword [rax + rax]
test eax, eax
je 0x14004bbbe
xor al, al
mov byte [rsp + 0x68], al
jmp 0x14004bc0d
mov edx, MsiPreviewDialogW
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14004bbdc
inc rax
jmp 0x14004bbdf
mov rax, rsi
mov rdx, rax
lea rcx, [0x14017bb60]
call fcn.140007964
mov rbx, rax
shl rbx, 0x34
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
or rdi, rbx
or rdi, rbp
mov al, byte [rsp + 0x68]
test al, al
je 0x14004bc22
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
nop dword [rax + rax]
mov rax, rdi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret