joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a6c0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push r12
push r14
sub rsp, 0x68
mov rax, r9
mov ebx, r8d
mov r12, rdx
mov r14, rcx
cmp r8d, 0x10
jbe 0x14000a82a
xor r9d, r9d
mov r8, rax
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000a81d
mov qword [rsp + 0x90], rsi
mov ebp, 0x10
mov qword [rsp + 0x60], r15
lea esi, [rbx + 0xf]
shr esi, 4
mov r15d, ebp
and ebx, 0xf
mov qword [rsp + 0x98], rdi
mov edi, esi
cmovne r15d, ebx
shl edi, 4
cmp esi, 2
jbe 0x14000a782
lea ecx, [rdi - 0x20]
xor r9d, r9d
mov dword [rsp + 0x30], ecx
xor r8d, r8d
mov dword [rsp + 0xa0], ecx
xor edx, edx
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x14000a782
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov r15, qword [rsp + 0x60]
add rsp, 0x68
pop r14
pop r12
pop rbp
pop rbx
ret
lea eax, [r15 + 0x10]
add esi, 0xfffffffe
shl esi, 4
lea rcx, [rsp + 0x40]
add rsi, r12
mov r8d, eax
mov rdx, rsi
mov ebx, eax
call fcn.140033fa0
lea rcx, [rsp + 0x40]
sub ebp, r15d
add rcx, rbx
mov r8d, ebp
xor edx, edx
call fcn.1400330d0
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x30], Ordinal_36
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov dword [rsp + 0xa0], Ordinal_36
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ebx, eax
test eax, eax
je 0x14000a762
movups xmm0, xmmword [rsp + 0x50]
lea ecx, [rdi - 0x10]
mov r8d, r15d
add rcx, r12
lea rdx, [rsp + 0x40]
movups xmmword [rsi], xmm0
call fcn.140033fa0
mov eax, ebx
jmp 0x14000a762
xor eax, eax
add rsp, 0x68
pop r14
pop r12
pop rbp
pop rbx
ret
jne 0x14000a81d
mov ebp, 0x10
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x30], ebp
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
mov dword [rsp + 0xa0], ebp
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
add rsp, 0x68
pop r14
pop r12
pop rbp
pop rbx
ret
Function at 0x14000aac0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor r13d, r13d
mov r15d, r9d
mov r12, r8
mov dword [rsp + 0x30], 1
mov rbp, rdx
mov dword [rsp + 0x20], 0xf0000000
mov r14, rcx
xor r8d, r8d
lea r9d, [r13 + 0x18]
xor edx, edx
lea rcx, [rsp + 0x40]
mov edi, r13d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14000ac5b
lea edx, [r13 + 0x1c]
mov qword [rsp + 0x80], rbx
mov rbx, qword [rsp + 0x40]
lea ecx, [rdx + 0x24]
mov qword [rsp + 0x88], rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14000ac3e
mov dword [rax], 0x208
lea r8d, [r13 + 0x1c]
mov dword [rax + 4], 0x660e
xor r9d, r9d
mov dword [rax + 8], 0x10
mov rdx, rsi
movups xmm0, xmmword [r14]
mov rcx, rbx
movups xmmword [rax + 0xc], xmm0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x14000ac3e
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
xor r9d, r9d
lea edx, [r13 + 4]
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000ac33
mov rcx, qword [rsp + 0x38]
lea edx, [r13 + 1]
xor r9d, r9d
mov r8, rbp
call qword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x14000ac33
mov edx, r15d
lea ecx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, qword [rsp + 0xa0]
mov rsi, rax
mov qword [rbx], rax
test rax, rax
je 0x14000ac33
mov r14, qword [rsp + 0xa8]
mov r8d, r15d
mov rdx, r12
mov rcx, rax
mov dword [r14], r15d
call fcn.140033fa0
mov rcx, qword [rsp + 0x38]
lea r8d, [r13 + 1]
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov edi, eax
test eax, eax
jne 0x14000ac33
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rax
mov dword [r14], r13d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x90]
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000b0f0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, qword [rsp + 0x60]
mov rdi, r9
mov esi, r8d
mov rbp, rdx
xor ebx, ebx
xor r8d, r8d
mov qword [r9], rbx
xor edx, edx
lea r9, [rsp + 0x60]
mov dword [r14], esi
call qword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x14000b193
mov edx, esi
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rdi], rax
test rax, rax
je 0x14000b188
mov r8d, esi
mov rdx, rbp
mov rcx, rax
call fcn.140033fa0
mov rax, qword [rdi]
lea r8d, [rbx + 1]
mov rcx, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ebx, eax
test eax, eax
jne 0x14000b188
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400170a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x68
movups xmm0, xmmword [str.ControlSet000]
mov eax, dword [0x140069228]
mov r15, r8
mov dword [rsp + 0x58], eax
lea r8, str.Select
movups xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x38]
mov rbp, rdx
movsd xmm0, qword [0x140069220]
mov r14, rcx
mov qword [rsp + 0x28], rax
xor ebx, ebx
movsd qword [rsp + 0x50], xmm0
mov dword [rsp + 0x20], 0x20019
call fcn.140020890
test eax, eax
je 0x140017278
mov qword [rsp + 0x90], rsi
xor esi, esi
mov qword [rsp + 0x60], r12
lea r12, str.Current
mov qword [rsp + 0x98], rdi
nop
cmp esi, 2
jae 0x140017235
mov ecx, dword [r14]
xor ebx, ebx
mov rdx, qword [r12 + rsi*8]
mov dword [rsp + 0xa8], 4
test ecx, ecx
je 0x1400171b3
cmp ecx, 1
jne 0x1400171ec
mov r8, rdx
mov rcx, r14
mov rdx, qword [rsp + 0x38]
call fcn.140020ba0
test rax, rax
setne bl
test rax, rax
je 0x1400171ec
mov r8d, dword [rax + 8]
xor ebx, ebx
mov edi, r8d
btr edi, 0x1f
cmp dword [rsp + 0xa8], edi
setae bl
jb 0x1400171aa
lea rdx, [rax + 0xc]
test r8d, r8d
js 0x14001719d
mov rax, qword [r14 + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, edi
lea rcx, [rsp + 0x30]
call fcn.140033fa0
mov dword [rsp + 0xa8], edi
jmp 0x1400171ec
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
je 0x1400171ec
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
inc esi
test ebx, ebx
je 0x140017120
mov r9d, dword [rsp + 0x30]
lea r8, str._03u
xor ebx, ebx
lea rcx, [rsp + 0x54]
lea edx, [rbx + 4]
call fcn.140004860
cmp eax, 0xffffffff
je 0x140017235
mov qword [rsp + 0x28], r15
lea r8, [rsp + 0x40]
mov rdx, rbp
mov dword [rsp + 0x20], 0x20019
mov rcx, r14
call fcn.140020890
mov ebx, eax
mov eax, dword [r14]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
test eax, eax
je 0x140017261
cmp eax, 1
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140017278
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x140017c00
Capabilities:
Encrypt data using rc4 via systemfunction033

Disassembly:
mov dword [rsp + 0x20], r9d
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xd0
mov eax, dword [rcx]
xor ebx, ebx
mov dword [rbp - 0x79], 0x10
mov r15, rcx
mov dword [rbp - 0x75], 0x10
lea rcx, [rbp - 1]
mov qword [rbp - 0x71], rcx
mov r12, r8
mov qword [rsp + 0x30], rbx
lea r14, [rdx + rax]
mov qword [rsp + 0x38], rbx
mov esi, ebx
mov edi, ebx
test eax, eax
je 0x140017e1e
mov edx, dword [r15 + 4]
test edx, edx
je 0x140017e1e
movzx ecx, word [r14 + 2]
sub ecx, 1
je 0x140017cf5
cmp ecx, 1
jne 0x140017e10
cmp dword [r14 + 4], 0x10
jb 0x140017e10
lea rax, [rbp + 0x57]
mov rcx, r12
mov qword [rsp + 0x28], rax
lea r9d, [rdx - 0x18]
lea rax, [rbp + 0x5f]
lea r8, [r14 + 0x18]
mov qword [rsp + 0x20], rax
lea rdx, [r14 + 8]
call fcn.14000aac0
test eax, eax
je 0x140017e0b
mov eax, dword [rbp + 0x57]
lea ecx, [rbx + 0x40]
mov edx, eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, qword [rbp + 0x5f]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140017ce7
mov r8d, dword [rbp + 0x57]
mov rdx, rdi
mov rcx, rax
call fcn.140033fa0
lea esi, [rbx + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140017dd2
cmp edx, 6
jb 0x140017e10
lea rcx, [rbp - 0x59]
call qword [sym.imp.cryptdll.dll_MD5Init]
mov r8d, 0x10
lea rcx, [rbp - 0x59]
mov rdx, r12
call qword [sym.imp.cryptdll.dll_MD5Update]
mov r8d, 4
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
call qword [sym.imp.cryptdll.dll_MD5Update]
mov ecx, 0x12
mov eax, dword [rbp + 0x7f]
lea r8d, [rcx - 7]
cmp dword [rbp + 0x77], ebx
je 0x140017d56
test eax, eax
lea rdx, str.NTPASSWORD
cmovne r8d, ecx
lea rcx, str.NTPASSWORDHISTORY
jmp 0x140017d6a
test eax, eax
lea rdx, str.LMPASSWORD
cmovne r8, rcx
lea rcx, str.LMPASSWORDHISTORY
cmovne rdx, rcx
lea rcx, [rbp - 0x59]
call qword [sym.imp.cryptdll.dll_MD5Update]
lea rcx, [rbp - 0x59]
call qword [sym.imp.cryptdll.dll_MD5Final]
mov eax, dword [r15 + 4]
mov ecx, 0x40
add eax, 0xfffffffc
mov edx, eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
mov rdi, rax
test rax, rax
je 0x140017e10
mov r8d, dword [rsp + 0x30]
lea rdx, [r14 + 4]
mov rcx, rax
call fcn.140033fa0
lea rdx, [rbp - 0x79]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_SystemFunction033]
mov esi, eax
not esi
shr esi, 0x1f
test esi, esi
je 0x140017e0b
mov r14d, dword [rsp + 0x30]
mov eax, dword [rbp + 0x6f]
mov rdi, qword [rsp + 0x38]
mov dword [rbp + 0x5f], eax
test r14d, r14d
je 0x140017e10
nop dword [rax + rax]
mov ecx, ebx
lea r8, [rbp - 0x69]
add rcx, rdi
lea rdx, [rbp + 0x5f]
call qword [sym.imp.ADVAPI32.dll_SystemFunction027]
add ebx, 0x10
cmp ebx, r14d
jb 0x140017df0
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140017e1e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140017e40
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x30
xor ebx, ebx
mov rsi, rcx
mov ecx, dword [rcx]
mov r15, r8
mov dword [rsp + 0x60], ebx
mov rbp, rdx
test ecx, ecx
je 0x140017e93
cmp ecx, 1
jne 0x14001804a
lea r8, str.SupplementalCredentials
mov rcx, rsi
call fcn.140020ba0
test rax, rax
mov edi, ebx
setne dil
test rax, rax
je 0x140017ecc
mov eax, dword [rax + 8]
btr eax, 0x1f
mov dword [rsp + 0x60], eax
jmp 0x140017ed0
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.SupplementalCredentials
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov edi, ebx
sete dil
test eax, eax
je 0x140017ecc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x60]
test edi, edi
je 0x14001804a
cmp eax, 0x90
jbe 0x14001804a
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x14001804a
mov edx, dword [rsi]
mov qword [rsp + 0x68], r14
test edx, edx
je 0x140017f75
cmp edx, 1
jne 0x14001803c
lea r8, str.SupplementalCredentials
mov rdx, rbp
mov rcx, rsi
call fcn.140020ba0
test rax, rax
mov r14d, ebx
mov rdx, rax
setne r14b
test rax, rax
je 0x140017faf
mov ecx, dword [rax + 8]
mov r14d, ebx
mov ebp, ecx
btr ebp, 0x1f
cmp dword [rsp + 0x60], ebp
setae r14b
jb 0x140017f6f
add rdx, 0xc
test ecx, ecx
js 0x140017f64
mov rax, qword [rsi + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, ebp
mov rcx, rdi
call fcn.140033fa0
mov dword [rsp + 0x60], ebp
jmp 0x140017faf
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, str.SupplementalCredentials
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov r14d, ebx
sete r14b
test eax, eax
je 0x140017faf
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test r14d, r14d
je 0x14001803c
mov edx, dword [rdi + 0xc]
mov ecx, 0x40
add edx, 0xc
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x14001803c
mov r9d, dword [rsp + 0x60]
lea r14, [rax + 4]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], r14
add r9d, 0xffffffe0
mov qword [rsp + 0x20], rax
lea r8, [rdi + 0x20]
mov rcx, r15
lea rdx, [rdi + 0x10]
call fcn.14000aac0
test eax, eax
je 0x140018033
mov eax, dword [r14]
mov rbp, qword [rsp + 0x78]
cmp eax, dword [rdi + 0xc]
jne 0x14001802a
mov r8d, eax
lea rcx, [rsi + 0xc]
mov rdx, rbp
mov ebx, 1
call fcn.140033fa0
mov rcx, rsi
call fcn.1400233b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x68]
mov eax, ebx
add rsp, 0x30
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001abf0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r14
sub rsp, 0x60
mov r14d, edx
mov rbp, rcx
xor esi, esi
lea rdx, str.ServicesActive
xor ecx, ecx
lea r8d, [rsi + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
je 0x14001acd2
lea r8d, [rsi + 4]
mov qword [rsp + 0x80], rdi
lea rdx, str.SamSs
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14001ac74
lea rax, [rsp + 0x90]
xor edx, edx
lea r9d, [rsi + 0x24]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rdi
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test esi, esi
je 0x14001acce
mov r8d, dword [rsp + 0x4c]
xor edx, edx
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001acce
mov r8, rbp
mov rdx, rax
call fcn.1400132d0
mov ebx, eax
test eax, eax
jne 0x14001acb5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x14001acb5
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
Function at 0x14001eb00
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x368]
sub rsp, 0x460
movaps xmmword [rax - 0x28], xmm7
xor edx, edx
movaps xmmword [rax - 0x48], xmm9
mov r8d, 0x400
mov qword [rax + 8], rbx
xorps xmm9, xmm9
mov rbx, rcx
mov qword [rax + 0x10], rdi
lea rcx, [rsp + 0x20]
movaps xmmword [rax - 0x38], xmm8
xorps xmm7, xmm7
call fcn.1400330d0
movzx eax, byte [rbx]
mov edi, 0x100
movsd xmm8, qword [0x14006afe8]
movaps xmmword [rsp + 0x450], xmm6
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 1]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 2]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 3]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 4]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 5]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 6]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 7]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 8]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 9]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0xa]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0xb]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0xc]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0xd]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0xe]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0xf]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x10]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x11]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x12]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x13]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x14]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x15]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x16]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x17]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x18]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x19]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x1a]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x1b]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x1c]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x1d]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x1e]
inc dword [rsp + rax*4 + 0x20]
movzx eax, byte [rbx + 0x1f]
lea rbx, [rsp + 0x20]
inc dword [rsp + rax*4 + 0x20]
nop
mov eax, dword [rbx]
test eax, eax
je 0x14001ec83
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mulsd xmm6, xmm8
movaps xmm0, xmm6
call fcn.140054780
mulsd xmm0, xmm6
addsd xmm7, xmm0
add rbx, 4
sub rdi, 1
jne 0x14001ec60
ucomisd xmm7, xmm9
mov rdi, qword [rsp + 0x478]
mov rbx, qword [rsp + 0x470]
movaps xmm8, xmmword [rsp + 0x430]
movaps xmm6, xmmword [rsp + 0x450]
jne 0x14001ecbb
movaps xmm0, xmm9
jmp 0x14001ecc6
mulsd xmm7, qword [0x14006aff8]
movaps xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x440]
movaps xmm9, xmmword [rsp + 0x420]
add rsp, 0x460
pop rbp
ret
Function at 0x140020d30
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r9d, dword [rcx]
xor ebx, ebx
mov r10, r8
mov r11, rdx
mov rdi, rcx
test r9d, r9d
je 0x140020dde
cmp r9d, 1
jne 0x140020e15
call fcn.140020ba0
mov rdx, rax
test rax, rax
je 0x140020e15
mov ecx, dword [rax + 8]
mov r8d, ecx
mov r9d, dword [rsp + 0x70]
btr r8d, 0x1f
cmp r8d, r9d
setae bl
jb 0x140020dc6
mov eax, dword [rsp + 0x60]
and ecx, 0x80000000
or ecx, r9d
mov dword [rdx + 0x10], eax
mov dword [rdx + 8], ecx
lea rcx, [rdx + 0xc]
jl 0x140020daf
mov rax, qword [rdi + 8]
movsxd rcx, dword [rcx]
mov rax, qword [rax + 0x10]
add rax, 4
add rcx, rax
mov rdx, qword [rsp + 0x68]
call fcn.140033fa0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, Ordinal_54
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, dword [rsp + 0x70]
xor r8d, r8d
mov r9d, dword [rsp + 0x60]
mov rdx, r10
mov dword [rsp + 0x28], eax
mov rcx, r11
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
test eax, eax
je 0x140020e15
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140020e30
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov r10d, dword [rcx]
xor r12d, r12d
mov r14, qword [rsp + 0x80]
mov rbp, rdx
mov r11d, r8d
mov rsi, r9
mov rdx, rcx
mov edi, r12d
test r10d, r10d
je 0x140020f79
cmp r10d, 1
jne 0x140020fb1
mov eax, dword [rbp + 0x18]
test eax, eax
je 0x140020fb1
cmp r11d, eax
jae 0x140020fb1
movsxd rcx, dword [rbp + 0x20]
cmp ecx, 0xffffffff
je 0x140020fb1
mov rax, qword [rdx + 8]
mov edx, 0x666c
mov r8, qword [rax + 0x10]
add rcx, r8
movzx eax, word [rcx + 4]
cmp ax, dx
je 0x140020ebb
mov edx, 0x686c
cmp ax, dx
jne 0x140020fb1
movzx eax, word [rcx + 6]
test ax, ax
je 0x140020fb1
cmp r11d, eax
jae 0x140020fb1
movsxd rdx, dword [rcx + r11*8 + 8]
mov eax, 0x6b6e
add rdx, r8
cmp word [rdx + 4], ax
jne 0x140020fb1
test rsi, rsi
je 0x140020fb1
test r14, r14
je 0x140020fb1
test byte [rdx + 6], 0x20
mov eax, dword [r14]
mov qword [rsp + 0x60], rbx
movzx ebx, word [rdx + 0x4c]
mov qword [rsp + 0x68], r15
je 0x140020f46
cmp eax, ebx
seta dil
jbe 0x140020f61
lea rcx, [rdx + 0x50]
mov edx, ebx
call fcn.1400071b0
mov rbp, rax
test rax, rax
je 0x140020f61
lea r8, [rbx + rbx]
mov rdx, rax
mov rcx, rsi
call fcn.140033fa0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140020f61
shr ebx, 1
cmp eax, ebx
seta dil
jbe 0x140020f61
movzx r8d, word [rbp + 0x4c]
add rdx, 0x50
mov rcx, rsi
call fcn.140033fa0
mov r15, qword [rsp + 0x68]
test edi, edi
je 0x140020f6f
mov word [rsi + rbx*2], r12w
mov dword [r14], ebx
mov rbx, qword [rsp + 0x60]
jmp 0x140020fb1
mov qword [rsp + 0x38], r12
mov r9, r14
mov qword [rsp + 0x30], r12
mov r8, rsi
mov qword [rsp + 0x28], r12
mov edx, r11d
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
sete dil
test eax, eax
je 0x140020fb1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbp, qword [rsp + 0x70]
mov eax, edi
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
Function at 0x140020fd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r15
sub rsp, 0x30
mov rsi, rcx
mov dword [rsp + 0x68], 0
mov ecx, dword [rcx]
mov rdi, r8
mov r15, rdx
test ecx, ecx
je 0x140021024
cmp ecx, 1
jne 0x140021177
mov rcx, rsi
call fcn.140020ba0
xor ebx, ebx
test rax, rax
setne bl
test rax, rax
je 0x14002105c
mov eax, dword [rax + 8]
btr eax, 0x1f
mov dword [rsp + 0x68], eax
jmp 0x140021060
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], 0
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
je 0x14002105c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x68]
test ebx, ebx
je 0x140021177
test eax, eax
je 0x140021177
mov qword [rsp + 0x50], rbp
mov ecx, 0x40
mov edx, eax
mov qword [rsp + 0x58], r14
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, qword [rsp + 0x70]
mov rbp, rax
mov qword [r14], rax
test rax, rax
je 0x140021175
mov ecx, dword [rsi]
xor ebx, ebx
test ecx, ecx
je 0x140021107
cmp ecx, 1
jne 0x140021139
mov r8, rdi
mov rdx, r15
mov rcx, rsi
call fcn.140020ba0
test rax, rax
mov rdx, rax
setne bl
test rax, rax
je 0x140021139
mov ecx, dword [rax + 8]
xor ebx, ebx
mov edi, ecx
btr edi, 0x1f
cmp dword [rsp + 0x68], edi
setae bl
jb 0x140021101
add rdx, 0xc
test ecx, ecx
js 0x1400210f6
mov rax, qword [rsi + 8]
movsxd rdx, dword [rdx]
mov rax, qword [rax + 0x10]
add rax, 4
add rdx, rax
mov r8d, edi
mov rcx, rbp
call fcn.140033fa0
mov dword [rsp + 0x68], edi
jmp 0x140021139
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbp
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
test eax, eax
je 0x140021139
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x140021167
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14002114d
mov ecx, dword [rsp + 0x68]
mov dword [rax], ecx
mov eax, ebx
mov rbp, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [r14], rax
jmp 0x14002114d
jmp 0x14002114f
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret