joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021dc0
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [r11 - 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x14005d030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rbp, rcx
mov qword [r11 - 0x28], rdx
lea rbx, [rcx + 0x18]
cmp byte [rcx + 0x50], 0
je 0x140021ea5
mov rcx, rdx
mov r9, qword [rdx + 0x18]
cmp r9, 8
jb 0x140021e12
mov rcx, qword [rdx]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x140021e1f
mov r8, qword [rbx]
mov r10, qword [rdx + 0x10]
mov r11, qword [rbx + 0x10]
mov rdx, r11
cmp r10, r11
cmovb rdx, r10
test rdx, rdx
je 0x140021e54
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140021e9d
add rcx, 2
sub rdx, 1
jne 0x140021e40
cmp r11, r10
jb 0x140021e9d
ja 0x140021e9d
cmp r9, 8
jb 0x140021e96
lea rdx, [r9*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140021e91
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140021fd5
mov rcx, r8
call fcn.140024800
xor esi, esi
jmp 0x140021f81
mov rcx, rbp
call fcn.140022000
xor esi, esi
cmp rbx, rdi
je 0x140021ef7
mov r9, rdi
cmp qword [rdi + 0x18], 8
jb 0x140021eb9
mov r9, qword [rdi]
mov rdx, qword [rdi + 0x10]
mov rax, qword [rbx + 0x18]
cmp rdx, rax
ja 0x140021eef
mov r14, rbx
cmp rax, 8
jb 0x140021ed2
mov r14, qword [rbx]
mov qword [rbx + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, r14
call fcn.140026830
mov word [rbx + r14], si
jmp 0x140021ef7
mov rcx, rbx
call fcn.140015b00
lea rcx, str.DtsService::CodecSupport::_Starting_Watcher_Thread.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r8d, r8d
mov rdx, rbp
lea rcx, [0x140022c10]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
test rax, rax
je 0x140021fdb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x40], rax
test rax, rax
je 0x140021fb2
mov byte [rbp + 0x50], 1
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140021f81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140021f7c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140021fd5
mov rcx, r8
call fcn.140024800
mov word [rdi], si
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400247e0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rdx, str.DtsService::RealtkeSupport::Unable_to_create_an_event_to_stop_thread
lea rcx, [rsp + 0x20]
call fcn.140017600
lea rdx, [0x14005b9b0]
lea rcx, [rsp + 0x20]
call fcn.140027268
nop
call fcn.14002bf94
nop
lea rdx, str.DtsService::CodecSupport::Unable_to_create_thread_for_registry_watcher
lea rcx, [rsp + 0x20]
call fcn.140017600
lea rdx, [0x14005b9b0]
lea rcx, [rsp + 0x20]
call fcn.140027268
int3
Function at 0x140022850
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14005d030]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
movzx r15d, r8b
cmp dword [0x14005da8c], ebx
mov eax, ebx
mov byte [rdx], al
mov rsi, rdx
mov r14, rcx
mov dword [rbp - 0x10], ebx
mov dword [rbp - 0xc], ebx
mov dil, 1
mov dword [rbp - 0x14], ebx
jne 0x140022969
mov rcx, qword [rcx]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov dword [rbp - 0x18], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400228d8
cmp dword [rbp - 0x20], 4
jne 0x1400228d8
mov byte [rsi], dil
jmp 0x1400228de
mov dword [rbp - 0x10], ebx
xor dil, dil
mov rcx, qword [r14]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
lea rax, [rbp - 0xc]
mov dword [rbp - 0x20], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002291d
cmp dword [rbp - 0x18], 4
jne 0x14002291d
mov byte [rsi], 1
jmp 0x140022923
mov dword [rbp - 0xc], ebx
xor dil, dil
mov rcx, qword [r14]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
lea rax, [rbp - 0x14]
mov dword [rbp - 0x20], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.3BA0CD54_830F_4551_A6EB_F3EAB68E3700_6
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140022962
cmp dword [rbp - 0x18], 4
jne 0x140022962
mov byte [rsi], 1
jmp 0x1400229d4
mov eax, ebx
xor dil, dil
jmp 0x1400229d7
cmp dword [0x14005da8c], 1
jne 0x1400229d7
mov rcx, qword [rcx]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x1c]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x18], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.7840C7E1_1D49_471D_B266_9DAD6C084569_0
mov dword [rbp - 0x20], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400229d4
cmp dword [rbp - 0x1c], 4
jne 0x1400229d4
mov ecx, dword [rbp - 0x18]
mov eax, ebx
cmp ecx, 1
setae al
test ecx, ecx
mov dword [rbp - 0x10], eax
lea rcx, str.DtsService::CodecSupport::Checking_CMedia_Formfactor_Registry_Key_value.
mov eax, ebx
sete al
mov dword [rbp - 0x14], eax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [rbp - 0x14]
cmp dword [0x14005da8c], ebx
jne 0x1400229f0
test r15b, r15b
je 0x1400229f0
test dil, dil
jne 0x1400229f0
mov eax, 3
jmp 0x140022a19
cmp dword [rbp - 0x10], 1
je 0x1400229fc
cmp dword [rbp - 0xc], 1
jne 0x140022a03
mov ebx, 1
jmp 0x140022a17
cmp eax, 1
je 0x140022a17
test eax, eax
mov ebx, 3
mov ecx, 2
cmove ebx, ecx
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400247e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400254b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400254fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400254fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400254fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400254fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400254fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400254fc
xor al, al
add rsp, 0x28
ret

Function at 0x14002aea4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14002aedb
call fcn.140031738
mov dword [rax], 0x16
call fcn.14002bf74
xor eax, eax
jmp 0x14002af69
mov rdx, r9
mov rcx, r8
call fcn.14002ae40
mov rbx, rax
test rax, rax
je 0x14002af66
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x14002ad6c]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14002af53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400316ac
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14002af3a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14002af49
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140032f8c
jmp 0x14002af66
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002af63
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400363f4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003640a
mov al, 1
jmp 0x14003646a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003641b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140036468
mov ecx, dword [rcx + 0x18]
nop
call fcn.140038218
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140036468
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140036468
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140036468
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003646a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140037874
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400378fb
mov rsi, rbx
cmp word [rax], bp
je 0x1400378ba
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400378a4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400378a0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140033e7c
mov rdi, rax
test rax, rax
je 0x1400378e8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140026830
mov rbp, rdi
xor ecx, ecx
call fcn.140032f8c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003b784
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x14005fb00]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14003b7db
cmp word [rdx], r13w
jne 0x14003b7db
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14003b7e0
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14003b905
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14003b926
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14003b819
mov rdx, r9
mov word [rbx], cx
jmp 0x14003b840
cmp r9, r8
jae 0x14003b850
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14003b7fa
jmp 0x14003b905
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003b8fa
cmp dword [rsp + 0x80], esi
je 0x14003b8fa
lea r8, [0x14005fb00]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14003b8d2
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14003b8a2
mov word [rbx], r13w
jmp 0x14003b902
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14003b8af
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14003b902
cmp word [rsp + 0x70], r13w
jne 0x14003b8df
cmp rbx, r14
je 0x14003b89c
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14003c450
cmp word [rsp + 0x70], r13w
je 0x14003b905
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x14005fb00]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14003b8ff
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14003b905
Function at 0x1400151bc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14001523a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140015231
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140015231
mov rax, qword [rbp - 8]
jmp 0x14001524f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140015204
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
lea r9, str._J_ms8m
mov r8d, 3
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140d3d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d3d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d3d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d3d06f
add dl, dl
jne 0x140d3d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d3d0f6
xor eax, eax
add dl, dl
jne 0x140d3d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d3d1ad
add dl, dl
jne 0x140d3d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d3d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d3d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d3d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d3d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d3d07e
mov eax, 1
add dl, dl
jne 0x140d3d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d3d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d3d0fb
sub eax, ebx
mov ebx, 1
jne 0x140d3d14c
mov ecx, 1
add dl, dl
jne 0x140d3d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d3d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d3d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d3d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d3d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d3d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d3d15d
cmp eax, 0x7d00
jae 0x140d3d19b
cmp eax, 0x500
jb 0x140d3d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d3d07e
cmp eax, 0x7f
ja 0x140d3d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d3d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d3d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d3d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x128dc
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x80
and dword [r11 + 8], 0
mov dword [rsp + 0x48], 0x30
and qword [r11 - 0x38], 0
mov dword [rsp + 0x60], 0x240
and qword [r11 - 0x20], 0
and qword [r11 - 0x18], 0
lea rax, [r11 + 8]
mov qword [r11 - 0x30], rcx
mov edi, r8d
mov qword [r11 - 0x58], rax
and dword [rsp + 0x28], 0
and qword [r11 - 0x68], 0
mov rbx, r9
mov rsi, rdx
lea rcx, [r11 - 0x48]
lea r8, [r11 - 0x40]
xor r9d, r9d
mov edx, 0x20006
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
js 0x1298a
mov eax, dword [rsp + 0xb0]
mov rcx, qword [rsp + 0x40]
mov r9d, edi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x129a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
and qword [rax - 0x58], 0
and qword [rax - 0x40], 0
and qword [rax - 0x38], 0
mov rbp, r8
mov qword [rax - 0x50], rcx
mov r14, rdx
lea r8, [rax - 0x60]
lea rcx, [rax - 0x68]
mov edx, 0x20019
mov r13, r9
mov dword [rax - 0x60], 0x30
mov dword [rax - 0x48], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x12ac3
mov rsi, qword [rsp + 0xc0]
xor ecx, ecx
mov ebx, dword [rsi]
add ebx, 0x10
mov edx, ebx
mov r12d, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
jne 0x12a30
mov ebx, 0xc000009a
jmp 0x12ab6
mov r8, r12
xor edx, edx
mov rcx, rax
call fcn.00021090
mov rcx, qword [rsp + 0x30]
lea r11, [rsp + 0xa0]
mov qword [rsp + 0x28], r11
mov r9, rdi
mov r8d, 2
mov rdx, r14
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ebx, eax
cmp eax, 0xc0000023
je 0x12a9f
cmp eax, 0x80000005
je 0x12a9f
test eax, eax
js 0x12aab
test rbp, rbp
je 0x12a84
mov ecx, dword [rdi + 4]
mov dword [rbp], ecx
mov eax, dword [rdi + 8]
lea rdx, [rdi + 0xc]
mov rcx, r13
cmp dword [rsi], eax
cmovb eax, dword [rsi]
mov r8d, eax
mov dword [rsi], eax
call fcn.0001faf0
jmp 0x12aab
mov eax, dword [rsp + 0xa0]
add eax, 0xfffffff4
mov dword [rsi], eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14200
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov ebp, 0x80000
mov dword [rax + 0x10], 3
mov dword [rax + 8], ebp
call fcn.00012e0c
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
xor ebx, ebx
mov rdi, rax
cmp rax, rbx
je 0x14415
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.00021090
lea rdx, [0x00024930]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x000249b0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00024a30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r11d, dword [0x00026250]
cmp r11d, ebx
je 0x14293
cmp r11d, 0x20
jb 0x1437b
movabs rsi, 0xfffff78000000014
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xa0]
mov rax, qword [rsi]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsi]
mov qword [rsp + 0xa0], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
mov eax, 0xaaaaaaab
mul edi
shr edx, 2
add edx, dword [rsp + 0xa8]
mov ecx, edx
call qword [sym.imp.ntoskrnl.exe_srand]
call qword [sym.imp.ntoskrnl.exe_rand]
cdq
and edx, 0x1f
add eax, edx
and eax, 0x1f
sub eax, edx
mov dword [0x00026250], eax
jne 0x14357
mov rax, qword [rsi]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0xa0], rax
call qword [sym.imp.ntoskrnl.exe_ExSystemTimeToLocalTime]
mov ecx, dword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_srand]
call qword [sym.imp.ntoskrnl.exe_rand]
mov r11d, eax
mov eax, 0x84210843
imul r11d
add edx, r11d
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x1f
sub r11d, edx
inc r11d
mov dword [0x00026250], r11d
lea r9, [0x00026250]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0x20], 4
call fcn.000128dc
lea rax, [rsp + 0x90]
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], rax
call fcn.000129a8
mov esi, dword [rsp + 0x90]
mov r12d, eax
cmp esi, ebp
jbe 0x143db
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
cmp rax, rbx
je 0x14448
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.00021090
cmp r12d, ebx
jl 0x1440a
mov r8d, dword [0x00026250]
mov edx, esi
mov rcx, rdi
mov byte [0x00025bd8], 1
call fcn.00017aec
movzx ecx, byte [0x00025bd8]
cmp eax, ebx
cmove ecx, ebx
mov byte [0x00025bd8], cl
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rcx, [0x00028680]
mov eax, ebx
mov edx, 8
test al, 1
je 0x14430
shr eax, 1
xor eax, 0xedb88320
jmp 0x14432
shr eax, 1
sub rdx, 1
jne 0x14423
inc ebx
mov dword [rcx], eax
add rcx, 4
cmp ebx, 0x100
jb 0x1441c
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret