joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006f090
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1401b4048]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1401be960], 0
je 0x14006f16b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14013b000]
movdqu xmmword [rsp + 0x38], xmm1
xor ebx, ebx
mov word [rsp + 0x28], bx
lea r8d, [rbx + 0x24]
lea rdx, str.InitLogModule:__already_initialized_n
lea rcx, [rsp + 0x28]
call fcn.140012d60
nop
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14006f145
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f140
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006f18c
call fcn.1400bece8
movdqa xmm0, xmmword [0x14013b000]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], bx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bf400
add rsp, 0x50
pop rbx
ret
mov qword [0x1401be968], rcx
mov byte [0x1401be960], 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bf400
add rsp, 0x50
pop rbx
ret
call fcn.1400e9e3c
int3
Function at 0x140084140
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rbx, r9
mov rdi, rdx
mov r9, rcx
mov qword [rsp + 0x20], 0
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x28], rax
mov rdx, r8
movabs r10, 0x100000001b3
mov qword [rsp + 0x30], rdx
lea rcx, [r8 + 1]
cmp rdx, rcx
je 0x1400841b2
movzx ecx, byte [rdx]
xor rax, rcx
mov qword [rsp + 0x28], rax
imul rax, r10
mov qword [rsp + 0x28], rax
inc rdx
jmp 0x14008418b
mov r10, qword [r9 + 0x30]
and r10, rax
mov qword [rsp + 0x40], r10
shl r10, 4
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
cmp qword [rcx + r10], rax
je 0x1400841dd
mov rax, qword [rcx + r10 + 8]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rax
mov rdx, rax
mov rcx, qword [r9 + 0x18]
cmp rdx, qword [r10 + rcx]
je 0x140084265
mov rax, qword [rax + 8]
mov rdx, rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax + 0x10]
cmp byte [r8], cl
jne 0x140084263
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rax + 8], rcx
dec qword [r9 + 0x10]
lea rax, [rbx + 0x10]
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x140084239
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rsp + 0x50], 0x20
mov edx, 0x20
mov rcx, rbx
call fcn.1400bece8
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov rax, rdi
jmp 0x140084301
jmp 0x1400841e5
mov rcx, qword [rbx]
mov rax, qword [rsp + 0x20]
cmp rax, rcx
je 0x1400842a4
mov rdx, qword [rbx + 8]
mov qword [rdx], rcx
mov rdx, qword [rcx + 8]
mov qword [rdx], rax
mov rdx, qword [rax + 8]
mov qword [rdx], rbx
mov r8, qword [rax + 8]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov qword [rbx + 8], r8
mov rax, qword [rsp + 0x20]
mov rdx, qword [r9 + 0x18]
add rdx, r10
mov rcx, qword [rdx]
cmp rcx, qword [r9 + 8]
jne 0x1400842c2
mov qword [rdx], rbx
mov rax, qword [r9 + 0x18]
mov qword [r10 + rax + 8], rbx
jmp 0x1400842ee
cmp rcx, rax
jne 0x1400842cc
mov qword [rdx], rbx
jmp 0x1400842ee
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rbx
je 0x1400842ee
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r9
call fcn.14008d540
nop
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140084c40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r10, [r8 + 0x10]
xor r11d, r11d
lea r9, [r10 + 1]
mov rdi, rdx
cmp r10, r9
mov rbx, rcx
movabs rax, 0xcbf29ce484222325
setbe r11b
ja 0x140084c95
movabs rdx, 0x100000001b3
nop dword [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
xor rax, rcx
imul rax, rdx
sub r11, 1
jne 0x140084c80
mov rdx, qword [rbx + 0x30]
mov rcx, qword [rbx + 0x18]
and rdx, rax
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x140084cd5
cmp rax, r8
jne 0x140084ccb
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x140084ce0
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x140084ce0
cmp rax, r8
jne 0x140084ce0
mov rax, qword [r8]
mov qword [rcx], rax
lea rcx, [rbx + 8]
mov rdx, rdi
call fcn.14008ebf0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140084d00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [r8 + 0x20]
mov rdi, r8
add r8, 0x10
mov rsi, rdx
mov r10, rcx
cmp qword [rdi + 0x28], 0x10
jb 0x140084d2b
mov r8, qword [rdi + 0x10]
xor ebx, ebx
lea rcx, [r8 + r9]
cmp r8, rcx
movabs rax, 0xcbf29ce484222325
mov rdx, r8
cmova r9, rbx
test r9, r9
je 0x140084d78
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx]
inc rdx
xor rax, rcx
mov rcx, rdx
sub rcx, r8
imul rax, rbx
cmp rcx, r9
jne 0x140084d60
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x140084db8
cmp rax, rdi
jne 0x140084dae
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x140084dc3
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x140084dc3
cmp rax, rdi
jne 0x140084dc3
mov rax, qword [rdi]
mov qword [rcx], rax
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r10 + 0x10]
call fcn.14008ac80
mov edx, 0x40
mov rcx, rdi
call fcn.1400bece8
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14008c7a0
Capabilities:
Compare security identifiers

Disassembly:
push rdi
sub rsp, 0x100
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x1401b4048]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov ecx, dword [0x1401bf9d0]
mov rax, qword gs:[0x58]
mov edx, 0x14
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1401beae0], eax
jg 0x14008c840
cmp qword [0x1401bead0], 0
jne 0x14008c7fd
xor eax, eax
jmp 0x14008c804
lea rax, [0x1401beac8]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400bf400
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rdi
ret
lea rcx, [0x140134990]
call fcn.1400bef8c
nop
lea rcx, [0x1401beae0]
call fcn.1400bf15c
jmp 0x14008c7ef
lea rcx, [0x1401beae0]
call fcn.1400bf1bc
cmp dword [0x1401beae0], 0xffffffff
jne 0x14008c7ef
xor edi, edi
mov dword [0x1401beac0], edi
mov dword [0x1401beac8], 0x18
xor eax, eax
mov qword [0x1401bead0], rax
mov qword [0x1401bead8], rax
mov dword [rsp + 0x80], eax
mov word [rsp + 0x84], 0x500
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x60]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14008c8aa
mov ebx, edi
jmp 0x14008c94b
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x54
lea r8, [rsp + 0x90]
lea edx, [r9 - 0x53]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rsp + 0x60]
test eax, eax
jne 0x14008c8e4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, edi
jmp 0x14008c94b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov dl, 1
lea rcx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x14008c92b
mov ebx, edi
jmp 0x14008c94b
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [0x1401beac0], ebx
cmp qword [0x1401bead0], rdi
jne 0x14008c825
test ebx, ebx
je 0x14008c825
lea rcx, [0x1401beac0]
call fcn.14008be80
mov qword [0x1401bead0], rax
mov dword [0x1401bead8], edi
jmp 0x14008c825
Function at 0x14008d880
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r11, rcx
mov r10, qword [rdx + 0x10]
jb 0x14008d891
mov rdx, qword [rdx]
xor ecx, ecx
lea r8, [rdx + r10]
cmp rdx, r8
movabs rax, 0xcbf29ce484222325
mov r9, rdx
cmova r10, rcx
test r10, r10
je 0x14008d8d9
movabs r8, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9]
inc r9
xor rax, rcx
mov rcx, r9
sub rcx, rdx
imul rax, r8
cmp rcx, r10
jne 0x14008d8c0
and rax, qword [r11 + 0x30]
ret
Function at 0x14008eec0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r10, qword [r8 + 0x18]
mov rsi, r8
mov r12, qword [r8 + 0x10]
mov rbp, rcx
cmp r10, 0x10
jb 0x14008eee7
mov r8, qword [r8]
xor r11d, r11d
lea rcx, [r8 + r12]
cmp r8, rcx
mov r9, r12
movabs rax, 0xcbf29ce484222325
mov rdx, r8
cmova r9, r11
test r9, r9
je 0x14008ef38
movabs r11, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx]
inc rdx
xor rax, rcx
mov rcx, rdx
sub rcx, r8
imul rax, r11
cmp rcx, r9
jne 0x14008ef20
mov rcx, qword [rbp + 0x30]
and rcx, rax
mov qword [rsp + 0x60], rbx
mov rax, qword [rbp + 0x18]
mov rbp, qword [rbp + 8]
shl rcx, 4
mov qword [rsp + 0x68], r14
mov r13, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rdi, r13
mov qword [rsp + 0x50], rax
cmp r13, rbp
jne 0x14008ef72
mov rax, rbp
jmp 0x14008ef78
mov rax, qword [rax]
mov rax, qword [rax]
cmp rdi, rax
je 0x14008eff5
lea rbx, [rdi + 0x10]
mov rdx, rsi
cmp r10, 0x10
jb 0x14008ef8d
mov rdx, qword [rsi]
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x14008ef9a
mov rcx, qword [rbx]
mov r14, qword [rbx + 0x10]
cmp r14, r12
jne 0x14008efb3
mov r8, r14
call fcn.1400e0cb0
test eax, eax
je 0x14008efbd
mov r10, qword [rsi + 0x18]
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x50]
jmp 0x14008ef68
cmp qword [rbx + 0x18], 0x10
jb 0x14008efc7
mov rbx, qword [rbx]
cmp qword [rsi + 0x18], 0x10
jb 0x14008efd1
mov rsi, qword [rsi]
cmp r12, r14
jne 0x14008efe8
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call fcn.1400e0cb0
test eax, eax
je 0x14008efeb
mov rdi, rbp
mov rax, qword [rsp + 0x58]
mov qword [rax], rdi
jmp 0x14008f000
mov r11, qword [rsp + 0x58]
mov rax, r11
mov qword [r11], rbp
mov r14, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140095b30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x270], rbx
mov rax, qword [0x1401b4048]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rdi, rcx
lea rax, vtable.fmt::v8::detail::buffer_char_.0
mov qword [rbp - 0x40], rax
xor r14d, r14d
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
lea r15, vtable.fmt::v8::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rbp - 0x40], r15
lea rax, [rbp - 0x20]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0xfa
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
lea r8, [rbp - 0x40]
call qword [rax + 8]
mov rsi, qword [rdi + 0x98]
mov rbx, qword [rbp - 0x30]
add rsi, rbx
cmp rsi, qword [rdi + 0x88]
jbe 0x140095cc9
lea rcx, [rdi + 0xa0]
call fcn.14008f180
lea rcx, [rdi + 0xa0]
call fcn.140095e90
test rax, rax
je 0x140095cc5
call fcn.14008c7a0
test rax, rax
je 0x140095d52
lea ebx, [r14 + 5]
mov dword [rsp + 0x30], r14d
lea r8, [rdi + 0xb0]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14008c990
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
mov byte [rsp + 0x60], r14b
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], r14b
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x78]
call fcn.1400090d0
nop
mov dword [rbp - 0x58], r14d
mov byte [rbp - 0x50], r14b
lea rcx, [rsp + 0x58]
call fcn.14008c120
cmp byte [rsp + 0x60], 0
jne 0x140095c7e
cmp dword [rbp - 0x58], 0
je 0x140095c7e
xor cl, cl
jmp 0x140095c80
mov cl, 1
mov byte [rbp - 0x50], cl
test ebx, ebx
je 0x140095c92
add ebx, 0xffffffff
je 0x140095c9e
test cl, cl
jne 0x140095c9e
jmp 0x140095c63
mov eax, r14d
test cl, cl
sete al
test eax, eax
jne 0x140095c63
cmp byte [rbp - 0x50], 0
je 0x140095cb0
mov rcx, rdi
call fcn.140094f80
mov rsi, qword [rbp - 0x30]
lea rcx, [rsp + 0x58]
call fcn.14008b280
nop
lea rcx, [rsp + 0x38]
call fcn.14000ae70
mov rbx, qword [rbp - 0x30]
mov r9, qword [rdi + 0xa8]
mov r8, rbx
mov edx, 1
mov rcx, qword [rbp - 0x38]
call fcn.1400ede08
cmp rax, rbx
jne 0x140095d6c
mov qword [rdi + 0x98], rsi
mov qword [rbp - 0x40], r15
lea rax, [rbp - 0x20]
mov rcx, qword [rbp - 0x38]
cmp rcx, rax
je 0x140095d2c
mov rdx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140095d27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140095d66
call fcn.1400bece8
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400bf400
mov rbx, qword [rsp + 0x270]
add rsp, 0x230
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.140094f80
mov rbx, qword [rbp - 0x30]
mov rsi, rbx
jmp 0x140095cc9
call fcn.1400e9e3c
nop
lea rdx, [rdi + 0xb0]
lea rcx, [rbp + 0xe0]
call fcn.14008ee80
nop
mov r8, rax
lea rdx, str.Failed_writing_to_file
lea rcx, [rbp + 0x100]
call fcn.140002f80
mov rbx, rax
call fcn.1400ee554
mov edx, dword [rax]
mov rcx, rbx
call fcn.1400962a0
int3
Function at 0x14009c9d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1401b4048]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 8
jb 0x14009ca09
mov rdx, qword [rdx]
movdqa xmm0, xmmword [0x14013b000]
movdqu xmmword [rsp + 0x60], xmm0
xor ebx, ebx
mov word [rsp + 0x50], bx
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], bx
jne 0x14009ca25
lea rcx, [rsp + 0x50]
call fcn.140012d60
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x88
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
call fcn.1400122c0
nop
cmp rbx, 0xffffffffffffffff
jne 0x14009caed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 5
jne 0x14009cada
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14009caa5
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x14009cad2
bt eax, 0xa
jb 0x14009cada
mov edx, eax
mov rcx, rdi
call fcn.140099860
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov dword [rsi], ebx
mov dword [rsi + 4], eax
jmp 0x14009cb09
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov r9, r14
mov r8, rdi
mov edx, ebp
mov rcx, rsi
call fcn.14009c3e0
nop
jmp 0x14009cb09
mov r9, r14
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14009c540
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400bf400
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400b5bec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
xor r10d, r10d
sar r8, 1
movabs rax, 0xcbf29ce484222325
add r8, r8
mov r9, rdx
lea rcx, [r8 + rdx]
cmp rdx, rcx
cmova r8, r10
test r8, r8
je 0x1400b5c38
movzx ecx, byte [r9]
movabs r10, 0x100000001b3
xor rax, rcx
inc r9
mov rcx, r9
sub rcx, rdx
imul rax, r10
cmp rcx, r8
jne 0x1400b5c15
ret

Function at 0x1400bd0a4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor ecx, ecx
mov r10, r8
sub r10, rdx
movabs rax, 0xcbf29ce484222325
cmp rdx, r8
mov r9, rdx
cmova r10, rcx
test r10, r10
je 0x1400bd0e8
movzx ecx, byte [r9]
movabs r8, 0x100000001b3
xor rax, rcx
inc r9
mov rcx, r9
sub rcx, rdx
imul rax, r8
cmp rcx, r10
jne 0x1400bd0c5
ret
Function at 0x1400c5bf8
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400c5c0b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400c6218
lea rdx, [0x1401b07d0]
lea rcx, [rsp + 0x20]
call fcn.1400dffb8
int3

Function at 0x1400d0494
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1401c0098]
xor edx, edx
jmp fcn.1400c5bf8

Function at 0x1400d0e2c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1401c0098]
jmp fcn.1400c5bf8

Function at 0x1400dca78
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400dcb34]
mov r9, qword [r9 + 8]
jmp fcn.1400cde4c

Function at 0x1400dcb0c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400dcb44]
mov r9, qword [r9 + 8]
jmp fcn.1400cde4c

Function at 0x1400fbac8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400fb8ec
Function at 0x140102dac
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140102ad2
call fcn.1400ee554
mov dword [rax], 0x16
call fcn.1400e9e1c
jmp 0x140102c1d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140102c1d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140102c1d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140102b01
lock or dword [rcx + 0x14], 0x10
jmp 0x140102c1d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140102b15
call fcn.140103e40
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x140102b25
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x140102b28
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1400f0498
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.140103394
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140102c0b
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x140102bb9
mov rcx, rbx
call fcn.1400f0498
cmp eax, 0xffffffff
je 0x140102ba4
mov rcx, rbx
call fcn.1400f0498
cmp eax, 0xfffffffe
je 0x140102ba4
mov rcx, rbx
call fcn.1400f0498
movsxd rdi, eax
lea r14, [0x1401c08a0]
mov rcx, rbx
sar rdi, 6
call fcn.1400f0498
mov rcx, qword [r14 + rdi*8]
and eax, 0x3f
shl rax, 6
lea rdx, [rax + rcx]
jmp 0x140102bab
lea rdx, [0x1401b4580]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140102bb9
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x140102bdd
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x140102bdd
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x140102bdd
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x140102bfb
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x140102c06
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x140102c22
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x140102a9c

Function at 0x140104ab0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140104ad0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400ee4e4
or eax, 0xffffffff
jmp 0x140104ad2
xor eax, eax
add rsp, 0x28
ret
Function at 0x140110060
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov eax, r9d
mov rbx, r8
xor edi, edi
mov qword [rsp + 0x38], rdi
lea r9, [rsp + 0x38]
mov r8d, eax
call fcn.140110890
test eax, eax
jne 0x1401100d8
mov dword [rsp + 0x34], edi
mov dword [rsp + 0x30], edi
cmp qword [rbx + 0x18], 8
jb 0x1401100a4
mov rbx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1401100d4
cmp eax, 0xea
jne 0x1401100d8
mov bl, 1
jmp 0x1401100da
xor bl, bl
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1401100ea
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140110e80
Capabilities:
Get token membership

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x1401b4048]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [r11 - 0x20], 0
mov word [r11 - 0x1c], 0x500
xor ebx, ebx
mov qword [r11 - 0x40], rbx
mov qword [r11 - 0x38], rbx
mov r8, qword [sym.imp.ADVAPI32.dll_FreeSid]
xor edx, edx
lea rcx, [r11 - 0x30]
call fcn.140110b50
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140018c90
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
lea r8d, [rbx + 0x20]
mov dl, 2
lea rcx, [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140110f4d
mov dword [rsp + 0x60], ebx
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x140110f4d
cmp dword [rsp + 0x60], ebx
setne dil
jmp 0x140110f50
xor dil, dil
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x140110f87
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140110f87
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 8]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x140110f87
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
movzx eax, dil
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400bf400
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret