joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b1dd0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, cl
movabs r10, 0x100000001b3
mov r9d, ecx
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov eax, ecx
imul r8, r10
sar eax, 8
movzx edx, al
mov eax, ecx
xor r8, rdx
sar eax, 0x10
mov rdx, qword [0x140687bd8]
imul r8, r10
movzx ecx, al
mov eax, r9d
xor r8, rcx
sar eax, 0x18
imul r8, r10
movzx ecx, al
xor r8, rcx
mov rcx, qword [0x140687c00]
imul r8, r10
and rcx, r8
shl rcx, 4
add rcx, qword [0x140687be8]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400b1e64
mov rcx, qword [rcx]
cmp r9d, dword [rax + 0x10]
je 0x1400b1e5f
nop
cmp rax, rcx
je 0x1400b1e64
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
jne 0x1400b1e50
test rax, rax
jne 0x1400b1e67
mov rax, rdx
cmp rax, rdx
setne al
ret
Function at 0x1400b6240
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x1400b63fe
lea rax, [rdx - 1]
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x20], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.14008f7e0
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx]
cmp rdx, rdi
je 0x1400b63c7
mov qword [rsp + 0x50], rbp
mov rcx, rdx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rbx
xor r9, rax
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rdi
jne 0x1400b6333
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400b63b6
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x1400b6370
mov r10, qword [rax]
cmp r10, rcx
je 0x1400b636a
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400b63b6
mov r8, rax
cmp r10, rax
je 0x1400b6392
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x1400b63d8
cmp r10, rax
jne 0x1400b6380
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rdi
jne 0x1400b62e0
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400b63b6
lea rcx, str.invalid_hash_bucket_count
call fcn.140332c94
int3
Function at 0x1400b97b0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rdx, str.Delayed_initialisation_started
xor ecx, ecx
call fcn.140109e80
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov r8d, 4
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
lea rbx, vtable.TAutoHandle_struct_SC_HANDLE______ptr64__struct_ServiceHandleTraits_.0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400b9827
lea rcx, str.OpenSCManager
call fcn.1400892d0
nop
jmp 0x1400b9860
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov r8d, 4
lea rdx, str.hmpalertsvc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400b9896
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rdx, str.Delayed_initialisation_failed__service_not_started
mov ecx, 3
call fcn.140109e80
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x1400b98d2
lea rcx, [0x1405f9958]
call fcn.1400892d0
nop
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400b9857
cmp dword [rsp + 0x5c], 4
sete bl
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test bl, bl
je 0x1400b9860
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.14011e770
nop
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rcx]
cmp byte [rbx + 0x19], 0
jne 0x1400b997a
mov ecx, dword [rbx + 0x1c]
call fcn.140116680
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1400b994a
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400b9945
cmp rbx, qword [rax + 0x10]
jne 0x1400b9945
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400b9932
mov rbx, rax
jmp 0x1400b996f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1400b996f
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1400b9960
cmp byte [rbx + 0x19], 0
je 0x1400b9916
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400b99be
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.140077dd0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.140359090
cmp byte [rbx + 0x19], 0
je 0x1400b9990
mov rcx, qword [rsp + 0x30]
mov edx, 0x20
call fcn.140359090
jmp 0x1400b9871
jmp 0x1400b97b0
Function at 0x1400b9fb0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x1400ba041
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ba01f
mov ecx, 0x800
call qword [case.0x1401cd220.0]
test eax, eax
je 0x1400ba041
mov byte [0x140686a5e], 1
jmp 0x1400ba041
lea rdx, str.SetDllDirectoryA
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ba041
lea rcx, [0x1405e4ea8]
call qword [case.0x1401cd220.0]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rax, [0x140000000]
mov qword [0x1406875f0], rax
mov eax, dword [rsp + 0x3c]
mov dword [0x140676368], eax
mov byte [rsp + 0x20], 0
lea rbx, [0x140686df0]
mov r14d, 1
lea rdi, [0x1406875f0]
nop dword [rax]
lea r9, [rsp + 0x28]
mov r8, r14
lea rdx, [rsp + 0x20]
lea rcx, [0x140607380]
call fcn.1401e60a0
mov rax, qword [rsp + 0x28]
mov qword [rbx], rax
inc byte [rsp + 0x20]
add rbx, 8
cmp rbx, rdi
jl 0x1400ba080
call fcn.1401e8d40
lea rdx, [0x1405e4ea8]
mov ecx, 2
call fcn.140371bc0
lea rcx, [0x140687688]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140687650]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
mov r8d, r14d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140687678], rax
lea rcx, [0x140687740]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
xor r15d, r15d
mov qword [rsp + 0x80], r15
lea rsi, [0x1405e95c0]
lea ebp, [r15 + 3]
lea rbx, [rsp + 0x68]
mov edi, 4
nop dword [rax]
mov ecx, dword [rsi]
call fcn.1401f40a0
mov qword [rbx], rax
lea rbx, [rbx + 8]
sub rdi, r14
jne 0x1400ba130
lea rbx, [rsp + 0x68]
mov edi, 4
nop dword [rax]
mov rcx, qword [rbx]
call fcn.1401f41b0
lea rbx, [rbx + 8]
sub rdi, r14
jne 0x1400ba150
add rsi, 4
sub rbp, 1
jne 0x1400ba122
call fcn.1401ee6a0
xor eax, eax
lea rbx, [0x1406875f8]
lock cmpxchg dword [0x140687cf4], r15d
jne 0x1400ba1a9
mov edx, 0xfa0
lea rcx, [0x140687718]
call fcn.1401d2870
mov edx, 0xfa0
mov rcx, rbx
call fcn.1401d2870
xchg dword [0x140687cf4], r14d
lea rax, vtable.AutoLock.0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp byte [0x140686d5b], 0
jne 0x1400ba1d9
call fcn.1401d84a0
mov byte [0x140686d5b], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400ca810
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp byte [0x140689f30], 0
lea rdi, [0x140689f30]
mov rbx, rcx
jne 0x1400ca898
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1400ca870
dec eax
cmp byte [rax + rdi], 0x5c
je 0x1400ca870
lea r8, [0x1405f6474]
mov edx, 0x104
mov rcx, rdi
call fcn.140372010
lea r8, [0x1405f6490]
mov edx, 0x104
mov rcx, rdi
call fcn.140372010
lea r8, [0x1405f6474]
mov edx, 0x104
mov rcx, rdi
call fcn.140372010
mov r8, rdi
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.140372090
mov r8, rbx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.140372010
xor ebx, ebx
call fcn.1401d6080
test al, al
mov ecx, 0x800
cmovne ebx, ecx
xor edx, edx
mov r8d, ebx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rdi
ret

Function at 0x1400ca900
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx eax, word [rdx + 0x14]
lea r9, [rdx + 0x18]
movzx ebx, word [rdx + 6]
add r9, rax
xor r10d, r10d
mov rsi, r8
mov edi, ecx
mov rax, r9
mov r11d, r10d
test ebx, ebx
je 0x1400ca953
mov ecx, dword [rax + 8]
test ecx, ecx
jne 0x1400ca93a
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0xc]
cmp edi, edx
jb 0x1400ca947
add ecx, edx
cmp edi, ecx
jb 0x1400ca965
inc r11d
add rax, 0x28
cmp r11d, ebx
jb 0x1400ca930
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov r8d, r9d
sub r8d, esi
nop dword [rax + rax]
cmp r9, rax
je 0x1400ca99e
inc r10d
add r9, 0x28
cmp r10d, ebx
jb 0x1400ca970
mov eax, dword [rax + 0x14]
sub eax, edx
add eax, r8d
add eax, edi
add rax, rsi
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov eax, dword [rax + 0x14]
mov r8d, dword [r9 + 0xc]
sub eax, edx
sub r8d, dword [r9 + 0x14]
mov rbx, qword [rsp + 8]
add eax, r8d
add eax, edi
mov rdi, qword [rsp + 0x18]
add rax, rsi
mov rsi, qword [rsp + 0x10]
ret
Function at 0x1400ca9d0
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, 0x5a4d
mov rbp, rcx
cmp word [rcx], ax
jne 0x1400cab14
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
cmp dword [rsi], 0x4550
jne 0x1400cab14
mov eax, 0x20b
cmp word [rsi + 0x18], ax
jne 0x1400cab14
lea rax, [rsi + 0x90]
test rax, rax
je 0x1400cab14
mov r8, rcx
mov rdx, rsi
mov ecx, dword [rax]
call fcn.1400ca900
mov r15, rax
test rax, rax
je 0x1400cab14
cmp dword [rax], 0
je 0x1400cab14
xor r14d, r14d
mov rdx, rax
mov ecx, dword [rdx + 0x10]
test ecx, ecx
je 0x1400caafe
mov edi, dword [rdx]
test edi, edi
je 0x1400caafe
mov r8, rbp
mov rdx, rsi
call fcn.1400ca900
mov r8, rbp
mov rdx, rsi
mov ecx, edi
mov rbx, rax
call fcn.1400ca900
mov rdi, rax
test rbx, rbx
je 0x1400caafe
test rax, rax
je 0x1400caafe
mov rcx, qword [rax]
test rcx, rcx
je 0x1400caafe
sub rdi, rbx
test rcx, rcx
js 0x1400caaf0
mov r8, rbp
mov rdx, rsi
call fcn.1400ca900
test rax, rax
je 0x1400caaf0
lea rdx, [rax + 2]
xor eax, eax
test rdx, rdx
je 0x1400caaf0
movzx ecx, byte [rdx]
test cl, cl
je 0x1400caaf0
movsx ecx, cl
lea rdx, [rdx + 1]
ror eax, 0xd
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x1400caad1
cmp eax, 0x753a512
jne 0x1400caaf0
test rbx, rbx
jne 0x1400cab3d
mov rcx, qword [rdi + rbx + 8]
add rbx, 8
test rcx, rcx
jne 0x1400caaad
inc r14
lea rax, [r14 + r14*4]
cmp dword [r15 + rax*4], 0
lea rdx, [r15 + rax*4]
jne 0x1400caa62
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, rbx
xor dil, dil
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400cab75
mov eax, dword [rsp + 0x4c]
test al, 0xf0
setne dil
test al, 0xcc
je 0x1400cab75
lea rax, [0x1400cabd0]
mov qword [rbx], rax
mov al, 1
jmp 0x1400cab16
mov eax, 0x40
lea r9, [rsp + 0x20]
mov r8d, 4
test dil, dil
mov rcx, rbx
cmovne r8d, eax
lea edx, [rax - 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400cabbe
mov r8d, dword [rsp + 0x20]
lea rax, [0x1400cabd0]
lea r9, [rsp + 0x24]
mov qword [rbx], rax
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
jmp 0x1400cab16
Function at 0x1400d1fd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xe0
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [rcx], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
mov dword [rsp + 0x30], 1
call fcn.1401d3600
mov ecx, 0x100
mov r9d, 0x200
cmp eax, 0xc
cmove r9d, ecx
or r9d, 0x20019
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWARESophosAutoUpdate
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d2113
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0x4c], 0x7f
mov dword [rsp + 0x48], edi
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.CustomerID
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d2108
cmp dword [rsp + 0x48], 1
jne 0x1400d2108
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400d20f0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400739a0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret
Function at 0x1400d5f10
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x88
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14d, r9d
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x19], rcx
xor r15d, r15d
mov qword [rbp - 0x11], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], 7
mov word [rbp - 0x11], r15w
lfence
mov word [rsp + 0x20], r15w
mov edx, 0xff
mov r9d, edx
lea rcx, [rbp - 0x11]
call fcn.140072e50
mov eax, dword [rbp - 1]
mov dword [rbp + 0xf], eax
lea r8, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae r8, qword [rbp - 0x11]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0xf]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400d60f1
mov ecx, dword [rbp + 0xf]
mov r8, qword [rbp - 1]
cmp rcx, r8
ja 0x1400d5fd9
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rax, qword [rbp - 0x11]
mov qword [rbp - 1], rcx
mov word [rax + rcx*2], r15w
jmp 0x1400d6032
mov rdx, rcx
sub rdx, r8
mov rdi, qword [rbp + 7]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x1400d601d
mov qword [rbp - 1], rcx
lea r9, [rbp - 0x11]
cmp rdi, 8
cmovae r9, qword [rbp - 0x11]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x1400d6012
movzx eax, r15w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r15w
jmp 0x1400d6032
lfence
mov word [rsp + 0x20], r15w
mov r9, rdx
lea rcx, [rbp - 0x11]
call fcn.140072e50
mov qword [rbx], r15
lea rcx, [rbx + 8]
mov qword [rcx], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
mov dword [rbx + 0x28], 2
lea rax, [rbp - 0x11]
cmp rcx, rax
je 0x1400d6073
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
mov r8, qword [rbp - 1]
call fcn.1400739a0
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
mov qword [rsp + 0x20], rbx
mov r9d, r14d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400d60d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d60cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d6147
call fcn.140359090
mov rax, rbx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140359070
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], 7
mov word [rbx + 8], r15w
mov dword [rbx + 0x28], 2
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1400d60d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d60cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400d60cd
call fcn.140368068
int3
Function at 0x1400e4100
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, r8
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov edx, ecx
lea rcx, [rsp + 0x28]
call fcn.14009bfc0
nop
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x1400e4182
add rdx, 0x40
lea rax, [rsp + 0x38]
cmp rax, rdx
je 0x1400e4182
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x1400e4177
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
call fcn.1400739a0
nop
mov rdi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400e41d1
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400e41d1
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1401cd220.0]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400e41d1
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1401cd220.0]
xor bpl, bpl
cmp qword [rsp + 0x48], 0
je 0x1400e4272
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
test rax, rax
je 0x1400e4272
xor cl, cl
cmp dword [rsp + 0x20], 0
jle 0x1400e4268
mov rbx, rax
test cl, cl
jne 0x1400e4245
mov rcx, qword [rbx]
mov rdx, rdi
nop word [rax + rax]
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x1400e4220
call fcn.1401d5cd0
cmp eax, 0x16a1c7f0
sete cl
inc esi
add rbx, 8
cmp esi, dword [rsp + 0x20]
jl 0x1400e4210
jmp 0x1400e4268
movsxd rax, esi
mov rdx, qword [r14 + rax*8]
nop dword [rax]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x1400e4250
mov r8, rdi
mov rcx, r15
call fcn.1400739a0
mov bpl, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400e42b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e42ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e42d5
call fcn.140359090
movzx eax, bpl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140368068
int3
mov r8, rdx
jmp 0x1400e4100
Function at 0x1400e42e0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, r8
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov edx, ecx
lea rcx, [rsp + 0x28]
call fcn.14009bfc0
nop
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x1400e4182
add rdx, 0x40
lea rax, [rsp + 0x38]
cmp rax, rdx
je 0x1400e4182
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x1400e4177
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
call fcn.1400739a0
nop
mov rdi, 0xffffffffffffffff
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400e41d1
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400e41d1
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1401cd220.0]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400e41d1
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1401cd220.0]
xor bpl, bpl
cmp qword [rsp + 0x48], 0
je 0x1400e4272
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
test rax, rax
je 0x1400e4272
xor cl, cl
cmp dword [rsp + 0x20], 0
jle 0x1400e4268
mov rbx, rax
test cl, cl
jne 0x1400e4245
mov rcx, qword [rbx]
mov rdx, rdi
nop word [rax + rax]
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x1400e4220
call fcn.1401d5cd0
cmp eax, 0x16a1c7f0
sete cl
inc esi
add rbx, 8
cmp esi, dword [rsp + 0x20]
jl 0x1400e4210
jmp 0x1400e4268
movsxd rax, esi
mov rdx, qword [r14 + rax*8]
nop dword [rax]
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x1400e4250
mov r8, rdi
mov rcx, r15
call fcn.1400739a0
mov bpl, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x1400e42b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e42ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e42d5
call fcn.140359090
movzx eax, bpl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140368068
int3
mov r8, rdx
jmp 0x1400e4100