joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010c3e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov r14, r8
mov rbx, rcx
add rcx, 0x68
mov qword [rax - 0x30], rcx
xor ebp, ebp
mov qword [rax - 0x28], rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edi, [rbp + 1]
mov eax, edi
lock xadd dword [rsp + 0x40], eax
test eax, eax
jne 0x14010c43a
cmp dword [rsp + 0x44], ebp
jne 0x14010c5dd
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rsp + 0x44], eax
mov word [r14], bp
cmp qword [rbx + 0x60], rbp
jne 0x14010c4bb
mov r9d, 0x1f0003
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventExW]
mov rsi, rax
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x14010c46d
mov qword [rbx + 0x60], rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x60], rsi
test rsi, rsi
je 0x14010c4bb
lea rsi, [rbx + 0x50]
cmp qword [rsi], rbp
jne 0x14010c5d0
mov r8, rsi
xor edx, edx
lea rcx, [0x1402d1b78]
call fcn.14008699c
test eax, eax
jne 0x14010c4bb
mov rcx, qword [rsi]
test rcx, rcx
je 0x14010c4bb
mov r9, qword [rbx + 0x60]
test r9, r9
je 0x14010c4bb
mov dword [rsp + 0x20], edi
mov r8d, 0x1000000f
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x14010c517
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14010c517
lea rcx, [rbx + 8]
call fcn.1400d7ce8
mov edx, 8
mov rcx, rbx
call fcn.140035658
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x14010c5af
mov r9, qword [rbx + 0x60]
test r9, r9
je 0x14010c5af
mov dword [rsp + 0x20], edi
mov r8d, 0x1000000f
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x14010c5af
movabs rcx, 0xcbf29ce484222325
mov rdx, rbp
movzx eax, byte [rsp + rdx + 0x78]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
add rdx, rdi
cmp rdx, 4
jb 0x14010c524
mov r8, qword [rbx + 0x30]
and r8, rcx
add r8, r8
mov r9, qword [rbx + 0x18]
mov rax, qword [r9 + r8*8]
mov rdx, qword [rbx + 8]
mov r10d, dword [rsp + 0x78]
cmp qword [r9 + r8*8], rdx
jne 0x14010c569
mov rcx, rdx
jmp 0x14010c571
mov rcx, qword [r9 + r8*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14010c581
cmp dword [rax + 0x10], r10d
je 0x14010c584
mov rax, qword [rax]
jmp 0x14010c55e
mov rax, rdx
cmp rax, rdx
je 0x14010c5af
lea r8, [rax + 0x18]
cmp qword [r8 + 0x18], 8
jb 0x14010c597
mov r8, qword [r8]
mov edx, 0x104
mov rcx, r14
call fcn.140263744
test eax, eax
mov edi, 2
jne 0x14010c5af
mov edi, ebp
lea rcx, [rsp + 0x38]
call fcn.1400261e0
mov eax, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
xor edx, edx
mov ecx, 0x23023a3
call fcn.140025d34
int3
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140025d34
int3
Function at 0x14010c5f0
Capabilities:
Get common file path
Hash data using fnv

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x40
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
movsxd rdi, r8d
mov rbx, rcx
xor r14d, r14d
mov word [rcx], r14w
test r8d, r8d
js 0x14010c6fb
cmp edi, 0x27
ja 0x14010c638
movabs rcx, 0x8814010060
bt rcx, rdi
jb 0x14010c655
mov rax, qword [str.x___]
mov edx, 0x3ca4d6
lea rcx, str.x___
mov rax, qword [rax]
call qword [case.0x140118f85.0]
nop
mov r8, rbx
mov edx, edi
lea rcx, [0x1403d9b00]
call fcn.14010c3e0
test eax, eax
jne 0x14010c66c
jmp 0x14010c6e5
cmp eax, 2
jne 0x14010c678
mov eax, 0x80004005
jmp 0x14010c6e5
mov edx, edi
bts edx, 0xf
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
test eax, eax
js 0x14010c6e5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r14w
jne 0x14010c69b
movsxd rcx, eax
test eax, eax
je 0x14010c6c1
mov edx, 0x5c
cmp word [rbx + rcx*2 - 2], dx
je 0x14010c6c8
inc eax
cmp eax, 0x104
jge 0x14010c6c8
mov dword [rbx + rcx*2], 0x5c
mov r8, rbx
mov edx, edi
lea rcx, [0x1403d9b00]
call fcn.14010c264
mov eax, esi
jmp 0x14010c6e5
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
xor edx, edx
mov ecx, 0x3ca4d4
call fcn.140025d34
nop
jmp 0x14010c70a
nop
nop
Function at 0x14010c70c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r9]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14010c744
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r11, qword [rcx + rax*8]
cmp r11, rdi
je 0x14010c789
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r11
je 0x14010c7c1
mov rdi, qword [rdi + 8]
mov rdx, rdi
mov eax, dword [rdi + 0x10]
cmp dword [r9], eax
jne 0x14010c78c
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 8]
call fcn.1400d8220
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14010c8e6
mov qword [rsp + 0x20], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x14010c7fb
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14010c81b
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14010c84a
cmp rax, rdx
jne 0x14010c826
mov qword [r9 + r8*8], rbx
jmp 0x14010c84a
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14010c84a
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140333fc4]
test rax, rax
jns 0x14010c86b
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14010c87c
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14010c8db
cmp rdx, 0x200
jae 0x14010c894
shl rdx, 3
jmp 0x14010c8a6
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14010c8a6
add rdx, rdx
mov rcx, rsi
call fcn.140035658
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14010c8db
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14010c70c
cmp rdi, r15
jne 0x14010c8bb
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14010c8fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov r9, rcx
mov rbx, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x14010c915
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14010c96d
cmp qword [rcx + rdx*8], r8
jne 0x14010c962
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14010c966
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14010c97a
cmp qword [rcx + rdx*8], r8
jne 0x14010c97a
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r9 + 8]
mov rdx, rbx
call fcn.1400d8220
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14010ece0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx eax, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0xcbf29ce484222325
mov rdi, rdx
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov r9, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and r9, rax
add r9, r9
cmp qword [rcx + r9*8 + 8], r8
jne 0x14010ed48
cmp qword [rcx + r9*8], r8
jne 0x14010ed3d
mov rax, qword [r10 + 8]
mov qword [rcx + r9*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x14010ed41
mov rax, qword [r8 + 8]
mov qword [rcx + r9*8 + 8], rax
jmp 0x14010ed55
cmp qword [rcx + r9*8], r8
jne 0x14010ed55
mov rax, qword [r8]
mov qword [rcx + r9*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.140261814
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140110490
Capabilities:
Hash data with crc32

Disassembly:
test rdx, rdx
jne 0x140110498
xor eax, eax
ret
jmp fcn.1401104a0
Function at 0x140122d50
Capabilities:
Check mutex on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor edi, edi
mov rsi, rcx
cmp qword [rcx], rdi
jne 0x140122e73
movsxd rax, r8d
lea rcx, [0x1402e7ed8]
mov r8, rdx
mov qword [rsp + 0x30], rdi
mov qword [rsi], rdi
mov dword [rsp + 0x20], 1
mov r14d, dword [rcx + rax*4]
mov r9d, r14d
lea rcx, [rsp + 0x40]
call fcn.140141318
mov ebp, r14d
mov r15, rax
shr ebp, 0x1a
mov r12b, dil
not bpl
and bpl, 1
test r15, r15
je 0x140122de2
mov edx, r14d
mov r8, r15
shr edx, 0x17
mov ecx, 0x120001
and edx, 1
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov qword [rsi], rax
cmp qword [rsi], rdi
jne 0x140122e41
test bpl, bpl
je 0x140122e41
mov r8d, 1
lea rdx, [rsp + 0x30]
mov ecx, r14d
call fcn.140140f60
test eax, eax
je 0x140122e41
mov rcx, qword [rsp + 0x30]
mov edx, r14d
shr edx, 0x19
mov r8, r15
and edx, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rsi], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x30]
mov ecx, r14d
mov ebx, eax
call fcn.140141260
cmp ebx, 5
jne 0x140122e41
test r12b, r12b
jne 0x140122e41
mov r12b, 1
jmp 0x140122dc3
mov rax, qword [rsi]
inc rax
test rax, 0xfffffffffffffffe
jne 0x140122e78
test bpl, bpl
je 0x140122e70
mov rax, qword [str.x___]
lea rcx, str.x___
mov edx, 0x1631e1
mov rax, qword [rax]
call qword [case.0x140118f85.0]
mov qword [rsi], rdi
mov edi, 0x80004005
mov eax, edi
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1402361b0
add rsp, 0x450
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140127b58
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov rsi, r9
mov r12, r8
mov rdi, rcx
and qword [rsp + 0x88], 0
and dword [rax + 0x10], 0
call fcn.1400a8488
mov r15, qword [rsp + 0x90]
test r15, r15
je 0x140127ba7
and qword [r15], 0
mov eax, dword [rsi]
test eax, eax
je 0x140127bb7
mov esi, 0x80004005
jmp 0x140127ca0
cmp byte [rdi + 0x4c], 0
je 0x140127bad
inc dword [rdi + 0x48]
test byte [rdi + 0x48], 0x3f
jne 0x140127bd1
xor edx, edx
mov rcx, rdi
call fcn.140127cc4
nop
and qword [rsp + 0x30], 0
mov rdx, qword [rdi + 0x38]
cmp qword [rdi + 0x40], rdx
je 0x140127bec
and qword [rdx], 0
add qword [rdi + 0x38], 8
jmp 0x140127bfb
lea r8, [rsp + 0x30]
lea rcx, [rdi + 0x30]
call fcn.140104b0c
nop
mov rcx, qword [rdi + 0x30]
mov r14, qword [rdi + 0x38]
sub r14, rcx
sar r14, 3
dec r14
lea r14, [rcx + r14*8]
mov qword [rsp + 0x88], r14
jmp 0x140127c38
test r14, r14
jne 0x140127c44
mov esi, 0x8007000e
jmp 0x140127ca0
xor esi, esi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], esi
mov r9, r12
lea r8, [0x14012a830]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r12, rax
test rax, rax
jne 0x140127c88
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x140127c96
mov qword [r14], r12
test r15, r15
je 0x140127c93
mov qword [r15], r12
xor r14d, r14d
test r14, r14
je 0x140127ca0
add qword [rdi + 0x38], 0xfffffffffffffff8
add dword [rdi + 4], 0xffffffff
jne 0x140127cb4
and dword [rdi], 0
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov eax, esi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14012995c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov edi, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
test byte [0x1403d6fc0], 0x10
mov esi, eax
je 0x14012999b
mov r9d, eax
lea rdx, [0x1402e3d08]
mov r8d, edi
call fcn.14012c644
mov rcx, qword [rbx + 0x80]
mov r8, rdi
xor r9d, r9d
mov edx, esi
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x1401299d0
mov rax, qword [rbx]
mov r8, rbp
xor edx, edx
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x140118f85.0]
mov al, 1
jmp 0x140129a6f
test byte [0x1403d6fc0], 0x20
je 0x1401299eb
mov r9d, esi
lea rdx, [0x1402e3d58]
mov r8d, edi
call fcn.14012c644
mov rax, qword [str.x___]
lea rcx, str.x___
mov edx, 0x1c135e
mov rax, qword [rax]
call qword [case.0x140118f85.0]
prefetchw byte [rbx + 0x10]
mov rax, qword [rbx + 0x10]
mov r8d, 0x7f000
mov qword [rsp + 0x30], rax
mov edx, dword [rsp + 0x30]
mov ecx, edx
shr ecx, 0xc
dec ecx
shl ecx, 0xc
xor ecx, edx
and ecx, r8d
xor edx, ecx
mov dword [rsp + 0x30], edx
mov rcx, qword [rsp + 0x30]
lock cmpxchg qword [rbx + 0x10], rcx
je 0x140129a6d
mov ecx, eax
mov qword [rsp + 0x30], rax
shr ecx, 0xc
mov rdx, rax
dec ecx
shl ecx, 0xc
xor ecx, eax
and ecx, r8d
xor ecx, eax
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x30]
lock cmpxchg qword [rbx + 0x10], rcx
cmp rax, rdx
jne 0x140129a40
xor al, al
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14012f488
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rbp, rcx
mov qword [rsp + 0x58], rbx
cmp byte [rcx + 0x10], bl
je 0x14012f4b3
mov edi, 0x80004005
jmp 0x14012f6b8
mov eax, dword [rcx + 0x58]
cmp eax, dword [rcx + 0x54]
ja 0x14012f4d3
lea edx, [rax + 5]
add rcx, 0x48
shl rdx, 3
call fcn.140147aa8
test al, al
je 0x14012f4a9
add dword [rbp + 0x58], 5
mov ecx, 0xc28
call fcn.140261ad4
test rax, rax
je 0x14012f4f2
mov rdx, rbp
mov rcx, rax
call fcn.14012f248
mov rsi, rax
jmp 0x14012f4f4
xor esi, esi
test rsi, rsi
jne 0x14012f503
mov edi, 0x8007000e
jmp 0x14012f6b8
mov r9d, 0x1f0003
xor r8d, r8d
xor edx, edx
xor ecx, ecx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateEventExW]
mov rcx, qword [rsi + 0xc00]
mov r14, rax
test rcx, rcx
je 0x14012f534
and qword [rsi + 0xc00], rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0xc00], r14
test r14, r14
jne 0x14012f554
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x14012f562
mov rbx, rsi
xor esi, esi
mov qword [rsp + 0x58], rbx
or r14d, 0xffffffff
test rsi, rsi
je 0x14012f5ac
mov eax, r14d
lock xadd dword [rsi + 0xc24], eax
add eax, r14d
jne 0x14012f5a7
mov rcx, qword [rsi + 0xc00]
test rcx, rcx
je 0x14012f595
and qword [rsi + 0xc00], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rsi
call fcn.140261814
mov rbx, qword [rsp + 0x58]
test edi, edi
js 0x14012f672
cmp qword [rbp + 0x60], 0
jne 0x14012f5c5
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rbp + 0x60], rax
lock inc dword [rbx + 0xc24]
mov rsi, qword [rsp + 0x58]
lea r8, [0x14012feb0]
mov r9, rsi
xor edx, edx
xor ecx, ecx
lea rax, [rsi + 0xbf8]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14012f648
mov eax, r14d
lock xadd dword [rbx + 0xc24], eax
mov rbx, qword [rsp + 0x58]
add eax, r14d
jne 0x14012f641
test rbx, rbx
je 0x14012f641
mov rcx, qword [rbx + 0xc00]
test rcx, rcx
je 0x14012f62f
and qword [rbx + 0xc00], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rbx
call fcn.140261814
mov edi, 0x80004005
jmp 0x14012f672
mov qword [rsi + 0xbf0], rax
mov ecx, dword [rbp + 0x54]
mov rax, qword [rbp + 0x48]
mov qword [rax + rcx*8], rsi
mov eax, 0x3e
inc dword [rbp + 0x54]
and qword [rsp + 0x58], 0
lock xadd dword [rbp + 0x50], eax
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x14012f6b8
mov eax, r14d
lock xadd dword [rbx + 0xc24], eax
add eax, r14d
jne 0x14012f6b8
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rbx + 0xc00]
test rcx, rcx
je 0x14012f6a6
and qword [rbx + 0xc00], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rbx
call fcn.140261814
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14013dfac
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x18], 0
lea rax, [rbp - 0x18]
mov rbx, rcx
mov qword [rsp + 0x20], rax
lea rsi, fcn.140084fd0
mov dword [rbp - 0x20], 1
mov rcx, 0xffffffff80000001
mov qword [rbp - 0x28], rsi
mov r9d, 0x20019
mov byte [rbp - 0x10], 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14013e045
and dword [rbp + 0x20], eax
lea r9, [rbp - 0x30]
and dword [rbp - 0x30], eax
xor r8d, r8d
mov rdx, qword [str.SendTelemetry]
lea rax, [rbp + 0x28]
mov rcx, qword [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14013e045
mov eax, dword [rbp + 0x20]
mov dword [rbx], eax
mov byte [rbx + 4], 1
jmp 0x14013e04c
and dword [rbx], 0
mov byte [rbx + 4], 0
cmp byte [rbp - 0x10], 0
mov qword [rbp - 0x28], rsi
je 0x14013e065
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14013e065
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret

Function at 0x1401415d8
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov word [rbp - 0xc], 0x500
lea rax, [rbp - 0x18]
mov dword [rbp - 0x20], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], ebx
mov r9d, r8d
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [rbp - 0x10], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14014165d
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and dword [rbp - 0x20], ecx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp - 0x20]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402361b0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140141680
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rbp + 0x37], rax
and qword [rbp - 0x31], 0
mov rsi, rcx
and dword [rbp - 0x39], 0
lea rcx, [rbp - 0x19]
mov ebx, 0x44
xor edx, edx
mov r8d, ebx
call fcn.140238d40
mov dword [rbp - 0x29], ebx
test rsi, rsi
jne 0x140141706
mov rax, qword [str.x___]
lea rcx, str.x___
mov edx, 0x15b3c8
mov rax, qword [rax]
call qword [case.0x140118f85.0]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x1401416ff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14014187f
cmp dword [0x1403d7058], 0
je 0x140141721
mov eax, dword [0x1403c008c]
mov dword [rsi], eax
mov eax, 1
jmp 0x14014187f
and dword [rsi], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x31]
mov edx, 0x20008
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140141763
mov edx, 0x15b3c9
mov rax, qword [str.x___]
lea rcx, str.x___
mov rax, qword [rax]
call qword [case.0x140118f85.0]
xor ebx, ebx
jmp 0x140141869
mov rcx, qword [rbp - 0x31]
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea ebx, [r9 + 2]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14014178d
mov edx, 0x15b3ca
jmp 0x140141745
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x14014179f
mov edx, 0x15b3cb
jmp 0x140141745
mov ecx, dword [rbp - 0x39]
call fcn.140261ad4
mov rdi, rax
test rax, rax
jne 0x1401417b6
mov edx, 0x15b3cc
jmp 0x140141745
mov r9d, dword [rbp - 0x39]
lea rax, [rbp - 0x39]
mov rcx, qword [rbp - 0x31]
mov r8, rdi
mov edx, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1401417f6
mov edx, 0x15b3cd
mov rax, qword [str.x___]
lea rcx, str.x___
mov rax, qword [rax]
call qword [case.0x140118f85.0]
xor ebx, ebx
jmp 0x140141861
xor edx, edx
lea r9, [rbp - 0x29]
lea r8, [rbp - 0x19]
lea ecx, [rdx + 0xb]
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
jne 0x140141814
mov edx, 0x15b3ce
jmp 0x1401417db
xor r14d, r14d
lea ebx, [r14 + 1]
cmp r14d, dword [rdi]
jae 0x140141853
mov r15d, r14d
add r15, r15
mov rcx, qword [rdi + r15*8 + 8]
call qword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x140141848
mov rdx, qword [rdi + r15*8 + 8]
lea rcx, [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14014184d
add r14d, ebx
jmp 0x14014181b
mov dword [rsi], ebx
mov eax, ebx
jmp 0x140141855
mov eax, dword [rsi]
mov dword [0x1403d7058], ebx
mov dword [0x1403c008c], eax
mov rcx, rdi
call fcn.140261814
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x14014187d
and qword [rbp - 0x31], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402361b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret