joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 4], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0xc], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x10], eax
movzx eax, byte [rdx + 0x14]
mov byte [rcx + 0x14], al
add rcx, 0x18
add rdx, 0x18
call fcn.140006500
movzx eax, byte [rsi + 0x38]
mov byte [rdi + 0x38], al
mov eax, dword [rsi + 0x3c]
mov dword [rdi + 0x3c], eax
movzx eax, byte [rsi + 0x40]
mov byte [rdi + 0x40], al
mov eax, dword [rsi + 0x48]
mov dword [rdi + 0x48], eax
mov eax, dword [rsi + 0x4c]
mov dword [rdi + 0x4c], eax
mov eax, dword [rsi + 0x50]
mov dword [rdi + 0x50], eax
mov eax, dword [rsi + 0x54]
mov dword [rdi + 0x54], eax
mov eax, dword [rsi + 0x58]
mov dword [rdi + 0x58], eax
movzx eax, byte [rsi + 0x5c]
mov byte [rdi + 0x5c], al
movzx eax, byte [rsi + 0x5d]
mov byte [rdi + 0x5d], al
movzx eax, byte [rsi + 0x5e]
mov byte [rdi + 0x5e], al
lea rcx, [rdi + 0x60]
lea rdx, [rsi + 0x60]
call fcn.140006500
movzx eax, byte [rsi + 0x80]
mov byte [rdi + 0x80], al
mov eax, dword [rsi + 0x84]
mov dword [rdi + 0x84], eax
movzx eax, byte [rsi + 0x88]
mov byte [rdi + 0x88], al
movzx eax, byte [rsi + 0x89]
mov byte [rdi + 0x89], al
movzx eax, byte [rsi + 0x8a]
mov byte [rdi + 0x8a], al
movzx eax, byte [rsi + 0x8b]
mov byte [rdi + 0x8b], al
lea rbx, [rdi + 0x98]
mov qword [rsp + 0x38], rbx
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
lea ecx, [rax + 0x30]
call fcn.140052e38
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
movss xmm0, dword [rsi]
movss xmm1, dword [rsi + 8]
cmp byte [rsi + 0x38], 0
je 0x140049b68
mulss xmm0, dword [0x1400955d8]
mulss xmm0, xmm1
cvttss2si ecx, xmm0
not ecx
mov eax, ecx
sar eax, 1
or ecx, eax
mov eax, ecx
sar eax, 2
or ecx, eax
mov eax, ecx
sar eax, 4
or ecx, eax
mov eax, ecx
sar eax, 8
or ecx, eax
mov edx, ecx
sar edx, 0x10
or edx, ecx
inc edx
jmp 0x140049b78
mulss xmm0, dword [0x1400953c8]
mulss xmm0, xmm1
cvttss2si edx, xmm0
lea rcx, [rdi + 0xa8]
call fcn.14004ae40
nop
movss xmm0, dword [rsi + 0x84]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x140049ba2
call fcn.14007c8f0
movss dword [rdi + 0x90], xmm0
movss xmm1, dword [0x14009540c]
mov rcx, rdi
call fcn.140049d40
nop
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140059494
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140059327
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140059327
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140059327
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140059327
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140059327
cmp dword [rcx + 0x84], 0xe
jbe 0x140059327
cmp dword [rcx + 0xf8], 0
je 0x140059327
mov ecx, ebx
call fcn.1400593c8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400591b8
cmp dword [rbp + 0x20], 0
je 0x140059374
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14005937c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400592c0
Function at 0x18001eb10
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov eax, 8
imul rax, rax, 0
lea rcx, [0x1800c33e0]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x60], 0x48
mov byte [rsp + 0x61], 0xb8
mov byte [rsp + 0x62], 0x91
mov byte [rsp + 0x63], 0x67
mov byte [rsp + 0x64], 0x2c
mov byte [rsp + 0x65], 0x58
mov byte [rsp + 0x66], 0xee
mov byte [rsp + 0x67], 0xd1
mov byte [rsp + 0x68], 0x7b
mov byte [rsp + 0x69], 0x41
mov byte [rsp + 0x70], 0x48
mov byte [rsp + 0x71], 0xb8
mov byte [rsp + 0x72], 0xb7
mov byte [rsp + 0x73], 0x88
mov byte [rsp + 0x74], reloc.WS2_32.dll_send
mov byte [rsp + 0x75], 0xe3
mov byte [rsp + 0x76], 0x37
mov byte [rsp + 0x77], 0xcf
mov byte [rsp + 0x78], 0x24
mov byte [rsp + 0x79], 0xb0
movabs rax, 0x9199674fa69ae42d
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x20], 0
mov r8d, 0xa
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18001ec11
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
jmp 0x18001ebe9
mov r8d, 0xa
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18001ec39
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
jmp 0x18001ec11
mov rax, qword [rsp + 0x28]
add rax, 0x11
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0x40
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
jmp 0x18001eca7
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x48], rax
je 0x18001ece9
mov eax, dword [rsp + 0x20]
movzx eax, byte [rsp + rax + 0x80]
mov rcx, qword [rsp + 0x48]
movzx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x48]
mov byte [rcx], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 7
mov dword [rsp + 0x20], eax
jmp 0x18001ec9a
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x38]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180084a40
add rsp, 0x98
ret
Function at 0x140008c20
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, 1
mov ecx, 0xff
cpuid
shr edx, 0x1c
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x24], ebx
test dl, 1
jne 0x140008c6a
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400594d0
add rsp, 0x70
pop rbx
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, byte [rsp + 0x26]
cmp eax, dword [rsp + 0x50]
setg al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400594d0
add rsp, 0x70
pop rbx
ret
Function at 0x14000aa10
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
cmp byte [0x140069ff8], 0
je 0x14000aa39
movzx eax, byte [0x140069ffb]
jmp 0x14000ac23
lea rcx, [0x14000b080]
call fcn.1400599d8
cmp qword [0x14006a010], 0
jne 0x14000ac13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x14000abf7
xor ebp, ebp
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov edi, 0xffffffff
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x14000ac02
lea rax, [0x14006a018]
mov qword [rsp + 0x20], rax
lea r9, [0x14005dbc8]
xor edx, edx
lea r8d, [rbp + 1]
lea rcx, [0x14005dbd8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000ac02
mov rax, qword [0x14006a018]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x18]
lea ecx, [rbp + 0x18]
call fcn.1400594f8
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000ab21
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rbp
mov dword [rbx + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000ac43
jmp 0x14000ab24
mov rbx, rbp
mov qword [rsp + 0x60], rbx
test rbx, rbx
je 0x14000ac38
lea rax, [0x14006a010]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, qword [0x14006a018]
call rsi
mov esi, eax
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x14000ab9f
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000ab80
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000ab92
call fcn.1400594f0
mov qword [rbx + 8], rbp
mov edx, 0x18
mov rcx, rbx
call fcn.1400594f0
test esi, esi
js 0x14000abe4
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
mov rcx, qword [0x14006a010]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x14000ac13
mov rcx, qword [0x14006a010]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x14006a018]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov byte [0x140069ffb], 0
xor al, al
jmp 0x14000ac1c
call qword [sym.imp.ole32.dll_CoUninitialize]
mov byte [0x140069ffb], bpl
xor al, al
jmp 0x14000ac1c
mov byte [0x140069ffb], 1
mov al, 1
mov byte [0x140069ff8], 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x8007000e
call fcn.140059210
nop
mov ecx, 0x8007000e
call fcn.140059210
int3
Function at 0x14000b0d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov r9, rbx
mov qword [rsp + 0x30], 0
mov r8d, 0x104
mov qword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000b14a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14000b14a
xor al, al
jmp 0x14000b14c
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400594d0
add rsp, 0x160
pop rbx
ret

Function at 0x14000b250
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x1250
call fcn.140059db0
sub rsp, rax
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rsp + 0x1240], rax
mov r14, rcx
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000b30d
mov ebp, dword [rsp + 0x20]
xor ebx, ebx
shr ebp, 2
test ebp, ebp
je 0x14000b30d
lea rsi, [rsp + 0x30]
nop dword [rax + rax]
mov r8d, dword [rsi]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000b303
mov r9d, 0x104
lea r8, [rsp + 0x1030]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x14000b2fa
mov rdx, r14
lea rcx, [rsp + 0x1030]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000b337
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add rsi, 4
cmp ebx, ebp
jb 0x14000b2b0
xor al, al
mov rcx, qword [rsp + 0x1240]
xor rcx, rsp
call fcn.1400594d0
lea r11, [rsp + 0x1250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14000b30f
Function at 0x14000c4b0
Capabilities:
Reference wmi statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rbp + 0x47], rax
call fcn.14000aa10
test al, al
jne 0x14000c4f8
lea rdx, str.Failed_to_initialize_WMI._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140046130
xor al, al
jmp 0x14000c6b4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2f], xmm0
mov qword [rbp + 0x3f], rax
movups xmmword [rbp - 9], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 7], xmm1
lea r8d, [rax + 0xc]
lea rdx, str.Manufacturer
lea rcx, [rbp - 9]
call fcn.140047560
nop
lea rax, [rbp - 9]
mov qword [rbp - 0x19], rax
lea rax, [rbp + 0x17]
mov qword [rbp - 0x11], rax
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x17]
call fcn.140044350
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov r8d, 0x1d
lea rdx, str.SELECT__FROM_Win32_BaseBoard
lea rcx, [rbp - 0x39]
call fcn.140047560
nop
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x2f]
call fcn.14000ac50
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 7
jbe 0x14000c5bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c5ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c5ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400594f0
movdqa xmm0, xmmword [0x140060df0]
movdqu xmmword [rbp - 0x29], xmm0
xor eax, eax
mov word [rbp - 0x39], ax
lea rcx, [rbp + 0x17]
call fcn.1400459e0
nop
lea r9, [fcn.140007ff0]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp - 9]
call fcn.1400596e0
mov rdi, qword [rbp + 0x37]
mov rcx, qword [rbp + 0x2f]
cmp rcx, rdi
je 0x14000c63b
lea rbx, [rcx + 8]
cmp dword [rbx - 8], 0
jne 0x14000c62a
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000c619
mov rcx, qword [rbx]
lea rdx, str.Microsoft_Corporation
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000c6a1
add rbx, 0x28
lea rax, [rbx - 8]
cmp rax, rdi
jne 0x14000c606
mov rcx, qword [rbp + 0x2f]
xor bl, bl
test rcx, rcx
je 0x14000c6b1
mov rdx, qword [rbp + 0x37]
call fcn.140047a90
mov rcx, qword [rbp + 0x3f]
mov r8, qword [rbp + 0x2f]
sub rcx, r8
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*4]
shl rdx, 3
mov rax, r8
cmp rdx, 0x1000
jb 0x14000c6a9
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c6a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov bl, 1
mov rcx, qword [rbp + 0x2f]
jmp 0x14000c63d
mov rcx, r8
call fcn.1400594f0
movzx eax, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400594d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400119f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x450
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, r8
mov dword [rsp + 0x3c], 1
mov rsi, rdx
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x400
mov rdi, r9
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 0x400
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140011ae6
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140011adb
mov r8, qword [rsp + 0x490]
lea rax, [rsp + 0x40]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140011ac3
inc rax
test ecx, ecx
jne 0x140011ab0
test edx, edx
jne 0x140011adb
lea rdx, [0x14005dcff]
mov rcx, rsi
call fcn.140040f20
mov rax, qword [r14]
inc byte [rax]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400594d0
mov rbx, qword [rsp + 0x478]
add rsp, 0x450
pop r14
pop rdi
pop rsi
ret
Function at 0x14003d610
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r14d, r14d
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x38]
mov dword [rsp + 0x30], r14d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], r14d
mov rdx, qword [rbx]
mov esi, r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14003d737
mov rbp, qword [rbx + 8]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rdx, rbp
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003d737
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rbx, rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov rdx, rbp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r9d, r14d
cmp dword [rbx], r14d
jbe 0x14003d733
mov r8d, dword [rbx + 0x10]
mov edx, r14d
test r8d, r8d
je 0x14003d72b
mov eax, r9d
lea rcx, [rax + rax*8]
lea r10, [rcx*4]
nop
mov eax, edx
lea rcx, [rax + rax*4]
mov eax, r8d
lea rcx, [r10 + rcx*4]
cmp byte [rcx + rbx + 0x14], 3
jne 0x14003d722
test rdi, rdi
je 0x14003d720
mov rax, qword [rcx + rbx + 0x18]
mov qword [rdi + 8], rax
mov eax, dword [rcx + rbx + 0x20]
mov qword [rdi], rax
add rdi, 0x10
mov eax, dword [rbx + 0x10]
inc esi
inc edx
mov r8d, eax
cmp edx, eax
jb 0x14003d6f0
inc r9d
cmp r9d, dword [rbx]
jb 0x14003d6d4
mov eax, esi
jmp 0x14003d739
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400594d0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140043f40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x38
cmp qword [rdx + 0x18], 0xf
mov r10, rdx
mov r11, qword [rdx + 0x10]
jbe 0x140043f55
mov r10, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x140043f99
mov qword [rsp + 0x30], rbx
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rbx
cmp r8, r11
jb 0x140043f80
mov rbx, qword [rsp + 0x30]
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.140046dc0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140043fb9
add rax, 0x30
add rsp, 0x38
ret
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3

Function at 0x140044f00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
movabs rax, 0xcbf29ce484222325
sar r8, 1
mov r9d, 0
add r8, r8
je 0x140044f44
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140044f30
ret

Function at 0x140045150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140045184
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140045170
ret

Function at 0x140046780
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov ecx, 0xe0
call fcn.1400594f8
mov rbx, rax
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
movups xmmword [rax + 0x20], xmm0
mov qword [rax + 0x30], rsi
mov qword [rax + 0x38], 0xf
mov byte [rax + 0x20], sil
movups xmmword [rax + 0x40], xmm0
mov qword [rax + 0x50], rsi
mov qword [rax + 0x58], 0xf
mov byte [rax + 0x40], sil
movups xmmword [rax + 0x60], xmm0
mov qword [rax + 0x70], rsi
mov qword [rax + 0x78], 0xf
mov byte [rax + 0x60], sil
movups xmmword [rax + 0x80], xmm0
mov qword [rax + 0x90], rsi
mov qword [rax + 0x98], 0xf
mov byte [rax + 0x80], sil
movups xmmword [rax + 0xa0], xmm0
mov qword [rax + 0xb0], rsi
mov qword [rax + 0xb8], 0xf
mov byte [rax + 0xa0], sil
movups xmmword [rax + 0xc0], xmm0
mov qword [rax + 0xd0], rsi
mov qword [rax + 0xd8], 0xf
mov byte [rax + 0xc0], sil
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
nop
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140046ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov r10, rdx
mov r11, qword [rdx + 0x10]
jbe 0x140046cb7
mov r10, qword [rdx]
xor ebx, ebx
movabs r9, 0xcbf29ce484222325
mov r8d, ebx
test r11, r11
je 0x140046cf9
mov qword [rsp + 0x40], rdi
movabs rdi, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rdi
cmp r8, r11
jb 0x140046ce0
mov rdi, qword [rsp + 0x40]
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.140046dc0
cmp qword [rax + 8], rbx
setne bl
mov rax, rbx
add rsp, 0x30
pop rbx
ret