joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140048230
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xf0
mov rax, qword [0x140120678]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rdi, r8
mov dword [rsp + 0x34], 1
mov rbx, rdx
mov dword [rsp + 0x30], 0
mov rsi, rcx
xor edx, edx
mov r8d, 0xa0
lea rcx, [rsp + 0x40]
call fcn.1400a20f0
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400482d0
mov dword [rsp + 0x28], eax
lea r9, str.WARN
lea r8, [0x1400cbd78]
mov qword [rsp + 0x20], rbx
lea rdx, str.__s_____s__query_key__ws__failed__ErrorCode:_ld_r_n
mov ecx, 2
call fcn.14000afc0
jmp 0x1400483b1
mov eax, dword [rsp + 0x30]
cmp eax, 0xa0
jb 0x140048308
mov dword [rsp + 0x28], eax
lea r9, str.WARN
lea r8, [0x1400cbd78]
mov qword [rsp + 0x20], rbx
lea rdx, str.__s_____s__The__ws_is_too_large__max_len_is__d_r_n
mov ecx, 2
call fcn.14000afc0
jmp 0x1400483b1
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140048366
mov dword [rsp + 0x28], eax
lea r9, str.WARN
lea r8, [0x1400cbd78]
mov qword [rsp + 0x20], rbx
lea rdx, str.__s_____s__query_value__ws__failed__ErrorCode:_ld_r_n
mov ecx, 2
call fcn.14000afc0
jmp 0x1400483b1
movzx eax, word [rsp + 0x40]
cmp ax, word [0x1400dfc00]
je 0x1400483c3
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0xa0
call fcn.1400438e0
test eax, eax
je 0x1400483c3
lea r9, str.WARN
mov dword [rsp + 0x20], 0x23300010
lea r8, [0x1400cbd78]
mov ecx, 2
lea rdx, str.__s_____s__properties_unicode_to_string_failed__ErrorCode:_ld_r_n
call fcn.14000afc0
xor r8d, r8d
lea rdx, [0x1400cd62b]
mov rcx, rdi
call fcn.1400046c0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400a0360
add rsp, 0xf0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140049890
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x140120678]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rdx, qword [str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x118], rdi
xor ebx, ebx
mov rdi, rcx
mov qword [rsp + 0x38], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140049919
mov dword [rsp + 0x28], eax
lea r9, str.ERROR
mov ebx, 0x23300010
lea r8, [0x1400cbd78]
lea rdx, str.__s_____s___0x_lx__query_bios_info_failed__ErrorCode:_ld_r_n
mov dword [rsp + 0x20], ebx
mov ecx, 3
call fcn.14000afc0
jmp 0x140049aaa
mov qword [rsp + 0x108], rbp
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x110], rsi
xor edx, edx
mov rsi, qword [rsp + 0x38]
mov r8d, 0xa0
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x30], ebx
call fcn.1400a20f0
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rbp, str.PROCESSOR_ARCHITECTURE
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400499a7
mov dword [rsp + 0x28], eax
lea r9, str.WARN
lea r8, [0x1400cbd78]
mov qword [rsp + 0x20], rbp
lea rdx, str.__s_____s__query_key__ws__failed__ErrorCode:_ld_r_n
mov ecx, 2
call fcn.14000afc0
jmp 0x140049a88
mov eax, dword [rsp + 0x30]
cmp eax, 0xa0
jb 0x1400499df
mov dword [rsp + 0x28], eax
lea r9, str.WARN
lea r8, [0x1400cbd78]
mov qword [rsp + 0x20], rbp
lea rdx, str.__s_____s__The__ws_is_too_large__max_len_is__d_r_n
mov ecx, 2
call fcn.14000afc0
jmp 0x140049a88
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140049a3d
mov dword [rsp + 0x28], eax
lea r9, str.WARN
lea r8, [0x1400cbd78]
mov qword [rsp + 0x20], rbp
lea rdx, str.__s_____s__query_value__ws__failed__ErrorCode:_ld_r_n
mov ecx, 2
call fcn.14000afc0
jmp 0x140049a88
movzx eax, word [rsp + 0x40]
cmp ax, word [0x1400dfc00]
je 0x140049a9a
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0xa0
call fcn.1400438e0
test eax, eax
je 0x140049a9a
lea r9, str.WARN
mov dword [rsp + 0x20], 0x23300010
lea r8, [0x1400cbd78]
mov ecx, 2
lea rdx, str.__s_____s__properties_unicode_to_string_failed__ErrorCode:_ld_r_n
call fcn.14000afc0
xor r8d, r8d
lea rdx, [0x1400cd62b]
mov rcx, rdi
call fcn.1400046c0
mov rsi, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x118]
test rcx, rcx
je 0x140049ac2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400a0360
add rsp, 0xf0
pop rbx
ret
Function at 0x140049b30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xf0
mov rax, qword [0x140120678]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rdx, qword [str.SOFTWAREMicrosoftWindows_NTCurrentVersion]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x118], rdi
xor ebx, ebx
mov rdi, rcx
mov qword [rsp + 0x38], rbx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140049bb9
mov dword [rsp + 0x28], eax
lea r9, str.ERROR
mov ebx, 0x23300010
lea r8, [0x1400cbd78]
lea rdx, str.__s_____s___0x_lx__query_properties_failed__ErrorCode:_ld_r_n
mov dword [rsp + 0x20], ebx
mov ecx, 3
call fcn.14000afc0
jmp 0x140049d89
mov qword [rsp + 0x108], rbp
lea rcx, [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
xor edx, edx
mov qword [rsp + 0x110], rsi
mov r8d, 0xa0
mov rsi, qword [0x1401204b0]
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x30], ebx
call fcn.1400a20f0
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov rdx, rsi
mov qword [rsp + 0x20], rbx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140049c47
mov dword [rsp + 0x28], eax
lea r9, str.WARN
lea r8, [0x1400cbd78]
mov qword [rsp + 0x20], rsi
lea rdx, str.__s_____s__query_key__ws__failed__ErrorCode:_ld_r_n
mov ecx, 2
call fcn.14000afc0
jmp 0x140049d28
mov eax, dword [rsp + 0x30]
cmp eax, 0xa0
jb 0x140049c7f
mov dword [rsp + 0x28], eax
lea r9, str.WARN
lea r8, [0x1400cbd78]
mov qword [rsp + 0x20], rsi
lea rdx, str.__s_____s__The__ws_is_too_large__max_len_is__d_r_n
mov ecx, 2
call fcn.14000afc0
jmp 0x140049d28
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 1
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140049cdd
mov dword [rsp + 0x28], eax
lea r9, str.WARN
lea r8, [0x1400cbd78]
mov qword [rsp + 0x20], rsi
lea rdx, str.__s_____s__query_value__ws__failed__ErrorCode:_ld_r_n
mov ecx, 2
call fcn.14000afc0
jmp 0x140049d28
movzx eax, word [rsp + 0x40]
cmp ax, word [0x1400dfc00]
je 0x140049d3a
mov r8, rdi
lea rcx, [rsp + 0x40]
mov edx, 0xa0
call fcn.1400438e0
test eax, eax
je 0x140049d3a
lea r9, str.WARN
mov dword [rsp + 0x20], 0x23300010
lea r8, [0x1400cbd78]
mov ecx, 2
lea rdx, str.__s_____s__properties_unicode_to_string_failed__ErrorCode:_ld_r_n
call fcn.14000afc0
xor r8d, r8d
lea rdx, [0x1400cd62b]
mov rcx, rdi
call fcn.1400046c0
mov rdx, qword [str.EditionId]
lea r8, [rdi + 0x20]
mov rcx, qword [rsp + 0x38]
call fcn.140048230
mov rdx, qword [str.ReleaseId]
lea r8, [rdi + 0x40]
mov rcx, qword [rsp + 0x38]
call fcn.140048230
mov rdx, qword [str.CurrentBuildNumber]
lea r8, [rdi + 0x60]
mov rcx, qword [rsp + 0x38]
call fcn.140048230
mov rsi, qword [rsp + 0x110]
mov rbp, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x118]
test rcx, rcx
je 0x140049da1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400a0360
add rsp, 0xf0
pop rbx
ret
Function at 0x140049dc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, r8
lea rax, [rsp + 0x38]
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov rdx, qword [str.SYSTEMCurrentControlSetServicesWUCS]
mov rbp, rcx
xor edi, edi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rdi
mov r9d, 0x20019
mov ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140049e9d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rbp
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x78], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140049e9d
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x140049e9d
mov ecx, eax
call fcn.14002d800
mov qword [rsi], rax
test rax, rax
jne 0x140049e66
mov ebx, 0x23300001
jmp 0x140049ea2
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140049e9d
mov edi, dword [rsp + 0x78]
jmp 0x140049eb2
mov ebx, 0x23300018
mov rcx, qword [rsi]
test rcx, rcx
je 0x140049eb2
call fcn.14002d7f0
mov qword [rsi], rdi
mov qword [r14], rdi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140049ec5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14004a7c0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rdx, qword [str.SYSTEMCurrentControlSetServicesWUCS]
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor edi, edi
mov byte [0x140125368], 1
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rdi
mov r9d, 0xf003f
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004a857
mov r8, qword [0x1401204d8]
mov rcx, 0xffffffff80000002
mov rdx, qword [str.SYSTEMCurrentControlSetServicesWUCS]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
cmp qword [rbx + 0x18], 0x10
mov rax, qword [rbx + 0x10]
jb 0x14004a82f
mov rbx, qword [rbx]
mov rdx, qword [0x1401204d8]
mov r9d, 3
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14004a887
mov dword [rsp + 0x28], eax
lea r9, str.ERROR
lea r8, [0x1400cbd78]
mov dword [rsp + 0x20], 0x23300017
lea rdx, str.__s_____s___0x_lx__open_jws_from_reg_failed__ret:_ld_r_n
mov ecx, 3
call fcn.14000afc0
mov edi, 0x23300017
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14004a897
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x14004c2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r12, r9
movzx r15d, r8b
mov r14, rdx
mov r10, rcx
mov r13, qword [rcx]
mov rsi, r13
mov rbx, qword [r13 + 8]
mov dil, 1
cmp byte [rbx + 0x19], 0
jne 0x14004c35e
mov rsi, rbx
test r15b, r15b
je 0x14004c333
lea rcx, [rbx + 0x20]
mov rdx, r12
call fcn.140004940
mov edi, eax
shr edi, 0x1f
xor dil, 1
jmp 0x14004c345
lea rdx, [rbx + 0x20]
mov rcx, r12
call fcn.140004940
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x14004c34f
mov rbx, qword [rbx]
jmp 0x14004c353
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
je 0x14004c314
mov r10, qword [rsp + 0x70]
mov rbx, rsi
mov rcx, rsi
test dil, dil
je 0x14004c420
cmp rsi, qword [r13]
jne 0x14004c3aa
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r12
mov r9, rsi
mov r8b, 1
lea rdx, [rsp + 0x70]
mov rcx, r10
call fcn.14004c040
mov rax, qword [rax]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
jmp 0x14004c475
cmp byte [rsi + 0x19], 0
je 0x14004c3b6
mov rbx, qword [rsi + 0x10]
jmp 0x14004c41d
mov rax, qword [rsi]
cmp byte [rax + 0x19], 0
je 0x14004c3ff
mov rax, qword [rsi + 8]
cmp byte [rax + 0x19], 0
jne 0x14004c3f1
mov rdx, rsi
nop dword [rax]
mov r8, rax
mov r9, rax
mov rcx, rdx
cmp rdx, qword [rax]
jne 0x14004c3f1
mov rbx, rax
mov rax, qword [rax + 8]
mov rdx, rbx
mov rcx, rbx
cmp byte [rax + 0x19], 0
je 0x14004c3d0
cmp byte [rbx + 0x19], 0
jne 0x14004c420
mov rbx, rax
mov rcx, rax
jmp 0x14004c420
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14004c41d
nop dword [rax]
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x14004c410
mov rcx, rbx
add rcx, 0x20
mov rdx, r12
call fcn.140004940
shr eax, 0x1f
test al, al
je 0x14004c46a
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r12
mov r9, rsi
movzx r8d, dil
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.14004c040
mov rax, qword [rax]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
jmp 0x14004c475
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14007f5a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
xor r11b, r11b
movzx ebx, cl
shl ebx, 2
nop
movzx r10d, r11b
xor r9b, r9b
add r10d, ebx
shl r10d, 2
nop
movzx eax, r9b
inc r9b
add eax, r10d
movzx ecx, byte [rax + r8]
xor byte [rdx], cl
inc rdx
cmp r9b, 4
jb 0x14007f5c0
inc r11b
cmp r11b, 4
jb 0x14007f5b0
mov rbx, qword [rsp + 8]
ret
Function at 0x14007f920
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
lea rax, [rcx + 2]
mov ebp, 4
nop dword [rax]
movzx esi, byte [rax - 2]
movzx r9d, byte [rax - 1]
movzx r8d, sil
movzx edi, byte [rax + 1]
xor r8b, r9b
movzx r11d, byte [rax]
lea rax, [rax + 4]
movzx ecx, r8b
movzx r10d, dil
shr cl, 7
add r8b, r8b
movzx ecx, cl
xor r10b, r11b
imul edx, ecx, 0x1b
movzx ebx, r10b
xor bl, sil
xor bl, r9b
xor dl, r8b
movzx r8d, r9b
xor dl, sil
xor r8b, r11b
xor dl, bl
movzx ecx, r8b
mov byte [rax - 6], dl
xor sil, dil
shr cl, 7
add r8b, r8b
movzx ecx, cl
imul edx, ecx, 0x1b
movzx ecx, r10b
shr cl, 7
add r10b, r10b
movzx ecx, cl
xor dl, r8b
xor dl, r9b
xor dl, bl
mov byte [rax - 5], dl
imul edx, ecx, 0x1b
movzx ecx, sil
shr cl, 7
add sil, sil
movzx ecx, cl
xor dl, r10b
xor dl, r11b
xor dl, bl
mov byte [rax - 4], dl
imul edx, ecx, 0x1b
xor dl, sil
xor dl, dil
xor dl, bl
mov byte [rax - 3], dl
sub rbp, 1
jne 0x14007f940
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x14007fa80
Capabilities:
Encode data using xor

Disassembly:
sub rdx, rcx
mov r8d, 0x10
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x14007fa90
ret
Function at 0x14007fab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push r12
push r15
sub rsp, 0x68
mov rax, qword [0x140120678]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r12, r8
mov r15, rdx
mov rsi, rcx
call fcn.14007fec0
mov ebx, eax
test eax, eax
je 0x14007fb08
lea r9, str.ERROR
mov dword [rsp + 0x20], eax
lea r8, [0x1400cbd78]
mov ecx, 3
lea rdx, str.__s_____s___0x_lx__UcsMPCSendEpsilon1AndDelta1___failed_r_n
call fcn.14000afc0
mov eax, ebx
jmp 0x14007fc29
xor eax, eax
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], rdi
lea rdi, [rsi + 0x1f98]
mov qword [rsp + 0x50], r14
lea r14, [rsp + 0x30]
sub r14, rsi
mov qword [rsp + 0x30], rax
lea ebp, [rax + 0x10]
mov qword [rsp + 0x38], rax
nop word [rax + rax]
movzx edx, byte [rdi - 0x30]
movzx ecx, byte [rdi + 0x10]
call fcn.140080a70
movzx edx, byte [rdi - 0x20]
movzx ebx, al
movzx ecx, byte [rdi]
call fcn.140080a70
movzx ecx, byte [rdi - 0x10]
lea rdi, [rdi + 1]
xor bl, al
xor cl, bl
mov byte [r14 + rdi - 0x1f99], cl
sub rbp, 1
jne 0x14007fb40
mov rcx, qword [rsi]
mov edx, 0x226454
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r14, qword [rsp + 0x50]
mov ebx, eax
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
test eax, eax
je 0x14007fbbe
lea r9, str.ERROR
mov dword [rsp + 0x20], eax
lea r8, [0x1400cbd78]
mov ecx, 3
lea rdx, str.__s_____s___0x_lx__SendEmptyMsg___failed_for_aes_calc_t2_r_n
call fcn.14000afc0
jmp 0x14007fc00
mov r9d, 0x10
lea r8, [rsp + 0x30]
mov rdx, r12
mov rcx, r15
call fcn.14002daa0
test eax, eax
je 0x14007fc27
lea r9, str.ERROR
mov dword [rsp + 0x20], eax
lea r8, [0x1400cbd78]
mov ecx, 3
lea rdx, str.__s_____s___0x_lx__copy_failed_for_t1_r_n
call fcn.14000afc0
mov ebx, 0x23300006
lea r9, str.ERROR
mov dword [rsp + 0x20], ebx
lea r8, [0x1400cbd78]
mov ecx, 3
lea rdx, str.__s_____s___0x_lx__UcsMPCCalcT1___failed_r_n
call fcn.14000afc0
mov eax, ebx
jmp 0x14007fc29
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a0360
add rsp, 0x68
pop r15
pop r12
pop rsi
pop rbx
ret

Function at 0x1400b4550
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400b4374
Function at 0x140139276
Capabilities:
Check for software breakpoints

Disassembly:
mov r10, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x70]
setg dl
neg r8b
not qword [rsp + 0x70]
mov r10, qword [rsp + 0x30]
add qword [rsp + 0x58], 0xffffffffbfdfe462
not word [rsp + 0x70]

Function at 0x14013ed0c
Capabilities:
Query service status

Disassembly:
bswap ecx
add qword [rsp], 0xffffffffffffcf7b
and rcx, rcx
not rcx
and ecx, 0x38a15552
push r14
jae 0x14014955b

Function at 0x1401a7ec7
Capabilities:
Check for software breakpoints

Disassembly:
sub bpl, byte [rsp + 0x2d]
neg rbx
jne 0x140310bc2

Function at 0x140302dc5
Capabilities:
Link function at runtime on windows
Link many functions at runtime

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, str.InitializeSRWLock
mov rcx, rbx
mov qword [0x140125960], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, str.AcquireSRWLockExclusive
mov rcx, rbx
mov qword [0x140125968], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, str.TryAcquireSRWLockExclusive
mov rcx, rbx
mov qword [0x140125970], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, str.ReleaseSRWLockExclusive
mov qword [0x140125978], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, str.SleepConditionVariableSRW
mov rcx, rbx
mov qword [0x140125980], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, str.CreateThreadpoolWork
mov rcx, rbx
mov qword [0x140125988], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, str.SubmitThreadpoolWork
mov rcx, rbx
mov qword [0x140125990], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, str.CloseThreadpoolWork
mov rcx, rbx
mov qword [0x140125998], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, [0x1400f2678]
mov rcx, rbx
mov qword [0x1401259a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, [0x1400f2688]
mov rcx, rbx
mov qword [0x1401259a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
lea rdx, [0x1400f2698]
mov rcx, rbx
mov qword [0x1401259b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor rax, qword [0x140120678]
mov qword [0x1401259b8], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
sub r15b, 0x5b
not di
xor qword [rsp], 0x1ef56391
and rdi, rbx
je fcn.14032a2b5
and r15, qword [rsp]
mov ebx, r15d
mov rax, qword [rsp + 0x38]
push rbp
push rdi
test ebx, 0x225d7c30
push rbx
movabs rdi, 0x71a724bd44cb5e9f
jo 0x140083e98
movabs rbp, 0x7200247c0d3e100d
lea rax, [rax + 1]
jns 0x14013f500

Function at 0x14030f9ab
Capabilities:
Query or enumerate registry value

Disassembly:
or ecx, ecx
or cl, 0x9c
mov rcx, qword [rsp + 0x38]
call fcn.1402493c4
Function at 0x140360269
Capabilities:
Query or enumerate registry value

Disassembly:
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140047d4d
lea rdx, str.__s_____s___0x_lx__query_manufacturer_for_value_failed__ErrorCode:_ld_r_n
mov dword [rsp + 0x28], eax
mov ebx, 0x23300009
lea r9, str.ERROR
mov dword [rsp + 0x20], ebx
lea r8, [0x1400cbd78]
mov ecx, 3
call fcn.14000afc0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140047d5d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
or r11w, 0x4f41
jbe 0x140047d17
xor r11d, r11d
add qword [rsp + 0x40], 0x1de2c5
add qword [rsp], 0xfffffffffff10988
mov rdx, rbx
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + r11]
test r11b, r11b
mov qword [rsp + 0x40], rbx
call fcn.1402955a5
setae cl
mov rcx, qword [rsp]
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.140423627
mov dword [rsp + 0x40], 0xbb057f5
call fcn.1403b2ebc

Function at 0x1403620bd
Capabilities:
Execute syscall

Disassembly:
sets r13b
mov r8, qword [rsp + 0x20]
or r13w, word [rsp + 0x6b]
neg r9d
test dword [rsp + 0x51], r13d
movzx r10w, dil

Function at 0x14037344c
Capabilities:
Encode data using xor

Disassembly:
out dx, al
dec dword [rbx + rcx*4 + 0x5c]
mov r11, qword [rsp + 0x48]
mov r11, qword [rsp + 0x48]
sub word [rsp + 0x30], 0x44bb
mov r8, qword [rsp + 0x30]
and al, 0x30
call fcn.140133a00
xor eax, dword [rdi - 0x3bcb9c37]
jge 0x140373449
jl 0x14037345a
test eax, 0xcf8302df
push rax
int3

Function at 0x1403848fc
Capabilities:
Encode data using xor

Disassembly:
call fcn.1401c7ab4
sbb dword [rcx + 0x1f], 0x2e
mov word gs:[rbp - 0x54cfa37e], ds
test ecx, eax
xor dword [rax - 0x5c82698b], eax
lea edi, [rsi + 0x34]
jp fcn.1403848fc
in eax, 0xd3
xchg edx, eax
mov gs, word ss:[rbp + rcx*4 + 0x5431c4c2]
mov ecx, 0xd1a37f3e
int 0x21
or r14, qword ss:[rax]
test r12, rbx
pop rsp
invalid

Function at 0x14038cbfd
Capabilities:
Query service status

Disassembly:
jb 0x14014954e
add qword [rsp + 0x10], 0xffffffffbfd02c85
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
ret

Function at 0x1403c2a5e
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 0x28]
or dword [rsp + 0x20], 0x13d48eb
movabs r8, 0x168a4178354d7e63
add dword [rsp + 0x20], ebp
mov rbp, qword [rsp + 0x40]
lea r8, [r8*4 + 0x664a5ec2]
seto byte [rsp + 0x20]
xor r8, 0x47557008
sets byte [rsp + 0x20]
jb 0x1403c2a63
add qword [rsp + 0x48], 0xffffffffbfde8dfa
not r8d
not r8b
mov r8, qword [rsp + 0x10]
mov word [rsp + 0x20], 0x3f21
sub byte [rsp + 0x20], 0x5d
call fcn.1402e29d7

Function at 0x1403d0be2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg qword [rsp + 0x20]
add qword [rsp], 0xffffffffbfd57fcd
mov rdx, qword [rsp + 0x68]
call fcn.140330315

Function at 0x1403d0c1f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rsp + 0x20]
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.1404ef52c
ja 0x1401a2702