joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140063e20
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x140063e3d
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402c5760
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov r8, qword [rbx + 0x70]
test r8, r8
je 0x140063e63
mov rcx, qword [rbx + 0x68]
lea r8, [r8*4]
xor edx, edx
call fcn.1402c5760
mov rax, qword [rbx + 0x48]
mov dword [rax], 0x67452301
mov rax, qword [rbx + 0x48]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rbx + 0x48]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rbx + 0x48]
mov dword [rax + 0xc], 0x10325476
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x10], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
Function at 0x140066690
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x1400666ad
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402c5760
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x48]
mov dword [rax], 0xc1059ed8
mov rax, qword [rbx + 0x48]
mov dword [rax + 4], 0x367cd507
mov rax, qword [rbx + 0x48]
mov dword [rax + 8], 0x3070dd17
mov rax, qword [rbx + 0x48]
mov dword [rax + 0xc], 0xf70e5939
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x10], 0xffc00b31
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x14], 0x68581511
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x18], 0x64f98fa7
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x1c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret

Function at 0x140066720
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x14006673d
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402c5760
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x48]
mov dword [rax], 0x6a09e667
mov rax, qword [rbx + 0x48]
mov dword [rax + 4], 0xbb67ae85
mov rax, qword [rbx + 0x48]
mov dword [rax + 8], 0x3c6ef372
mov rax, qword [rbx + 0x48]
mov dword [rax + 0xc], 0xa54ff53a
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x10], 0x510e527f
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x14], 0x9b05688c
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x18], 0x1f83d9ab
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x1c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret
Function at 0x14006a700
Capabilities:
Hash data using sha384

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x14006a71d
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402c5760
xor eax, eax
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x48]
mov qword [rax], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x14006a7c0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x14006a7dd
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402c5760
xor eax, eax
movabs rcx, 0x6a09e667f3bcc908
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x48]
mov qword [rax], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x14007bd00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rbx, rdx
mov rdi, rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
mov rax, qword [rdx]
test byte [rax], 0x80
mov esi, ecx
movzx eax, r8b
cmovne esi, eax
mov qword [rdi], rcx
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rcx
mov cl, 1
call fcn.14001d0b0
mov qword [rdi + 0x18], rax
xor edx, edx
mov rcx, rdi
call fcn.1400bf6b0
mov rdx, qword [rbx + 8]
mov rcx, rdi
call fcn.1400bf6b0
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x48], rcx
mov rax, qword [rdi + 8]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
cmp rax, rcx
cmovae r8, rdx
mov r8, qword [r8]
mov rdx, qword [rbx]
mov rcx, qword [rdi]
call fcn.1402bd1f0
nop
xor al, al
mov r9, qword [rdi + 8]
test r9, r9
je 0x14007bdd2
nop word [rax + rax]
mov rdx, qword [rdi]
movzx r8d, byte [rdx + r9 - 1]
movzx ecx, r8b
add cl, cl
or cl, al
mov byte [rdx + r9 - 1], cl
movzx eax, r8b
shr al, 7
dec r9
jne 0x14007bdb0
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
xor byte [rcx + rax - 1], sil
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b4eb0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx]
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call qword [rax]
cmp rsi, 0x10
jne 0x1400b4f52
mov rax, qword [rbx + 8]
mov dword [rax], 0x61707865
mov eax, dword [rdi]
mov rcx, qword [rbx + 8]
mov dword [rcx + 4], eax
mov eax, dword [rdi + 4]
mov rcx, qword [rbx + 8]
mov dword [rcx + 8], eax
mov eax, dword [rdi + 8]
mov rcx, qword [rbx + 8]
mov dword [rcx + 0xc], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0xc]
mov dword [rcx + 0x10], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x14], 0x3120646e
mov rax, qword [rbx + 8]
mov dword [rax + 0x28], 0x79622d36
mov rcx, qword [rbx + 8]
mov eax, dword [rdi]
mov dword [rcx + 0x2c], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 4]
mov dword [rcx + 0x30], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 8]
mov dword [rcx + 0x34], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0xc]
mov dword [rcx + 0x38], eax
jmp 0x1400b4fc7
cmp rsi, 0x20
jne 0x1400b4fd2
mov rax, qword [rbx + 8]
mov dword [rax], 0x61707865
mov eax, dword [rdi]
mov rcx, qword [rbx + 8]
mov dword [rcx + 4], eax
mov eax, dword [rdi + 4]
mov rcx, qword [rbx + 8]
mov dword [rcx + 8], eax
mov eax, dword [rdi + 8]
mov rcx, qword [rbx + 8]
mov dword [rcx + 0xc], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0xc]
mov dword [rcx + 0x10], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x14], 0x3320646e
mov rax, qword [rbx + 8]
mov dword [rax + 0x28], 0x79622d32
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0x10]
mov dword [rcx + 0x2c], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0x14]
mov dword [rcx + 0x30], eax
mov eax, dword [rdi + 0x18]
mov rcx, qword [rbx + 8]
mov dword [rcx + 0x34], eax
mov rdx, qword [rbx + 8]
mov eax, dword [rdi + 0x1c]
mov dword [rdx + 0x38], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x3c], 0x6b206574
xor eax, eax
lea rdx, [rsp + 0x20]
mov r8d, 8
mov dword [rsp + 0x21], eax
mov word [rsp + 0x25], ax
mov byte [rsp + 0x27], al
mov rax, qword [rbx]
mov rcx, rbx
mov byte [rsp + 0x20], 0
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b6290
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r9d, r9d
nop dword [rax + rax]
mov eax, dword [r9 + rdx]
add r9, 4
mov r8d, eax
rol eax, 8
and eax, 0xff00ff
ror r8d, 8
and r8d, 0xff00ff00
or r8d, eax
mov rax, qword [rcx + 0x48]
mov dword [r9 + rax - 4], r8d
cmp r9, 0x10
jne 0x1400b62b0
xor r8d, r8d
mov rax, qword [rcx + 0x48]
mov rdx, qword [rcx + 8]
add r8, 4
mov eax, dword [r8 + rax - 4]
mov dword [r8 + rdx - 4], eax
cmp r8, 0x10
jne 0x1400b62e3
mov r9, r8
lea r10, [0x14034ace0]
nop dword [rax]
mov rax, qword [rcx + 8]
mov edx, dword [r9 + rax - 0x10]
lea r8, [r9 + rax]
add r9, 4
add edx, dword [r8 - 4]
mov eax, edx
shr edx, 3
and eax, 7
mov eax, dword [r10 + rax*4]
xor eax, edx
mov dword [r8], eax
cmp r9, 0x400
jne 0x1400b6310
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx + 8]
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 0x164]
add r8, 4
add dword [rdx], eax
cmp r8, 0x5c
jne 0x1400b6350
mov rax, qword [rcx + 8]
mov r10d, dword [rax + 0xec]
mov r9d, dword [rax + 0x84]
btr r10d, 0x17
or r10d, 0x1000001
xor r8d, r8d
nop dword [rax]
mov rdx, qword [rcx + 8]
btr r9d, 0x17
add r8, 4
mov eax, dword [rdx + r8 - 4]
add r9d, r10d
and eax, 0xffffff
xor eax, r9d
mov dword [rdx + r8 - 4], eax
cmp r8, 0x400
jne 0x1400b6390
mov r8, qword [rcx + 8]
movzx edx, r9b
mov eax, dword [r8 + rdx*4]
mov ebx, dword [r8]
xor eax, r9d
movzx r10d, al
mov r9d, r10d
lea r11, [r10*4]
mov eax, dword [r11 + r8]
mov dword [r8], eax
mov r8d, 1
nop dword [rax]
mov rdx, qword [rcx + 8]
xor r9, r8
inc r8
mov eax, dword [rdx + r8*4 - 4]
mov dword [r11 + rdx], eax
mov rdx, qword [rcx + 8]
mov eax, dword [rdx + r9*4]
xor eax, r10d
movzx r10d, al
mov r9d, r10d
lea r11, [r10*4]
mov eax, dword [r11 + rdx]
mov dword [rdx + r8*4 - 4], eax
cmp r8, 0x100
jne 0x1400b63f0
mov rax, qword [rcx + 8]
lea rdx, [rsp + 0x20]
mov r8d, 8
mov dword [rax + r10*4], ebx
xor eax, eax
mov qword [rcx + 0x88], 0
mov dword [rsp + 0x21], eax
mov word [rsp + 0x25], ax
mov byte [rsp + 0x27], al
mov rax, qword [rcx]
mov byte [rsp + 0x20], 0
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0x30
pop rbx
ret
Function at 0x1400b6480
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx]
mov rdx, r8
call qword [rax + 0x38]
test al, al
jne 0x1400b64f5
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rax + 8]
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000e820
lea rdx, [0x140414fc0]
lea rcx, [rsp + 0x28]
call fcn.1402c4a18
nop
xor edx, edx
nop word [rax + rax]
mov rax, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x28]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x10
jne 0x1400b6500
mov eax, dword [rsi]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x28]
mov dword [rax + 0x10], ecx
mov rcx, qword [rbx + 0x28]
mov eax, dword [rcx + 0x10]
xor dword [rcx], eax
mov rdx, qword [rbx + 0x28]
mov eax, dword [rsi + 4]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
xor dword [rdx + 8], ecx
mov rax, qword [rbx + 0x28]
mov r15d, dword [rax]
mov esi, dword [rax + 4]
mov ebp, dword [rax + 8]
mov edi, dword [rax + 0xc]
mov r14d, dword [rax + 0x10]
xor r12d, r12d
nop word [rax + rax]
mov ecx, edi
ror ecx, 8
and ecx, 0xff00ff00
mov eax, edi
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x68]
mov dword [r12 + rax], ecx
lea r8d, [r14 + rdi]
add edi, ebp
add ebp, esi
add esi, r15d
mov rdx, qword [rbx + 8]
movzx ecx, sil
shr esi, 8
mov r9d, dword [rdx + rcx*4]
xor r9d, esi
movzx ecx, bpl
shr ebp, 8
mov r10d, dword [rdx + rcx*4]
xor r10d, ebp
movzx ecx, dil
shr edi, 8
mov r11d, dword [rdx + rcx*4]
xor r11d, edi
movzx ecx, r8b
shr r8d, 8
mov r14d, dword [rdx + rcx*4]
xor r14d, r8d
mov ecx, r11d
ror ecx, 8
and ecx, 0xff00ff00
mov eax, r11d
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x68]
mov dword [rax + r12 + 4], ecx
lea r8d, [r15 + r11]
add r11d, r10d
add r10d, r9d
add r9d, r14d
mov rdx, qword [rbx + 8]
movzx ecx, r9b
shr r9d, 8
mov esi, dword [rdx + rcx*4]
xor esi, r9d
movzx ecx, r10b
shr r10d, 8
mov ebp, dword [rdx + rcx*4]
xor ebp, r10d
movzx ecx, r11b
shr r11d, 8
mov edi, dword [rdx + rcx*4]
xor edi, r11d
movzx ecx, r8b
shr r8d, 8
mov r15d, dword [rdx + rcx*4]
xor r15d, r8d
add r12, 8
cmp r12, 0x20
jne 0x1400b6580
mov rax, qword [rbx + 0x28]
mov dword [rax], r15d
mov rax, qword [rbx + 0x28]
mov dword [rax + 4], esi
mov rax, qword [rbx + 0x28]
mov dword [rax + 8], ebp
mov rax, qword [rbx + 0x28]
mov dword [rax + 0xc], edi
mov rax, qword [rbx + 0x28]
mov dword [rax + 0x10], r14d
mov qword [rbx + 0x88], 0
mov rdx, qword [rbx + 0x70]
mov rcx, rbx
call fcn.1400b6120
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400b6a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
xor r8d, r8d
xor ecx, ecx
mov qword [rbp - 0x3c], rax
mov dword [rbp - 0x34], eax
cpuid
mov dword [rbp - 0x40], r8d
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x34], edx
mov dl, 1
mov ecx, r8d
mov dword [rbp - 0x20], 0x756e6547
mov dword [rbp - 0x1c], 0x6c65746e
mov dword [rbp - 0x18], 0x49656e69
mov dword [rbp - 0x30], 0x68747541
mov dword [rbp - 0x2c], 0x444d4163
mov dword [rbp - 0x28], 0x69746e65
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x3c], ebx
nop word [rax + rax]
mov eax, dword [rbp + rcx - 0x20]
cmp dword [rbp + rcx - 0x3c], eax
sete al
add rcx, 4
and dl, al
cmp rcx, 0xc
jne 0x1400b6b00
test dl, dl
je 0x1400b6b38
xor ecx, ecx
mov eax, 1
cpuid
shr ebx, 8
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x38], ecx
movzx eax, bl
mov dword [rbp - 0x34], edx
shl eax, 3
jmp 0x1400b6b7c
mov cl, 1
nop word [rax + rax]
mov eax, dword [rbp + r8 - 0x30]
cmp dword [rbp + r8 - 0x3c], eax
sete al
add r8, 4
and cl, al
cmp r8, 0xc
jne 0x1400b6b40
test cl, cl
je 0x1400b6b77
mov eax, 0x80000005
xor ecx, ecx
cpuid
mov dword [rbp - 0x40], eax
movzx eax, cl
mov dword [rbp - 0x3c], ebx
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x34], edx
jmp 0x1400b6b7c
mov eax, 0x20
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400cb230
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x68]
mov rdi, r8
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x1400cb28e
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov dword [rdi], eax
mov al, 1
add rsp, 0x40
pop rdi
ret
Function at 0x1400cb6c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [0x1404310b0], 0
je 0x1400cb822
lea rcx, str.SeBackupPrivilege
call fcn.140100af0
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [rsp + 0x30]
call fcn.1400cf300
mov rsi, rax
test rax, rax
je 0x1400cb824
call fcn.1400ceaa0
mov rdi, rax
cmp qword [0x140430bd8], 0
jne 0x1400cb76d
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueryKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140430bd8], rax
test rax, rax
jne 0x1400cb76d
xor ebx, ebx
jmp 0x1400cb790
mov ecx, 0xa8
call fcn.1402bcb4c
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400cb78e
mov rcx, rax
call fcn.1400d00d0
mov rbx, rax
jmp 0x1400cb790
xor ebx, ebx
mov rdx, 0xffffffff80000002
mov rcx, rbx
call fcn.1400d05f0
mov rdx, 0xffffffff80000003
mov rcx, rbx
call fcn.1400d05f0
mov rcx, rsi
call fcn.1400cb850
cmp qword [0x1404310b0], 0
jbe 0x1400cb7e2
test rdi, rdi
je 0x1400cb7cd
mov rcx, rdi
call fcn.1400cebd0
mov rcx, rsi
call fcn.1400cf490
mov rcx, rbx
call fcn.1400d0270
call fcn.1400cbd50
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
test rbx, rbx
je 0x1400cb801
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
test rdi, rdi
je 0x1400cb813
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
cmp qword [0x1404310b0], 0
jbe 0x1400cb822
call fcn.1400cc000
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400ceaa0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x258
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str.AppCompatProgramsAmcache.hve
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.1402bf098
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.1400ce880
test al, al
jne 0x1400ceb11
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0x258
ret
mov qword [rsp + 0x260], rbx
mov ecx, 0x20
mov qword [rsp + 0x268], rbp
mov qword [rsp + 0x250], rsi
call fcn.1402bcb4c
mov rbx, rax
test rax, rax
je 0x1400ceb5e
lea rax, vtable.CommunityRemnantsAmcache.0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx], rax
mov dword [rbx + 0x18], 0
jmp 0x1400ceb60
xor ebx, ebx
mov rsi, qword [rsp + 0x28]
mov ebp, dword [rsp + 0x20]
mov ecx, 0x18
mov qword [rbx + 0x10], rsi
mov dword [rbx + 0x18], ebp
call fcn.1402bcb4c
test rax, rax
je 0x1400ceb91
lea rcx, vtable.RegParser.0
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbp
mov qword [rax], rcx
mov rsi, qword [rsp + 0x250]
mov rbp, qword [rsp + 0x268]
mov qword [rbx + 8], rax
mov rax, rbx
mov rbx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0x258
ret
Function at 0x1400cf300
Capabilities:
Get volume information via ioctl

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [0x14034c078]
movsd xmm0, qword [0x14034c070]
xor r14d, r14d
mov dword [r11 - 0x20], eax
movzx eax, word [0x14034c07c]
movzx ebp, cx
movsd qword [r11 - 0x28], xmm0
mov word [r11 - 0x20], cx
mov qword [rsp + 0x30], r14
lea r8d, [r14 + 3]
lea rcx, [r11 - 0x28]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], r14d
mov word [r11 - 0x1c], ax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400cf3c8
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x90064
mov rcx, rdi
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400cf3cf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400cf461
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rsi
mov esi, dword [rsp + 0x80]
mov ecx, 0x38
add esi, 0x10
call fcn.1402bcb4c
mov rbx, rax
test rax, rax
je 0x1400cf413
lea rax, vtable.CommunityRemnantsNtfs.0
mov qword [rbx + 0x10], 0xffffffffffffffff
mov qword [rbx + 0x30], r14
mov qword [rbx], rax
jmp 0x1400cf416
mov rbx, r14
mov word [rbx + 8], bp
mov qword [rbx + 0x10], rdi
mov ecx, dword [rsp + 0x80]
mov dword [rbx + 0x18], ecx
mov ecx, esi
mov dword [rbx + 0x28], esi
call fcn.1402bd120
mov rsi, qword [rsp + 0xe8]
mov qword [rbx + 0x30], rax
mov rax, qword [rsp + 0x88]
mov ecx, dword [rsp + 0x80]
cqo
idiv rcx
mov qword [rbx + 0x20], rax
mov rax, rbx
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0xd0]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400d0270
Capabilities:
Create thread
Get system information on windows

Disassembly:
mov r11, rsp
push rbp
sub rsp, 0xd0
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0xb0], rax
cmp qword [rcx + 0xa0], 0
mov rbp, rcx
je 0x1400d0374
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], r14
lea rcx, [rsp + 0x38]
xor r14d, r14d
mov esi, r14d
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x58]
mov ecx, 2
cmp eax, ecx
cmovl eax, ecx
mov ecx, 8
cmp eax, ecx
cmovg eax, ecx
test eax, eax
jle 0x1400d0336
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0xc8], rdi
mov edi, eax
lea rbx, [rsp + 0x70]
nop word [rax + rax]
lea rax, [rsp + 0x30]
lea r8, [0x1400d0940]
mov r9, rbp
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400d0321
mov qword [rbx], rax
inc esi
add rbx, 8
dec rdi
jne 0x1400d02f0
mov rdi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0x40]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, [rsp + 0x70]
or r9d, 0xffffffff
mov r8d, 1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov r14, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xf0]
mov al, 1
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0xd0
pop rbp
ret