joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140090374
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rax - 0x28], 0xfffffffffffffffe
mov rbx, r9
mov rsi, rdx
mov r9, rcx
mov r11, qword [r8]
mov qword [rax + 0x18], r11
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x60]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x1400903aa
mov rdx, qword [r9 + 0x30]
and rdx, rcx
lea r10, [r9 + 8]
mov r8, rdx
add r8, r8
mov rcx, qword [r9 + 0x18]
mov rax, qword [rcx + r8*8]
cmp rax, qword [r10]
jne 0x1400903ec
mov rdi, qword [r10]
jmp 0x1400903f4
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, rax
je 0x140090432
add rdx, rdx
mov rdi, qword [rdi + 8]
cmp r11, qword [rdi + 0x10]
sete al
test al, al
jne 0x140090413
cmp rdi, qword [rcx + rdx*8]
jne 0x1400903fc
jmp 0x140090432
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, r10
call fcn.140099c44
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400904ca
mov qword [rsp + 0x60], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x14009046c
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r10]
jne 0x140090488
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400904b7
cmp rax, rdi
jne 0x140090493
mov qword [rdx + r8*8], rbx
jmp 0x1400904b7
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400904b7
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.140095c5c
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140099134
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x14009915e
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400991b6
cmp qword [rcx + rdx*8], rdi
jne 0x1400991b0
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400991c3
mov rax, qword [rdi + 8]
jmp 0x1400991a9
cmp qword [rcx + rdx*8], rdi
jne 0x1400991c8
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
xor edx, edx
dec qword [r8 + 0x10]
call fcn.1400cc9e8
mov rcx, rdi
call fcn.14015729c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14009920c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x140099236
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14009928e
cmp qword [rcx + rdx*8], rdi
jne 0x140099288
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14009929b
mov rax, qword [rdi + 8]
jmp 0x140099281
cmp qword [rcx + rdx*8], rdi
jne 0x1400992a0
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x18]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140034514
mov rcx, rdi
call fcn.14015729c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400992e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rdi, r8
movabs r10, 0xcbf29ce484222325
mov rsi, rdx
mov r8, rcx
mov rcx, r10
xor r9d, r9d
movabs rdx, 0x100000001b3
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + r9 + 0x30]
inc r9
xor rcx, rax
imul rcx, rdx
cmp r9, 4
jb 0x14009931e
movzx eax, byte [rdi + 0x14]
xor rax, r10
imul rax, rdx
imul rdx, rcx, 0x18d
mov rcx, qword [r8 + 0x18]
xor rdx, rax
and rdx, qword [r8 + 0x30]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14009937e
cmp qword [rcx + rdx*8], rdi
jne 0x140099378
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14009938b
mov rax, qword [rdi + 8]
jmp 0x140099371
cmp qword [rcx + rdx*8], rdi
jne 0x140099390
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
xor edx, edx
dec qword [r8 + 0x10]
call fcn.1400cc9e8
mov rcx, rdi
call fcn.14015729c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400993d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rdi, r8
movabs r10, 0xcbf29ce484222325
mov rsi, rdx
mov r8, rcx
mov rcx, r10
xor r9d, r9d
movabs rdx, 0x100000001b3
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + r9 + 0x30]
inc r9
xor rcx, rax
imul rcx, rdx
cmp r9, 4
jb 0x140099412
movzx eax, byte [rdi + 0x14]
xor rax, r10
imul rax, rdx
imul rdx, rcx, 0x18d
mov rcx, qword [r8 + 0x18]
xor rdx, rax
and rdx, qword [r8 + 0x30]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140099472
cmp qword [rcx + rdx*8], rdi
jne 0x14009946c
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14009947f
mov rax, qword [rdi + 8]
jmp 0x140099465
cmp qword [rcx + rdx*8], rdi
jne 0x140099484
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x18]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140034514
mov rcx, rdi
call fcn.14015729c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400994c4
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
movzx eax, byte [r8 + 0x10]
mov r9, rcx
mov rdi, r8
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
mov rsi, rdx
movabs rcx, 0x100000001b3
mov r8, qword [r9 + 0x30]
imul rax, rcx
mov rcx, qword [r9 + 0x18]
and r8, rax
add r8, r8
cmp qword [rcx + r8*8 + 8], rdi
jne 0x140099539
cmp qword [rcx + r8*8], rdi
jne 0x140099533
mov rax, qword [r9 + 8]
mov qword [rcx + r8*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [rcx + r8*8 + 8], rax
jmp 0x140099546
mov rax, qword [rdi + 8]
jmp 0x14009952c
cmp qword [rcx + r8*8], rdi
jne 0x14009954b
mov rax, qword [rdi]
mov qword [rcx + r8*8], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
xor edx, edx
dec qword [r9 + 0x10]
call fcn.1400cc9e8
mov rcx, rdi
call fcn.14015729c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140099590
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
movzx eax, byte [r8 + 0x10]
mov r9, rcx
mov rdi, r8
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
mov rsi, rdx
movabs rcx, 0x100000001b3
mov r8, qword [r9 + 0x30]
imul rax, rcx
mov rcx, qword [r9 + 0x18]
and r8, rax
add r8, r8
cmp qword [rcx + r8*8 + 8], rdi
jne 0x140099605
cmp qword [rcx + r8*8], rdi
jne 0x1400995ff
mov rax, qword [r9 + 8]
mov qword [rcx + r8*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [rcx + r8*8 + 8], rax
jmp 0x140099612
mov rax, qword [rdi + 8]
jmp 0x1400995f8
cmp qword [rcx + r8*8], rdi
jne 0x140099617
mov rax, qword [rdi]
mov qword [rcx + r8*8], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x18]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
call fcn.140034514
mov rcx, rdi
call fcn.14015729c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140099660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x20
mov rax, qword [r8 + 0x10]
mov r10, rcx
mov qword [rsp + 0x30], rax
mov rbx, rdx
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rsp + rcx + 0x30]
movabs rdx, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rdx
cmp rcx, 8
jb 0x140099685
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r9
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400996dc
cmp qword [rcx + rdx*8], r8
jne 0x1400996d6
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400996e9
mov rax, qword [r8 + 8]
jmp 0x1400996cf
cmp qword [rcx + rdx*8], r8
jne 0x1400996ee
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov r8, qword [rsp + 0x40]
lea rcx, [r10 + 8]
lea rdx, [rsp + 0x30]
call fcn.140099c44
mov rcx, qword [rax]
mov rax, rbx
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x140099cd8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov r11d, dword [r8]
movabs rdi, 0xcbf29ce484222325
mov rbx, rcx
mov dword [rsp + 8], r11d
mov r9, rdi
xor r10d, r10d
movabs rcx, 0x100000001b3
movzx eax, byte [rsp + r10 + 8]
inc r10
xor r9, rax
imul r9, rcx
cmp r10, 4
jb 0x140099d07
movzx r10d, byte [r8 + 4]
mov r8, qword [rbx + 8]
mov eax, r10d
xor rax, rdi
imul rax, rcx
imul rcx, r9, 0x18d
mov r9, qword [rbx + 0x18]
xor rcx, rax
and rcx, qword [rbx + 0x30]
mov rax, rcx
add rax, rax
lea rdi, [rcx + rcx]
mov rax, qword [r9 + rax*8]
cmp qword [r9 + rdi*8], r8
jne 0x140099d5b
mov rcx, r8
jmp 0x140099d63
mov rcx, qword [r9 + rdi*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140099d8d
cmp dword [rax + 0x10], r11d
jne 0x140099d74
cmp byte [rax + 0x14], r10b
je 0x140099d79
mov rax, qword [rax]
jmp 0x140099d50
cmp r11d, dword [rax + 0x10]
jne 0x140099d85
cmp r10b, byte [rax + 0x14]
je 0x140099d88
mov rax, r8
mov qword [rdx], rax
jmp 0x140099d90
mov qword [rdx], r8
mov rbx, qword [rsp + 0x10]
mov rax, rdx
mov rdi, qword [rsp + 0x18]
ret

Function at 0x140099da0
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
movabs r8, 0xcbf29ce484222325
mov r10, qword [rcx + 0x18]
mov eax, r9d
xor rax, r8
movabs r8, 0x100000001b3
imul rax, r8
mov r8, qword [rcx + 0x30]
and r8, rax
mov rax, r8
add rax, rax
lea r11, [r8 + r8]
mov r8, qword [rcx + 8]
mov rax, qword [r10 + rax*8]
cmp qword [r10 + r11*8], r8
jne 0x140099dea
mov rcx, r8
jmp 0x140099df2
mov rcx, qword [r10 + r11*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140099e0b
cmp r9b, byte [rax + 0x10]
je 0x140099e02
mov rax, qword [rax]
jmp 0x140099ddf
cmovne rax, r8
mov qword [rdx], rax
jmp 0x140099e0e
mov qword [rdx], r8
mov rax, rdx
ret
Function at 0x140099e14
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, r8
movabs r9, 0xcbf29ce484222325
mov r8, rcx
xor r10d, r10d
movzx eax, byte [r10 + r11]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 2
jb 0x140099e27
mov rcx, qword [r8 + 0x30]
and rcx, r9
mov r9, qword [r8 + 0x18]
mov r8, qword [r8 + 8]
mov rax, rcx
add rax, rax
lea r10, [rcx + rcx]
mov rax, qword [r9 + rax*8]
cmp qword [r9 + r10*8], r8
jne 0x140099e6e
mov rcx, r8
jmp 0x140099e76
mov rcx, qword [r9 + r10*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140099e9b
movzx ecx, word [r11]
cmp word [rax + 0x10], cx
je 0x140099e8a
mov rax, qword [rax]
jmp 0x140099e63
movzx ecx, word [rax + 0x10]
cmp word [r11], cx
cmovne rax, r8
mov qword [rdx], rax
jmp 0x140099e9e
mov qword [rdx], r8
mov rax, rdx
ret

Function at 0x140099ea4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov r10, qword [r8]
mov r11, rcx
mov qword [rsp + 8], r10
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [rsp + r9 + 8]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 8
jb 0x140099ec1
mov rcx, qword [r11 + 0x30]
mov r9, qword [r11 + 0x18]
and rcx, r8
mov r8, qword [r11 + 8]
mov rax, rcx
add rax, rax
lea rbx, [rcx + rcx]
mov rax, qword [r9 + rax*8]
cmp qword [r9 + rbx*8], r8
jne 0x140099f09
mov rcx, r8
jmp 0x140099f11
mov rcx, qword [r9 + rbx*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140099f2a
cmp r10, qword [rax + 0x10]
je 0x140099f21
mov rax, qword [rax]
jmp 0x140099efe
cmovne rax, r8
mov qword [rdx], rax
jmp 0x140099f2d
mov qword [rdx], r8
mov rbx, qword [rsp + 0x10]
mov rax, rdx
ret
Function at 0x14009d578
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
xor r10d, r10d
mov rsi, r8
mov ebx, edx
mov rdi, rcx
mov r11d, r10d
test rcx, rcx
je 0x14009d720
test r8, r8
je 0x14009d720
mov r14, qword [rsp + 0x38]
test r14, r14
je 0x14009d720
test edx, edx
je 0x14009d704
mov ecx, r10d
lea r13, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [rdi]
dec ebx
mov byte [rsp + rcx + 0x18], al
inc r11d
inc rcx
inc rdi
cmp rcx, 3
jne 0x14009d653
cmp r9d, 4
jb 0x14009d65b
movzx edx, byte [rsp + 0x1a]
mov r11d, r10d
movzx eax, byte [rsp + 0x18]
movzx ecx, byte [rsp + 0x19]
shr rax, 2
shr rcx, 4
mov al, byte [r13 + rax*2]
mov byte [r8], al
mov al, byte [rsp + 0x18]
shl al, 4
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov cl, byte [rsp + 0x19]
mov byte [r8 + 1], al
mov eax, edx
shr rax, 6
and edx, 0x3f
shl cl, 2
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov rcx, r10
mov byte [r8 + 2], al
mov al, byte [r13 + rdx*2]
mov byte [r8 + 3], al
add r8, 4
add r9d, 0xfffffffc
test ebx, ebx
jne 0x14009d5cb
test r11d, r11d
jle 0x14009d702
cmp r9d, 4
jb 0x14009d6ff
movzx edi, byte [rsp + 0x19]
cmp r11d, 1
movzx ebx, byte [rsp + 0x1a]
mov dl, 0x3d
movzx eax, byte [rsp + 0x18]
cmovle edi, r10d
cmp r11d, 2
movzx ecx, dil
cmovle ebx, r10d
shr rax, 2
shr rcx, 4
mov al, byte [r13 + rax*2]
mov byte [r8], al
mov al, byte [rsp + 0x18]
shl al, 4
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov byte [r8 + 1], al
cmp r11d, 1
jle 0x14009d6d9
mov al, dil
movzx ecx, bl
shl al, 2
shr rcx, 6
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
jmp 0x14009d6db
mov al, dl
mov byte [r8 + 2], al
cmp r11d, 2
jle 0x14009d6f0
movzx eax, bl
and eax, 0x3f
mov dl, byte [r13 + rax*2]
mov byte [r8 + 3], dl
mov r11d, r10d
add r8, 4
add r9d, 0xfffffffc
test r11d, r11d
jne 0x14009d70f
cmp r9d, 1
jb 0x14009d70f
mov byte [r8], r10b
jmp 0x14009d715
mov r10d, 0x800700ea
sub r8d, esi
mov eax, r10d
mov dword [r14], r8d
jmp 0x14009d725
mov eax, 0x80070057
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r14
pop r13
ret

Function at 0x1400a1094
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x40]
call fcn.1401380c0
mov rcx, rbx
mov dword [rbx], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x1400a10c4
mov ecx, 0x3617ce
call fcn.140175954
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400a1200
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x40
mov edi, ecx
lea r9, [rbp - 0x10]
xor ebx, ebx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
and qword [rbp - 0x10], rbx
mov rcx, 0xffffffff80000001
mov r8d, 0x20019
call fcn.1400a623c
test eax, eax
jne 0x1400a1338
lea r15d, [rbx + 1]
test r15b, dil
je 0x1400a1291
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x30]
and dword [rbp + 0x28], ebx
lea r9, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.HideFileExt
lea rax, [rbp + 0x28]
mov dword [rbp + 0x30], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a1289
cmp dword [rbp + 0x38], 4
jne 0x1400a1289
mov eax, dword [rbp + 0x28]
jmp 0x1400a128b
xor eax, eax
test eax, eax
cmove ebx, r15d
test dil, 2
je 0x1400a12e5
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x30]
and dword [rbp + 0x28], 0
lea r9, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.Hidden
lea rax, [rbp + 0x28]
mov dword [rbp + 0x30], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a12db
cmp dword [rbp + 0x38], 4
jne 0x1400a12db
mov eax, dword [rbp + 0x28]
jmp 0x1400a12dd
xor eax, eax
cmp eax, r15d
jne 0x1400a12e5
or ebx, 2
test dil, 4
je 0x1400a1338
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x30]
and dword [rbp + 0x28], 0
lea r9, [rbp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.ShowSuperHidden
lea rax, [rbp + 0x28]
mov dword [rbp + 0x30], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a132f
cmp dword [rbp + 0x38], 4
jne 0x1400a132f
mov eax, dword [rbp + 0x28]
jmp 0x1400a1331
xor eax, eax
test eax, eax
je 0x1400a1338
or ebx, 4
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400a134c
and qword [rbp - 0x10], 0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop rdi
pop rbp
ret
Function at 0x1400a2cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov rsi, rcx
xor r13d, r13d
test rcx, rcx
jne 0x1400a2ced
xor eax, eax
jmp 0x1400a2ecb
mov dword [rbp + 0x58], r13d
mov dword [rbp + 0x50], r13d
mov r14d, r13d
mov r15d, 2
or edi, 0xffffffff
test r14d, r14d
jne 0x1400a2d18
cmp dword [0x14033e590], r13d
je 0x1400a2e75
mov r12d, r15d
jmp 0x1400a2d35
cmp r14d, 1
jne 0x1400a2e75
mov rcx, rsi
call fcn.1400a3140
test al, al
je 0x1400a2e75
mov r12d, r13d
mov qword [rbp - 0x18], r13
mov bl, r13b
mov byte [rbp + 0x48], bl
cmp dword [0x14033e5c0], r13d
je 0x1400a2d5b
mov bl, 1
mov byte [rbp + 0x48], bl
lea rcx, [0x14033f088]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov qword [rbp + 0x60], r13
movzx r9d, word [rsi + 0x18]
shr r9d, 1
and r9d, 0x10
or r9d, r12d
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x18]
mov rcx, qword [rsi + 0x10]
call fcn.1400a2174
mov edi, eax
test eax, eax
jne 0x1400a2e5b
mov r15, qword [rbp - 0x18]
mov rcx, qword [rbp + 0x60]
test rcx, rcx
jne 0x1400a2d9e
mov rcx, qword [r15]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x58]
xor r8d, r8d
mov rdx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov ecx, 2
cmp dword [rbp + 0x50], ecx
jae 0x1400a2dd3
mov eax, dword [rbp + 0x58]
dec eax
cmp eax, 1
cmovbe edi, ecx
cmp edi, 0x3f2
je 0x1400a2de8
cmp edi, 0x3fa
je 0x1400a2de8
cmp edi, 6
jne 0x1400a2e49
mov rax, qword [rsi + 0x10]
movzx ecx, word [rax + 0xa]
and ecx, 0xf
lea rax, [rcx + rcx*2]
lea rcx, [0x140331750]
mov qword [rcx + rax*8], r13
mov rdx, r15
lea rcx, [0x14033eaa0]
call fcn.1400a3008
mov qword [rbp - 0x18], r13
mov qword [rbp + 0x60], r13
movzx r9d, word [rsi + 0x18]
shr r9d, 1
and r9d, 0x10
or r9d, r12d
mov qword [rsp + 0x20], r13
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x18]
mov rcx, qword [rsi + 0x10]
call fcn.1400a2174
mov edi, eax
test eax, eax
jne 0x1400a2e55
jmp 0x1400a2d8e
mov rcx, r15
call fcn.1400a4154
test edi, edi
je 0x1400a2e82
mov r15d, 2
cmp dword [0x14033e5c0], r13d
je 0x1400a2e75
test bl, bl
je 0x1400a2e75
lea rcx, [0x14033f088]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc r14d
cmp r14d, r15d
jge 0x1400a2e9c
jmp 0x1400a2cfe
cmp dword [0x14033e5c0], r13d
je 0x1400a2ea0
test bl, bl
je 0x1400a2ea0
lea rcx, [0x14033f088]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x1400a2ebd
mov ecx, 2
cmp dword [rbp + 0x58], ecx
je 0x1400a2eb3
mov al, byte [rsi + 0x18]
and al, 0xf
cmp al, cl
jne 0x1400a2ec8
mov ecx, dword [rbp + 0x50]
call fcn.1400a5678
jmp 0x1400a2ec5
mov rcx, rsi
call fcn.1400a5a04
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x50]
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400a33dc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov dil, dl
mov rsi, rcx
test rcx, rcx
jne 0x1400a3401
xor al, al
jmp 0x1400a353f
test dil, dil
je 0x1400a3410
xor ecx, ecx
cmp dword [0x14033e590], ecx
jmp 0x1400a3419
call fcn.1400a3140
xor ecx, ecx
test al, al
sete cl
test ecx, ecx
jne 0x1400a33fa
and qword [rsp + 0x80], 0
and qword [rsp + 0x88], 0
xor bl, bl
mov byte [rsp + 0x70], bl
cmp dword [0x14033e5c0], ecx
je 0x1400a3454
mov bl, 1
mov byte [rsp + 0x70], bl
lea rcx, [0x14033f088]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
neg dil
sbb ebp, ebp
and ebp, 2
movzx r9d, word [rsi + 0x18]
shr r9d, 1
and r9d, 0x10
and qword [rsp + 0x20], 0
or r9d, ebp
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsi + 0x10]
call fcn.1400a2174
test eax, eax
mov edi, eax
jne 0x1400a351c
mov r14, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
jne 0x1400a34ac
mov rcx, qword [r14]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, 0x3f2
je 0x1400a34dc
cmp eax, 0x3fa
je 0x1400a34dc
cmp eax, 6
jne 0x1400a3514
mov rax, qword [rsi + 0x10]
movzx ecx, word [rax + 0xa]
and ecx, 0xf
lea rax, [rcx + rcx*2]
lea rcx, [0x140331750]
and qword [rcx + rax*8], 0
mov rdx, r14
lea rcx, [0x14033eaa0]
call fcn.1400a3008
and qword [rsp + 0x80], 0
jmp 0x1400a345c
mov rcx, r14
call fcn.1400a4154
test edi, edi
sete dil
cmp dword [0x14033e5c0], 0
je 0x1400a353c
test bl, bl
je 0x1400a353c
lea rcx, [0x14033f088]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, dil
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret