joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f3e80
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.14000a500
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.14000a550
test ebx, ebx
jne 0x1400f3ef4
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, 0xc0000017
jne 0x1400f3f1b
lea rcx, [0x1401a3b48]
call fcn.140005160
mov rbx, rax
mov rcx, rbx
call fcn.140103b20
mov rcx, rbx
call fcn.140008c30
lea rcx, [0x1401a3688]
call fcn.140005160
mov rbx, rax
mov rcx, rbx
call fcn.1400ffb10
mov rcx, rbx
call fcn.140008c30
int3

Function at 0x1400fb160
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 8], rax
xorps xmm4, xmm4
movaps xmmword [rbp + 0x10], xmm4
movaps xmmword [rbp + 0x20], xmm4
mov rax, qword [0x1400d5dc8]
mov qword [rbp], rax
mov rbx, rcx
mov esi, dword [rbx + 8]
xor edi, edi
cmp esi, 0x40
jae 0x1400fb1b3
test dword [rsp], esp
sub rsp, 0x80
lea r14, [rsp + 0x20]
mov r15d, 0x40
jmp 0x1400fb1f2
lea rcx, [0x14019fe20]
cmp qword [rcx - 8], 0
jne 0x1400fb2f1
mov rcx, qword [0x1400d5818]
mov rcx, qword [rcx + 8]
lea edx, [rsi + 1]
cmp dword [rcx], ecx
call fcn.140163aa0
mov rdi, rax
test rdi, rdi
jne 0x1400fb1ea
xor r14d, r14d
xor r15d, r15d
jmp 0x1400fb1f2
lea r14, [rdi + 0x10]
mov r15d, dword [rdi + 8]
lea rcx, [rbx + 0xc]
mov edx, dword [rbx + 8]
mov edx, esi
mov qword [rbp + 0x18], rcx
mov dword [rbp + 0x20], edx
mov qword [rbp + 8], r14
mov dword [rbp + 0x10], r15d
lea rcx, [rbp + 0x18]
lea rdx, [rbp + 8]
call fcn.140113df0
cmp esi, r15d
jae 0x1400fb302
mov ecx, esi
mov word [r14 + rcx*2], 0
mov ebx, 0x15051505
mov r13d, 0x15051505
xor ecx, ecx
test r15d, r15d
cmovne rcx, r14
mov qword [rbp + 0x28], rcx
cmp esi, 2
jle 0x1400fb278
add esi, 0xfffffffc
mov edx, ebx
rol edx, 5
add ebx, edx
mov edx, dword [rcx]
or edx, 0x200020
xor ebx, edx
mov edx, r13d
rol edx, 5
add r13d, edx
mov edx, dword [rcx + 4]
or edx, 0x200020
xor r13d, edx
add rcx, 8
cmp esi, 2
jg 0x1400fb246
test esi, esi
jle 0x1400fb292
mov edx, r13d
rol edx, 5
add edx, r13d
mov r13d, dword [rcx]
or r13d, 0x200020
xor r13d, edx
xor ecx, ecx
mov qword [rbp + 0x28], rcx
test rdi, rdi
je 0x1400fb2c3
lea rcx, [0x14019fe20]
cmp qword [rcx - 8], 0
jne 0x1400fb2fb
mov rcx, qword [0x1400d5818]
mov rcx, qword [rcx + 8]
mov rdx, rdi
xor r8d, r8d
cmp dword [rcx], ecx
call fcn.140163ce0
imul eax, r13d, 0x5d588b65
add eax, ebx
lea rcx, [0x1400d5dc8]
mov rcx, qword [rcx]
cmp qword [rbp], rcx
je 0x1400fb2e1
call fcn.140004e90
nop
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1400019a7
jmp 0x1400fb1c5
call fcn.1400019a7
jmp 0x1400fb2ab
call fcn.1401050c0
int3
Function at 0x1400fe2c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.140138260
xor ecx, ecx
xor edx, edx
mov r8d, eax
sar r8d, 0x1f
and r8d, 3
add eax, r8d
sar eax, 2
test eax, eax
jle 0x1400fe2fb
lea r8d, [rdx*4]
movsxd r8, r8d
xor ecx, dword [rbx + r8]
inc edx
cmp eax, edx
jg 0x1400fe2e6
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x140101da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x30
xor eax, eax
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov ebx, edx
mov rsi, r8
mov ecx, 1
test ebx, ebx
cmovle ebx, ecx
mov rcx, rdi
neg rcx
lea rdx, [0x14007c908]
mov rax, rcx
or rax, 1
bsr r8, rax
lzcnt rax, rax
xor eax, 0x3f
test dword [0x1400dcfd8], 0x1000
cmovne r8d, eax
movsxd rax, r8d
movzx edx, byte [rdx + rax]
mov eax, edx
shl rax, 3
lea r8, [0x140080828]
add rax, r8
cmp rcx, qword [rax]
setb cl
movzx ecx, cl
sub edx, ecx
cmp ebx, edx
mov ebp, edx
cmovge ebp, ebx
mov r14d, dword [rsi + 8]
add ebp, r14d
lea rcx, [0x1401a1d10]
mov edx, ebp
call fcn.140005220
mov r15, rax
test r15, r15
jne 0x140101e3f
xor eax, eax
jmp 0x140101e4d
lea rax, [r15 + 0xc]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movsxd rdx, ebp
lea rbp, [rax + rdx*2]
neg rdi
cmp rdi, 0x64
jb 0x140101f26
lea rax, [0x14019fb40]
cmp qword [rax - 8], 0
jne 0x140101f5b
mov rcx, qword [0x1400d5460]
add rbp, 0xfffffffffffffffc
add ebx, 0xfffffffe
movabs rdx, 0x28f5c28f5c28f5c3
mov rax, rdi
shr rax, 2
mul rdx
shr rdx, 2
imul rax, rdx, 0x64
sub rdi, rax
mov r13, rdx
mov rax, qword [rcx + 0x38]
cmp byte [rax], al
shl edi, 2
mov edx, edi
mov eax, dword [rax + rdx + 0x10]
mov dword [rbp], eax
cmp r13, 0x64
jae 0x140101f1e
test r13, r13
je 0x140101ef6
dec ebx
movabs rdx, 0xcccccccccccccccd
mov rax, r13
mul rdx
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
mov rcx, r13
sub rcx, rax
mov r13, rdx
add rbp, 0xfffffffffffffffe
add ecx, 0x30
mov word [rbp], cx
test r13, r13
jne 0x140101ec0
test ebx, ebx
jg 0x140101ec0
mov rax, rbp
lea ecx, [r14 - 1]
test ecx, ecx
jl 0x140101f42
cmp r14d, ecx
jle 0x140101f2b
add rax, 0xfffffffffffffffe
mov edx, ecx
movzx edx, word [rsi + rdx*2 + 0xc]
mov word [rax], dx
dec ecx
jns 0x140101f0a
jmp 0x140101f42
mov rdi, r13
jmp 0x140101e7a
mov r13, rdi
jmp 0x140101ebb
add rax, 0xfffffffffffffffe
cmp ecx, r14d
jae 0x140101f65
mov edx, ecx
movzx edx, word [rsi + rdx*2 + 0xc]
mov word [rax], dx
dec ecx
jns 0x140101f2b
xor eax, eax
mov qword [rsp + 0x28], rax
mov rax, r15
add rsp, 0x30
pop rbx
pop rbp
pop rsi
pop rdi
pop r13
pop r14
pop r15
ret
call fcn.1400012a7
jmp 0x140101e73
call fcn.1401050c0
int3
Function at 0x140106810
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp qword [rbx], 0
jne 0x14010683a
lea rcx, [0x1401cd590]
mov edx, 0x55
call fcn.140005280
mov rdx, rax
mov rcx, rbx
call fcn.140008930
xor eax, eax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], eax
mov rax, qword [rbx]
cmp dword [rax + 8], 0x50
jbe 0x1401068a8
mov dword [rax + 0x150], 0x67452301
mov rax, qword [rbx]
cmp dword [rax + 8], 0x51
jbe 0x1401068a8
mov dword [rax + 0x154], 0xefcdab89
mov rax, qword [rbx]
cmp dword [rax + 8], 0x52
jbe 0x1401068a8
mov dword [rax + 0x158], 0x98badcfe
mov rax, qword [rbx]
cmp dword [rax + 8], 0x53
jbe 0x1401068a8
mov dword [rax + 0x15c], 0x10325476
mov rax, qword [rbx]
cmp dword [rax + 8], 0x54
jbe 0x1401068a8
mov dword [rax + 0x160], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
call fcn.1401050c0
int3

Function at 0x14010dcd0
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
lea rdi, [0x14019fd28]
cmp qword [rdi - 8], 0
jne 0x14010dd46
cmp byte [rdi], 0
je 0x14010dcfb
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
lea rbp, [0x14019fb70]
cmp qword [rbp - 8], 0
jne 0x14010dd4d
cmp byte [rbp], 0
jne 0x14010dd21
mov rcx, rbx
mov edx, esi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp 0x14010e6a0
mov edx, esi
mov ecx, edx
or ecx, 0x80000000
cmp byte [rbx + 0x1b8], 0
cmove edx, ecx
mov rcx, qword [rbx + 8]
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.14010edc0
call fcn.1400011b3
jmp 0x14010dceb
call fcn.140001074
jmp 0x14010dd09
sub rsp, 0x28
cmp edx, 0x1009
jne 0x14010e6b3
xor eax, eax
add rsp, 0x28
ret
xor r8d, r8d
mov dword [rsp + 0x20], r8d
mov rcx, qword [rcx + 0x10]
lea r8, [rsp + 0x20]
call fcn.14013bad0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x14010dd60
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, edx
lea rdi, [0x14019fd28]
cmp qword [rdi - 8], 0
jne 0x14010dde1
cmp byte [rdi], 0
je 0x14010dd8b
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
lea rbp, [0x14019fb70]
cmp qword [rbp - 8], 0
jne 0x14010dde8
cmp byte [rbp], 0
jne 0x14010ddbc
movzx ecx, byte [rbx + 0x1b8]
test ecx, ecx
jne 0x14010ddbc
mov rcx, rbx
mov edx, esi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp 0x14010e6a0
mov edx, esi
mov ecx, edx
or ecx, 0x80000000
cmp byte [rbx + 0x1b8], 0
cmove edx, ecx
mov rcx, qword [rbx + 8]
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.14010edc0
call fcn.1400011b3
jmp 0x14010dd7b
call fcn.140001074
jmp 0x14010dd99
Function at 0x14010ecf0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x1400d5dc8]
mov qword [rbp + 0x48], rax
test dword [rsp], esp
sub rsp, 0x430
lea rbx, [rsp + 0x20]
test rcx, rcx
je 0x14010ed30
add rcx, 0xc
jmp 0x14010ed32
xor ecx, ecx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov r8, rbx
mov qword [rbp + 0x30], r8
mov r9d, 0x212
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.14000a500
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov esi, eax
lea rcx, [rbp + 8]
call fcn.14000a550
xor ecx, ecx
mov qword [rbp + 0x50], rcx
test esi, esi
jle 0x14010ed8a
mov rcx, rbx
call fcn.1400f87e0
jmp 0x14010ed8c
xor eax, eax
lea rcx, [0x1400d5dc8]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x14010eda1
call fcn.140004e90
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14010edc0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x14010edf6
add rcx, 0xc
jmp 0x14010edf8
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.14000a500
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.14000a550
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140110440
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [0x14019fd28]
cmp qword [rbx - 8], 0
jne 0x1401104aa
cmp byte [rbx], 0
jne 0x14011047f
xor ecx, ecx
mov edx, 0x5c
call fcn.14010ecf0
test rax, rax
jne 0x1401104a4
lea rcx, [0x14018d6d8]
mov edx, 0x5c
add rsp, 0x20
pop rbx
jmp fcn.14010ecf0
lea rcx, [0x14019fb68]
cmp qword [rcx - 8], 0
jne 0x1401104b1
mov rcx, qword [0x1400d54a0]
mov rcx, qword [rcx + 0x18]
cmp dword [rcx], ecx
add rsp, 0x20
pop rbx
jmp fcn.14010fc30
add rsp, 0x20
pop rbx
ret
call fcn.1400011b3
jmp 0x140110453
call fcn.140001327
jmp 0x14011048d
Function at 0x140118f00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm7
movsd xmm6, qword [0x140088a90]
movaps xmm7, xmm6
call fcn.140119150
call fcn.1401186b0
test eax, eax
jge 0x140118f52
mov dword [0x1400d67e0], 0xffff
xor eax, eax
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x68
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
pop r15
ret
lea rbx, [0x14019fc50]
cmp qword [rbx - 8], 0
jne 0x140119112
movabs rdx, 0x431bde82d7b634db
mov rax, rdx
imul qword [rbx]
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0x12
lea rsi, [rdx + rcx + 1]
xor edi, edi
mov ebx, 8
add ebx, ebx
lea rcx, [rsp + 0x38]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbp, qword [rsp + 0x38]
xor r14d, r14d
cmp dword [0x1400dd0c0], 0
jne 0x14011911c
test ebx, ebx
jle 0x140118fbd
call fcn.1401186b0
inc r14d
cmp r14d, ebx
jl 0x140118fb0
lea rcx, [rsp + 0x30]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rcx, qword [rsp + 0x30]
sub rcx, rbp
mov rbp, rcx
cmp dword [0x1400dd0c0], 0
jne 0x140119126
cmp rbp, rsi
jl 0x140118f8b
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, ebx
divsd xmm0, xmm1
ucomisd xmm7, xmm0
jp 0x140118fff
je 0x14011900d
ucomisd xmm7, xmm7
jp 0x140119017
ucomisd xmm0, xmm7
ja 0x140119017
jmp 0x14011901a
movq rcx, xmm7
test rcx, rcx
jge 0x14011900b
movaps xmm0, xmm7
movaps xmm7, xmm0
mov ecx, ebx
sar ecx, 0x1f
and ecx, 3
add ecx, ebx
mov ebx, ecx
sar ebx, 2
add ebx, ebx
lea rcx, [rsp + 0x28]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbp, qword [rsp + 0x28]
xor r15d, r15d
cmp dword [0x1400dd0c0], 0
jne 0x140119130
test ebx, ebx
jle 0x14011905e
call fcn.140119150
inc r15d
cmp r15d, ebx
jl 0x140119051
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rax, qword [rsp + 0x20]
sub rax, rbp
mov rbp, rax
cmp dword [0x1400dd0c0], 0
jne 0x14011913a
cmp rbp, rsi
jl 0x14011902c
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, ebx
divsd xmm0, xmm1
ucomisd xmm6, xmm0
jp 0x1401190a0
je 0x1401190ae
ucomisd xmm6, xmm6
jp 0x1401190b8
ucomisd xmm0, xmm6
ja 0x1401190b8
jmp 0x1401190bb
movq rax, xmm6
test rax, rax
jge 0x1401190ac
movaps xmm0, xmm6
movaps xmm6, xmm0
inc edi
cmp edi, 0xa
jl 0x140118f86
movaps xmm0, xmm7
mulsd xmm0, qword [0x140088a98]
divsd xmm0, xmm6
cvttsd2si eax, xmm0
mov ecx, 0x1388
cmp eax, 0x1388
cmovg eax, ecx
mov dword [0x1400d67e0], eax
xor eax, eax
cmp dword [0x1400d67e0], 5
setle al
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x68
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
pop r15
ret
call fcn.140001105
jmp 0x140118f64
call fcn.140009450
jmp 0x140118fac
call fcn.140009450
jmp 0x140118fdf
call fcn.140009450
jmp 0x14011904d
call fcn.140009450
jmp 0x140119080
Function at 0x14013a530
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov ebx, r8d
mov qword [rbp - 0x40], rdx
mov rsi, rdx
test rcx, rcx
je 0x14013a56a
add rcx, 0xc
mov rdi, rcx
jmp 0x14013a56c
xor edi, edi
mov qword [rbp - 0x48], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x54], rcx
mov rdx, rsi
mov qword [rbp - 0x5c], rdx
mov r8d, ebx
mov dword [rbp - 0x4c], r8d
lea rcx, [rbp - 0x88]
call fcn.14000a500
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.14000a550
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
call fcn.140001a9f
mov dword [rax + 8], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14013aa00
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.14000a500
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.14000a550
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140001a9f
mov dword [rax + 8], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14013adc0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov ebx, r8d
mov qword [rbp - 0x40], rdx
mov rsi, rdx
test rcx, rcx
je 0x14013adfa
add rcx, 0xc
mov rdi, rcx
jmp 0x14013adfc
xor edi, edi
mov qword [rbp - 0x48], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x54], rcx
mov rdx, rsi
mov qword [rbp - 0x5c], rdx
mov r8d, ebx
mov dword [rbp - 0x4c], r8d
lea rcx, [rbp - 0x88]
call fcn.14000a500
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.14000a550
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
call fcn.140001a9f
mov dword [rax + 8], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14013bb70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov edi, edx
mov rbx, r8
mov rsi, r9
mov r14, qword [rbp + 0x38]
mov r15, qword [rbp + 0x40]
mov r13, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401311c0
nop
lea rcx, [r13 + 0x10]
xor edx, edx
test r13, r13
cmove rcx, rdx
mov qword [rbp - 0x50], rcx
lea rdx, [r15 + 0x10]
xor r8d, r8d
test r15, r15
cmove rdx, r8
mov qword [rbp - 0x58], rdx
lea r8, [r14 + 0x10]
xor r9d, r9d
test r14, r14
cmove r8, r9
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x68], rsi
mov r9, rsi
lea rax, [rbx + 0x10]
xor r10d, r10d
test rbx, rbx
cmove rax, r10
mov qword [rbp - 0x70], rax
mov r10, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [r10 + 8]
mov qword [rbp - 0x7c], rcx
mov edx, edi
mov dword [rbp - 0x74], edx
mov r8, rax
mov qword [rbp - 0x84], r8
mov qword [rbp - 0x8c], r9
lea rcx, [rbp - 0xb8]
call fcn.14000a500
mov rcx, qword [rbp - 0x7c]
mov edx, dword [rbp - 0x74]
mov r8, qword [rbp - 0x84]
mov r9, qword [rbp - 0x8c]
call sub.ADVAPI32.dll_RegEnumValueW
mov ebx, eax
lea rcx, [rbp - 0xb8]
call fcn.14000a550
nop
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x14013bcb9
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.140131200
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14013bf80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1401311c0
nop
test rbx, rbx
je 0x14013bfd6
add rbx, 0xc
mov rdx, rbx
jmp 0x14013bfd8
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov r8, rsi
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.14000a500
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.14000a550
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x14013c055
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.140131200
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14013de60
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
mov r8, qword [rcx + 0x18]
mov r10, qword [rcx + 0x20]
lea r9, [rdx + rdx*4]
rol r9, 7
lea r9, [r9 + r9*8]
mov r11, rdx
shl r11, 0x11
xor r8, rax
xor r10, rdx
xor rdx, r8
xor rax, r10
xor r8, r11
rol r10, 0x2d
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x20], r10
mov rax, r9
shr rax, 0x21
cmp rax, 0x7fffffff
je fcn.14013de60
ret
Function at 0x140140b40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x70
xorps xmm4, xmm4
movups xmmword [rsp + 0x48], xmm4
xor eax, eax
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov esi, edx
mov edx, dword [rbx + 8]
mov ecx, 0x20
call fcn.1400f8930
mov rdx, rax
lea rcx, [0x14018d2d8]
call fcn.1400f8b40
mov qword [rsp + 0x40], rax
mov rcx, rbx
lea rdx, [0x14018d020]
lea r8, [0x14018cd80]
call fcn.1400f95a0
mov rcx, rax
lea rdx, [0x14018d2d8]
lea r8, [0x14018cd80]
cmp dword [rcx], ecx
call fcn.1400f95a0
mov rdx, rax
lea rcx, [0x14018d2d8]
call fcn.1400f8b40
mov rbx, rax
test sil, sil
je 0x140140bdc
mov qword [rsp + 0xa0], rbx
mov rcx, rbx
call fcn.140143ad0
mov rbx, qword [rsp + 0xa0]
xor ecx, ecx
call fcn.140144590
lea rcx, [0x14019fd78]
cmp qword [rcx - 8], 0
jne 0x140140d9d
mov qword [rsp + 0xa0], rbx
mov rbp, qword [0x1400d56e0]
mov qword [rsp + 0x20], rbp
mov r14, qword [rbp + 0x10]
mov qword [rsp + 0x38], r14
xor ecx, ecx
mov qword [r14 + 8], rcx
lea rcx, [rsp + 0x58]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rax, qword [rsp + 0x58]
mov r14, qword [rsp + 0x38]
mov qword [r14 + 0x10], rax
mov byte [r14 + 0x18], 1
cmp dword [0x1400dd0c0], 0
jne 0x140140daf
call fcn.140143820
test eax, eax
jne 0x140140d5b
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rbp + 0x10]
mov qword [rsp + 0x30], rbx
mov rdi, qword [rbx + 8]
cmp byte [rbx + 0x18], 0
je 0x140140c8f
lea rcx, [rsp + 0x50]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x30]
sub rax, qword [rbx + 0x10]
add rdi, rax
cmp dword [0x1400dd0c0], 0
jne 0x140140db9
lea rbx, [0x14019fc50]
cmp qword [rbx - 8], 0
jne 0x140140dd6
xorps xmm0, xmm0
cvtsi2sd xmm0, rdi
mulsd xmm0, qword [rbx + 0x10]
cvttsd2si rdx, xmm0
movabs rcx, 0x346dc5d63886594b
mov rax, rcx
imul rdx
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0xb
add rcx, rdx
cmp rcx, 0x3e8
jle 0x140140d44
movzx esi, sil
test esi, esi
jne 0x140140cef
mov rbx, qword [rsp + 0xa0]
mov rcx, rbx
jmp 0x140140cf7
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140143ad0
test esi, esi
sete sil
movzx esi, sil
mov rbp, qword [rsp + 0x20]
mov r14, qword [rbp + 0x10]
mov qword [rsp + 0x28], r14
xor ecx, ecx
mov qword [r14 + 8], rcx
lea rcx, [rsp + 0x48]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rcx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x28]
mov qword [r14 + 0x10], rcx
mov byte [r14 + 0x18], 1
cmp dword [0x1400dd0c0], 0
jne 0x140140de0
mov ecx, 0xa
call fcn.1401185e0
call fcn.140143820
test eax, eax
je 0x140140c4f
lea rcx, [rsp + 0x60]
mov edx, 1
call fcn.140144220
mov rcx, qword [rsp + 0xa0]
call fcn.140143a90
mov rbp, qword [rsp + 0x20]
mov rcx, qword [rbp + 0x10]
cmp dword [rcx], ecx
call fcn.140128d20
mov ecx, 1
call fcn.140144590
nop
add rsp, 0x70
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
call fcn.140001867
mov qword [rsp + 0xa0], rbx
jmp 0x140140bfd
call fcn.140009450
jmp 0x140140c42
call fcn.140009450
lea rax, [0x14019fc50]
mov r14, rax
cmp qword [r14 - 8], 0
mov rbx, r14
je 0x140140ca1
call fcn.140001105
jmp 0x140140ca1
call fcn.140009450
jmp 0x140140d44