joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cc0f0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
mov r12, rcx
mov r14, rdx
mov rdi, r8
test r12, r12
je 0x1400cc130
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax + 0x40]
mov r13, rax
test r13, r13
jne 0x1400cc14f
xor eax, eax
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
mov rcx, rdi
call fcn.1400cc210
xor al, 1
je 0x1400cc192
mov rcx, r13
imul rcx, r12
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], r14
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.14004d920
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
xor ebx, ebx
xor esi, esi
test r12, r12
je 0x1400cc1e7
mov rdx, rsi
imul rdx, r13
add rdx, r14
mov rcx, rdi
mov r8, qword [rdi]
call qword [r8 + 0x28]
movabs r9, 0x87c37b91114253d5
mul r9
rol rax, 0x1f
movabs r10, 0x4cf5ad432745937f
mul r10
xor rax, rbx
rol rax, 0x1b
lea rdx, [rax + rax*4 + 0x52dce729]
mov rbx, rdx
inc rsi
cmp rsi, r12
jb 0x1400cc19b
mov rax, rbx
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret

Function at 0x1400cd3a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 8], rsi
mov rsi, rcx
mov r8, rsi
xor edx, edx
mov ecx, 1
call fcn.1400ea1b0
xor al, 1
je 0x1400cd3da
call fcn.1400b8ac0
mov r8, rsi
xor edx, edx
mov ecx, 1
call fcn.1400ea1b0
xor al, 1
jne 0x1400cd3c2
mov rsi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret

Function at 0x1400d9120
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, [rbp - 0x30]
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov rcx, rax
call sub.KERNEL32.dll_GetSystemInfo
mov edx, dword [rbp - 0x2c]
mov qword [0x1401dc870], rdx
mov rsp, rbp
pop rbp
ret
Function at 0x1400da2b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], r12
mov r8, rcx
mov r11, qword [r8 + 0x9c8]
mov rsi, r11
dec rsi
jns 0x1400da2db
mov esi, 0x26f
mov ecx, dword [r8 + 0x9c0]
mov rdi, r11
add rdi, 0xfffffffffffffe73
jns 0x1400da2f5
lea rdi, [r11 + 0xe3]
mov edx, ecx
shr edx, 0xb
xor ecx, edx
cmp r11, 0x270
jae 0x1400da3c0
mov eax, dword [r8 + r11*4]
and eax, 0x80000000
cmp rsi, 0x270
jae 0x1400da3df
mov r10d, ecx
shl r10d, 7
and r10d, 0x9d2c5680
xor ecx, r10d
mov r9d, dword [r8 + rsi*4]
and r9d, 0x7fffffff
or r9d, eax
mov dword [rbp - 8], r9d
shr r9d, 1
mov r12d, ecx
shl r12d, 0xf
and r12d, 0xefc60000
xor ecx, r12d
test dword [rbp - 8], 1
je 0x1400da366
xor r9d, 0x9908b0df
cmp rdi, 0x270
jae 0x1400da3fe
mov eax, dword [r8 + rdi*4]
xor eax, r9d
mov r10d, ecx
shr r10d, 0x12
xor ecx, r10d
cmp r11, 0x270
jae 0x1400da41d
lea rdi, [r8 + r11*4]
mov dword [rdi], eax
mov r10d, dword [rdi]
mov dword [r8 + 0x9c0], r10d
mov qword [r8 + 0x9c8], rsi
mov dword [r8 + 0x9c4], ecx
mov rsi, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x18]
mov r12, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret
mov qword [rbp - 0x30], 0x270
mov r9, r11
xor r8d, r8d
mov edx, 0x3f8
lea rcx, str.std_random.d
call fcn.1400b24b0
mov qword [rbp - 0x30], 0x270
mov r9, rsi
xor r8d, r8d
mov edx, 0x3f9
lea rcx, str.std_random.d
call fcn.1400b24b0
mov qword [rbp - 0x30], 0x270
mov r9, rdi
xor r8d, r8d
mov edx, 0x400
lea rcx, str.std_random.d
call fcn.1400b24b0
mov qword [rbp - 0x30], 0x270
mov r9, r11
xor r8d, r8d
mov edx, 0x402
lea rcx, str.std_random.d
call fcn.1400b24b0
int3
Function at 0x1400df890
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp - 0x90], rbx
mov qword [rbp - 0x88], rsi
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rsi, rdx
lea rcx, [rbp - 0x60]
sub rsp, 0x20
call fcn.1400fca20
add rsp, 0x20
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call fcn.140092060
add rsp, 0x20
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x70]
sub rsp, 0x20
call fcn.1400c1310
add rsp, 0x20
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.1400c1420
add rsp, 0x20
xor al, 1
je 0x1400df9d0
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.1400745b0
add rsp, 0x20
mov esi, eax
mov ecx, esi
sub rsp, 0x20
call fcn.1400c1ed0
add rsp, 0x20
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
sub rsp, 0x20
call fcn.1400c20a0
add rsp, 0x20
xor al, 1
je 0x1400df9a6
mov rcx, qword [rbp + 0x18]
lea rcx, [rbp - 0x18]
sub rsp, 0x20
call fcn.1400c2010
add rsp, 0x20
mov esi, eax
mov edx, esi
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call fcn.140087730
add rsp, 0x20
lea rcx, [rbp - 0x18]
sub rsp, 0x20
call fcn.1400c20d0
add rsp, 0x20
lea rcx, [rbp - 0x18]
sub rsp, 0x20
call fcn.1400c20a0
add rsp, 0x20
xor al, 1
jne 0x1400df95a
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.1400c1440
add rsp, 0x20
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.1400c1420
add rsp, 0x20
xor al, 1
jne 0x1400df91b
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea rsi, [rbp - 0x10]
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.14009e000
add rsp, 0x20
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov rbx, qword [rbp + 0x10]
mov qword [rbx], rax
mov qword [rbx + 8], rdx
mov rax, rbx
mov qword [rbp - 0x80], rax
sub rsp, 8
call fcn.1400dfa5a
add rsp, 8
mov rax, qword [rbp - 0x80]
mov qword [rbp - 0x78], rax
sub rsp, 8
call fcn.1400dfa7b
add rsp, 8
mov rax, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x90]
mov rsi, qword [rbp - 0x88]
mov rsp, rbp
pop rbp
ret
Function at 0x1400e0360
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rbp - 0xb8], rdi
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
xor eax, eax
lea rdi, [rbp - 0xa8]
mov ecx, reloc.WS2_32.dll_ntohl
rep stosq qword [rdi], rax
xor edx, edx
lea rcx, [rbp - 0xa8]
sub rsp, 0x20
call fcn.1400fcf40
add rsp, 0x20
lea rdx, [rbp - 0x28]
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call fcn.1400c11f0
add rsp, 0x20
lea rcx, [rbp - 0x28]
sub rsp, 0x20
call fcn.1400c27e0
add rsp, 0x20
xor al, 1
je 0x1400e0427
lea rcx, [rbp - 0x28]
sub rsp, 0x20
call fcn.1400c3040
add rsp, 0x20
mov qword [rbp - 8], rax
mov r9d, dword [rbp - 8]
mov r8d, dword [rbp - 4]
mov edx, 1
lea rcx, [rbp - 0xa8]
sub rsp, 0x20
call fcn.1400fd010
add rsp, 0x20
lea rcx, [rbp - 0x28]
sub rsp, 0x20
call fcn.1400c3100
add rsp, 0x20
lea rcx, [rbp - 0x28]
sub rsp, 0x20
call fcn.1400c27e0
add rsp, 0x20
xor al, 1
jne 0x1400e03cb
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp - 0xa8]
sub rsp, 0x20
call fcn.1400fd0d0
add rsp, 0x20
mov qword [rbp - 0xb0], rax
sub rsp, 8
call fcn.1400e0475
add rsp, 8
mov rax, qword [rbp - 0xb0]
mov rdi, qword [rbp - 0xb8]
mov rsp, rbp
pop rbp
ret
Function at 0x1400ed120
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
cmp qword [0x1401dc9b0], 0
je 0x1400ed13e
lea rax, [0x1401dc930]
mov rsp, rbp
pop rbp
ret
lea rcx, str.dbghelp.dll
call sub.KERNEL32.dll_LoadLibraryA
mov qword [0x1401dc9b0], rax
test rax, rax
je 0x1400ed306
lea rdx, str.SymInitialize
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc930], rax
lea rdx, str.SymCleanup
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc938], rax
lea rdx, str.StackWalk64
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc940], rax
lea rdx, str.SymGetOptions
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc948], rax
lea rdx, str.SymSetOptions
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc950], rax
lea rdx, str.SymFunctionTableAccess64
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc958], rax
lea rdx, str.SymGetLineFromAddr64
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc960], rax
lea rdx, str.SymGetModuleBase64
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc968], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc970], rax
lea rdx, str.SymGetSymFromAddr64
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc978], rax
lea rdx, str.UnDecorateSymbolName
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc980], rax
lea rdx, str.SymLoadModule64
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc988], rax
lea rdx, str.SymGetSearchPath
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc990], rax
lea rdx, str.SymUnloadModule64
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc998], rax
lea rdx, str.SymRegisterCallback64
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc9a0], rax
lea rdx, str.ImagehlpApiVersion
mov rcx, qword [0x1401dc9b0]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1401dc9a8], rax
lea rax, [0x1401dc930]
mov rsp, rbp
pop rbp
ret
xor eax, eax
mov rsp, rbp
pop rbp
ret
Function at 0x1400ed310
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x890
mov qword [rbp - 0x868], rbx
mov qword [rbp - 0x860], rsi
mov qword [rbp - 0x858], rdi
mov qword [rbp - 0x850], 0
mov qword [rbp - 0x848], 0
lea rsi, reloc.WS2_32.dll_ntohs
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov r8d, 0x800
lea rdx, [rbp - 0x840]
mov rcx, qword [rbp - 0x38]
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov edi, eax
test edi, edi
je 0x1400ed3cb
mov r9d, edi
mov qword [rbp - 0x30], r9
lea r10, [rbp - 0x840]
mov qword [rbp - 0x28], r10
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x850]
lea rcx, [0x140183520]
call fcn.1400ab270
lea r9, [0x1401759f0]
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x20], 1
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x850]
lea rcx, [0x140183520]
call fcn.1400ab270
add rsi, 0x10
lea rax, str._NT_SYMBOL_PATH
cmp rsi, rax
jb 0x1400ed34d
lea rbx, [0x1401c2d60]
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], 1
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x850]
lea rcx, [0x140183520]
call fcn.1400ab270
mov rdx, qword [rbp - 0x848]
mov rax, qword [rbp - 0x850]
mov rbx, qword [rbp - 0x868]
mov rsi, qword [rbp - 0x860]
mov rdi, qword [rbp - 0x858]
mov rsp, rbp
pop rbp
ret

Function at 0x1400ed570
Capabilities:
Resolve dns

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x150
mov qword [rbp - 0x130], rbx
mov qword [rbp - 0x128], rsi
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x120]
call fcn.1400c76e0
lea rcx, [rbp - 0x120]
call fcn.1400c7930
mov rcx, rax
call sub.WS2_32.dll_gethostbyname
mov rsi, rax
lea rcx, [rbp - 0x120]
call fcn.1400c7950
test rsi, rsi
jne 0x1400ed5f1
xor eax, eax
mov rbx, qword [rbp - 0x130]
mov rsi, qword [rbp - 0x128]
mov rsp, rbp
pop rbp
ret
mov rdx, rsi
mov rcx, qword [rbp + 0x10]
mov rbx, qword [rcx]
call qword [rbx + 0x28]
mov rdx, rsi
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + gethostbyaddr]
mov eax, 1
mov rbx, qword [rbp - 0x130]
mov rsi, qword [rbp - 0x128]
mov rsp, rbp
pop rbp
ret

Function at 0x1400f2250
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], rbx
mov qword [rbp + 0x10], rcx
call fcn.1400db910
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax]
lea rcx, [rbp - 0x40]
call fcn.140015f80
mov rbx, qword [rbp + 0x10]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.140106de0
lea rcx, [rbp - 0x30]
call fcn.140106eb0
xor al, 1
je 0x1400f22d0
lea rcx, [rbp - 0x30]
call fcn.140106ee0
mov edx, eax
lea rcx, [rbp - 0x40]
call fcn.14000ccd0
lea rcx, [rbp - 0x30]
call fcn.140106fd0
lea rcx, [rbp - 0x30]
call fcn.140106eb0
xor al, 1
jne 0x1400f22a6
lea rcx, [rbp - 0x40]
call fcn.140015fd0
mov rbx, qword [rbp - 0x48]
mov rsp, rbp
pop rbp
ret
Function at 0x1400fb5d0
Capabilities:
Hash data using murmur3

Disassembly:
push rbx
push rsi
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
movabs rbx, 0x87c37b91114253d5
mul rbx
rol rax, 0x1f
movabs rsi, 0x4cf5ad432745937f
mul rsi
xor rax, rcx
rol rax, 0x1b
lea rax, [rax + rax*4 + 0x52dce729]
pop rsi
pop rbx
ret

Function at 0x1400fcca0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rsi, rcx
xor edi, edi
mov rcx, rsi
call fcn.1400dfd10
xor al, 1
je 0x1400fccd8
inc rdi
mov rcx, rsi
call fcn.1400dfd90
mov rcx, rsi
call fcn.1400dfd10
xor al, 1
jne 0x1400fccc1
mov rax, rdi
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret

Function at 0x1400fccf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rdi
mov qword [rbp + 0x18], rdx
mov rbx, rcx
mov rsi, qword [rbp + 0x18]
lea rdi, [rbp - 0x50]
mov ecx, 0xa
rep movsq qword [rdi], qword [rsi]
lea rcx, [rbp - 0x50]
call fcn.1400dfd10
xor al, 1
je 0x1400fcd5c
mov rdx, rbx
mov qword [rbp - 0x58], rdx
lea rcx, [rbp - 0x50]
call fcn.1400dfd50
mov ecx, eax
mov rdx, qword [rbp - 0x58]
call fcn.140107f00
lea rcx, [rbp - 0x50]
call fcn.1400dfd90
lea rcx, [rbp - 0x50]
call fcn.1400dfd10
xor al, 1
jne 0x1400fcd2b
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov rbx, qword [rbp - 0x70]
mov rsi, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x60]
mov rsp, rbp
pop rbp
ret

Function at 0x1400fd1e0
Capabilities:
Hash data using murmur3

Disassembly:
push rbx
push rsi
mov rax, rcx
shr rax, 0x21
xor rax, rcx
movabs rbx, 0xff51afd7ed558ccd
mul rbx
mov rcx, rax
shr rax, 0x21
xor rax, rcx
movabs rsi, 0xc4ceb9fe1a85ec53
mul rsi
mov rcx, rax
shr rax, 0x21
xor rax, rcx
pop rsi
pop rbx
ret

Function at 0x1400fe950
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rdi, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.14000c270
xor al, 1
je 0x1400fe990
mov rcx, rsi
call fcn.1401099b0
mov edx, eax
mov rcx, rdi
call fcn.1400e3a30
mov rcx, rsi
call fcn.14000c270
xor al, 1
jne 0x1400fe972
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret

Function at 0x140109040
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rdi, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.14000c270
xor al, 1
je 0x140109080
mov rcx, rsi
call fcn.140113ae0
mov edx, eax
mov rcx, rdi
call fcn.140106d40
mov rcx, rsi
call fcn.14000c270
xor al, 1
jne 0x140109062
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
Function at 0x14010a3f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rdi, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.14000c270
xor al, 1
je 0x14010a430
mov rcx, rsi
call fcn.140114d70
mov edx, eax
mov rcx, rdi
call fcn.1400e3a30
mov rcx, rsi
call fcn.14000c270
xor al, 1
jne 0x14010a412
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret

Function at 0x14010b730
Capabilities:
Delete registry key

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x2e0
mov qword [rbp - 0x2b8], rbx
mov qword [rbp - 0x2b0], rsi
mov qword [rbp - 0x2a8], rdi
mov qword [rbp - 0x2a0], r12
mov qword [rbp - 0x298], r13
mov qword [rbp - 0x290], r14
mov qword [rbp - 0x288], r15
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov ecx, dword [rbp + 0x10]
call fcn.140115780
test al, al
je 0x14010b84c
call fcn.1401157a0
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x150], rax
mov qword [rbp - 0x148], rdx
lea rdx, [rbp - 0x150]
lea rcx, [rbp - 0x260]
call fcn.1400c90d0
xor r9d, r9d
mov r8d, dword [rbp + 0x10]
mov qword [rbp - 0x280], r8
mov qword [rbp - 0x278], r9
lea rcx, [rbp - 0x260]
sub rsp, 0x20
call fcn.14000e7a0
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x278]
mov r8, qword [rbp - 0x280]
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
mov eax, dword [0x1401dab80]
mov rbx, qword gs:[0x58]
mov rsi, qword [rbx + rax*8]
mov edi, 0xd38
call qword [rsi + rdi]
add rsp, 0x20
mov dword [rbp - 0x270], eax
sub rsp, 8
call fcn.14010b82f
add rsp, 8
jmp 0x14010b844
mov esi, dword [rbp - 0x270]
jmp 0x14010b895
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.1400c90d0
lea rcx, [rbp - 0x140]
call fcn.14000e7a0
mov rdx, rax
mov rcx, qword [rbp + 0x20]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov esi, eax
lea rcx, [rbp - 0x140]
call fcn.14000e7b0
mov r9d, esi
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rdx, [0x14010b910]
mov qword [rbp - 0x18], rdx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], reloc.WS2_32.dll_shutdown
lea rdx, [rbp - 0x10]
mov ecx, 0x163
sub rsp, 0x20
call fcn.14010b180
add rsp, 0x20
mov rbx, qword [rbp - 0x2b8]
mov rsi, qword [rbp - 0x2b0]
mov rdi, qword [rbp - 0x2a8]
mov r12, qword [rbp - 0x2a0]
mov r13, qword [rbp - 0x298]
mov r14, qword [rbp - 0x290]
mov r15, qword [rbp - 0x288]
mov rsp, rbp
pop rbp
ret
Function at 0x14010b9a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1c0
mov qword [rbp - 0x198], rbx
mov qword [rbp - 0x190], rsi
mov qword [rbp - 0x188], rdi
mov qword [rbp - 0x180], r12
mov qword [rbp - 0x178], r13
mov qword [rbp - 0x170], r14
mov qword [rbp - 0x168], r15
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 0x150], 0xffffffff
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.1400c90d0
push 0
push 0
lea r9, [rbp - 0x150]
xor r8d, r8d
mov qword [rbp - 0x160], r8
mov qword [rbp - 0x158], r9
lea rcx, [rbp - 0x140]
sub rsp, 0x20
call fcn.14000e7a0
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x158]
mov r8, qword [rbp - 0x160]
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r9d, eax
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rbx, [0x14010bb00]
mov qword [rbp - 0x18], rbx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], reloc.WS2_32.dll_shutdown
lea rdx, [rbp - 0x10]
mov ecx, 0x1ef
call fcn.14010b180
sub rsp, 8
call fcn.14010baa8
add rsp, 8
jmp 0x14010babd
mov eax, dword [rbp - 0x150]
mov rbx, qword [rbp - 0x198]
mov rsi, qword [rbp - 0x190]
mov rdi, qword [rbp - 0x188]
mov r12, qword [rbp - 0x180]
mov r13, qword [rbp - 0x178]
mov r14, qword [rbp - 0x170]
mov r15, qword [rbp - 0x168]
mov rsp, rbp
pop rbp
ret

Function at 0x14010bbb0
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1b0
mov qword [rbp - 0x188], rbx
mov qword [rbp - 0x180], rsi
mov qword [rbp - 0x178], rdi
mov qword [rbp - 0x170], r12
mov qword [rbp - 0x168], r13
mov qword [rbp - 0x160], r14
mov qword [rbp - 0x158], r15
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rdx, qword [r9 + 8]
mov rax, qword [r9]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.1400c90d0
push qword [rbp + 0x10]
push qword [rbp + 0x18]
mov r9d, dword [rbp + 0x20]
xor r8d, r8d
mov qword [rbp - 0x150], r8
mov qword [rbp - 0x148], r9
lea rcx, [rbp - 0x140]
sub rsp, 0x20
call fcn.14000e7a0
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x148]
mov r8, qword [rbp - 0x150]
mov rcx, qword [rbp + 0x30]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x30
mov r9d, eax
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rbx, [0x14010bd00]
mov qword [rbp - 0x18], rbx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], reloc.WS2_32.dll_shutdown
lea rdx, [rbp - 0x10]
mov ecx, 0x2de
call fcn.14010b180
sub rsp, 8
call fcn.14010bcb4
add rsp, 8
jmp 0x14010bcc9
mov rbx, qword [rbp - 0x188]
mov rsi, qword [rbp - 0x180]
mov rdi, qword [rbp - 0x178]
mov r12, qword [rbp - 0x170]
mov r13, qword [rbp - 0x168]
mov r14, qword [rbp - 0x160]
mov r15, qword [rbp - 0x158]
mov rsp, rbp
pop rbp
ret
Function at 0x14010c110
Capabilities:
Delete registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1a0
mov qword [rbp - 0x178], rbx
mov qword [rbp - 0x170], rsi
mov qword [rbp - 0x168], rdi
mov qword [rbp - 0x160], r12
mov qword [rbp - 0x158], r13
mov qword [rbp - 0x150], r14
mov qword [rbp - 0x148], r15
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.1400c90d0
lea rcx, [rbp - 0x140]
sub rsp, 0x20
call fcn.14000e7a0
add rsp, 0x20
mov rdx, rax
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegDeleteValueW
add rsp, 0x20
mov r9d, eax
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rbx, [0x14010c230]
mov qword [rbp - 0x18], rbx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], reloc.WS2_32.dll_shutdown
lea rdx, [rbp - 0x10]
mov ecx, 0x16e
call fcn.14010b180
sub rsp, 8
call fcn.14010c1e4
add rsp, 8
jmp 0x14010c1f9
mov rbx, qword [rbp - 0x178]
mov rsi, qword [rbp - 0x170]
mov rdi, qword [rbp - 0x168]
mov r12, qword [rbp - 0x160]
mov r13, qword [rbp - 0x158]
mov r14, qword [rbp - 0x150]
mov r15, qword [rbp - 0x148]
mov rsp, rbp
pop rbp
ret

Function at 0x14010c370
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rdi, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.14000c270
xor al, 1
je 0x14010c3b0
mov rcx, rsi
call fcn.140113ae0
mov edx, eax
mov rcx, rdi
call fcn.1401159b0
mov rcx, rsi
call fcn.14000c270
xor al, 1
jne 0x14010c392
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret