joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421810
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x00b68480], 1
je 0x421826
call fcn.00421780
mov ecx, dword [0x00b379c8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x421850
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00421600
cmp qword [0x00b6b050], 0
mov rsi, rax
je 0x42183a
test rax, rax
je 0x42183a
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rsi + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [rsi + 0x68]
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x30], rax
call fcn.004216c0
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsi + 0xb8], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov r8, rbp
mov rdx, rdi
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov rcx, rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x421940
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rdx, rsi
mov ecx, dword [0x00b379c8]
mov dword [rsi + 0xbc], 0
mov dword [rsi + 0xc0], eax
movzx eax, byte [rsi + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x421940
mov rbx, rsi
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
Function at 0x475fd0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
jmp 0x475ff8
call r12
cmp dword [rax], 4
jne 0x476016
mov rcx, rbp
call fcn.00475ed0
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x475ff0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x4ab4a0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp fcn.00401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0041f770
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.0041f770
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x140007530
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], 0
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rcx
xor eax, eax
mov rcx, qword [rsp + 0x38]
cmp qword [rcx + 0x30], 0
mov byte [rsp + 0x27], al
je 0x1400075a7
cmp qword [rsp + 0x30], 0
sete al
mov byte [rsp + 0x27], al
mov al, byte [rsp + 0x27]
test al, 1
jne 0x1400075b8
jmp 0x1400075ec
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.140007600
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
jmp 0x140007584
mov rax, qword [rsp + 0x30]
add rsp, 0x68
ret

Function at 0x140008830
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x138
mov qword [rsp + 0x20], rax
jne 0x14000885e
mov rcx, qword [rsp + 0x20]
call fcn.140008920
jmp 0x14000887f
mov eax, 0x270
mov rcx, qword [rsp + 0x20]
cmp eax, dword [rcx]
ja 0x14000887a
mov rcx, qword [rsp + 0x20]
call fcn.1400089f0
jmp 0x14000887f
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
mov edx, ecx
add edx, 1
mov dword [rax], edx
mov ecx, ecx
mov r8d, ecx
mov r8, qword [rax + r8*8 + 8]
mov qword [rsp + 0x28], r8
mov r8, qword [rsp + 0x28]
shr r8, 0x1d
and r8, qword [rax + 0x1388]
xor r8, qword [rsp + 0x28]
mov qword [rsp + 0x28], r8
mov r8, qword [rsp + 0x28]
shl r8, 0x11
movabs r9, 0x71d67fffeda60000
and r8, r9
xor r8, qword [rsp + 0x28]
mov qword [rsp + 0x28], r8
mov r8, qword [rsp + 0x28]
shl r8, 0x25
movabs r9, 0xfff7eee000000000
and r8, r9
xor r8, qword [rsp + 0x28]
mov qword [rsp + 0x28], r8
mov r8, qword [rsp + 0x28]
shr r8, 0x2b
xor r8, qword [rsp + 0x28]
mov qword [rsp + 0x28], r8
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret

Function at 0x140008920
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rcx
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x10], 0x138
mov qword [rsp], rax
cmp qword [rsp + 0x10], 0x270
jae 0x1400089e7
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x10]
sub rdx, 0x138
mov r8, qword [rsp]
mov rdx, qword [r8 + rdx*8 + 8]
and rdx, 0xffffffff80000000
mov r9, qword [rsp + 0x10]
sub r9, 0x138
mov r9, qword [r8 + r9*8 + 0x10]
and r9, 0x7fffffff
or rdx, r9
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 8]
shr rdx, 1
mov r9, qword [rsp + 8]
and r9, 1
cmp r9, 0
movabs r9, 0xb5026f5aa96619e9
cmovne rcx, r9
xor rdx, rcx
mov rcx, qword [rsp + 0x10]
sub rcx, 0x138
xor rdx, qword [r8 + rcx*8 + 0x4e8]
mov rcx, qword [rsp + 0x10]
mov qword [r8 + rcx*8 + 8], rdx
mov rax, qword [rsp + 0x10]
add rax, 1
mov qword [rsp + 0x10], rax
jmp 0x14000893b
add rsp, 0x20
ret
Function at 0x1400089f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rcx
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], 0
mov qword [rsp], rax
cmp qword [rsp + 0x20], 0x9c
jae 0x140008aa8
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp]
mov rdx, qword [r8 + rdx*8 + 0x9c8]
and rdx, 0xffffffff80000000
mov r9, qword [rsp + 0x20]
mov r9, qword [r8 + r9*8 + 0x9d0]
and r9, 0x7fffffff
or rdx, r9
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x18]
shr rdx, 1
mov r9, qword [rsp + 0x18]
and r9, 1
cmp r9, 0
movabs r9, 0xb5026f5aa96619e9
cmovne rcx, r9
xor rdx, rcx
mov rcx, qword [rsp + 0x20]
xor rdx, qword [r8 + rcx*8 + 0xea8]
mov rcx, qword [rsp + 0x20]
mov qword [r8 + rcx*8 + 8], rdx
mov rax, qword [rsp + 0x20]
add rax, 1
mov qword [rsp + 0x20], rax
jmp 0x140008a0b
jmp 0x140008aad
cmp qword [rsp + 0x20], 0x137
jae 0x140008b51
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp]
mov rdx, qword [r8 + rdx*8 + 0x9c8]
and rdx, 0xffffffff80000000
mov r9, qword [rsp + 0x20]
mov r9, qword [r8 + r9*8 + 0x9d0]
and r9, 0x7fffffff
or rdx, r9
mov qword [rsp + 0x10], rdx
mov rdx, qword [rsp + 0x10]
shr rdx, 1
mov r9, qword [rsp + 0x10]
and r9, 1
cmp r9, 0
movabs r9, 0xb5026f5aa96619e9
cmovne rcx, r9
xor rdx, rcx
mov rcx, qword [rsp + 0x20]
sub rcx, 0x138
xor rdx, qword [r8 + rcx*8 + 0x4e8]
mov rcx, qword [rsp + 0x20]
mov qword [r8 + rcx*8 + 8], rdx
mov rax, qword [rsp + 0x20]
add rax, 1
mov qword [rsp + 0x20], rax
jmp 0x140008aad
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp]
mov rdx, qword [r8 + rdx*8 + 0x9c8]
and rdx, 0xffffffff80000000
mov r9, qword [r8 + 8]
and r9, 0x7fffffff
or rdx, r9
mov qword [rsp + 8], rdx
mov rdx, qword [rsp + 8]
shr rdx, 1
mov r9, qword [rsp + 8]
and r9, 1
cmp r9, 0
movabs r9, 0xb5026f5aa96619e9
cmovne rcx, r9
xor rdx, rcx
xor rdx, qword [r8 + 0x4e0]
mov rcx, qword [rsp + 0x20]
mov qword [r8 + rcx*8 + 8], rdx
mov dword [r8], 0
add rsp, 0x30
ret
Function at 0x14000bc60
Capabilities:
Encrypt data using chaskey

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x18], rcx
mov rax, qword [rsp + 0x28]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov dword [rsp + 0x14], 0
cmp dword [rsp + 0x14], 4
jae 0x14000bcc9
mov rax, qword [rsp]
mov ecx, dword [rsp + 0x14]
mov edx, ecx
mov ecx, dword [rax + rdx*4]
mov rax, qword [rsp + 8]
mov r8d, dword [rsp + 0x14]
mov edx, r8d
xor ecx, dword [rax + rdx*4]
mov dword [rax + rdx*4], ecx
mov eax, dword [rsp + 0x14]
add eax, 1
mov dword [rsp + 0x14], eax
jmp 0x14000bc8e
mov dword [rsp + 0x14], 0
cmp dword [rsp + 0x14], 0x10
jae 0x14000be06
mov rax, qword [rsp + 8]
mov ecx, dword [rax + 4]
mov rax, qword [rsp + 8]
add ecx, dword [rax]
mov dword [rax], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax + 4]
shr ecx, 0x1b
mov rax, qword [rsp + 8]
mov edx, dword [rax + 4]
shl edx, 5
or ecx, edx
mov rax, qword [rsp + 8]
xor ecx, dword [rax]
mov rax, qword [rsp + 8]
mov dword [rax + 4], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax + 0xc]
mov rax, qword [rsp + 8]
add ecx, dword [rax + 8]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax + 0xc]
shr ecx, 0x18
mov rax, qword [rsp + 8]
mov edx, dword [rax + 0xc]
shl edx, 8
or ecx, edx
mov rax, qword [rsp + 8]
xor ecx, dword [rax + 8]
mov rax, qword [rsp + 8]
mov dword [rax + 0xc], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax + 4]
mov rax, qword [rsp + 8]
add ecx, dword [rax + 8]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax]
shr ecx, 0x10
mov rax, qword [rsp + 8]
mov edx, dword [rax]
shl edx, 0x10
or ecx, edx
mov rax, qword [rsp + 8]
add ecx, dword [rax + 0xc]
mov rax, qword [rsp + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax + 0xc]
shr ecx, 0x13
mov rax, qword [rsp + 8]
mov edx, dword [rax + 0xc]
shl edx, 0xd
or ecx, edx
mov rax, qword [rsp + 8]
xor ecx, dword [rax]
mov rax, qword [rsp + 8]
mov dword [rax + 0xc], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax + 4]
shr ecx, 0x19
mov rax, qword [rsp + 8]
mov edx, dword [rax + 4]
shl edx, 7
or ecx, edx
mov rax, qword [rsp + 8]
xor ecx, dword [rax + 8]
mov rax, qword [rsp + 8]
mov dword [rax + 4], ecx
mov rax, qword [rsp + 8]
mov ecx, dword [rax + 8]
shr ecx, 0x10
mov rax, qword [rsp + 8]
mov edx, dword [rax + 8]
shl edx, 0x10
or ecx, edx
mov rax, qword [rsp + 8]
mov dword [rax + 8], ecx
mov eax, dword [rsp + 0x14]
add eax, 1
mov dword [rsp + 0x14], eax
jmp 0x14000bcd1
mov dword [rsp + 0x14], 0
cmp dword [rsp + 0x14], 4
jae 0x14000be49
mov rax, qword [rsp]
mov ecx, dword [rsp + 0x14]
mov edx, ecx
mov ecx, dword [rax + rdx*4]
mov rax, qword [rsp + 8]
mov r8d, dword [rsp + 0x14]
mov edx, r8d
xor ecx, dword [rax + rdx*4]
mov dword [rax + rdx*4], ecx
mov eax, dword [rsp + 0x14]
add eax, 1
mov dword [rsp + 0x14], eax
jmp 0x14000be0e
add rsp, 0x30
ret
Function at 0x140021850
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x128
mov qword [rsp + 0x120], rcx
mov rax, qword [rsp + 0x120]
mov byte [rsp + 0x11f], 0
mov rcx, rax
lea rdx, [rsp + 0xf8]
lea r8, [rsp + 0x11f]
mov qword [rsp + 0x50], rax
call fcn.140020070
lea rcx, [rsp + 0xf8]
call fcn.140016d40
test al, 1
jne 0x1400218a6
jmp 0x1400218c1
mov rax, qword [rsp + 0x50]
add rax, 0x68
lea rcx, [rsp + 0xf8]
mov rdx, rax
call fcn.1400139a0
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xd8]
lea r8, [rsp + 0xf8]
call fcn.140020d20
mov byte [rsp + 0xd7], 0
mov al, byte [rsp + 0xd7]
xor al, 0xff
test al, 1
jne 0x1400218f9
jmp 0x1400219e2
lea rcx, [rsp + 0xb8]
call fcn.140014290
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x28]
lea rcx, [rsp + 0x78]
lea r8, [0x14011d5a1]
mov qword [rsp + 0x48], rdx
mov rdx, r8
mov r8d, 0x24
mov qword [rsp + 0x40], rax
call fcn.14002f4b0
mov ecx, 4
mov edx, 8
call fcn.140004a70
lea rcx, [rsp + 0x58]
mov edx, eax
call fcn.140005060
lea rcx, [rsp + 0x98]
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x78]
call fcn.140013d00
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx]
lea r8, [rsp + 0xd8]
mov qword [rsp + 0x38], rdx
mov rdx, r8
lea r8, [rsp + 0x98]
mov r9, qword [rsp + 0x38]
call qword [r9 + 0x28]
and al, 1
mov byte [rsp + 0xd7], al
lea rcx, [rsp + 0x98]
call fcn.140001770
lea rcx, [rsp + 0x58]
call fcn.140001770
lea rcx, [rsp + 0x78]
call fcn.140001770
test byte [rsp + 0xd7], 1
jne 0x1400219d0
mov ecx, 0x1388
call fcn.140004570
lea rcx, [rsp + 0xb8]
call fcn.140016120
jmp 0x1400218e3
test byte [rsp + 0x11f], 1
je 0x140021a1f
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x28]
mov rdx, qword [rcx]
mov r8d, 2
mov qword [rsp + 0x30], rdx
mov edx, r8d
mov r9, qword [rsp + 0x30]
call qword [r9 + 0x40]
xor ecx, ecx
mov byte [rsp + 0x2f], al
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0xd8]
call fcn.140001770
lea rcx, [rsp + 0xf8]
call fcn.140001770
nop
add rsp, 0x128
ret
Function at 0x140034b90
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0x98], rcx
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x68], 0
mov qword [rsp + 0x48], rax
je 0x140034bc6
mov rax, qword [rsp + 0x48]
test byte [rax + 0x71], 1
jne 0x140034bd3
mov byte [rsp + 0xa7], 1
jmp 0x140034d4c
call fcn.140028f40
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx]
mov qword [rsp + 0x40], rdx
mov edx, eax
mov r8, qword [rsp + 0x40]
call qword [r8 + 0x18]
mov dword [rsp + 0x94], eax
call fcn.140028f40
mov dword [rsp + 0x90], eax
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x94]
call fcn.1400291b0
test al, 1
jne 0x140034c25
jmp 0x140034c32
mov byte [rsp + 0xa7], 0
jmp 0x140034d4c
mov qword [rsp + 0x88], 0x20
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x68]
lea r9, [rsp + 0x80]
add rax, 0x74
mov rdx, rsp
lea r8, [rsp + 0x58]
mov qword [rdx + 0x20], r8
lea r8, [rsp + 0x60]
mov rdx, rax
call fcn.140034ea0
mov r10d, eax
test eax, eax
mov dword [rsp + 0x3c], r10d
je 0x140034ca5
jmp 0x140034c81
mov eax, dword [rsp + 0x3c]
sub eax, 1
je 0x140034cae
jmp 0x140034c93
mov eax, dword [rsp + 0x3c]
sub eax, 3
je 0x140034d2e
jmp 0x140034d44
mov rax, qword [rsp + 0x48]
mov byte [rax + 0x71], 0
xor eax, eax
mov ecx, eax
lea rdx, [rsp + 0x60]
mov r8, qword [rsp + 0x58]
sub r8, rdx
mov qword [rsp + 0x50], r8
cmp rcx, qword [rsp + 0x50]
jae 0x140034d14
lea rcx, [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov r9, qword [rdx + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov qword [rsp + 0x30], rax
call fcn.1400dd918
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
je 0x140034d14
mov byte [rsp + 0xa7], 0
jmp 0x140034d4c
mov rax, qword [rsp + 0x48]
mov cl, byte [rax + 0x71]
xor cl, 0xff
and cl, 1
mov byte [rsp + 0xa7], cl
jmp 0x140034d4c
mov rax, qword [rsp + 0x48]
mov byte [rax + 0x71], 0
mov byte [rsp + 0xa7], 1
jmp 0x140034d4c
mov byte [rsp + 0xa7], 0
mov al, byte [rsp + 0xa7]
and al, 1
movzx eax, al
add rsp, 0xa8
ret

Function at 0x140044520
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
call fcn.1400445f0
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.140044600
lea rax, [0x140044670]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
add rax, 8
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rax
call fcn.1400446d0
xor r8d, r8d
mov ecx, r8d
xor edx, edx
lea r8, [0x140044670]
mov r9, rax
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
call fcn.1400d6330
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
cmp qword [rcx], 0
je 0x1400445bf
lea rcx, [rsp + 0x50]
call fcn.1400446e0
jmp 0x1400445d5
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14007ced4
lea rcx, [rsp + 0x50]
call fcn.140044710
nop
add rsp, 0x68
ret
Function at 0x140044a30
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
call fcn.140044b00
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.140044b10
lea rax, [0x140044b80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
add rax, 8
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rax
call fcn.140044be0
xor r8d, r8d
mov ecx, r8d
xor edx, edx
lea r8, [0x140044b80]
mov r9, rax
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
call fcn.1400d6330
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
cmp qword [rcx], 0
je 0x140044acf
lea rcx, [rsp + 0x50]
call fcn.140044bf0
jmp 0x140044ae5
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.14007ced4
lea rcx, [rsp + 0x50]
call fcn.140044c20
nop
add rsp, 0x68
ret
Function at 0x140045270
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rcx
push r11
ucomiss xmm5, xmm7
push r13
or r11w, r13w
push r8
emms
push rbx
emms
push r9
emms
push r14
mulss xmm1, xmm8
pop r14
nop
pop r9
sub bx, 0x10
pop rbx
xorps xmm0, xmm11
pop r8
minps xmm4, xmm0
pop r13
dec r11d
pop r11
mov dword [rsp + 0xc], 0
push rax
mov rax, 1
push rbx
packssdw mm6, mm3
push r15
nop
emms
push r13
sbb r15w, r13w
pmulhuw mm6, mm1
nop
push r14
punpcklwd mm0, mm1
rcl bl, 0x11
psrlq mm2, 0x1e
not r15b
push rax
minps xmm0, xmm9
pxor mm4, mm5
sub r15d, 0xa
addss xmm1, xmm14
emms
pop rax
mulss xmm12, xmm4
pcmpgtd mm3, mm0
paddb mm1, mm0
neg r15d
pop r14
nop
nop
nop
pop r13
not r15b
not r15b
pop r15
nop
pop rbx
dec rax
jne 0x1400452c0
pop rax
mov dword [rsp + 8], 0x1f1ca4c9
push r12
psrlw mm5, 0x5d
push r8
nop
pslld mm4, 0x52
push rax
mov r8w, 0x16
emms
paddd mm1, mm3
push r14
psraw mm6, 0xd
rcr r12w, 1
cmp r8, rax
emms
pop r14
not eax
or r8w, r12w
shr r8b, 7
pop rax
emms
nop
pop r8
subps xmm10, xmm9
pop r12
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 0xc]
mov edx, ecx
cmp byte [rax + rdx], 0
je 0x14004545e
push rdx
psllq mm5, 0x3e
push r9
pcmpeqb mm6, mm1
push rax
inc r9d
push r11
paddsb mm7, mm3
push r15
inc edx
pop r15
emms
pop r11
maxss xmm14, xmm2
pop rax
add dl, r9b
pop r9
emms
pop rdx
mov rax, qword [rsp + 0x10]
mov ecx, dword [rsp + 0xc]
mov edx, ecx
add edx, 1
mov dword [rsp + 0xc], edx
mov ecx, ecx
mov r8d, ecx
add rax, r8
mov r9w, word [rax]
mov word [rsp + 6], r9w
push rbx
mov rbx, 3
push r13
emms
emms
neg r13d
psubw mm5, mm2
movlhps xmm10, xmm9
push r8
nop
psrld mm1, 0x39
maxss xmm8, xmm15
emms
neg r13b
pop r8
pslld mm6, 0x4e
rcl r13d, 8
pmaxsw mm6, mm7
psrlq mm7, 0x43
nop
addss xmm0, xmm9
pop r13
dec rbx
jne 0x1400453d2
pop rbx
movzx ecx, word [rsp + 6]
mov edx, dword [rsp + 8]
shr edx, 8
mov r10d, dword [rsp + 8]
shl r10d, 0x18
or edx, r10d
add ecx, edx
xor ecx, dword [rsp + 8]
mov dword [rsp + 8], ecx
push rdx
comiss xmm10, xmm13
push r15
dec r15d
push rcx
psllq mm1, 9
push r13
emms
pop r13
and ecx, edx
pop rcx
pslld mm2, 0x10
pop r15
emms
pop rdx
jmp 0x140045366
push r14
inc r14
push rcx
cmp r14, rcx
psrld mm4, 0x69
push rbx
mulss xmm15, xmm9
paddusw mm7, mm0
nop
pop rbx
dec rcx
pxor mm5, mm2
pop rcx
shl r14d, 0xf
pop r14
mov eax, dword [rsp + 8]
add rsp, 0x18
ret
Function at 0x1400509e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0xc8
mov rax, rdx
mov r8, rdx
mov qword [rsp + 0xc0], r8
mov qword [rsp + 0xb8], rcx
mov rcx, qword [rsp + 0xb8]
mov r8, rcx
add r8, 0x58
mov dword [rsp + 0xa8], 3
mov qword [rsp + 0x68], rcx
mov rcx, r8
lea r8, [rsp + 0xa8]
mov qword [rsp + 0x60], rdx
mov rdx, r8
mov qword [rsp + 0x58], rax
call fcn.140013390
mov rcx, rax
call fcn.1400017a0
mov dword [rsp + 0xac], eax
mov rcx, qword [rsp + 0x68]
add rcx, 0x58
mov dword [rsp + 0x84], 3
lea rdx, [rsp + 0x84]
call fcn.140013390
mov rcx, rax
call fcn.1400017a0
xor r8d, r8d
lea rcx, [rsp + 0x88]
mov rdx, rax
call fcn.140038b80
mov rcx, qword [rsp + 0x68]
add rcx, 0x118
mov qword [rsp + 0x50], rax
call fcn.1400073b0
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rdx, rax
mov r9d, 0x20019
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0
jne 0x140050c5c
lea rcx, [rsp + 0x88]
call fcn.1400073b0
mov rcx, qword [rsp + 0x68]
add rcx, 0x58
mov dword [rsp + 0x7c], 2
lea rdx, [rsp + 0x7c]
mov qword [rsp + 0x48], rax
call fcn.140013390
mov rcx, rax
call fcn.1400073b0
xor r8d, r8d
mov ecx, r8d
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rcx
mov rcx, rdx
mov rdx, rax
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0xea
jne 0x140050bfc
xor r8d, r8d
mov eax, dword [rsp + 0xac]
mov edx, eax
lea rcx, [rsp + 0x88]
call fcn.14003e890
lea rcx, [rsp + 0x88]
call fcn.1400073b0
mov rcx, qword [rsp + 0x68]
add rcx, 0x58
mov dword [rsp + 0x78], 2
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x38], rax
call fcn.140013390
mov rcx, rax
call fcn.1400073b0
xor r8d, r8d
mov ecx, r8d
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rcx
mov rcx, rdx
mov rdx, rax
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x80], eax
jmp 0x140050b4e
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x80], 0
je 0x140050c3d
mov rax, qword [rsp + 0x68]
add rax, 0x78
mov rcx, qword [rsp + 0x60]
mov rdx, rax
call fcn.140005ff0
mov dword [rsp + 0x74], 1
jmp 0x140050c7c
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x88]
call fcn.140016c60
mov dword [rsp + 0x74], 1
jmp 0x140050c7c
mov rax, qword [rsp + 0x68]
add rax, 0x78
mov rcx, qword [rsp + 0x60]
mov rdx, rax
call fcn.140005ff0
mov dword [rsp + 0x74], 1
lea rcx, [rsp + 0x88]
call fcn.140001770
mov rax, qword [rsp + 0x58]
add rsp, 0xc8
ret
Function at 0x140050df0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x60]
mov rcx, rax
add rcx, 0x118
mov qword [rsp + 0x48], rax
call fcn.1400073b0
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov rdx, rax
mov r9d, 0x20006
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0
jne 0x140050ee4
mov rcx, qword [rsp + 0x68]
call fcn.1400017a0
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x44], eax
call fcn.1400073b0
mov rcx, qword [rsp + 0x48]
add rcx, 0x58
mov dword [rsp + 0x54], 2
lea rdx, [rsp + 0x54]
mov qword [rsp + 0x38], rax
call fcn.140013390
mov rcx, rax
call fcn.1400073b0
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
mov rdx, rax
mov r9d, 3
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r10d, dword [rsp + 0x44]
mov dword [rsp + 0x28], r10d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 0
jne 0x140050ecf
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x77], 1
jmp 0x140050ee9
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x77], 0
jmp 0x140050ee9
mov byte [rsp + 0x77], 0
mov al, byte [rsp + 0x77]
and al, 1
movzx eax, al
add rsp, 0x78
ret