joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f8fe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rbp, qword [rcx + 0xaf0]
lea rax, [rsp + 0x28]
mov rbx, qword [rcx + 0xab8]
xorps xmm0, xmm0
mov r14, rdx
mov qword [rsp + 0x20], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
lea rdx, [rbp + 1]
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140017ab0
mov edi, 0x59775c11
sub edi, 0x2d557a06
xor edi, 0x4688821a
mov r9, rax
mov ecx, edi
mov r15d, 0x33f52e0a
xor r15d, 0x53997b8
add r15d, 0x27a34d56
xor r15d, 0x5e7007f7
test rbp, rbp
je 0x1400f90a6
mov rdx, rax
sub rbx, rax
mov r8, rbp
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r15w
ror ecx, 8
xor ax, word [rbx + rdx - 2]
mov word [rdx - 2], ax
sub r8, 1
jne 0x1400f9085
xor ebx, ebx
mov word [r9 + rbp*2], bx
cmp word [rsi + 0xb40], bx
je 0x1400f90f1
mov edx, ebx
cmp qword [rsi + 0xaf0], rbx
jbe 0x1400f90f1
nop dword [rax + rax]
mov rax, qword [rsp + 0x20]
movzx ecx, word [rsi + 0xb40]
mov word [rax + rdx*2], cx
inc rdx
cmp rdx, qword [rsi + 0xaf0]
jb 0x1400f90d1
mov rsi, qword [rsp + 0x20]
lea rax, [r14 + 8]
xorps xmm0, xmm0
mov qword [r14], rax
movups xmmword [rax], xmm0
nop
movabs rdx, 0xffffffff586c50be
sub rdx, 0x8ae7154
xor rdx, 0x1441eb61
add rdx, 0x7fffffff
xor rdx, 0x2403cbf5
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], bx
jne 0x1400f9135
mov rcx, r14
mov qword [r14 + 0x38], rdx
call fcn.140017ab0
cmp qword [r14 + 0x38], rbx
jbe 0x1400f9181
sub rsi, rax
nop
movzx ecx, di
lea rax, [rax + 2]
and cx, r15w
ror edi, 8
xor cx, word [rsi + rax - 2]
inc rbx
mov word [rax - 2], cx
cmp rbx, qword [r14 + 0x38]
jb 0x1400f915d
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
cmp rcx, rax
jne 0x1400f91b3
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0xfe36bc1
add ecx, 0x48f8a1dd
sub ecx, 0x58dc0d6e
rep stosb byte [rdi], al
jmp 0x1400f91b8
call fcn.140099eb0
lea r11, [rsp + 0x60]
mov rax, r14
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140106720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
add rsp, 0xffffffffffffffe0
mov r8, qword [rcx + 0x648]
xor esi, esi
mov rbx, rcx
test r8, r8
je 0x140106750
mov rdi, qword [rcx + 0x640]
jmp 0x140106757
mov rdi, rsi
nop dword [rax]
test r8, r8
je 0x140106770
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
jmp 0x140106773
mov rcx, rsi
cmp rdi, rcx
je 0x14010699f
mov rax, qword [rdi]
cmp qword [rax + 0x28], rdx
je 0x140106792
add rdi, 8
jmp 0x140106757
test r8, r8
je 0x140106864
cmp rdi, qword [rbx + 0x640]
jb 0x140106864
mov rax, qword [rbx + 0x640]
lea rcx, [rax + r8*8]
cmp rdi, rcx
jae 0x140106864
mov rdx, rdi
nop word [rax + rax]
mov rcx, qword [rbx + 0x648]
test rcx, rcx
je 0x1401067e9
mov rax, qword [rbx + 0x640]
lea rax, [rax + rcx*8]
jmp 0x1401067ec
mov rax, rsi
nop
sub rax, 0xffffffffb520a2ca
add rax, 0xffffffffb520a2c2
cmp rdx, rax
jae 0x14010681d
mov rax, qword [rdx + 8]
mov qword [rdx], rax
nop
add rdx, 0x638bf41e
sub rdx, 0x638bf416
jmp 0x1401067c9
test rcx, rcx
je 0x140106864
lea rax, [rcx - 1]
mov qword [rbx + 0x648], rax
test rax, rax
jne 0x140106864
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x140106856
call fcn.140099eb0
mov qword [rbx + 0x640], rsi
mov qword [rbx + 0x650], rsi
mov qword [rbx + 0x648], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x14010688c
mov rax, qword [rcx]
mov edx, 0xf7bfcf3
add edx, 0x395f5456
add edx, 0x277ba709
xor edx, 0x7056f853
call qword [rax]
cmp qword [rbx + 0x648], rsi
je 0x14010699f
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400f0de0
mov rcx, qword [rsp + 0x30]
mov r10d, 0x13094131
xor r10d, 0x3c5a7fe8
xor r10d, 0x2f533e79
mov r8d, dword [rsp + 0x34]
mov eax, ecx
mov r9, qword [rbx + 0x648]
sub eax, r8d
cdq
idiv dword [rbx + 0x648]
cmp eax, r10d
cmovl r10d, eax
test r9, r9
je 0x140106957
mov rdx, qword [rbx + 0x640]
lea r11, [rdx + r9*8]
cmp rdx, r11
je 0x140106957
mov r9d, r10d
xor r9d, 0x1d816b1d
xor r8d, 0x1d816b1d
nop dword [rax]
mov rcx, qword [rdx]
mov eax, esi
xor eax, 0x1d816b1d
add esi, r10d
sub rdx, 0xfffffffffffffff8
mov dword [rcx + 0x30], eax
mov dword [rcx + 0x34], 0x5a73437f
sub dword [rcx + 0x34], 0x120127fd
sub dword [rcx + 0x34], 0x2af0b065
mov dword [rcx + 0x38], r9d
mov dword [rcx + 0x3c], r8d
cmp rdx, r11
jne 0x140106913
mov rcx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140106997
sub ecx, r8d
mov dword [rax + 0x14], 0x6d2adcef
sub dword [rax + 0x14], 0x318c3bce
sub dword [rax + 0x14], 0x1e1d3604
xor ecx, 0x1d816b1d
xor r8d, 0x1d816b1d
mov dword [rax + 0x10], ecx
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov rcx, rbx
call fcn.1400f0540
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
sub rsp, 0xffffffffffffffe0
pop rdi
ret
Function at 0x1401069b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
add rsp, 0xffffffffffffffe0
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x78]
mov rdx, qword [rbx + 0x648]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140102d60
lea rcx, [rbx + 0x640]
lea rdx, [rsp + 0x30]
call fcn.1401065e0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1401069b0
push rbx
nop
add rsp, 0x239bb21f
sub rsp, 0x239bb23f
cmp qword [rcx + 0x648], 0
mov rbx, rcx
je 0x140106af3
lea rdx, [rsp + 0x30]
call fcn.1400f0de0
mov r8, qword [rsp + 0x30]
mov r11d, 0x40360e6e
xor r11d, 0x75cedf9d
sub r11d, 0x1ad1c63e
xor r11d, 0x1b270b15
mov r9d, dword [rsp + 0x34]
mov eax, r8d
sub eax, r9d
cdq
idiv dword [rbx + 0x648]
mov rdx, qword [rbx + 0x648]
cmp eax, r11d
cmovl r11d, eax
xor r10d, r10d
test rdx, rdx
je 0x140106aa9
mov rax, qword [rbx + 0x640]
mov qword [rsp + 0x38], rdi
lea rdi, [rax + rdx*8]
cmp rax, rdi
je 0x140106aa4
mov r8d, r11d
xor r8d, 0x1d816b1d
xor r9d, 0x1d816b1d
nop word [rax + rax]
mov rdx, qword [rax]
mov ecx, r10d
xor ecx, 0x1d816b1d
add r10d, r11d
neg rax
add rax, 0xfffffffffffffff8
neg rax
mov dword [rdx + 0x30], ecx
mov dword [rdx + 0x34], 0x2e9f083b
xor dword [rdx + 0x34], 0x3236af24
add dword [rdx + 0x34], 0xd7c3fe
mov dword [rdx + 0x38], r8d
mov dword [rdx + 0x3c], r9d
cmp rax, rdi
jne 0x140106a58
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rax, qword [rbx + 0x660]
test rax, rax
je 0x140106aeb
sub r8d, r9d
mov dword [rax + 0x14], 0x498b99aa
sub dword [rax + 0x14], 0x42510ee5
add dword [rax + 0x14], 0x1646e058
xor r8d, 0x1d816b1d
xor r9d, 0x1d816b1d
mov dword [rax + 0x10], r8d
mov dword [rax + 0x18], r9d
mov dword [rax + 0x1c], r9d
mov rcx, rbx
call fcn.1400f0540
nop
add rsp, 0x680d6cf5
sub rsp, 0x680d6cd5
pop rbx
ret
Function at 0x14011a3dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r8, r8
xchg r8, rsi
mov qword [rsp + 0x18], r8
xchg rsi, r8
xchg rbx, rdi
mov qword [rsp + 0x20], rbx
xchg rdi, rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
xchg r12, rbp
mov r12, rsp
xchg r12, rbp
add rsp, 0xffffffffffffff80
xor esi, esi
mov dword [rsp - 0x1c], ebx
mov dword [rbp - 0x50], 0x491e9e0b
sub dword [rbp - 0x50], 0x3a50414f
xor dword [rbp - 0x50], 0x5bb6c532
sub dword [rbp - 0x50], 0x533e21a9
sub dword [rbp - 0x50], 0x20877a4
mov dword [rbp - 0x4c], 0x4a0ee783
sub dword [rbp - 0x4c], 0x3f3b6e62
add dword [rbp - 0x4c], 0x30a3f597
sub dword [rbp - 0x4c], 0x2cba2b7c
xor dword [rbp - 0x4c], 0xe9443da
mov dword [rbp - 0x48], 0x27dd965f
add dword [rbp - 0x48], 0x80f9c3b
sub dword [rbp - 0x48], 0x25407771
add dword [rbp - 0x48], 0x426f3d7
sub dword [rbp - 0x48], 0xe9baeac
mov dword [rbp - 0x44], 0x53537801
sub dword [rbp - 0x44], 0x38ebf1ca
xor dword [rbp - 0x44], 0x2dfc6e98
sub dword [rbp - 0x44], 0x3775e7b6
mov qword [rbp + 0x10], rsi
xchg r13, r13
lea ebx, [rsi + 1]
xchg rsp, rax
mov rsp, qword [rbp + 0x10]
xchg rsp, rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
mov r13, r13
and cl, 3
shl cl, 1
shl cl, 2
movzx edx, word [rbp + rax*2 - 0x50]
mov r13, r13
mov eax, 0x471b26eb
xor eax, 0x74023443
add eax, 0x3340ce68
sub eax, 0xd43c260
add eax, 0x11934161
shr eax, cl
movzx ecx, al
mov dword [rsp - 0x18], 0x6e893e8f
mov rax, qword [rbp + 0x10]
xor cx, dx
mov word [rbp + rax*2 - 0x20], cx
mov dword [rsp - 0x20], esi
mov rax, qword [rbp + 0x10]
add rax, rbx
xchg rdi, rax
mov qword [rbp + 0x10], rdi
xchg rdi, rax
mov rax, qword [rbp + 0x10]
cmp rax, 8
mov dword [rsp - 0xc], 0x2a998d40
jb 0x14011a4ae
lea rax, [rbp - 0x20]
mov word [rbp - 0x10], si
xorps xmm0, xmm0
mov dword [rsp - 0x34], 0x2f60252f
mov qword [rbp - 0x38], rax
lea r9, [rbp - 0x30]
mov dword [rbp - 0x40], 0x64d8e299
xor dword [rbp - 0x40], 0x451b4883
add dword [rbp - 0x40], 0xd403343
sub dword [rbp - 0x40], 0x2ef1dd4d
lea r8, [rbp - 0x40]
mov dword [rsp + 0x20], esi
xchg r13, r13
xor edx, edx
xor ecx, ecx
movups xmmword [rbp - 0x30], xmm0
call fcn.140135890
xchg r13, r13
xchg r10, rax
mov rdi, r10
xchg r10, rax
test rax, rax
je 0x14011a5c0
xchg rbp, rax
mov rcx, rbp
xchg rbp, rax
call fcn.140110c6c
mov dword [rsp - 0x10], 0x47ca1808
test al, al
je 0x14011a5c0
lea rdx, [rbp - 0x40]
xchg r13, rcx
mov r13, rdi
xchg r13, rcx
call fcn.14010fb4c
test al, al
mov dword [rsp - 0x44], ebx
jne 0x14011a5c3
mov bl, sil
xor eax, eax
lea r11, [rsp + 0x80]
xchg r12, r12
mov rsi, qword [r11 + 0x20]
lea rdi, [rbp - 0x20]
lea ecx, [rax + 8]
rep stosb byte [rdi], al
mov dword [rsp - 0x34], ebx
xchg rdi, r12
mov r12, qword [r11 + 0x28]
xchg rdi, r12
mov al, bl
mov rdi, rdi
mov rbx, qword [r11 + 0x18]
xchg r10, rsp
mov r10, r11
xchg rsp, r10
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140135890
Capabilities:
Execute syscall

Disassembly:
xchg rcx, r10
mov rcx, r10
xchg r10, rcx
mov eax, dword [0x140145004]
cmp qword [0x140145018], 0
mov r11, r11
jne 0x14008e980
syscall
ret
jmp 0x14008f500

Function at 0x140135a00
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
xchg r15, rbp
mov qword [rsp + 0x10], r15
xchg r15, rbp
xchg r12, rsi
mov qword [rsp + 0x18], r12
xchg r12, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
add rsp, 0xffffffffffffffe0
mov dword [rsp - 0x38], 0x729383a2
xchg r12, rcx
mov rbx, r12
xchg r12, rcx
mov rcx, qword [rcx + 0x50]
mov rcx, rcx
test rcx, rcx
je 0x140135b26
mov rax, qword [0x140144310]
xchg r12, r12
movabs rdx, 0x29857f7c38f4517c
sub rdx, 0x22b28f6f
add rdx, 0x5f502477
sub rdx, 0x4114df38
add rdx, 0x7fffffff
add rdx, 0x1accf667
not rax
sub rax, rdx
movabs rdx, 0x65ded22868a18097
sub rdx, 0x1179485b
sub rdx, 0x3dac8ebd
add rdx, 0x6bccf2fd
xor rax, rdx
xchg r15, r15
movabs rdx, 0x563d46ef3e433da6
add rdx, 0x31a7e2e6
xor rdx, 0x1c7c6e9b
xor rdx, 0x50e9c66c
sub rax, rdx
movabs rdx, 0xd34c7d732ad3ca66
add rdx, 0x32f20ff9
sub rdx, 0x54b0f2d6
xor rdx, 0x1070bf48
xor rax, rdx
mov dword [rsp - 0x2c], 0x462ce6c3
movabs rdx, 0x3ca7aabb3647f9a9
xor rdx, 0x7052eaa6
sub rdx, 0x4505812e
add rdx, 0x7fffffff
add rdx, 0x56be5f22
sub rax, rdx
call rax
mov dword [rsp - 0x1c], edx
mov rcx, qword [rbx + 0x48]
movabs rdi, 0x6fe89b9350790057
add rdi, 0x5f25b37
add rdi, 0x1ec788e5
sub rdi, 0x60fab92b
add rdi, 0x7fffffff
add rdi, 0xa768a72
movabs rsi, 0x61cb7f3f4c478a4d
sub rsi, 0x6ea86e9
add rsi, 0x113b5f94
add rsi, 0x98ed364
add rsi, 0x2f67294a
movabs rbp, 0x6fc479b80f707f7f
add rbp, 0x41c5217b
sub rbp, 0x17e2d4ee
add rbp, 0x7fffffff
add rbp, 0x33be034e
test rcx, rcx
je 0x140135be2
mov rbx, rbx
mov rax, qword [0x1401445c0]
rol rax, 1
rol rax, 6
rol rax, 7
rol rax, 0x10
xor rax, rdi
mov dword [rsp - 0x14], edx
not rax
add rax, rsi
rol rax, 0xe
rol rax, 0x1a
rol rax, 1
add rax, rbp
call rax
mov rcx, qword [rbx + 0x40]
mov dword [rsp - 0x10], 0x5235c1a8
test rcx, rcx
je 0x140135c53
mov rax, qword [0x1401445c0]
mov dword [rsp - 0x14], 0x7547c789
rol rax, 0xf
rol rax, 8
rol rax, 5
rol rax, 1
rol rax, 1
xor rax, rdi
not rax
mov dword [rsp - 0x38], 0x7033bb08
add rax, rsi
rol rax, 9
rol rax, 4
rol rax, 0xd
rol rax, 0xa
rol rax, 2
rol rax, 1
rol rax, 1
rol rax, 1
add rax, rbp
mov dword [rsp - 0x44], 0x1a7c6784
call rax
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg rbx, r15
xchg r8, rbp
mov r8, qword [rsp + 0x38]
xchg rbp, r8
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
mov dword [rsp - 0x28], 0x611eeb5f
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140137fb8
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbx, rbp
xchg r9, rsi
mov qword [rsp + 0x10], r9
xchg rsi, r9
xchg rbp, rdi
mov qword [rsp + 0x18], rbp
xchg rdi, rbp
push rbp
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
xchg r15, rbp
mov r15, rsp
xchg r15, rbp
sub rsp, 0x70
mov rdi, r8
mov r15, r15
xchg r15, r14
mov r15, rdx
xchg r14, r15
xchg rsi, r8
mov r8, rcx
xchg rsi, r8
movabs r12, 0x7398656467cb807a
xor r12, 0x5dcc7214
sub r12, 0x38c69fa1
xor r12, 0x33503b02
cmp r9d, 0x60001
jne 0x1401381cf
mov r9, r9
mov dword [rbp - 0x40], 0x1ecd0d8d
xor dword [rbp - 0x40], 0x54e62849
sub dword [rbp - 0x40], 0x34d5d448
add dword [rbp - 0x40], 0x486999d2
add dword [rbp - 0x40], 0x2c462f42
xor edx, edx
mov rbp, rbp
mov dword [rbp - 0x3c], 0x6217439
xor dword [rbp - 0x3c], 0x7cd6832c
sub dword [rbp - 0x3c], 0x79127740
xor dword [rbp - 0x3c], 0x27fb54c0
mov dword [rbp - 0x38], 0xbf01347
xor dword [rbp - 0x38], 0x6f774392
xor dword [rbp - 0x38], 0x16f0a173
xor dword [rbp - 0x38], 0x4f610451
sub dword [rbp - 0x38], 0x2a2ff769
mov ecx, edx
mov rcx, rcx
mov eax, 0x3eef078c
add eax, 0x17816a66
xor eax, 0xf1d0aba
sub eax, 0x1a2287ff
xor eax, 0x6418bd98
rol eax, cl
xchg r12, r12
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
inc rdx
mov dword [rsp - 0x38], 0x635a3fd
cmp rdx, 0xc
jb 0x1401380a8
mov r9d, 0x2de0e21e
sub r9d, 0xf34603e
add r9d, 0xc14dfc
add r9d, 0x4e787ed9
sub r9d, 0x6de63eb6
mov qword [rsp + 0x20], 0xa952b2
add qword [rsp + 0x20], 0x46ede93
xor qword [rsp + 0x20], 0x68f5e183
sub qword [rsp + 0x20], 0x6dedd0ba
lea r8, [rbp - 0x34]
mov rdx, rdi
mov r11, r11
mov rcx, r14
call fcn.1401354e4
xchg r14, rax
mov rbx, r14
xchg r14, rax
lea rdi, [rbp - 0x34]
xchg r14, r14
xor eax, eax
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
mov r14, r14
je 0x14013821a
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
call fcn.140090db4
mov dword [rsp - 0x44], 0x74a9d01c
test dword [rbp - 7], 0x1000
jne 0x14013821a
cmp byte [rbp - 0x1d], 0xe8
jne 0x14013821a
mov rdx, rdx
lea rdx, [rbx + 0xc]
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
call fcn.140086620
mov r8, r8
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
add edx, eax
xchg rcx, rax
mov rcx, qword [rsi + 8]
xchg rcx, rax
xor rax, r12
mov dword [rsp - 0x2c], ecx
add rdx, rax
xor rdx, r12
mov qword [rsi + 0x20], rdx
mov dword [rsp - 0x20], 0x4cf4b692
cmp qword [rsi + 0x20], r12
setne al
lea r11, [rsp + 0x70]
mov rbp, rbp
mov rbx, qword [r11 + 0x20]
xchg rdx, rsi
mov rdx, qword [r11 + 0x28]
xchg rsi, rdx
xchg r14, rdi
mov r14, qword [r11 + 0x30]
xchg rdi, r14
mov rsp, r11
mov dword [rsp - 0x18], ebp
nop
mov r14, qword [rsp]
add rsp, 8
pop r12
mov dword [rsp - 0x24], 0x5301974
nop
mov rbp, qword [rsp]
add rsp, 8
ret
xor al, al
jmp 0x1401381d6
Function at 0x10001932c
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x120
xor r12d, r12d
mov ebp, ecx
lea rcx, [rax - 0x98]
lea r8d, [r12 + 0x70]
mov rbx, r12
xor edx, edx
mov dword [rax + 0x10], r12d
mov rdi, r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], rbx
Function at 0x10003e708
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rbp, r8
mov r12, rcx
cmp edx, 4
jne 0x10003e72e
lea rdi, [0x10000dc50]
jmp 0x10003e75a
cmp edx, 9
jne 0x10003e73c
lea rdi, [0x10000e018]
jmp 0x10003e75a
cmp edx, 0xa
jne 0x10003e74a
lea rdi, [0x10000bbb0]
jmp 0x10003e75a
cmp edx, 8
jne 0x10003e7f1
lea rdi, [0x10000e040]
call fcn.10003f274
xor ebx, ebx
cmp eax, ebx
je 0x10003e7f1
mov rcx, qword [r12 + 0x20]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x58], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e7f1
mov eax, dword [rsp + 0x58]
cmp eax, 1
jbe 0x10003e7f1
add eax, 4
mov ecx, eax
mov dword [rsp + 0x58], eax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rsi, rax
cmp rax, rbx
je 0x10003e7f1
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [r12 + 0x20]
lea r11, [rsp + 0x58]
mov qword [rsp + 0x28], r11
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x10003e806
mov rcx, rsi
call 0x10005ccc0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
mov rdx, rsi
mov rcx, rbp
call fcn.10003de0c
mov rcx, rsi
call 0x10005ccc0
cmp qword [rbp + 0x10], rbx
setne bl
mov eax, ebx
jmp 0x10003e7f3

Function at 0x10003e82c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
call fcn.10003f274
test eax, eax
jne 0x10003e851
xor eax, eax
jmp 0x10003e8ba
mov rcx, qword [rsi + 0x20]
lea rdx, [0x10000e078]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rdi
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10003e84d
mov ecx, dword [rdi]
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov qword [rbx], rax
test rax, rax
je 0x10003e84d
mov rcx, qword [rsi + 0x20]
lea rdx, [0x10000e078]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10003e8b5
mov rcx, qword [rbx]
call 0x10005ccc0
jmp 0x10003e84d
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x10003f0d4
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov r12, r8
mov rbp, rdx
mov r13, rcx
call fcn.10003f274
xor ebx, ebx
cmp eax, ebx
jne 0x10003f10b
jmp 0x10003f250
mov rdx, qword [rbp]
xor eax, eax
lea rdi, [0x10000dc50]
mov rsi, rdx
lea ecx, [rax + 9]
repe cmpsw word [rsi], word [rdi]
je 0x10003f128
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x10003f19b
xor eax, eax
lea rdi, [0x10000e018]
mov rsi, rdx
lea ecx, [rax + 0x13]
repe cmpsw word [rsi], word [rdi]
je 0x10003f14a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x10003f19b
xor eax, eax
lea rdi, [0x10000bbb0]
mov rsi, rdx
lea ecx, [rax + 0x17]
repe cmpsw word [rsi], word [rdi]
je 0x10003f16c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
jne 0x10003f19b
xor eax, eax
lea rdi, [0x10000e040]
mov rsi, rdx
lea ecx, [rax + 0x19]
repe cmpsw word [rsi], word [rdi]
je 0x10003f18e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
sete al
cmp al, bl
je 0x10003f250
cmp qword [r12 + 0x10], rbx
jne 0x10003f1cc
cmp dword [rdx - 8], 1
jle 0x10003f1b3
mov edx, dword [rdx - 0x10]
mov rcx, rbp
call fcn.10001e9a0
mov rdx, qword [rbp]
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop
mov ebx, 1
jmp 0x10003f250
mov dword [rsp + 0x88], ebx
lea rdx, [rsp + 0x88]
mov rcx, r12
call fcn.100031ad4
mov rsi, rax
cmp rax, rbx
je 0x10003f250
mov rcx, qword [rbp]
sub rcx, 0x18
cmp dword [rcx + 0x10], 1
jle 0x10003f20c
mov edx, dword [rcx + 8]
mov rcx, rbp
call fcn.10001e9a0
mov rcx, qword [rbp]
sub rcx, 0x18
add dword [rcx + 0x10], 0xffffffff
jne 0x10003f216
or dword [rcx + 0x10], 0xffffffff
mov eax, dword [rsp + 0x88]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rbp]
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rcx, rsi
call 0x10005ccc0
cmp edi, ebx
sete bl
jmp 0x10003f250
mov rcx, rbp
call fcn.10001f3ec
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x10003fc9c
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rsi, r8
mov rbp, rdx
mov r12, rcx
and qword [rax - 0x48], 0
lea rcx, [rax - 0x40]
call fcn.10001e06c
nop
xor edi, edi
lea rdx, [0x10000e130]
lea rcx, [rsp + 0xb8]
call fcn.10001e134
nop
lea r8, [rsp + 0x58]
mov rdx, r12
lea rcx, [rsp + 0xb8]
call fcn.10002f9d0
test al, al
sete bl
lea rcx, [rsp + 0xb8]
call fcn.10001f3ec
test bl, bl
je 0x10003fd1e
mov ebx, 0x65b
jmp 0x10003fdd9
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x10003fdd9
cmp qword [rsi + 0x10], 0
jbe 0x10003fdb5
lea rdx, [rsp + 0xb8]
mov rcx, rsi
call fcn.100031ad4
mov rdi, rax
test rax, rax
jne 0x10003fd83
lea ebx, [rax + 8]
jmp 0x10003fdcc
mov eax, dword [rsp + 0xb8]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rbp]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x10003fdcc
jmp 0x10003fdca
mov rdx, qword [rbp]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
test eax, eax
jne 0x10003fdd9
xor ebx, ebx
test rdi, rdi
je 0x10003fdd9
mov rcx, rdi
call 0x10005ccc0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x10003fdea
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x58]
call fcn.10001f3ec
nop
mov rcx, r12
call fcn.10001f3ec
nop
mov rcx, rbp
call fcn.10001f3ec
mov eax, ebx
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret