joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007ae30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x110
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, qword [rsp + 0x160]
mov r15, r9
mov rbp, r8
mov r14, rdx
mov r12, rcx
test rcx, rcx
je 0x14007b023
test r8, r8
jne 0x14007ae7d
test r9, r9
jne 0x14007b023
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0xc8
call fcn.140003420
cmp r15, rbx
jb 0x14007afb5
mov qword [rsp + 0x108], rsi
lea rax, [rsp + 0x20]
mov qword [rsp + 0x100], rdi
mov rsi, rbp
sub rsi, rax
lea rdi, [rsp + 0x20]
sub rdi, rbp
nop dword [rax + rax]
xor eax, eax
test rbx, rbx
je 0x14007af86
cmp rbx, 0x40
jb 0x14007af70
lea rcx, [rbx - 1]
add rcx, rbp
lea r8, [rsp + 0x20]
lea rdx, [rsp + rbx + 0x1f]
cmp r8, rcx
ja 0x14007aef4
cmp rdx, rbp
jae 0x14007af70
mov rdx, rbx
and rdx, 0xffffffffffffffc0
lea rcx, [rbp + 0x20]
nop
movdqu xmm0, xmmword [rdi + rcx - 0x20]
add rax, 0x40
movdqu xmm1, xmmword [rcx - 0x20]
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rdi + rcx - 0x60], xmm1
movdqu xmm0, xmmword [rdi + rcx - 0x50]
movdqu xmm1, xmmword [rcx - 0x50]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rcx - 0x40]
movdqu xmmword [rdi + rcx - 0x50], xmm1
movdqu xmm1, xmmword [rdi + rcx - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rdi + rcx - 0x40], xmm1
movdqu xmm0, xmmword [rdi + rcx - 0x30]
movdqu xmm1, xmmword [rcx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rdi + rcx - 0x30], xmm1
cmp rax, rdx
jb 0x14007af00
cmp rax, rbx
jae 0x14007af86
nop word [rax + rax]
lea rdx, [rsp + 0x20]
add rdx, rax
inc rax
movzx ecx, byte [rsi + rdx]
xor byte [rdx], cl
cmp rax, rbx
jb 0x14007af70
lea rcx, [rsp + 0x20]
call fcn.14007b170
add rbp, rbx
add rsi, rbx
sub rdi, rbx
sub r15, rbx
cmp r15, rbx
jae 0x14007aec0
mov rdi, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x108]
xor byte [rsp + r15 + 0x20], 1
lea rcx, [rsp + 0x20]
xor byte [rsp + rbx + 0x1f], 0x80
mov r8, r15
mov rdx, rbp
call fcn.14007b080
lea rcx, [rsp + 0x20]
call fcn.14007b170
cmp r14, rbx
jb 0x14007b00a
nop
test rbx, rbx
je 0x14007aff5
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.14000e2b0
lea rcx, [rsp + 0x20]
call fcn.14007b170
add r12, rbx
sub r14, rbx
cmp r14, rbx
jae 0x14007afe0
test r14, r14
je 0x14007b01f
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.14000e2b0
xor eax, eax
jmp 0x14007b028
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400015f0
add rsp, 0x110
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
Function at 0x1400026f0
Capabilities:
Check for time delay via gettickcount
Check mutex on windows
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140029008]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, str.fuckyou.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14000271c
call fcn.1400026f0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x3e8
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x3e8
jge 0x140002743
call fcn.1400026f0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x40], 2
jge 0x14000275a
call fcn.1400026f0
mov ecx, 0x5f5e100
call fcn.14000a84c
mov rbx, rax
test rax, rax
je 0x140002784
xor edx, edx
mov r8d, 0x5f5e100
mov rcx, rax
call fcn.140006970
mov rcx, rbx
call fcn.14000a838
lea r8, str.FakeMutex
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400027bd
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400036b0
add rsp, 0x60
pop rbx
ret
call fcn.1400026f0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400036b0
add rsp, 0x60
pop rbx
ret

Function at 0x140002a40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
xor r9d, r9d
mov rsi, rdx
mov r11, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r10d, dword [rdi + 0x20]
mov ebx, dword [rdi + 0x18]
add r10, rcx
test ebx, ebx
je 0x140002ab3
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [r10]
mov rax, rsi
add r8, r11
sub r8, rsi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140002aa3
inc rax
test ecx, ecx
jne 0x140002a90
test edx, edx
je 0x140002ac5
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x140002a80
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r11
mov rbx, qword [rsp + 8]
add rcx, r11
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
add rax, r11
ret
Function at 0x14000dbe4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000da43
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000da43
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000da43
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000da43
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000da43
cmp dword [rcx + 0x84], 0xe
jbe 0x14000da43
cmp dword [rcx + 0xf8], 0
je 0x14000da43
mov ecx, ebx
call fcn.14000db00
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000d8d0
nop
cmp dword [rbp + 0x20], 0
je 0x14000da91
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000da9c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000d9d4
Function at 0x140013b50
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140013bd7
mov rsi, rbx
cmp word [rax], bp
je 0x140013b96
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140013b80
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140013b7c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000ef88
mov rdi, rax
test rax, rax
je 0x140013bc4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140006b30
mov rbp, rdi
xor ecx, ecx
call fcn.14000ef4c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007800
Capabilities:
Access the windows event log

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140186768]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r10, qword [rcx + 8]
mov qword [rsp + 0x50], r8
test r10, r10
je 0x140007881
test r8, r8
je 0x140007881
mov r11d, 1
test edx, edx
je 0x14000783b
cmp edx, r11d
jne 0x14000783b
movzx eax, r11w
jmp 0x140007840
mov eax, 4
cmp edx, r11d
mov ecx, 0xc0020011
mov r9d, 0x40020010
mov r8d, r11d
cmove r9d, ecx
xor edx, edx
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], r11w
mov qword [rsp + 0x20], rdx
movzx edx, ax
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e9aa0
add rsp, 0x68
ret

Function at 0x1400078c0
Capabilities:
Access the windows event log

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140186768]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r10, qword [rcx + 8]
mov qword [rsp + 0x50], r8
test r10, r10
je 0x140007941
test r8, r8
je 0x140007941
mov r11d, 1
test edx, edx
je 0x1400078fb
cmp edx, r11d
jne 0x1400078fb
movzx eax, r11w
jmp 0x140007900
mov eax, 4
cmp edx, r11d
mov ecx, 0xc0020011
mov r9d, 0x40020010
mov r8d, r11d
cmove r9d, ecx
xor edx, edx
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov dword [rsp + 0x30], edx
mov word [rsp + 0x28], r11w
mov qword [rsp + 0x20], rdx
movzx edx, ax
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e9aa0
add rsp, 0x68
ret

Function at 0x1400084a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140186768]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea r8, str.Service_start
mov rcx, qword [rcx + 0x270]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400341b6.0]
mov rcx, qword [rbx + 0x260]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140008490]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400e9aa0
add rsp, 0x40
pop rbx
ret
Function at 0x14002c570
Capabilities:
Query service status

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x140186768]
xor rax, rsp
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
mov r9d, 0x24
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14002c658
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.14001a6d0
xor eax, eax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], 7
mov word [rsp + 0x128], ax
lea rdx, str.Cannot_query_service_state_0x
lea rcx, [rsp + 0x40]
call fcn.14001b1c0
mov rcx, qword [rsp + 0x40]
movsxd rax, dword [rcx + 4]
lea rcx, [rsp + 0x58]
add rcx, rax
mov eax, dword [rcx]
and eax, 0xfffff9ff
bts eax, 0xb
mov dword [rcx], eax
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.14001e540
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
mov eax, dword [rsp + rcx + 0x58]
and eax, 0xfffff3ff
bts eax, 9
mov dword [rsp + rcx + 0x58], eax
lea rcx, [rsp + 0x40]
call fcn.14001a8c0
nop
lea rcx, [rsp + 0x30]
call fcn.1400193a0
mov eax, ebx
jmp 0x14002c65a
xor eax, eax
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1400e9aa0
add rsp, 0x160
pop rbx
ret

Function at 0x14002c680
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140186768]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov ecx, 0x264
mov eax, dword [rcx + rdx]
mov r8d, 0x260
test al, 1
jne 0x14002c6ca
or eax, 1
mov dword [rcx + rdx], eax
lea rcx, [rdx + r8]
call fcn.14000fa60
nop
cmp byte [rdx + r8 + 1], 0
je 0x14002c710
lea rdx, str.Waiting_for_the_pending_service_stop...
lea rbx, [0x1401950c0]
mov rcx, rbx
call fcn.1400104a0
mov rax, qword [0x1401950c0]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140010290
movzx edx, al
mov rcx, rbx
call fcn.140010130
mov rcx, rbx
call fcn.140010060
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14002c570
cmp dword [rsp + 0x24], 1
je 0x14002c793
nop dword [rax]
mov eax, 0xcccccccd
mul dword [rsp + 0x38]
shr edx, 3
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14002c570
test eax, eax
jne 0x14002c795
cmp dword [rsp + 0x24], 1
je 0x14002c787
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x7530
ja 0x14002c774
cmp dword [rsp + 0x24], 1
jne 0x14002c730
jmp 0x14002c793
lea rcx, str.Service_stop_timed_out._n
call fcn.14002b5e0
mov eax, 0x41d
jmp 0x14002c795
lea rcx, str.Service_stopped_successfully._n
call fcn.14002b5e0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400e9aa0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140031910
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [0x140186768]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebp, ebp
mov qword [rsp + 0x50], rbx
mov edi, ebp
lea r14, [0x140196d70]
lea rsi, [0x140187398]
nop dword [rax + rax]
mov rcx, qword [rdi + r14]
cmp byte [rcx + 0x41], 2
jne 0x140031a1e
cmp qword [rcx + 0x20], 8
lea rdx, [rcx + 8]
mov qword [rsp + 0x30], rbp
jb 0x140031971
mov rdx, qword [rdx]
mov rcx, qword [rcx]
lea rax, [rsp + 0x30]
mov r9d, 0x1000b
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
jne 0x1400319ab
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test eax, eax
je 0x140031a13
test rcx, rcx
je 0x1400319b6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 2
jne 0x1400319ea
mov rcx, qword [0x140187398]
cmp rcx, rsi
je 0x140031a1e
test dword [rcx + 0x44], 0x8000
je 0x140031a1e
cmp byte [rcx + 0x41], bl
jb 0x140031a1e
mov rcx, qword [rcx + 0x38]
lea edx, [rbx + 8]
lea r8, [0x140159e38]
call fcn.14000a720
jmp 0x140031a1e
mov rcx, qword [0x140187398]
cmp rcx, rsi
je 0x140031a1e
test dword [rcx + 0x44], 0x8000
je 0x140031a1e
cmp byte [rcx + 0x41], 2
jb 0x140031a1e
mov rcx, qword [rcx + 0x38]
mov r9d, ebx
call fcn.1400318a0
jmp 0x140031a1e
test rcx, rcx
je 0x140031a1e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rdi, 8
cmp rdi, 0x60
jb 0x140031950
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400e9aa0
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140031a60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140186768]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebp, ebp
mov edi, ebp
mov qword [rsp + 0x50], rbp
lea rax, [0x140196d70]
mov r12, qword [rdi + rax]
movzx eax, byte [r12 + 0x40]
dec al
test al, 0xfd
jne 0x140031beb
mov qword [rsp + 0x58], rbp
lea rdx, [r12 + 8]
cmp qword [rdx + 0x18], 8
jb 0x140031ac3
mov rdx, qword [rdx]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test eax, eax
jne 0x140031c2b
mov rbx, qword [r12 + 0x28]
mov r13, qword [r12 + 0x30]
cmp rbx, r13
je 0x140031bdb
cmp byte [r12 + 0x40], 3
jne 0x140031b59
mov dword [rsp + 0x64], ebp
mov dword [rsp + 0x60], ebp
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400341b6.0]
mov rdx, rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x64]
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140031bc9
mov rax, qword [rbx]
mov rdx, qword [rax]
mov rdi, rdx
mov r15, rax
mov rcx, rax
mov rax, qword [rdx + 8]
call qword [case.0x1400341b6.0]
mov r14, rax
mov rcx, r15
mov rax, qword [rdi]
call qword [case.0x1400341b6.0]
mov rbp, rax
mov rcx, r15
mov rax, qword [rdi + 0x10]
call qword [case.0x1400341b6.0]
mov edi, eax
mov rdx, qword [r15]
mov rcx, r15
mov rax, qword [rdx + 0x18]
call qword [case.0x1400341b6.0]
mov rdx, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rbp
mov r9d, edi
xor r8d, r8d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test eax, eax
jne 0x140031c2b
xor ebp, ebp
add rbx, 8
cmp rbx, r13
jne 0x140031b10
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140031beb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rdi, 8
mov qword [rsp + 0x50], rdi
cmp rdi, 0x60
jb 0x140031a94
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400e9aa0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140031910
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140031c41
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140031c00
Function at 0x140035540
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov r14, rdx
mov rsi, rcx
movzx edi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rdi, rax
movabs rcx, 0x100000001b3
imul rdi, rcx
movzx eax, byte [r8 + 1]
xor rdi, rax
imul rdi, rcx
movzx eax, byte [r8 + 2]
xor rdi, rax
imul rdi, rcx
movzx eax, byte [r8 + 3]
xor rdi, rax
imul rdi, rcx
mov rdx, rdi
and rdx, qword [rsi + 0x30]
add rdx, rdx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
lea r12, [rsi + 8]
mov rbp, qword [r12]
cmp rax, rbp
je 0x140035604
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [r8]
cmp ecx, dword [rax + 0x10]
je 0x1400355de
nop dword [rax]
cmp rax, rdx
je 0x140035601
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1400355d0
mov qword [r14], rax
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbp, rax
movabs rax, 0x7ffffffffffffff
cmp qword [rsi + 0x10], rax
je 0x140035775
mov qword [rsp + 0x30], r12
xor r13d, r13d
mov qword [rsp + 0x38], r13
lfence
lea ecx, [r13 + 0x20]
call fcn.1400e9afc
mov rbx, rax
mov qword [rsp + 0x38], rax
mov eax, dword [r15]
mov dword [rbx + 0x10], eax
mov qword [rbx + 0x18], r13
mov rdx, qword [rsi + 0x10]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x14003565a
cvtsi2ss xmm0, rcx
jmp 0x14003566f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140035682
cvtsi2ss xmm1, rcx
jmp 0x140035697
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x140035710
mov rcx, rsi
call fcn.140036c80
mov rax, rdi
and rax, qword [rsi + 0x30]
add rax, rax
mov r8, qword [rsi + 0x18]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [r12]
cmp rcx, rdx
jne 0x1400356d5
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], r13
jmp 0x1400356fc
mov rdx, qword [r8 + rax*8]
mov eax, dword [rbx + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x1400356ef
cmp rcx, rdx
je 0x140035745
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x1400356e1
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
mov rdx, qword [rsi + 0x10]
mov rbp, qword [rsp + 0x30]
mov rcx, qword [rbp + 8]
lea rax, [rdx + 1]
mov qword [rsi + 0x10], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [rbp + 8], rbx
mov rax, qword [rsi + 0x18]
and rdi, qword [rsi + 0x30]
add rdi, rdi
mov rdx, qword [rax + rdi*8]
cmp rdx, qword [r12]
jne 0x140035751
mov qword [rax + rdi*8], rbx
jmp 0x140035763
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r13
jmp 0x1400356fc
cmp rdx, rbp
jne 0x14003575c
mov qword [rax + rdi*8], rbx
jmp 0x140035768
cmp qword [rax + rdi*8 + 8], rcx
jne 0x140035768
mov qword [rax + rdi*8 + 8], rbx
mov qword [r14], rbx
mov byte [r14 + 8], 1
jmp 0x1400355e6
lea rcx, str.unordered_map_set_too_long
call fcn.1400c6364
int3
Function at 0x140035820
Capabilities:
Hash data using fnv

Disassembly:
cmp rdx, r8
je 0x140035a6c
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, r8
mov r14, rdx
mov rdi, rcx
lea r15, [rcx + 8]
movabs r8, 0x7ffffffffffffff
xor r13d, r13d
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
movzx ebp, byte [r14]
xor rbp, rax
imul rbp, rcx
movzx eax, byte [r14 + 1]
xor rbp, rax
imul rbp, rcx
movzx eax, byte [r14 + 2]
xor rbp, rax
imul rbp, rcx
movzx eax, byte [r14 + 3]
xor rbp, rax
imul rbp, rcx
mov rdx, qword [rdi + 0x30]
and rdx, rbp
add rdx, rdx
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
mov rsi, qword [r15]
cmp rax, rsi
je 0x1400358db
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [r14]
cmp ecx, dword [rax + 0x10]
je 0x140035a48
cmp rax, rdx
je 0x1400358d8
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1400358c5
jmp 0x140035a48
mov rsi, rax
cmp qword [rdi + 0x10], r8
je 0x140035a6d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r13
lfence
mov ecx, 0x20
call fcn.1400e9afc
mov rbx, rax
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [r14]
movups xmmword [rax + 0x10], xmm0
mov r8, qword [rdi + 0x10]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140035923
cvtsi2ss xmm0, rcx
jmp 0x140035938
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rdi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14003594b
cvtsi2ss xmm1, rcx
jmp 0x140035960
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rdi]
seta al
test al, al
je 0x1400359df
mov rcx, rdi
call fcn.140036c80
mov rax, qword [rdi + 0x30]
and rax, rbp
add rax, rax
mov r8, qword [rdi + 0x18]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [r15]
cmp rcx, rdx
jne 0x14003599d
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], r13
jmp 0x1400359cb
mov rdx, qword [r8 + rax*8]
mov eax, dword [rbx + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x1400359be
nop dword [rax]
cmp rcx, rdx
je 0x140035a1b
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x1400359b0
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x40], xmm0
mov r8, qword [rdi + 0x10]
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x38], r13
mov rdx, qword [rsi + 8]
lea rax, [r8 + 1]
mov qword [rdi + 0x10], rax
mov qword [rbx], rsi
mov qword [rbx + 8], rdx
mov qword [rdx], rbx
mov qword [rsi + 8], rbx
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x30]
and rax, rbp
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r15]
jne 0x140035a27
mov qword [rcx + rax*8], rbx
jmp 0x140035a39
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r13
jmp 0x1400359cb
cmp r8, rsi
jne 0x140035a32
mov qword [rcx + rax*8], rbx
jmp 0x140035a3e
cmp qword [rcx + rax*8 + 8], rdx
jne 0x140035a3e
mov qword [rcx + rax*8 + 8], rbx
movabs r8, 0x7ffffffffffffff
add r14, 0x10
cmp r14, r12
jne 0x140035857
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1400c6364
int3