joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400400b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rsi, r9
mov ebp, r8d
mov r14, rdx
mov rdi, rcx
mov r11d, dword [0x1401c4d60]
lea r10d, [r11 + 2]
lea eax, [r11 + 1]
imul r10d, eax
imul r10d, r11d
mov eax, 0x2aaaaaab
imul r10d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r10d, eax
cmp r10d, 0xa
jne 0x1400401ba
xor edx, edx
nop word [rax + rax]
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, r11d
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r11d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r11d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r11d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r11d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r11d
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, r11d
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, r11d
sar ecx, 1
xor eax, ecx
add r11d, eax
inc edx
cmp edx, 0x100
jl 0x140040120
mov dword [0x1401c4d60], r11d
lea rax, [rsp + 0x40]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
mov r8d, 0x10
lea rdx, str.OpenProcessToken
lea rcx, [rsp + 0x40]
call fcn.1400013f0
nop
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], 0
mov byte [rsp + 0x60], 0
mov r8d, 8
lea rdx, str.Advapi32
lea rcx, [rsp + 0x60]
call fcn.1400013f0
nop
lea rbx, [rdi + 0x88]
mov r9, rbx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.140040d90
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
mov r8d, 0x10
lea rdx, str.OpenProcessToken
lea rcx, [rsp + 0x40]
call fcn.1400013f0
lea rax, [rsp + 0x40]
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140040670
movzx edi, byte [rax]
cmp qword [rsp + 0x58], 0x10
jb 0x1400402a8
mov rcx, qword [rsp + 0x40]
call fcn.1400ce2b0
test dil, dil
jne 0x1400402b1
xor eax, eax
jmp 0x1400402bb
mov r8, rsi
mov edx, ebp
mov rcx, r14
call qword [rbx]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140046e00
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov r11d, dword [0x1401c4d60]
mov r10d, eax
movzx ebx, al
lea r9d, [r11 + 1]
lea r8d, [r11 + 2]
mov eax, 0x2e8ba2e9
imul r8d, r9d
imul r8d, r11d
imul r8d
mov eax, 0x4ec4ec4f
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 5
cmove r11d, r9d
shr r10w, 8
mov dword [0x1401c4d60], r11d
movzx edi, r10b
imul r11d, r11d
imul r11d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub r11d, edx
cmp r11d, 2
jne 0x140046e8a
call fcn.1400cebc4
mov dword [0x1401c4d60], eax
cmp ebx, 6
ja 0x140046ea3
jne 0x140046e96
cmp edi, 1
ja 0x140046ea3
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140046eb0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, dword [0x1401c4d60]
mov eax, 0x4ec4ec4f
mov ecx, r8d
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 7
jne 0x140046ee9
inc r8d
mov dword [0x1401c4d60], r8d
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ebx, al
call fcn.140046bc0
test al, al
jne 0x140046f01
dec dword [0x1401c4d60]
cmp ebx, 6
setb al
add rsp, 0x20
pop rbx
ret
Function at 0x140048ba0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdx, qword [rcx]
mov rcx, qword [0x1401bfd48]
lea rax, [rsp + 0x30]
mov rdi, r8
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140048c18
mov r8d, dword [0x1401c4d60]
mov eax, 0x2e8ba2e9
lea ecx, [r8 + 1]
imul ecx, r8d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0x11
jne 0x140048c0b
dec r8d
mov dword [0x1401c4d60], r8d
xor al, al
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rax, qword [rdi]
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x30]
cmp dword [rax - 0x10], 0
jne 0x140048c33
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
jmp 0x140048c6d
lea rax, [rsp + 0x38]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140048c6d
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
mov rbx, qword [rsp + 0x68]
sete al
add rsp, 0x40
pop rdi
ret
Function at 0x1400498b0
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x200
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov rsi, rcx
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rbp
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140049949
mov dword [rsp + 0x58], ebp
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x50], rbx
jmp 0x1400499b5
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
mov r8, qword [rbx]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14001b5c0
test eax, eax
je 0x1400499b0
call fcn.140046a90
test al, al
jne 0x1400499a6
mov ecx, ebp
lea rdx, [rsp + 0x80]
mov r8d, dword [0x1401c4d60]
mov eax, dword [rdx]
imul eax, eax, 0x99
add r8d, eax
inc ecx
lea rdx, [rdx + 4]
movsxd rax, ecx
cmp rax, 0x16c
jb 0x140049983
mov dword [0x1401c4d60], r8d
xor dil, dil
mov rbx, qword [rsp + 0x50]
jmp 0x140049a22
mov rbx, qword [rsp + 0x50]
mov rcx, qword [r14]
mov eax, ebp
test rcx, rcx
setne al
test eax, eax
jne 0x1400499c9
lea edi, [rax + 0xd]
jmp 0x140049a02
or rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x1400499d0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test rbx, rbx
je 0x140049a18
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebp
test edi, edi
sete dil
test rbx, rbx
je 0x140049a35
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rbp
movzx eax, dil
mov dword [rsp + 0x58], ebp
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x200
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140049a60
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
call fcn.140046930
xor ebp, ebp
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x68], ebp
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x50], rbp
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140049af6
mov dword [rsp + 0x68], ebp
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x60], rbx
jmp 0x140049b23
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebp
mov r8, qword [rdi]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14001b5c0
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x140049b23
xor dil, dil
jmp 0x140049bbd
mov eax, dword [rsi]
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test rbx, rbx
je 0x140049b6e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], ebp
mov edx, dword [0x1401c4d60]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x78787879
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub r8d, edx
mov eax, dword [0x1401c5df0]
mov ecx, 0x7de46263
cmp r8d, 5
cmove eax, ecx
mov dword [0x1401c5df0], eax
test edi, edi
sete dil
test rbx, rbx
je 0x140049bd0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], rbp
movzx eax, dil
mov dword [rsp + 0x68], ebp
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140049bf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov rsi, r9
mov r15, r8
mov r12, rdx
mov r14, rcx
xor r13d, r13d
mov ebp, r13d
mov qword [rax - 0x48], r13
mov dword [rax - 0x40], r13d
mov qword [rax - 0x38], r13
call fcn.140046bc0
test al, al
jne 0x140049c8a
lea r8d, [r13 + 0x47]
mov r11d, r13d
mov edi, dword [0x1401c4d60]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
test ebx, ebx
jle 0x140049c82
mov eax, edi
cdq
and edx, 3
add eax, edx
sar eax, 2
mov r9d, r13d
mov r10, rbx
test eax, eax
jle 0x140049c7a
mov ecx, r9d
mov edx, eax
nop
add r8d, ecx
dec ecx
dec rdx
jne 0x140049c70
add r9d, r11d
dec r10
jne 0x140049c66
inc r11d
cmp r11d, r8d
jl 0x140049c51
mov qword [rsp + 0xa0], r13
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140049e00
mov dword [rsp + 0x48], r13d
mov rbp, qword [rsp + 0xa0]
mov qword [rsp + 0x40], rbp
mov rax, qword [r14]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x800
or eax, ecx
jge 0x140049cf2
mov edx, 0x800
mov rcx, r14
call fcn.1400023a0
mov rdi, qword [r14]
cmp dword [rdi - 0xc], 0x800
jge 0x140049d09
mov ecx, 0x80070057
call fcn.140001920
int3
mov dword [rdi - 0x10], 0x800
mov rax, qword [r14]
mov word [rax + 0x1000], r13w
mov dword [rsp + 0xa0], 0x1000
mov esi, r13d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140049d9b
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x140049d68
mov ebx, 0xd
jmp 0x140049d9b
mov ecx, dword [rsp + 0xa0]
test rdi, rdi
je 0x140049d94
test ecx, ecx
je 0x140049d90
test cl, 1
jne 0x140049d89
mov eax, ecx
shr rax, 1
cmp word [rdi + rax*2 - 2], si
je 0x140049d94
mov ebx, 0xd
jmp 0x140049d9b
mov word [rdi], r13w
mov esi, ecx
shr esi, 1
mov ebx, r13d
lea eax, [rsi - 1]
cmp eax, 0xffffffff
jne 0x140049db9
mov rcx, qword [r14]
test rcx, rcx
jne 0x140049db0
mov eax, r13d
jmp 0x140049dbd
movsxd rdx, dword [rcx - 0xc]
call fcn.1400cedf8
test eax, eax
js 0x140049df5
mov rcx, qword [r14]
cmp eax, dword [rcx - 0xc]
jg 0x140049df5
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [r14]
mov word [rax + rcx*2], r13w
test rbp, rbp
je 0x140049de9
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x48], r13d
test ebx, ebx
sete bl
jmp 0x140049e02
mov ecx, 0x80070057
call fcn.140001920
int3
xor bl, bl
test rbp, rbp
je 0x140049e15
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x48], r13d
movzx eax, bl
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140049e40
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
mov r10, r9
mov rax, r8
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
mov ebx, ebp
mov qword [r11 - 0x28], rbx
mov dword [rsp + 0x48], ebp
mov qword [r11 - 0x18], rbp
mov qword [r11 + 0x18], rbp
lea rcx, [r11 + 0x18]
mov qword [r11 - 0x48], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140049f16
mov dword [rsp + 0x48], ebp
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x80], 4
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x140049ef4
mov edi, ebp
mov eax, 0xd
cmp dword [rsp + 0x30], 4
cmovne edi, eax
test rbx, rbx
je 0x140049f0a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], ebp
test edi, edi
sete dil
jmp 0x140049f4b
mov r8d, dword [0x1401c4d60]
imul r8d, r8d
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 0xe
jne 0x140049f48
dec dword [0x1401c5dc4]
xor dil, dil
test rbx, rbx
je 0x140049f5e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
movzx eax, dil
mov dword [rsp + 0x48], ebp
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140049f80
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r11d, dword [0x1401c4d60]
mov rsi, rdx
mov rbx, r9
lea eax, [r11 + 1]
lea r10d, [r11 + 2]
mov rdi, r8
mov r14, rcx
imul r10d, eax
mov eax, 0x38e38e39
imul r10d, r11d
imul r10d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r10d, eax
cmp r10d, 5
jne 0x140049ff7
mov ecx, 1
cmp r11d, ecx
jle 0x140049ff1
mov eax, r11d
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, r11d
jl 0x140049fe2
mov dword [0x1401c4d60], ecx
mov rdx, qword [rdi]
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004a09b
call fcn.1400469b0
test al, al
jne 0x14004a097
mov ecx, dword [0x1401c4d60]
test ecx, ecx
je 0x14004a097
mov eax, ecx
and eax, 0x80000001
jge 0x14004a041
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x14004a056
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [0x1401c4d60], eax
jmp 0x14004a063
lea ecx, [rcx*2 + 1]
mov dword [0x1401c4d60], ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, ecx
sub edx, eax
je 0x14004a085
sub edx, 2
je 0x14004a088
dec edx
je 0x14004a08a
jmp 0x14004a093
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x1401c4d60], ecx
test ecx, ecx
jne 0x14004a031
xor al, al
jmp 0x14004a0dc
mov rcx, qword [rsi]
mov rdx, qword [r14]
mov r9d, 1
mov eax, dword [rcx - 0x10]
xor r8d, r8d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14004aa10
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x30
mov eax, dword [0x1401c4d60]
mov rdi, rcx
mov r11, r8
lea r10d, [rax + 1]
mov rbx, r9
mov ecx, 0xc76fa666
mov r9d, 0x2001f
imul r10d, eax
mov eax, 0x92492493
imul r10d
add edx, r10d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [0x1401c5db8]
imul edx, edx, 0xe
sub r10d, edx
mov rdx, qword [r11]
cmp r10d, 0xa
cmove eax, ecx
xor r8d, r8d
mov rcx, rbx
mov dword [0x1401c5db8], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14004aa98
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
call fcn.140046b30
test al, al
jne 0x14004aae3
call fcn.1400cebc4
mov ecx, dword [0x1401c4d60]
cmp ecx, eax
jne 0x14004aae3
dec ecx
mov dword [0x1401c4d60], ecx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
mov rbx, qword [rsp + 0x40]
sete al
add rsp, 0x30
pop rdi
ret
Function at 0x1400506a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [0x1401c4d60]
mov eax, 0x2e8ba2e9
mov r8d, ecx
imul r8d, ecx
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 2
jne 0x1400507a7
lea eax, [rcx + 1]
lea r8d, [rcx + 2]
imul r8d, eax
mov eax, 0x2aaaaaab
imul r8d, ecx
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub r8d, eax
cmp r8d, 1
jne 0x1400507a4
xor r8d, r8d
nop word [rax + rax]
mov edx, r8d
mov eax, r8d
inc r8d
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
mov edx, eax
sar eax, 1
and edx, 1
dec edx
not edx
and edx, ecx
xor edx, eax
mov eax, edx
sar edx, 1
and eax, 1
dec eax
not eax
and eax, ecx
xor eax, edx
add ecx, eax
cmp r8d, 0x100
jl 0x140050710
mov dword [0x1401c4d60], ecx
xor al, al
ret
mov al, 1
ret
Function at 0x140050d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r9d, dword [0x1401c4d60]
mov eax, 0x92492493
mov edi, 4
mov ecx, r9d
imul ecx, r9d
imul ecx, r9d
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
sub ecx, edx
cmp ecx, 5
jne 0x140050d75
mov ecx, edi
call fcn.1400cea88
mov r9d, dword [0x1401c4d60]
mov dword [rax], r9d
mov ecx, r9d
mov eax, 0x2aaaaaab
mov ebx, 0x36
imul ecx, r9d
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 3
jne 0x140050db8
lea edx, [rbx - 1]
lea rcx, str._d__d_n
mov r8d, ebx
call fcn.1400cf1dc
mov r9d, dword [0x1401c4d60]
cmp byte [0x1401c6988], 0
je 0x140050dcd
lea rax, [0x1401c0af8]
jmp 0x140050ea6
xor r10d, r10d
mov dword [rbp - 0x40], 0x90014
mov dword [rbp - 0x3c], 0xf0019
mov dword [rbp - 0x38], 0x10008
mov dword [rbp - 0x34], 0x110038
mov dword [rbp - 0x30], 0x360003
mov eax, r10d
mov dword [rbp - 0x2c], 0x160010
mov dword [rbp - 0x28], 0x110007
mov dword [rbp - 0x24], 0xa0006
mov dword [rbp - 0x20], 0x1e0037
mov dword [rbp - 0x1c], 0xd0003
mov dword [rbp - 0x18], 0x4000b
mov dword [rbp - 0x14], 0x1d
lea rbx, [0x1401c0af8]
lea rdx, [0x1401bfd90]
nop word [rax + rax]
movzx ecx, byte [rax + rdx]
inc rax
xor cx, word [rbp + rax*2 - 0x42]
mov word [rbx + rax*2 - 2], cx
cmp rax, 0x17
jl 0x140050e40
mov r8d, r9d
mov eax, 0x38e38e39
mov byte [0x1401c6988], 1
imul r8d, r9d
imul r8d, r9d
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*8]
add ecx, ecx
sub r8d, ecx
cmp r8d, 5
jne 0x140050ea3
mov qword [rsp + 0x28], r10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ce2d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140051050
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140050920
test al, al
jne 0x140051092
mov ecx, 1
mov r8d, 0x72
mov eax, ecx
nop dword [rax]
dec r8d
lea edx, [rax + rcx]
lea ecx, [rax]
mov eax, edx
jns 0x140051080
mov dword [0x1401c4d60], edx
cmp byte [0x1401c69b5], 0
lea rax, [0x1401c0590]
jne 0x140051147
xor ecx, ecx
mov dword [rbp - 0x40], 0x1e001c
mov dword [rbp - 0x3c], 0x3c0000
mov dword [rbp - 0x38], 0xb0018
mov dword [rbp - 0x34], 0x1d0002
mov dword [rbp - 0x30], 0xc001c
mov word [rbp - 0xc], cx
mov dword [rbp - 0x2c], 0x100010
mov dword [rbp - 0x28], 0x140007
mov dword [rbp - 0x24], 0x1d002d
mov dword [rbp - 0x20], 0x4000d
mov dword [rbp - 0x1c], 0x170005
mov dword [rbp - 0x18], 0x34000a
mov dword [rbp - 0x14], 0x80002
mov dword [rbp - 0x10], 0x1d001c
lea r9, [0x1401bfd91]
nop
movzx edx, byte [rcx + r9 - 1]
movzx r8d, word [rbp + rcx*2 - 0x3e]
add rcx, 2
xor dx, word [rbp + rcx*2 - 0x44]
mov word [rax + rcx*2 - 4], dx
movzx edx, byte [rcx + r9 - 2]
xor r8w, dx
mov word [rax + rcx*2 - 2], r8w
cmp rcx, 0x1a
jl 0x140051110
mov byte [0x1401c69b5], 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x60
pop rbp
ret

Function at 0x140051160
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, dword [0x1401c4d60]
lea eax, [rdx + 2]
lea ecx, [rdx + 1]
imul eax, ecx
imul eax, edx
and eax, 0x80000007
jge 0x140051193
dec eax
or eax, 0xfffffff8
inc eax
cmp eax, 7
jne 0x1400511a3
call fcn.1400cebc4
mov dword [0x1401c4d60], eax
cmp byte [0x1401c69af], 0
je 0x1400511c5
lea rax, [0x1401c0708]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x58
ret
mov qword [rsp + 0x50], rdi
call fcn.140050620
mov edi, 4
test al, al
jne 0x140051201
mov ecx, edi
mov qword [rsp + 0x60], rbx
call fcn.1400cea88
mov rbx, rax
call fcn.1400cebc4
mov rcx, rbx
mov dword [rbx], eax
mov dword [0x1401c4d60], eax
call fcn.1400ce2b0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x20], 0x11
mov word [rsp + 0x40], r8w
mov dword [rsp + 0x24], 0x1b0035
mov dword [rsp + 0x28], 0x110004
mov dword [rsp + 0x2c], 0xa0024
mov dword [rsp + 0x30], 0xc0008
mov dword [rsp + 0x34], 0x70055
mov dword [rsp + 0x38], 0x14000d
mov dword [rsp + 0x3c], 0x520017
lea rdx, [0x1401c0708]
lea r9, [0x1401bfd91]
nop dword [rax]
movzx eax, byte [r8 + r9 - 1]
movzx ecx, word [rsp + r8*2 + 0x22]
add r8, 4
xor ax, word [rsp + r8*2 + 0x18]
mov word [rdx + r8*2 - 8], ax
movzx eax, byte [r8 + r9 - 4]
xor cx, ax
mov word [rdx + r8*2 - 6], cx
movzx ecx, byte [r8 + r9 - 3]
xor cx, word [rsp + r8*2 + 0x1c]
mov word [rdx + r8*2 - 4], cx
movzx ecx, byte [r8 + r9 - 2]
xor cx, word [rsp + r8*2 + 0x1e]
mov word [rdx + r8*2 - 2], cx
cmp r8, 0x10
jl 0x140051260
mov byte [0x1401c69af], 1
mov rax, rdx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ce2d0
add rsp, 0x58
ret