joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d210
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r11, rdx
mov dword [rsp + 0x20], ecx
mov r9, qword [r11]
mov r8, r9
and r8, 0xfffffffffffffffc
mov rdx, qword [r11 + 8]
add r8, rdx
cmp rdx, r8
je 0x14001d27d
mov ecx, dword [rdx]
imul eax, ecx, 0xcc9e2d51
mov ecx, eax
rol eax, 0xf
mov ecx, eax
imul r10d, ecx, 0x1b873593
mov ecx, r10d
xor dword [rsp + 0x20], ecx
mov ebx, dword [rsp + 0x20]
rol ebx, 0xd
lea ebx, [rbx + rbx*4]
lea esi, [rbx - 0x19ab949c]
mov dword [rsp + 0x20], esi
add rdx, 4
cmp rdx, r8
jne 0x14001d243
xor ecx, ecx
mov rdi, r9
and rdi, 3
cmp rdi, 1
je 0x14001d2ad
cmp rdi, 2
je 0x14001d2a4
cmp rdi, 3
je 0x14001d29d
jmp 0x14001d2cd
movzx ecx, byte [rdx + 2]
shl ecx, 0x10
movzx eax, byte [rdx + 1]
shl eax, 8
xor ecx, eax
movzx r8d, byte [rdx]
xor ecx, r8d
imul ebx, ecx, 0xcc9e2d51
mov ecx, ebx
rol ebx, 0xf
mov ecx, ebx
imul esi, ecx, 0x1b873593
mov ecx, esi
xor dword [rsp + 0x20], ecx
xor dword [rsp + 0x20], r9d
movzx ecx, word [rsp + 0x22]
xor ecx, dword [rsp + 0x20]
imul eax, ecx, 0x85ebca6b
mov dword [rsp + 0x20], eax
shr eax, 0xd
xor eax, dword [rsp + 0x20]
imul edx, eax, 0xc2b2ae35
mov dword [rsp + 0x20], edx
movzx ebx, word [rsp + 0x22]
xor dword [rsp + 0x20], ebx
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
add rsp, 0x28
ret

Function at 0x14001dfc0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
mov r12, rcx
mov r14, rdx
mov rdi, r8
test r12, r12
je 0x14001e000
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax + 0x40]
mov r13, rax
test r13, r13
jne 0x14001e01f
xor eax, eax
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
mov rcx, rdi
call fcn.14001e0e0
xor al, 1
je 0x14001e062
mov rcx, r13
imul rcx, r12
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], r14
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.14001d210
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
xor ebx, ebx
xor esi, esi
test r12, r12
je 0x14001e0b7
mov rdx, rsi
imul rdx, r13
add rdx, r14
mov rcx, rdi
mov r8, qword [rdi]
call qword [r8 + 0x28]
movabs r9, 0x87c37b91114253d5
mul r9
rol rax, 0x1f
movabs r10, 0x4cf5ad432745937f
mul r10
xor rax, rbx
rol rax, 0x1b
lea rdx, [rax + rax*4 + 0x52dce729]
mov rbx, rdx
inc rsi
cmp rsi, r12
jb 0x14001e06b
mov rax, rbx
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
Function at 0x14001f320
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 8], rsi
mov rsi, rcx
mov r8, rsi
xor edx, edx
mov ecx, 1
call fcn.140034090
xor al, 1
je 0x14001f35a
call fcn.1400170a0
mov r8, rsi
xor edx, edx
mov ecx, 1
call fcn.140034090
xor al, 1
jne 0x14001f342
mov rsi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret

Function at 0x14002aa00
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp - 0xb8], rbx
mov qword [rbp - 0xb0], rsi
mov qword [rbp - 0xa8], rdi
xor eax, eax
mov qword [rbp - 0x90], rax
call sub.KERNEL32.dll_GetEnvironmentStringsW
mov r9, rax
mov qword [rbp - 0x88], r9
lea rcx, [0x14002ac80]
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x80], 0
lea r8, [rbp - 0x80]
lea rdx, str.stdprocess.d
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x70], 0xd
lea rdx, [rbp - 0x70]
mov ecx, 0x1a0
call fcn.14001ab40
xor esi, esi
mov rax, qword [rbp - 0x88]
cmp word [rax], si
je 0x14002ac02
mov edi, esi
movsxd r8, esi
mov r9, qword [rbp - 0x88]
cmp word [r9 + r8*2], 0x3d
je 0x14002aaa9
inc esi
movsxd rdx, esi
mov rcx, qword [rbp - 0x88]
cmp word [rcx + rdx*2], 0x3d
jne 0x14002aa96
movsxd r10, esi
movsxd r8, edi
mov qword [rbp - 0xa0], r10
sub r10, r8
mov qword [rbp - 0x50], r10
mov r9, qword [rbp - 0x88]
lea rdx, [r9 + r8*2]
mov qword [rbp - 0x48], rdx
lea rcx, [rbp - 0x50]
sub rsp, 0x20
call fcn.140038d40
add rsp, 0x20
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.140038da0
add rsp, 0x20
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea edi, [rsi + 1]
mov r8, qword [rbp - 0xa0]
mov r9, qword [rbp - 0x88]
cmp word [r9 + r8*2], 0
je 0x14002ab2b
inc esi
movsxd rdx, esi
mov r10, qword [rbp - 0x88]
cmp word [r10 + rdx*2], 0
jne 0x14002ab17
cmp qword [rbp - 0x60], 0
je 0x14002abeb
movsxd rcx, esi
movsxd r8, edi
sub rcx, r8
mov qword [rbp - 0x20], rcx
mov r9, qword [rbp - 0x88]
lea rdx, [r9 + r8*2]
mov qword [rbp - 0x18], rdx
lea rcx, [rbp - 0x20]
sub rsp, 0x20
call fcn.140038da0
add rsp, 0x20
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea r8, [rbp - 0x60]
lea rdx, [0x1400ba4d0]
mov rcx, qword [rbp - 0x90]
sub rsp, 0x20
call fcn.14002a650
add rsp, 0x20
test rax, rax
jne 0x14002abeb
mov r9, qword [rbp - 0x28]
or r9, qword [rbp - 0x30]
je 0x14002aba3
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
jmp 0x14002abac
lea rdx, [0x1400b8400]
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea r9, [rbp - 0x60]
mov r8d, 0x10
lea rdx, [0x1400c65d0]
lea rcx, [rbp - 0x90]
sub rsp, 0x20
call fcn.140017180
add rsp, 0x20
mov rdi, rax
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
inc esi
movsxd rbx, esi
mov rdi, qword [rbp - 0x88]
cmp word [rdi + rbx*2], 0
jne 0x14002aa82
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x98], rax
sub rsp, 8
call fcn.14002ac4d
add rsp, 8
mov rax, qword [rbp - 0x98]
mov rbx, qword [rbp - 0xb8]
mov rsi, qword [rbp - 0xb0]
mov rdi, qword [rbp - 0xa8]
mov rsp, rbp
pop rbp
ret
Function at 0x14002b7a0
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
lea rax, [rbp - 0x30]
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov rcx, rax
call sub.KERNEL32.dll_GetSystemInfo
mov edx, dword [rbp - 0x2c]
mov qword [0x1400dc6d0], rdx
mov rsp, rbp
pop rbp
ret
Function at 0x14002d2f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], r12
mov r8, rcx
mov r11, qword [r8 + 0x9c8]
mov rsi, r11
dec rsi
jns 0x14002d31b
mov esi, 0x26f
mov ecx, dword [r8 + 0x9c0]
mov rdi, r11
add rdi, 0xfffffffffffffe73
jns 0x14002d335
lea rdi, [r11 + 0xe3]
mov edx, ecx
shr edx, 0xb
xor ecx, edx
cmp r11, 0x270
jae 0x14002d400
mov eax, dword [r8 + r11*4]
and eax, 0x80000000
cmp rsi, 0x270
jae 0x14002d41f
mov r10d, ecx
shl r10d, 7
and r10d, 0x9d2c5680
xor ecx, r10d
mov r9d, dword [r8 + rsi*4]
and r9d, 0x7fffffff
or r9d, eax
mov dword [rbp - 8], r9d
shr r9d, 1
mov r12d, ecx
shl r12d, 0xf
and r12d, 0xefc60000
xor ecx, r12d
test dword [rbp - 8], 1
je 0x14002d3a6
xor r9d, 0x9908b0df
cmp rdi, 0x270
jae 0x14002d43e
mov eax, dword [r8 + rdi*4]
xor eax, r9d
mov r10d, ecx
shr r10d, 0x12
xor ecx, r10d
cmp r11, 0x270
jae 0x14002d45d
lea rdi, [r8 + r11*4]
mov dword [rdi], eax
mov r10d, dword [rdi]
mov dword [r8 + 0x9c0], r10d
mov qword [r8 + 0x9c8], rsi
mov dword [r8 + 0x9c4], ecx
mov rsi, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x18]
mov r12, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret
mov qword [rbp - 0x30], 0x270
mov r9, r11
xor r8d, r8d
mov edx, 0x3f8
lea rcx, str.std_random.d
call fcn.140010870
mov qword [rbp - 0x30], 0x270
mov r9, rsi
xor r8d, r8d
mov edx, 0x3f9
lea rcx, str.std_random.d
call fcn.140010870
mov qword [rbp - 0x30], 0x270
mov r9, rdi
xor r8d, r8d
mov edx, 0x400
lea rcx, str.std_random.d
call fcn.140010870
mov qword [rbp - 0x30], 0x270
mov r9, r11
xor r8d, r8d
mov edx, 0x402
lea rcx, str.std_random.d
call fcn.140010870
int3
Function at 0x1400387a0
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
cmp qword [0x1400dc810], 0
je 0x1400387be
lea rax, [0x1400dc790]
mov rsp, rbp
pop rbp
ret
lea rcx, str.dbghelp.dll
call sub.KERNEL32.dll_LoadLibraryA
mov qword [0x1400dc810], rax
test rax, rax
je 0x140038986
lea rdx, str.SymInitialize
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc790], rax
lea rdx, str.SymCleanup
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc798], rax
lea rdx, str.StackWalk64
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7a0], rax
lea rdx, str.SymGetOptions
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7a8], rax
lea rdx, str.SymSetOptions
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7b0], rax
lea rdx, str.SymFunctionTableAccess64
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7b8], rax
lea rdx, str.SymGetLineFromAddr64
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7c0], rax
lea rdx, str.SymGetModuleBase64
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7c8], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7d0], rax
lea rdx, str.SymGetSymFromAddr64
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7d8], rax
lea rdx, str.UnDecorateSymbolName
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7e0], rax
lea rdx, str.SymLoadModule64
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7e8], rax
lea rdx, str.SymGetSearchPath
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7f0], rax
lea rdx, str.SymUnloadModule64
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc7f8], rax
lea rdx, str.SymRegisterCallback64
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc800], rax
lea rdx, str.ImagehlpApiVersion
mov rcx, qword [0x1400dc810]
call sub.KERNEL32.dll_GetProcAddress
mov qword [0x1400dc808], rax
lea rax, [0x1400dc790]
mov rsp, rbp
pop rbp
ret
xor eax, eax
mov rsp, rbp
pop rbp
ret
Function at 0x140038990
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x890
mov qword [rbp - 0x868], rbx
mov qword [rbp - 0x860], rsi
mov qword [rbp - 0x858], rdi
mov qword [rbp - 0x850], 0
mov qword [rbp - 0x848], 0
lea rsi, [0x1400c5f60]
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov r8d, 0x800
lea rdx, [rbp - 0x840]
mov rcx, qword [rbp - 0x38]
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov edi, eax
test edi, edi
je 0x140038a4b
mov r9d, edi
mov qword [rbp - 0x30], r9
lea r10, [rbp - 0x840]
mov qword [rbp - 0x28], r10
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x850]
lea rcx, [0x1400ba4d0]
call fcn.14000ebb0
lea r9, [0x1400c5fd0]
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x20], 1
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x850]
lea rcx, [0x1400ba4d0]
call fcn.14000ebb0
add rsi, 0x10
lea rax, str._NT_SYMBOL_PATH
cmp rsi, rax
jb 0x1400389cd
lea rbx, [0x1400c5fe0]
mov qword [rbp - 8], rbx
mov qword [rbp - 0x10], 1
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x850]
lea rcx, [0x1400ba4d0]
call fcn.14000ebb0
mov rdx, qword [rbp - 0x848]
mov rax, qword [rbp - 0x850]
mov rbx, qword [rbp - 0x868]
mov rsi, qword [rbp - 0x860]
mov rdi, qword [rbp - 0x858]
mov rsp, rbp
pop rbp
ret

Function at 0x14003a4a0
Capabilities:
Hash data using murmur3

Disassembly:
push rbx
push rsi
mov rax, rcx
shr rax, 0x21
xor rax, rcx
movabs rbx, 0xff51afd7ed558ccd
mul rbx
mov rcx, rax
shr rax, 0x21
xor rax, rcx
movabs rsi, 0xc4ceb9fe1a85ec53
mul rsi
mov rcx, rax
shr rax, 0x21
xor rax, rcx
pop rsi
pop rbx
ret

Function at 0x14003a4e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rdi, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.1400058c0
xor al, 1
je 0x14003a520
mov rcx, rsi
call fcn.14004d210
mov edx, eax
mov rcx, rdi
call fcn.140007880
mov rcx, rsi
call fcn.1400058c0
xor al, 1
jne 0x14003a502
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
Function at 0x14003b380
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
call fcn.14003b4d0
mov qword [rbp - 0xa0], rax
cmp rax, 0xffffffffffffffff
jne 0x14003b3ab
ud2
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp - 0x90]
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0x14
lea rcx, [rbp - 0x10]
call fcn.14001bac0
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rbx, qword [rbp + 0x20]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
xor esi, esi
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, 0xe
lea rdx, str.Aborting_from
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, dword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, 1
lea rdx, [0x1400ba920]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, dword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, 2
lea rdx, [0x1400c9f40]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
mov qword [rbp - 0xb0], rsi
mov r9, rsi
mov r8d, dword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_WriteFile
call fcn.14009451c
int3

Function at 0x14003c220
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rdi, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.1400058c0
xor al, 1
je 0x14003c260
mov rcx, rsi
call fcn.14004e070
mov edx, eax
mov rcx, rdi
call fcn.140007880
mov rcx, rsi
call fcn.1400058c0
xor al, 1
jne 0x14003c242
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret

Function at 0x140047c30
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], rbx
mov qword [rbp + 0x10], rcx
call fcn.140007190
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax]
lea rcx, [rbp - 0x40]
call fcn.140007370
mov rbx, qword [rbp + 0x10]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.140050090
lea rcx, [rbp - 0x30]
call fcn.140050160
xor al, 1
je 0x140047cb0
lea rcx, [rbp - 0x30]
call fcn.140050190
mov edx, eax
lea rcx, [rbp - 0x40]
call fcn.14004f530
lea rcx, [rbp - 0x30]
call fcn.140050280
lea rcx, [rbp - 0x30]
call fcn.140050160
xor al, 1
jne 0x140047c86
lea rcx, [rbp - 0x40]
call fcn.1400073c0
mov rbx, qword [rbp - 0x48]
mov rsp, rbp
pop rbp
ret
Function at 0x14004c8b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rdi, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.1400058c0
xor al, 1
je 0x14004c8f0
mov rcx, rsi
call fcn.140054f30
mov edx, eax
mov rcx, rdi
call fcn.14004ffc0
mov rcx, rsi
call fcn.1400058c0
xor al, 1
jne 0x14004c8d2
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret

Function at 0x140058360
Capabilities:
Delete registry key

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x2e0
mov qword [rbp - 0x2b8], rbx
mov qword [rbp - 0x2b0], rsi
mov qword [rbp - 0x2a8], rdi
mov qword [rbp - 0x2a0], r12
mov qword [rbp - 0x298], r13
mov qword [rbp - 0x290], r14
mov qword [rbp - 0x288], r15
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov ecx, dword [rbp + 0x10]
call fcn.140066c00
test al, al
je 0x14005847c
call fcn.140066c20
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x150], rax
mov qword [rbp - 0x148], rdx
lea rdx, [rbp - 0x150]
lea rcx, [rbp - 0x260]
call fcn.14001a170
xor r9d, r9d
mov r8d, dword [rbp + 0x10]
mov qword [rbp - 0x280], r8
mov qword [rbp - 0x278], r9
lea rcx, [rbp - 0x260]
sub rsp, 0x20
call fcn.14000b2c0
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x278]
mov r8, qword [rbp - 0x280]
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
mov eax, dword [0x1400dad70]
mov rbx, qword gs:[0x58]
mov rsi, qword [rbx + rax*8]
mov edi, 0xb48
call qword [rsi + rdi]
add rsp, 0x20
mov dword [rbp - 0x270], eax
sub rsp, 8
call fcn.14005845f
add rsp, 8
jmp 0x140058474
mov esi, dword [rbp - 0x270]
jmp 0x1400584c5
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.14001a170
lea rcx, [rbp - 0x140]
call fcn.14000b2c0
mov rdx, rax
mov rcx, qword [rbp + 0x20]
call sub.ADVAPI32.dll_RegDeleteKeyW
mov esi, eax
lea rcx, [rbp - 0x140]
call fcn.14000b2d0
mov r9d, esi
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rdx, [0x140058540]
mov qword [rbp - 0x18], rdx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0x16
lea rdx, [rbp - 0x10]
mov ecx, 0x163
sub rsp, 0x20
call fcn.140057db0
add rsp, 0x20
mov rbx, qword [rbp - 0x2b8]
mov rsi, qword [rbp - 0x2b0]
mov rdi, qword [rbp - 0x2a8]
mov r12, qword [rbp - 0x2a0]
mov r13, qword [rbp - 0x298]
mov r14, qword [rbp - 0x290]
mov r15, qword [rbp - 0x288]
mov rsp, rbp
pop rbp
ret
Function at 0x1400585d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1c0
mov qword [rbp - 0x198], rbx
mov qword [rbp - 0x190], rsi
mov qword [rbp - 0x188], rdi
mov qword [rbp - 0x180], r12
mov qword [rbp - 0x178], r13
mov qword [rbp - 0x170], r14
mov qword [rbp - 0x168], r15
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp - 0x150], 0xffffffff
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.14001a170
push 0
push 0
lea r9, [rbp - 0x150]
xor r8d, r8d
mov qword [rbp - 0x160], r8
mov qword [rbp - 0x158], r9
lea rcx, [rbp - 0x140]
sub rsp, 0x20
call fcn.14000b2c0
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x158]
mov r8, qword [rbp - 0x160]
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r9d, eax
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rbx, [0x140058730]
mov qword [rbp - 0x18], rbx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0x16
lea rdx, [rbp - 0x10]
mov ecx, 0x1ef
call fcn.140057db0
sub rsp, 8
call fcn.1400586d8
add rsp, 8
jmp 0x1400586ed
mov eax, dword [rbp - 0x150]
mov rbx, qword [rbp - 0x198]
mov rsi, qword [rbp - 0x190]
mov rdi, qword [rbp - 0x188]
mov r12, qword [rbp - 0x180]
mov r13, qword [rbp - 0x178]
mov r14, qword [rbp - 0x170]
mov r15, qword [rbp - 0x168]
mov rsp, rbp
pop rbp
ret

Function at 0x1400587e0
Capabilities:
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1b0
mov qword [rbp - 0x188], rbx
mov qword [rbp - 0x180], rsi
mov qword [rbp - 0x178], rdi
mov qword [rbp - 0x170], r12
mov qword [rbp - 0x168], r13
mov qword [rbp - 0x160], r14
mov qword [rbp - 0x158], r15
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rdx, qword [r9 + 8]
mov rax, qword [r9]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.14001a170
push qword [rbp + 0x10]
push qword [rbp + 0x18]
mov r9d, dword [rbp + 0x20]
xor r8d, r8d
mov qword [rbp - 0x150], r8
mov qword [rbp - 0x148], r9
lea rcx, [rbp - 0x140]
sub rsp, 0x20
call fcn.14000b2c0
add rsp, 0x20
mov rdx, rax
mov r9, qword [rbp - 0x148]
mov r8, qword [rbp - 0x150]
mov rcx, qword [rbp + 0x30]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegSetValueExW
add rsp, 0x30
mov r9d, eax
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rbx, [0x140058930]
mov qword [rbp - 0x18], rbx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0x16
lea rdx, [rbp - 0x10]
mov ecx, 0x2de
call fcn.140057db0
sub rsp, 8
call fcn.1400588e4
add rsp, 8
jmp 0x1400588f9
mov rbx, qword [rbp - 0x188]
mov rsi, qword [rbp - 0x180]
mov rdi, qword [rbp - 0x178]
mov r12, qword [rbp - 0x170]
mov r13, qword [rbp - 0x168]
mov r14, qword [rbp - 0x160]
mov r15, qword [rbp - 0x158]
mov rsp, rbp
pop rbp
ret
Function at 0x140058d50
Capabilities:
Delete registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1a0
mov qword [rbp - 0x178], rbx
mov qword [rbp - 0x170], rsi
mov qword [rbp - 0x168], rdi
mov qword [rbp - 0x160], r12
mov qword [rbp - 0x158], r13
mov qword [rbp - 0x150], r14
mov qword [rbp - 0x148], r15
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x140]
call fcn.14001a170
lea rcx, [rbp - 0x140]
sub rsp, 0x20
call fcn.14000b2c0
add rsp, 0x20
mov rdx, rax
mov rcx, qword [rbp + 0x18]
sub rsp, 0x20
call sub.ADVAPI32.dll_RegDeleteValueW
add rsp, 0x20
mov r9d, eax
mov rax, rbp
mov qword [rbp - 0x20], rax
lea rbx, [0x140058e70]
mov qword [rbp - 0x18], rbx
lea r8, [rbp - 0x20]
lea rcx, str.stdwindows_registry.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0x16
lea rdx, [rbp - 0x10]
mov ecx, 0x16e
call fcn.140057db0
sub rsp, 8
call fcn.140058e24
add rsp, 8
jmp 0x140058e39
mov rbx, qword [rbp - 0x178]
mov rsi, qword [rbp - 0x170]
mov rdi, qword [rbp - 0x168]
mov r12, qword [rbp - 0x160]
mov r13, qword [rbp - 0x158]
mov r14, qword [rbp - 0x150]
mov r15, qword [rbp - 0x148]
mov rsp, rbp
pop rbp
ret