joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ba6a0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4ba6b7
inc rax
cmp rax, 4
jge 0x4ba6cf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4ba6b4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4ba6e0
inc rax
cmp rax, 4
jge 0x4ba6ee
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4ba717
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4ba6fb
jmp 0x4ba6dd

Function at 0x4d6bc0
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x4d6bd8
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x4d6bd8
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x4d6be0
xor eax, eax
ret
cmp rbx, 3
je 0x4d6bec
cmp rbx, 4
jne 0x4d6c19
cmp al, 0x2c
ja 0x4d6c06
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x4d6c16
cmp al, 0x24
je 0x4d6c16
nop dword [rax]
cmp al, 0x26
jae 0x4d6c16
jmp 0x4d6c19
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x4d6c16
cmp al, 0x5b
je 0x4d6c16
cmp al, 0x5d
jne 0x4d6c19
xor eax, eax
ret
cmp al, 0x2f
ja 0x4d6c52
nop dword [rax]
cmp al, 0x26
ja 0x4d6c31
cmp al, 0x24
je 0x4d6c71
cmp al, 0x26
je 0x4d6c71
jmp 0x4d6ceb
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x4d6c71
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x4d6ce8
cmp al, 0x2f
je 0x4d6c71
jmp 0x4d6ceb
cmp al, 0x3d
ja 0x4d6c69
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x4d6c71
nop
cmp al, 0x3d
je 0x4d6c71
jmp 0x4d6ceb
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x4d6ce0
cmp rbx, 2
jg 0x4d6ca7
cmp rbx, 1
je 0x4d6ca1
nop dword [rax]
cmp rbx, 2
jne 0x4d6ceb
cmp al, 0x2f
je 0x4d6c92
cmp al, 0x3b
je 0x4d6c92
cmp al, 0x2c
jne 0x4d6c99
mov ecx, 1
jmp 0x4d6c9e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x4d6cca
cmp al, 0x40
je 0x4d6cb9
cmp al, 0x2f
je 0x4d6cb9
cmp al, 0x3f
jne 0x4d6cc2
mov ecx, 1
nop
jmp 0x4d6cc7
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x4d6cd9
cmp rbx, 7
jne 0x4d6ceb
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x4d6ce8
cmp al, 0x7e
jne 0x4d6ceb
xor eax, eax
ret
cmp rbx, 7
jne 0x4d6d01
cmp al, 0x21
je 0x4d6cfd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x4d6d01
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x140001f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140002008
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140002008
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140001ff5
nop
cmp rbx, rcx
jae 0x140002008
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140001fe0
cmp rbx, rcx
jae 0x140002008
cmp word [rbx], 0
je 0x140002008
lfence
mov rax, rbx
jmp 0x14000200a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140003290
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400654b0]
test rax, rax
jne 0x140003310
lea rcx, str.sciter.dll
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x1400032f5
lea rdx, str.SciterAPI
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400032ec
call rax
mov qword [0x1400654b0], rax
call qword [rax + 0x4d8]
test rax, rax
je 0x1400032f5
mov qword [0x1400654a8], rax
jmp 0x1400032f5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1400654b0]
mov rbx, qword [rsp + 0x20]
test rax, rax
jne 0x140003310
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x28
ret
Function at 0x140008d30
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x140063010]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rsi, rcx
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [rsp + 0x60], eax
mov r9, 0xffffffffffffffff
lea r8, str.CBdVpnUi::ShowUiFront
mov edx, 0x102
lea rcx, [rsp + 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea r8, [0x140051568]
mov edx, 0x104
lea rcx, [rsp + 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r9, 0xffffffffffffffff
lea r8, str.CBdVpnUi::ShowUiFront
mov edx, 0x104
lea rcx, [rbp + 0x16c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, dword [0x140065724]
mov eax, dword [0x140065720]
xor r14d, r14d
lea r15d, [r14 + 1]
add ecx, eax
je 0x140008e82
mov dword [rsp + 0x48], r14d
call fcn.140028b70
mov qword [rsp + 0x40], rax
lock inc dword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
test rax, rax
jne 0x140008e0e
call fcn.140028b70
mov qword [rsp + 0x40], rax
lock inc dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x50], 0x20
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], rax
lea rax, str.____s
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x16c]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rsp + 0x50]
movsx edx, r15w
call fcn.140028cf0
nop
mov qword [rsp + 0x40], r14
mov eax, 0xffffffff
lock xadd dword [rsp + 0x48], eax
cmp eax, 1
js 0x140008e7d
call fcn.140028730
mov eax, 0xffffffff
lock xadd dword [rsp + 0x48], eax
cmp eax, 1
jns 0x140008e68
lock inc dword [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
mov r8d, r15d
mov edx, edi
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 1]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 2]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
mov edx, edi
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.USER32.dll_SetActiveWindow]
lea rcx, [rsi + 0x28]
mov rax, qword [rcx]
mov edx, r15d
call qword [rax + 0x20]
nop
lea rcx, [rsp + 0x60]
call fcn.140027640
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140045c20
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140029680
Capabilities:
Accept command line arguments
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x140063010]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400296b1
lea ebx, [rax - 1]
jmp 0x14002975c
lea rdx, str.crash
mov qword [rsp + 0x60], rdi
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rdi, rax
test rax, rax
je 0x140029752
cmp rax, rbx
jbe 0x1400296e7
movzx eax, word [rax - 2]
cmp ax, 0x20
je 0x1400296e7
cmp ax, 9
jne 0x140029752
add rdi, 0xe
mov edx, 0x23
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov r8, rax
test rax, rax
je 0x140029752
movzx eax, word [rax + 2]
cmp eax, 0x20
ja 0x140029752
movabs rcx, 0x100000201
bt rcx, rax
jae 0x140029752
mov ebx, esi
mov r9d, esi
cmp rdi, r8
jae 0x140029752
movzx edx, word [rdi]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x140029752
cmp ebx, 0x5265c00
ja 0x140029752
lea ebx, [rbx + rbx*4]
inc r9d
add rdi, 2
lea ebx, [rbx - 0x18]
lea ebx, [rdx + rbx*2]
cmp rdi, r8
jb 0x140029724
test r9d, r9d
jne 0x140029757
mov ebx, 0xffffffff
mov rdi, qword [rsp + 0x60]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
call fcn.140001550
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140029816
test rcx, rcx
je 0x14002978d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
js 0x140029821
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140065980], eax
jle 0x1400297d8
lea rcx, [0x140065980]
call fcn.140045df4
cmp dword [0x140065980], 0xffffffff
jne 0x1400297d8
lea rcx, [0x140065980]
mov dword [0x140065984], ebx
call fcn.140045d94
cmp dword [0x140065984], esi
lea rax, [0x140065984]
mov r9, rsi
mov qword [rsp + 0x28], rsi
cmova r9, rax
mov dword [rsp + 0x20], esi
xor edx, edx
lea r8, [0x140029650]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140029821
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140029821
test rcx, rcx
je 0x140029821
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140045c20
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
Function at 0x140042110
Capabilities:
Extract resource via kernel32 functions
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x40
mov dword [rcx + 0x474], r8d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r8, str.debug
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 4
mov rbp, r9
mov qword [rsp + 0x20], rax
mov r14, rdx
mov dword [rsp + 0x70], 0
mov rbx, rcx
mov dword [rsp + 0x60], 4
lea r9, [rsp + 0x30]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareBitdefender_bdhtml
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [rsp + 0x70], 1
jne 0x140042187
mov byte [rbx + 0x479], 1
movzx edx, word [rbx + 0x474]
mov r8d, 0x17
mov rcx, qword [rbx + 0x248]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1400421c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x260], eax
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rbx + 0x248]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400421a9
mov rcx, rax
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x140042206
mov rcx, qword [rbx + 0x248]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test eax, eax
jne 0x140042219
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x260], eax
xor eax, eax
jmp 0x1400422b9
lea eax, [rdi + 2]
mov qword [rbx + 0x10], r14
mov ecx, eax
mov dword [rbx + 0x30], eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, dword [rbx + 0x30]
xor edx, edx
mov rcx, rax
mov qword [rbx + 0x28], rax
call fcn.140046cd8
mov edx, dword [rbx + 0x30]
mov r9, rdi
mov rcx, qword [rbx + 0x28]
mov r8, rsi
call fcn.140002320
add dword [rbx + 0x30], 0xfffffffe
test rbp, rbp
je 0x140042261
lea rcx, [rbx + 0x34]
mov r8, rbp
jmp 0x1400422a5
cmp word [0x1400654d0], 0
jne 0x140042270
call fcn.140043580
lea rcx, [rbx + 0x34]
test rcx, rcx
je 0x1400422b0
lea r8, [0x1400654d0]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [r8 + rax*2], 0
jne 0x140042290
cmp eax, 0x104
jge 0x1400422b0
lfence
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rcx, [rbx - 0x28]
call fcn.1400422d0
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1400428f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x140063010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
je 0x140042a8a
cmp word [r8], 0
je 0x140042a8a
lea rdx, str.sciter:
mov rcx, r8
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
cmp rax, rsi
je 0x140042a86
mov edx, 0x2f
mov rcx, rsi
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, rax
test rax, rax
je 0x140042a8a
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140046cd8
lea r8, [rdi + 2]
mov edx, 0x104
mov r9, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov edx, 0x2e
lea rcx, [rsp + 0x30]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, rax
test rax, rax
je 0x140042a10
xor eax, eax
mov word [rdi], ax
add rdi, 2
je 0x140042a10
lea rdx, str.HTML
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140042a10
lea rdx, [0x1400548f8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea rdx, [rsp + 0x30]
test eax, eax
jne 0x140042a0b
mov rcx, qword [rbx + 0x278]
lea r8, [0x1400548f8]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140042a02
mov rbx, qword [rbx + 0x278]
jmp 0x140042a37
lea r8, [0x1400548f8]
jmp 0x140042a16
mov r8, rdi
jmp 0x140042a1b
mov r8d, 0x17
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 0x270]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x140042a86
mov rbx, qword [rbx + 0x270]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140042a8a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x140042a8a
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test eax, eax
je 0x140042a8a
call fcn.140003290
mov r9d, ebx
mov r8, rbp
mov rdx, rsi
mov rcx, r14
mov rax, qword [rax + 0x18]
call qword [case.0x140042b0e.0]
xor eax, eax
jmp 0x140042a8f
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140045c20
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400439f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x140063010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor r14d, r14d
mov qword [rbp + 0x2f], r14
mov qword [rbp + 0x3f], r14
mov qword [rbp + 0x47], 7
mov word [rbp + 0x2f], r14w
mov rsi, 0xffffffff80000001
lea rcx, [rbp + 7]
call fcn.140041d20
nop
cmp byte [rbp + 0x27], r14b
je 0x140043a93
mov rsi, 0xffffffff80000003
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140043a70
lea rcx, [rbp + 0x2f]
call fcn.140001860
mov edx, 0x5c
lea rcx, [rbp + 0x2f]
call fcn.140001af0
nop
lea rcx, [rbp + 7]
call fcn.14002fbb0
mov rcx, qword [rbp + 0x3f]
mov rdx, qword [rbp + 0x47]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1b
jb 0x140043ae2
lea rdi, [rcx + 0x1b]
mov qword [rbp + 0x3f], rdi
lea rbx, [rbp + 0x2f]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x2f]
lea rcx, [rbx + rcx*2]
mov r8d, 0x36
lea rdx, str.SoftwareBitdefender_bdhtml
call fcn.140046cd2
mov word [rbx + rdi*2], r14w
jmp 0x140043b03
lfence
mov qword [rsp + 0x20], 0x1b
lea r9, str.SoftwareBitdefender_bdhtml
mov edx, 0x1b
lea rcx, [rbp + 0x2f]
call fcn.140001990
mov qword [rbp - 1], r14
mov dword [rbp - 5], 4
mov dword [rbp - 9], r14d
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140043b82
lea rax, [rbp - 5]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.dark
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp - 9]
mov edx, 1
test eax, eax
cmove ecx, edx
mov dword [rbp - 9], ecx
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 9], 1
sete bl
mov rdx, qword [rbp + 0x47]
cmp rdx, 8
jb 0x140043bcc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043bc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043bc7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400462d0
movzx eax, bl
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140045c20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140043c30
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140063010]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor eax, eax
lea rdx, str..DEFAULTSoftwareSetId
xorps xmm0, xmm0
mov qword [r11 - 0x40], rax
movups xmmword [rsp + 0x40], xmm0
mov rbx, rcx
mov r9d, 0x20019
movups xmmword [rsp + 0x50], xmm0
mov qword [r11 - 0x18], rax
xor r8d, r8d
lea rax, [r11 - 0x40]
mov rcx, 0xffffffff80000003
mov qword [r11 - 0x58], rax
xor sil, sil
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov ebp, 1
test eax, eax
jne 0x140043cdc
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x34], ebp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.wslibsite_lang
mov dword [rsp + 0x30], 0x26
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140043cec
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140043d20
cmp qword [rbx + 0x18], 8
jb 0x140043cfa
mov rbx, qword [rbx]
lea rdx, [rsp + 0x40]
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x140043d15
add rbx, 2
test eax, eax
jne 0x140043d02
test ecx, ecx
movzx eax, sil
cmove eax, ebp
jmp 0x140043d24
movzx eax, sil
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140045c20
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x1800f03bf
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x18012ee80
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x18037b395]
call fcn.1800f62e7
nop
mov qword [rbp + 8], 0
jmp 0x18012eebf
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x18012ef15
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x18012eeb4
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x1800f2354
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1802da2a0
mov rax, rcx
neg rcx
test rax, 7
je 0x1802da2bd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1802da318
test al, 7
jne 0x1802da2b0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1802da2d1
mov rdx, qword [rax - 8]
test dl, dl
je 0x1802da342
test dh, dh
je 0x1802da33c
shr rdx, 0x10
test dl, dl
je 0x1802da336
test dh, dh
je 0x1802da330
shr rdx, 0x10
test dl, dl
je 0x1802da32a
test dh, dh
je 0x1802da324
shr edx, 0x10
test dl, dl
je 0x1802da31e
test dh, dh
jne 0x1802da2d1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1800f23c2
Capabilities:
Query environment variable

Disassembly:
jmp 0x1802b7f40
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1802b7ac0
lea rcx, [rsp + 0x20]
call fcn.1802b7b10
movzx eax, al
test eax, eax
jne 0x1802b7f85
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.1802b7af0
mov rax, qword [rsp + 0x40]
jmp 0x1802b807f
lea rcx, [rsp + 0x20]
call fcn.1802b7c10
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.1802b7bb0
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1800f288b
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1800f1a53
lea rcx, [rsp + 0x28]
call fcn.1800f2f7f
movzx eax, al
test eax, eax
jne 0x1802b801f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1800f4b7c
lea rcx, [rsp + 0x20]
call fcn.1802b7af0
mov rax, qword [rsp + 0x50]
jmp 0x1802b807f
lea rcx, [rsp + 0x20]
call fcn.1802b7c10
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1800f6198
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1800f278c
lea rcx, [rsp + 0x28]
call fcn.1800f6ea4
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1800f4b7c
lea rcx, [rsp + 0x20]
call fcn.1802b7af0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret