joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005320
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000534d
xor eax, eax
jmp 0x1400054a2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140005378
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140005378
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400054a2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140005495
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400053bb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400053e6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000549a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005455
sub eax, 1
je 0x140005455
cmp eax, 2
jne 0x140005495
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000549a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005483
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140005495
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000549a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000ebc0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400058a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140005973
cmp byte [rcx + 0x71], 0
je 0x140005973
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000596f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005934
sub eax, 1
je 0x140005938
cmp eax, 2
jne 0x14000596f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ebc0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005966
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000596f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000591c
xor al, al
jmp 0x14000591c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ebc0
add rsp, 0x60
pop rbx
ret
Function at 0x14000c810
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14000c923
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000c923
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x14000c888
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x14000c930
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x14000c911
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x14000c911
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x14000c8ea
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x14000c906
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.14000cf70
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x14000c8a0
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x14000c930
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000ebc0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000df00
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
mov r14, rcx
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000df8e
nop dword [rax]
test rbx, rbx
je 0x14000df56
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000df40
test eax, eax
jns 0x14000dfaf
test rbx, rbx
je 0x14000dfb4
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14000e0a6
test rbx, rbx
jne 0x14000dfbb
xor eax, eax
jmp 0x14000e0a6
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14000e086
mov esi, edi
lea rdx, [rbx + 0x30]
imul rax, rsi, 0x128
mov qword [rsp + 0x28], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], 0xf
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
add rdx, rcx
inc r8
cmp byte [rdx + r8], bpl
jne 0x14000e004
lea rcx, [rsp + 0x28]
call fcn.140005d50
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x14000e024
mov rdx, qword [r14]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000e0bc
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000e07c
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e077
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000e10d
call fcn.14000ebe0
inc edi
cmp edi, dword [rbx]
jb 0x14000dfd2
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000ebc0
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000e119
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e114
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e114
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ebe0
mov rax, rdi
jmp 0x14000e099
Function at 0x140129b7c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x140
cmp qword [rcx + 0x18], 0xf
mov rbx, rcx
jbe 0x140129ba8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140129d11
mov rdi, qword [rbx + 0x10]
test rdi, rdi
je 0x140129d69
xor r15d, r15d
lea rax, [0x140d813b0]
or rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x140129bd2
cmp qword [rbx + 0x18], 0xf
mov r14, rbx
jbe 0x140129be8
mov r14, qword [rbx]
test rsi, rsi
je 0x140129c4e
cmp r15, rdi
jae 0x140129c4e
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call fcn.140c85fe0
lea rax, [0x140d813b0]
lea rdx, [rsi + rax]
mov rcx, rax
cmp rax, rdx
je 0x140129c27
movzx eax, byte [rcx]
inc rcx
mov byte [rsp + rax + 0x40], 1
cmp rcx, rdx
jne 0x140129c17
lea rcx, [rdi + r14]
lea rdi, [r14 + r15]
jmp 0x140129c3e
movzx eax, byte [rdi]
cmp byte [rsp + rax + 0x40], 0
jne 0x140129c45
inc rdi
cmp rdi, rcx
jb 0x140129c31
jmp 0x140129c4e
sub rdi, r14
cmp rdi, 0xffffffffffffffff
jne 0x140129c52
mov rdi, qword [rbx + 0x10]
and qword [rsp + 0x30], 0
mov r8, rdi
and qword [rsp + 0x38], 0
xorps xmm0, xmm0
cmp qword [rbx + 0x10], rdi
mov rdx, rbx
movups xmmword [rsp + 0x20], xmm0
cmovb r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140129c7f
mov rdx, qword [rbx]
lea rcx, [rsp + 0x20]
call fcn.140131988
cmp qword [rsp + 0x30], 0
je 0x140129cc7
cmp qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140129cc7
cmp qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call fcn.140c5a500
test eax, eax
jne 0x140129d30
mov rdx, qword [rsp + 0x38]
lea r15, [rdi + 1]
cmp rdx, 0xf
jbe 0x140129d04
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140129cff
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140129d6d
call fcn.140c4bba0
mov rdi, qword [rbx + 0x10]
cmp r15, rdi
jb 0x140129bc7
mov al, 1
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140129d69
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140129d64
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140129d6d
call fcn.140c4bba0
xor al, al
jmp 0x140129d13
call fcn.140c5acfc
int3
Function at 0x140131588
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r13, r8
mov rsi, rdx
mov rbp, rcx
movzx eax, byte [r8]
mov edx, eax
movabs rcx, 0xcbf29ce484222325
xor rdx, rcx
movabs rcx, 0x100000001b3
imul rdx, rcx
mov qword [rsp + 0x60], rdx
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rdx, qword [rbp + 0x18]
mov rbx, qword [rdx + rcx*8 + 8]
lea r8, [rbp + 8]
mov r12, qword [r8]
cmp rbx, r12
jne 0x1401315f4
mov rbx, r12
mov r14, r12
jmp 0x14013162f
mov rdx, qword [rdx + rcx*8]
jmp 0x140131603
cmp rbx, rdx
je 0x140131629
mov rbx, qword [rbx + 8]
cmp al, byte [rbx + 0x10]
jne 0x1401315fa
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov r12, rbx
mov r14, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [rbp + 0x10], rax
je 0x14013177f
mov qword [rsp + 0x20], r8
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.140c4b84c
mov rdi, rax
mov qword [rsp + 0x28], rax
mov cl, byte [r13]
mov byte [rax + 0x10], cl
and qword [rax + 0x18], 0
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x140131680
cvtsi2ss xmm0, rcx
jmp 0x140131695
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1401316a8
cvtsi2ss xmm1, rcx
jmp 0x1401316bd
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x140131723
mov rcx, rbp
call fcn.14013441c
mov rcx, qword [rbp + 0x30]
mov r9, qword [rsp + 0x60]
and rcx, r9
add rcx, rcx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rbp + 8]
cmp rax, rbx
je 0x14013170d
mov r8, qword [rdx + rcx*8]
mov cl, byte [rdi + 0x10]
jmp 0x140131705
mov rbx, rax
cmp rax, r8
je 0x14013171c
mov rax, qword [rax + 8]
cmp cl, byte [rax + 0x10]
jne 0x1401316f9
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r14, rbx
mov r12, qword [rsp + 0x20]
jmp 0x140131728
mov qword [rsp + 0x20], rax
jmp 0x140131712
mov r9, qword [rsp + 0x60]
mov rdx, qword [rbx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], r12
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r9
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rbp + 8]
jne 0x14013175c
mov qword [rcx + rax*8], rdi
jmp 0x14013176e
cmp r8, r14
jne 0x140131767
mov qword [rcx + rax*8], rdi
jmp 0x140131773
cmp qword [rcx + rax*8 + 8], rdx
jne 0x140131773
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x14013160f
lea rcx, str.unordered_map_set_too_long
call fcn.140c48988
int3
Function at 0x14013441c
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov edi, 1
add rdx, rdi
mov rbx, qword [rcx + 0x38]
mov rsi, rcx
xorps xmm0, xmm0
js 0x140134450
cvtsi2ss xmm0, rdx
jmp 0x140134465
mov rax, rdx
and rdx, rdi
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.140c85690
movss xmm1, dword [0x140d88b80]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140134493
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140134493
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1401344c1
cmp rbx, 0x200
jae 0x1401344be
shl rbx, 3
cmp rbx, rcx
jae 0x1401344c1
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov rax, rdi
shl rax, cl
cmp rbx, rax
ja 0x140134619
lea rax, [rbx - 1]
mov rbx, qword [rsi + 8]
or rax, rdi
mov r8, rbx
bsr rcx, rax
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14012dd04
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1401345dd
movzx r8d, byte [rax + 0x10]
movabs r9, 0xcbf29ce484222325
mov r11, qword [rsi + 0x30]
mov edx, r8d
mov rdi, qword [rsi + 0x18]
xor rdx, r9
mov rcx, qword [rcx]
movabs r9, 0x100000001b3
imul rdx, r9
and r11, rdx
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x140134566
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x1401345d1
mov r10, qword [rdi + r11*8 + 8]
cmp r8b, byte [r10 + 0x10]
jne 0x1401345a6
mov r10, qword [r10]
cmp r10, rax
je 0x14013455f
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14013455f
mov r10, qword [r10 + 8]
cmp r8b, byte [r10 + 0x10]
je 0x1401345f3
cmp qword [rdi + r11*8], r10
jne 0x14013459c
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140134521
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1401345d1
lea rcx, str.invalid_hash_bucket_count
call fcn.140c48988
int3

Function at 0x1401357d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x140135804
movzx eax, byte [rcx + r9]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x1401357e6
mov rax, r8
ret
Function at 0x140136048
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rbx, rdx
mov rax, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x14013606a
mov rax, qword [r8]
mov r9d, dword [r8 + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140136078
mov rdx, qword [rdx]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x40], eax
test eax, eax
jne 0x1401360ac
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rbp
ret
movabs rax, 0x583db2a5f0007781
mov qword [rsp + 0x40], rax
movabs rax, 0x1813c94a2d31c8a6
mov qword [rsp + 0x48], rax
movabs rax, 0xc9d7332fa5fd1e5d
mov qword [rsp + 0x50], rax
movabs rax, 0x3897c82ab567b4db
mov qword [rsp + 0x58], rax
movabs rax, 0xf3db0a0388b6f075
mov qword [rsp + 0x60], rax
movabs rax, 0xe40b4fd6f51cd421
mov qword [rsp + 0x68], rax
movabs rax, 0x64e91616f625685c
mov qword [rsp + 0x70], rax
movabs rax, 0x727de8a9b53c2ca2
mov qword [rsp + 0x78], rax
movabs rax, 0x214fc6d6996712d3
mov qword [rbp - 0x80], rax
movabs rax, 0x7c76a5234c77e89c
mov qword [rbp - 0x78], rax
movabs rax, 0xbdbe415885926a7d
mov qword [rbp - 0x70], rax
movabs rax, 0x4ce4a14dd01594be
mov qword [rbp - 0x68], rax
movabs rax, 0x96ae6662fe968907
mov qword [rbp - 0x60], rax
movabs rax, 0x9f2b75af9057f400
mov qword [rbp - 0x58], rax
movabs rax, 0x5e9b796484604821
mov qword [rbp - 0x50], rax
movabs rax, 0x727de8a9b5415782
mov qword [rbp - 0x48], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rsp + 0x50]
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x70], xmm1
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x28]
call fcn.14012d810
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x18]
call fcn.140135d64
movups xmm1, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 8]
call fcn.140135d64
movups xmm1, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm1
lea r9, [rbp + 0x40]
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 8]
call fcn.14013704c
nop
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140135d10
lea rdx, [0x140db1a28]
lea rcx, [rbp - 0x40]
call fcn.140c4d970
int3
Function at 0x1401366ec
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov rbx, rdx
mov eax, 4
mov dword [rbp + 0x60], eax
mov dword [rbp + 0x58], eax
and dword [rbp + 0x50], 0
cmp qword [rdx + 0x18], 0xf
jbe 0x140136717
mov rdx, qword [rdx]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rbp + 0x68], eax
test eax, eax
jne 0x14013674d
mov eax, dword [rbp + 0x50]
add rsp, 0x138
pop rbx
pop rbp
ret
movabs rax, 0x583db2a5f0007781
mov qword [rsp + 0x40], rax
movabs rax, 0x1813c94a2d31c8a6
mov qword [rsp + 0x48], rax
movabs rax, 0xd9df242aa5fd1e5d
mov qword [rsp + 0x50], rax
movabs rax, 0x3e90d224b770e69e
mov qword [rsp + 0x58], rax
movabs rax, 0xb7cb130e9fe0a97e
mov qword [rsp + 0x60], rax
movabs rax, 0xe2505595e932bf20
mov qword [rsp + 0x68], rax
movabs rax, 0x7ea10b0bf6120d01
mov qword [rsp + 0x70], rax
movabs rax, 0x727de8a9b5412af9
mov qword [rsp + 0x78], rax
movabs rax, 0x214fc6d6996712d3
mov qword [rbp - 0x80], rax
movabs rax, 0x7c76a5234c77e89c
mov qword [rbp - 0x78], rax
movabs rax, 0xbdbe415885926a7d
mov qword [rbp - 0x70], rax
movabs rax, 0x4ce4a14dd01594be
mov qword [rbp - 0x68], rax
movabs rax, 0x96ae6662fe968907
mov qword [rbp - 0x60], rax
movabs rax, 0x9f2b75af9057f400
mov qword [rbp - 0x58], rax
movabs rax, 0x5e9b796484604821
mov qword [rbp - 0x50], rax
movabs rax, 0x727de8a9b5415782
mov qword [rbp - 0x48], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rsp + 0x50]
xorps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x70], xmm1
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x28]
call fcn.14012d810
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x18]
call fcn.140135d64
movups xmm1, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 8]
call fcn.140135d64
movups xmm1, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm1
lea r9, [rbp + 0x68]
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 8]
call fcn.14013704c
nop
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140135d10
lea rdx, [0x140db1a28]
lea rcx, [rbp - 0x40]
call fcn.140c4d970
int3
Function at 0x140136ba8
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
cmp qword [rdx + 0x18], 0xf
jbe 0x140136bb6
mov rdx, qword [rdx]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [rcx]
xor r8d, r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x14013937c
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
xor ecx, ecx
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x1401393d1
cmp qword [rbx + 0x18], 0xf
jbe 0x1401393ae
mov rbx, qword [rbx]
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
jne 0x1401393e3
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test ebx, ebx
je 0x1401393d1
cmp dword [rsp + 0x24], 4
sete al
jmp 0x1401393d3