joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018b64
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
and qword [rsp + 0x30], 0
xor r14b, r14b
cmp qword [rcx + 0x18], 8
mov rdi, rdx
mov rbx, rcx
mov rdx, rcx
jb 0x140018b92
mov rdx, qword [rcx]
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140018ca7
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x140018bcd
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140018c12
cmp qword [rdi + 0x18], 8
mov r14b, 1
mov r9, rdi
jb 0x140018bf2
mov r9, qword [rdi]
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x140018bff
mov r8, qword [rbx]
lea rdx, str._s_s_registry_value_deleted_successfully.
xor ecx, ecx
call fcn.14000b5ac
jmp 0x140018d17
mov rbp, rdi
cmp eax, 2
jne 0x140018c62
cmp qword [rdi + 0x18], 8
jb 0x140018c24
mov rbp, qword [rdi]
cmp qword [rbx + 0x18], 8
mov rsi, rbx
jb 0x140018c31
mov rsi, qword [rbx]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r9, rbp
or ecx, 0x80070000
lea rdx, str._s_s_registry_value_does_not_exist
test eax, eax
mov r8, rsi
cmovle ecx, eax
call fcn.14000b5ac
jmp 0x140018d17
cmp qword [rdi + 0x18], 8
jb 0x140018c6c
mov rbp, qword [rdi]
cmp qword [rbx + 0x18], 8
mov rsi, rbx
jb 0x140018c79
mov rsi, qword [rbx]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r9, rbp
or ecx, 0x80070000
lea rdx, str._s_s_registry_value_delete_failed.
test eax, eax
mov r8, rsi
cmovle ecx, eax
call fcn.14000b430
jmp 0x140018d17
mov rsi, rbx
cmp eax, 2
jne 0x140018ce4
cmp qword [rbx + 0x18], 8
jb 0x140018cb9
mov rsi, qword [rbx]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r8, rsi
or ecx, 0x80070000
lea rdx, str._s_registry_key_does_not_exist
test eax, eax
cmovle ecx, eax
call fcn.14000b5ac
jmp 0x140018d17
cmp qword [rbx + 0x18], 8
jb 0x140018cee
mov rsi, qword [rbx]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov r8, rsi
or ecx, 0x80070000
lea rdx, str._s_registry_key_open_failed.
test eax, eax
cmovle ecx, eax
call fcn.14000b430
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140018d2d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, rbx
call fcn.14000be20
mov rcx, rdi
call fcn.14000be20
mov rbx, qword [rsp + 0x70]
mov al, r14b
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140018d5c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x30
and qword [r11 + 0x10], 0
xor ebx, ebx
mov rdi, r9
mov rax, r8
mov rsi, rcx
test r8, r8
jne 0x140018d93
mov ecx, 0x80070057
mov ebx, ecx
call fcn.14000bbd0
jmp 0x140018df2
test rdi, rdi
je 0x140018d85
mov byte [rcx], bl
mov r9d, 0x20019
lea rcx, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140018df2
and qword [rsp + 0x28], rbx
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
and qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140018df2
mov byte [rsi], 1
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140018e08
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000bbf0
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140018e28
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x48], 0
xor ebx, ebx
mov rdi, r8
mov rsi, rcx
test rdx, rdx
jne 0x140018e58
mov ecx, 0x80070057
mov ebx, ecx
call fcn.14000bbd0
jmp 0x140018eb4
test rdi, rdi
je 0x140018e4a
mov byte [rcx], bl
lea rax, [rsp + 0x48]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140018eb4
and qword [rsp + 0x28], rbx
xor r9d, r9d
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
and qword [rsp + 0x20], rbx
mov rdx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140018eb4
mov byte [rsi], 1
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140018eca
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000bbf0
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140018fcc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
and qword [rsp + 0x30], 0
mov rsi, rdx
cmp qword [rcx + 0x18], 8
mov rbx, rcx
mov rdx, rcx
jb 0x140018ff4
mov rdx, qword [rcx]
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
mov edi, eax
jb 0x140019029
mov rdx, qword [rsi]
and qword [rsp + 0x28], 0
xor r9d, r9d
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test edi, edi
jne 0x140019059
test eax, eax
jne 0x140019059
mov dil, 1
jmp 0x14001905c
xor dil, dil
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x140019069
mov r8, qword [rbx]
lea rax, str.exists
test dil, dil
lea r9, str.does_not_exist
cmovne r9, rax
lea rdx, str._s_registry_key__s
xor ecx, ecx
call fcn.14000b5ac
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400190a2
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, rbx
call fcn.14000be20
mov rcx, rsi
call fcn.14000be20
mov rbx, qword [rsp + 0x60]
mov al, dil
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1400192e8
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
and qword [rsp + 0x30], 0
mov rsi, rdx
cmp qword [rcx + 0x18], 8
mov rdi, r8
mov r14, rcx
mov rdx, rcx
jb 0x140019311
mov rdx, qword [rcx]
lea rax, [rsp + 0x30]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14001934d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x1400193af
cmp qword [rdi + 0x18], 8
mov rcx, rdi
mov rax, qword [rdi + 0x10]
jb 0x14001935e
mov rcx, qword [rdi]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
jb 0x14001936b
mov rdx, qword [rsi]
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001939d
xor ebx, ebx
jmp 0x1400193b6
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x1400193b6
mov ecx, ebx
call fcn.14000bbd0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400193cc
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000bbf0
mov rcx, r14
call fcn.14000be20
mov rcx, rsi
call fcn.14000be20
mov rcx, rdi
call fcn.14000be20
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140019404
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x140056920]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r8
mov rbx, rdx
xor esi, esi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], si
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.14000bd88
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14001948f
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x1400194e6
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov eax, dword [rbp - 0x20]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400194d4
mov ebx, esi
jmp 0x1400194ed
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x1400194ed
mov ecx, ebx
call fcn.14000bbd0
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140019502
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000bbf0
nop
lea rcx, [rbp - 0x30]
call fcn.14000be20
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400301c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019538
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x1080
call fcn.140031470
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140056920]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov word [rsp + 0x70], r14w
mov dword [rsp + 0x40], 0x1000
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14001959d
mov rdx, qword [rcx]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400195e2
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x1400195e2
mov ecx, ebx
call fcn.14000bbd0
jmp 0x140019656
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400195ef
mov r8, qword [rsi]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400195fc
mov rdx, qword [rdi]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov rcx, 0xffffffff80000002
mov r9d, 2
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140019637
mov ebx, r14d
jmp 0x140019649
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x1400195d9
lea rdx, [rsp + 0x70]
mov rcx, rbp
call fcn.14000bd88
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001966c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000bbf0
nop
mov rcx, rdi
call fcn.14000be20
nop
mov rcx, rsi
call fcn.14000be20
mov eax, ebx
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.1400301c0
add rsp, 0x1080
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400196ac
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x30
and qword [r11 + 0x10], 0
lea rax, [r11 + 0x10]
mov rdi, r8
mov qword [r11 - 0x18], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCloudManagedUpdateuhs
mov r9d, 2
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140019709
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x14001974f
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001973d
xor ebx, ebx
jmp 0x140019756
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x140019756
mov ecx, ebx
call fcn.14000bbd0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001976c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000bbf0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140019788
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
mov rdi, r9
mov dword [rax + 8], 4
lea rax, [rax - 0x18]
mov rsi, r8
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400197e9
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x14001982c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001981a
xor ebx, ebx
jmp 0x140019833
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
je 0x140019833
mov ecx, ebx
call fcn.14000bbd0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140019849
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov ecx, ebx
call fcn.14000bbf0
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14001b458
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov r10, r8
mov r14, rdx
mov r9, rcx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14001b495
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r15 + r15]
xor ecx, ecx
test r11, r11
je 0x14001b4c8
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rdi, 0x100000001b3
imul rdx, rdi
inc rcx
cmp rcx, r11
jb 0x14001b4aa
mov r8, qword [r9 + 0x30]
and r8, rdx
mov rdi, qword [r9 + 8]
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov r12, qword [rcx + rax*8]
cmp rdi, r12
je 0x14001b591
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
cmp rdi, r12
je 0x14001b591
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
cmp qword [rdi + 0x28], 8
jb 0x14001b50e
mov rax, qword [rdi + 0x10]
mov rdx, r10
cmp qword [r10 + 0x18], 8
jb 0x14001b51b
mov rdx, qword [r10]
cmp r15, qword [rdi + 0x20]
jne 0x14001b4f2
mov rsi, r15
test r15, r15
je 0x14001b543
sub rdx, rax
movzx ecx, word [rdx + rax]
cmp cx, word [rax]
jne 0x14001b5ec
add rax, 2
sub rsi, 1
jne 0x14001b52c
xor eax, eax
test eax, eax
jne 0x14001b4f2
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x38]
call fcn.14000be20
lea rcx, [rbx + 0x10]
call fcn.14000be20
mov edx, 0x58
mov rcx, rbx
call fcn.1400301e8
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14001b63b
mov rax, qword [rbx]
cmp rdi, rax
je 0x14001b5c6
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov r10, r8
add r10, r10
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x14001b5f8
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14001b627
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x14001b545
cmp rax, rdi
jne 0x14001b603
mov qword [rdx + r8*8], rbx
jmp 0x14001b627
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14001b627
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.14001b654
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001b890
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov r10, qword [rsi + 0x10]
jb 0x14001b8c3
mov r9, qword [rsi]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r10, r10
je 0x14001b8f2
movzx eax, byte [rdx + r9]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, r10
jb 0x14001b8d4
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14001b92a
cmp qword [rcx + rdx*8], rdi
jne 0x14001b91f
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14001b923
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14001b937
cmp qword [rcx + rdx*8], rdi
jne 0x14001b937
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x28]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14000be20
mov rcx, rsi
call fcn.14000be20
mov edx, 0x58
mov rcx, rdi
call fcn.1400301e8
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret

Function at 0x14001cff4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
and qword [rax - 0x10], 0
mov rsi, r9
mov rbp, r8
lea r9, [rax - 0x10]
mov r8d, 1
mov rcx, 0xffffffff80000002
call fcn.14000d40c
mov edi, eax
test eax, eax
jns 0x14001d038
mov ecx, eax
call fcn.14000bbd0
jmp 0x14001d08c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rbp
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
je 0x14001d085
cmp eax, 2
je 0x14001d08a
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
je 0x14001d08a
mov ecx, edi
jmp 0x14001d031
mov ecx, 1
mov dword [rsi], ecx
mov ecx, edi
call fcn.14000bbf0
cmp qword [rsp + 0x38], 0
je 0x14001d0ac
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x58]
mov eax, edi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400261fc
Capabilities:
Read http header
Receive http response

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov rsi, rdx
mov dword [rax + 8], 4
xor ebx, ebx
xor edx, edx
mov dword [r8], ebx
mov rdi, r8
mov rcx, qword [rsi]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
nop dword [rax + rax]
test eax, eax
jne 0x14002625d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovs eax, ecx
jmp 0x1400262b0
mov rcx, qword [rsi]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov r9, rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x20000013
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
nop dword [rax + rax]
test eax, eax
jne 0x1400262ae
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov ebx, 0x80004005
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovs ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400268d0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x60
mov qword [rax - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rbx, rdx
xor edi, edi
mov dword [rax - 0x48], edi
lea rdx, [0x140036e2c]
mov rcx, rbx
call fcn.14000be90
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_2_0.dll_GetNativeSystemInfo]
nop dword [rax + rax]
movzx eax, word [rsp + 0x30]
test ax, ax
jne 0x14002693d
lea rdx, [0x1400441a8]
jmp 0x14002694a
cmp ax, 9
jne 0x140026952
lea rdx, str.amd64
mov rcx, rbx
call fcn.14000da7c
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002695f
mov r8, qword [rbx]
lea rdx, str.Found_OS_architecture:__s
xor ecx, ecx
call fcn.14000b5ac
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret