joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e8a60
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x1e0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x1d8], rax
mov rbx, rdx
mov qword [r11 - 0x30], rdx
mov dword [r11 - 0x28], 0x410
xor eax, eax
mov dword [r11 - 0x18], eax
test rdx, rdx
je 0x1400e8c5f
mov word [rdx], ax
mov qword [r11 - 0x38], rax
lea rax, [r11 - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
je 0x1400e8b56
mov r8d, eax
lea rdx, str.RegOpenKeyEx_WINLOGIN__failed._ErrorCode:__d
lea rcx, [rsp + 0x30]
call fcn.140027a80
mov rbx, rax
lea rdx, str.CreateProcessHelper.cpp
mov qword [rsp + 0x20], rdx
lea r9, str.CCPHelper::_GetShellProgram
mov edx, 4
mov r8d, 0x99
lea rcx, [rsp + 0x60]
call fcn.14002c550
nop
mov rdx, rbx
mov rcx, rax
call fcn.14002cda0
nop
lea rcx, [rsp + 0x60]
call fcn.1400298d0
nop
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x1400e8b4f
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14002e610
mov eax, edi
jmp 0x1400e8c64
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x1d0]
xor r8d, r8d
lea rdx, str.Shell
mov rcx, qword [rsp + 0x1b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x1400e8c04
mov r8d, eax
lea rdx, str.RegQueryValueEx_failed._ErrorCode:__d
lea rcx, [rsp + 0x30]
call fcn.140027a80
mov rbx, rax
lea rdx, str.CreateProcessHelper.cpp
mov qword [rsp + 0x20], rdx
lea r9, str.CCPHelper::_GetShellProgram
mov edx, 4
mov r8d, reloc.OLEAUT32.dll_RegisterTypeLib
lea rcx, [rsp + 0x60]
call fcn.14002c550
nop
mov rdx, rbx
mov rcx, rax
call fcn.14002cda0
nop
lea rcx, [rsp + 0x60]
call fcn.1400298d0
nop
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x1400e8c44
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.14002e610
jmp 0x1400e8c44
mov ecx, 1
call fcn.1400294e0
test eax, eax
je 0x1400e8c44
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x28], rax
lea rax, str.The_shell_program_is:__s
mov qword [rsp + 0x20], rax
mov r9d, 0xa6
lea r8, str.CCPHelper::_GetShellProgram
lea rdx, str.CreateProcessHelper.cpp
call fcn.140044a00
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x1400e8b4f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1400e8c64
mov eax, 0x57
mov rcx, qword [rsp + 0x1d8]
xor rcx, rsp
call fcn.14026d870
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
Function at 0x1400ea3c0
Capabilities:
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x1d0], rdx
xor r14d, r14d
mov edi, r14d
test rdx, rdx
jne 0x1400ea40c
xor eax, eax
jmp 0x1400ea581
mov dword [r8], r14d
mov dword [rsp + 0x200], r14d
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x208]
call fcn.14028e7e0
mov qword [rsp + 0x1e0], r14
xor eax, eax
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x1f0], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x200]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400ea4f9
mov ecx, 1
call fcn.1400294e0
test eax, eax
je 0x1400ea4cf
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x28], rax
lea rax, str.Successfully_created_process___s_
mov qword [rsp + 0x20], rax
mov r9d, 0x2bd
lea r8, str.CCPHelper::_RunProcessNormal
lea rdx, str.CreateProcessHelper.cpp
mov ecx, 1
call fcn.140032190
mov rcx, qword [rsp + 0x1e8]
test rcx, rcx
je 0x1400ea4e2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x1e0]
test rax, rax
cmovne rdi, rax
mov dword [rsi], r14d
jmp 0x1400ea57e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov r9d, eax
mov r8, rbx
lea rdx, str.Failed_to_create_process___s_._ErrorCode:__u
lea rcx, [rsp + 0x58]
call fcn.140027a80
mov rbx, rax
lea rax, str.CreateProcessHelper.cpp
mov qword [rsp + 0x20], rax
lea r9, str.CCPHelper::_RunProcessNormal
mov edx, 4
mov r8d, 0x2c8
lea rcx, [rsp + 0x80]
call fcn.14002c550
nop
mov rdx, rbx
mov rcx, rax
call fcn.14002cda0
nop
lea rcx, [rsp + 0x80]
call fcn.1400298d0
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x1400ea57e
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.14002e610
mov rax, rdi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x280
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400ea950
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x90
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor esi, esi
mov dword [rsp + 0x78], 0
mov word [rsp + 0x7c], 0x500
mov rax, rdx
mov ebp, 1
test rdx, rdx
je 0x1400ea996
mov qword [rsp + 0x68], rdx
mov ebp, esi
jmp 0x1400ea9d4
mov qword [rsp + 0x68], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400ea9cf
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400ea9c8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400eab1a
mov rax, qword [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0xb0], rdi
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x70], rsi
lea edx, [r9 + 2]
mov rdi, rsi
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1400eaa18
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400eaade
mov edx, dword [rsp + 0x60]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1400eaade
mov r9d, dword [rsp + 0x60]
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov r8, rdi
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400eaade
lea rax, [rsp + 0x70]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x48], esi
mov r8d, 0x20
mov dword [rsp + 0x40], esi
mov dl, 2
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400eaade
cmp dword [rdi], 0
mov qword [rsp + 0xa0], rbx
mov ebx, esi
jbe 0x1400eaad6
nop dword [rax + rax]
mov rcx, qword [rsp + 0x70]
mov edx, ebx
add rdx, rdx
mov rdx, qword [rdi + rdx*8 + 8]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1400eaad1
inc ebx
cmp ebx, dword [rdi]
jb 0x1400eaab0
jmp 0x1400eaad6
mov esi, 1
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400eaaee
call qword [sym.imp.ADVAPI32.dll_FreeSid]
test rdi, rdi
je 0x1400eaafc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdi, qword [rsp + 0xb0]
test ebp, ebp
je 0x1400eab18
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400eab18
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14026d870
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop rsi
ret

Function at 0x1400ec890
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov rdi, rcx
jb 0x1400ec8a7
mov rdx, qword [rdx]
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rcx, qword [rdi + 8]
test eax, eax
setne bl
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x1400ec8d1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], 0xffffffffffffffff
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ecd60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x208
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x1f8], rax
mov ebp, r9d
mov rbx, r8
mov rax, rdx
cmp qword [rdx + 0x10], 0
je 0x1400ecf76
cmp qword [r8], 0
je 0x1400ecf76
test r9d, r9d
je 0x1400ecf76
mov dword [rsp + 0x1d0], 0
lea rdx, vtable.CAutoHandle.0
mov qword [rsp + 0x68], rdx
lea rsi, [rcx + 8]
mov qword [rsp + 0x70], rsi
cmp qword [rax + 0x18], 8
jb 0x1400ecdd8
mov rax, qword [rax]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edi, 2
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rdi + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jne 0x1400ece8c
lea rdx, str.Error:_File_not_found.
lea rcx, [rsp + 0x40]
call fcn.140027a80
mov rbx, rax
lea rax, str.PcFile.cpp
mov qword [rsp + 0x20], rax
lea r9, str.CPcFile::WriteToFile
lea edx, [rdi + 2]
lea r8d, [rdi + 0x57]
lea rcx, [rsp + 0x80]
call fcn.14002c550
nop
mov rdx, rbx
mov rcx, rax
call fcn.14002cda0
nop
lea rcx, [rsp + 0x80]
call fcn.1400298d0
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1400ecf58
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14002e610
jmp 0x1400ecf58
mov qword [rsp + 0x1d8], 0
xor ecx, ecx
mov qword [rsp + 0x1e0], rcx
mov qword [rsp + 0x1e8], rcx
mov qword [rsp + 0x1f0], rcx
lea rcx, [rsp + 0x1d8]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x1d0]
mov r8d, ebp
mov rdx, qword [rbx]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400ecf56
lea rdx, str.Error:_Write_fault.
lea rcx, [rsp + 0x40]
call fcn.140027a80
mov rbx, rax
lea rax, str.PcFile.cpp
mov qword [rsp + 0x20], rax
lea r9, str.CPcFile::WriteToFile
mov edx, 4
lea r8d, [rdx + 0x5b]
lea rcx, [rsp + 0x80]
call fcn.14002c550
nop
mov rdx, rbx
mov rcx, rax
call fcn.14002cda0
nop
lea rcx, [rsp + 0x80]
call fcn.1400298d0
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1400ecf4f
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14002e610
mov edi, 0x1d
jmp 0x1400ecf58
xor edi, edi
mov rcx, qword [rsi]
lea rdx, [rcx - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x1400ecf72
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
mov eax, edi
jmp 0x1400ecf7b
mov eax, 0x57
mov rcx, qword [rsp + 0x1f8]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x208
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400f1840
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov eax, r8d
mov edi, r8d
xor edi, 8
and al, 8
cmove edi, r8d
test rcx, rcx
jne 0x1400f1886
xor eax, eax
jmp 0x1400f192c
xor ebp, ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14032b668]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x30], rbx
test eax, eax
jns 0x1400f18b5
mov edi, ebp
jmp 0x1400f191b
mov r9, rsi
mov r8, rbx
lea rdx, [0x14032b378]
lea rcx, [rsp + 0x38]
call fcn.140027a80
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1400f1908
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.14002e610
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
test rbx, rbx
je 0x1400f1929
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14026d870
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400f1840

Function at 0x1400f1950
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov eax, r8d
mov edi, r8d
xor edi, 8
and al, 8
cmove edi, r8d
test rcx, rcx
jne 0x1400f1886
xor eax, eax
jmp 0x1400f192c
xor ebp, ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14032b668]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x30], rbx
test eax, eax
jns 0x1400f18b5
mov edi, ebp
jmp 0x1400f191b
mov r9, rsi
mov r8, rbx
lea rdx, [0x14032b378]
lea rcx, [rsp + 0x38]
call fcn.140027a80
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1400f1908
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.14002e610
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
test rbx, rbx
je 0x1400f1929
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14026d870
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400f1840
Function at 0x1400f38b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r15, r8
mov rsi, rdx
mov r11, rcx
mov r14, qword [r8 + 0x10]
mov r13, qword [r8 + 0x18]
cmp r13, 8
jb 0x1400f38ef
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
lea r9, [r14 + r14]
test r9, r9
je 0x1400f3924
movabs r10, 0x100000001b3
nop
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r9
jb 0x1400f3910
mov r12, qword [r11 + 0x30]
and r12, rdx
shl r12, 4
mov rdi, qword [r11 + 0x18]
mov rax, qword [rdi + r12]
cmp rax, qword [r11 + 8]
jne 0x1400f3943
mov rdi, qword [r11 + 8]
jmp 0x1400f394b
mov rdi, qword [rdi + r12 + 8]
mov rdi, qword [rdi]
cmp rdi, rax
je 0x1400f3a0f
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
lea rcx, [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x1400f396a
mov rdx, qword [rdx]
cmp r13, 8
jb 0x1400f3975
mov r8, qword [r15]
jmp 0x1400f3978
mov r8, r15
mov r10, qword [rcx]
mov r9, r10
cmp r14, r10
cmovb r9, r14
test r9, r9
jmp 0x1400f39bc
movzx ecx, word [rdx]
cmp word [r8], cx
jne 0x1400f39a7
add r8, 2
add rdx, 2
sub r9, 1
jmp 0x1400f39bc
mov r9d, 1
cmp word [r8], cx
mov ecx, 0xffffffff
cmovb r9d, ecx
jmp 0x1400f39c1
jne 0x1400f3990
xor r9d, r9d
test r9d, r9d
jne 0x1400f3a06
cmp r14, r10
jb 0x1400f3a06
ja 0x1400f3a06
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r11 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.1400f4da0
mov rcx, rbx
call fcn.14026d850
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400f3aa9
cmp rdi, rax
jne 0x1400f3954
mov qword [rsp + 0x80], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400f3a4c
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r12
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x1400f3a6a
mov qword [rdx], rbx
mov rax, qword [r11 + 0x18]
mov qword [rax + r12 + 8], rbx
jmp 0x1400f3a96
cmp rax, rdi
jne 0x1400f3a74
mov qword [rdx], rbx
jmp 0x1400f3a96
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rbx
je 0x1400f3a96
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r12 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r12 + 8], rcx
mov rcx, r11
call fcn.1400f5410
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f7920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov r9, qword [r8 + 0x20]
mov rdi, r8
add r8, 0x10
mov rsi, rdx
mov r10, rcx
cmp qword [r8 + 0x18], 8
jb 0x1400f794f
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r9, r9
je 0x1400f7984
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r9
jb 0x1400f7970
mov r8, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and r8, rdx
shl r8, 4
add rcx, r8
cmp qword [rcx + 8], rdi
jne 0x1400f79c1
cmp qword [rcx], rdi
jne 0x1400f79b7
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r8 + rcx + 8], rax
jmp 0x1400f79cc
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x1400f79cc
cmp qword [rcx], rdi
jne 0x1400f79d1
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdi, qword [rsp + 0x40]
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r10 + 0x10]
call fcn.1400f4da0
mov rcx, rdi
call fcn.14026d850
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f7d50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rbp, qword [r8 + 0x18]
mov r10, r8
mov rbx, qword [r8 + 0x10]
mov r15, rdx
mov r11, rcx
cmp rbp, 8
jb 0x1400f7d86
mov r8, qword [r8]
xor edi, edi
lea r9, [rbx + rbx]
movabs rdx, 0xcbf29ce484222325
mov ecx, edi
test r9, r9
je 0x1400f7dc4
movabs rsi, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, rsi
cmp rcx, r9
jb 0x1400f7db0
mov rcx, qword [r11 + 0x30]
mov r13d, 1
mov rsi, qword [r11 + 8]
and rcx, rdx
mov rdx, qword [r11 + 0x18]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r14, qword [rdx + rcx*8]
lea r12, [rdx + rcx*8]
nop
cmp r14, rsi
jne 0x1400f7dfa
mov rcx, rsi
jmp 0x1400f7e02
mov rcx, qword [r12 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400f7edc
lea rdx, [rax + 0x10]
cmp rbp, 8
jb 0x1400f7e1a
mov r8, qword [r10]
jmp 0x1400f7e1d
mov r8, r10
cmp qword [rdx + 0x18], 8
lea rcx, [rdx + 0x10]
jb 0x1400f7e2b
mov rdx, qword [rdx]
mov r11, qword [rcx]
mov r9, rbx
cmp r11, rbx
cmovb r9, r11
test r9, r9
jne 0x1400f7e51
mov r9d, edi
test r9d, r9d
jne 0x1400f7e4c
cmp r11, rbx
jb 0x1400f7e4c
jbe 0x1400f7e78
mov rax, qword [rax]
jmp 0x1400f7df0
movzx ecx, word [r8]
cmp word [rdx], cx
jne 0x1400f7e67
add rdx, 2
add r8, 2
sub r9, r13
jmp 0x1400f7e3b
cmp word [rdx], cx
mov r9d, r13d
mov ecx, 0xffffffff
cmovb r9d, ecx
jmp 0x1400f7e40
cmp qword [rax + 0x28], 8
lea rdx, [rax + 0x10]
lea r9, [rdx + 0x10]
jb 0x1400f7e8a
mov rdx, qword [rdx]
cmp rbp, 8
jb 0x1400f7e93
mov r10, qword [r10]
mov r9, qword [r9]
cmp rbx, r9
mov r8, r9
cmovb r8, rbx
test r8, r8
je 0x1400f7ec9
movzx ecx, word [rdx]
cmp word [r10], cx
jne 0x1400f7ebd
add r10, 2
add rdx, 2
sub r8, r13
jne 0x1400f7ea5
jmp 0x1400f7ec9
mov ecx, 0xffffffff
cmovb r13d, ecx
mov edi, r13d
test edi, edi
jne 0x1400f7ed4
cmp rbx, r9
jb 0x1400f7ed4
jbe 0x1400f7ed7
mov rax, rsi
mov qword [r15], rax
jmp 0x1400f7edf
mov qword [r15], rsi
mov rbx, qword [rsp + 0x28]
mov rax, r15
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400f9d50
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov r14, r9
mov rsi, r8
mov rdi, rdx
mov r15, rcx
call fcn.1400284f0
mov rcx, rax
test rax, rax
jne 0x1400f9d96
mov ecx, 0x80004005
call fcn.140028e20
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
test rdi, rdi
je 0x1400f9dd6
test rdi, 0xffffffffffff0000
jne 0x1400f9dd6
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.140027c50
test rax, rax
je 0x1400f9de8
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400cf680
jmp 0x1400f9de3
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400cf540
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsi]
mov rbp, qword [rsp + 0x80]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov r9, r14
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp eax, 0xea
jne 0x1400f9e59
mov rcx, qword [rsi]
call fcn.14026e340
mov qword [rsi], 0
mov ecx, dword [rbp]
lea rdx, [0x1403eed54]
call fcn.14026e5e4
mov qword [rsi], rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov r9, r14
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400f9e73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400f9e90
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov qword [r11 - 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov rsi, r9
mov ebp, r8d
mov r12, rdx
mov r14, rcx
test r9, r9
je 0x1400f9fe7
mov edi, dword [rsp + 0xa0]
cmp edi, 1
jb 0x1400f9fe7
xor eax, eax
mov dword [r11 + 0x20], eax
mov qword [r11 - 0x48], rax
cmp r8d, 1
jne 0x1400f9efd
lea rax, [r11 + 0x20]
mov qword [r11 - 0x58], rax
lea r9, [r11 - 0x48]
mov r8d, edi
mov rdx, rsi
call fcn.1400f9670
jmp 0x1400f9f1f
cmp ebp, 7
jne 0x1400f9f37
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, edi
mov rdx, rsi
call fcn.1400f9470
mov edi, eax
test eax, eax
jne 0x1400f9fd9
mov rsi, qword [rsp + 0x30]
mov edi, dword [rsp + 0x98]
jmp 0x1400f9f3e
mov dword [rsp + 0x98], edi
lea r15d, [rdi + 0x20]
mov ecx, r15d
call fcn.14026ded8
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400f9f5c
lea edi, [rax + 8]
jmp 0x1400f9fd0
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rbx
mov r9d, ebp
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call fcn.1400f9910
mov edi, eax
test eax, eax
jne 0x1400f9fd0
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.1400cf4b0
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rbx
lea r9d, [rdi + 3]
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [r14 + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400f9fcb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.14026e340
nop
mov rcx, qword [rsp + 0x30]
call fcn.14026e340
mov eax, edi
jmp 0x1400f9fec
mov eax, 0x57
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret