joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001ff0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x14005d010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov dword [rsp + 0x50], ebp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x58], rbp
lea rcx, [rsp + 0x48]
call fcn.140001ee0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x14000210c
lea rax, [rsp + 0x60]
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400020e1
nop dword [rax + rax]
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140001ff0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x14000210c
lea rax, [rsp + 0x60]
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140002090
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400020f6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov dword [rsp + 0x50], ebp
mov rcx, rdi
call fcn.140001d90
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x140002117
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400407e0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400025b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x14005d010]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x70], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000263e
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000263e
call fcn.140001b10
mov ebx, eax
jmp 0x140002763
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000265f
call fcn.140001b10
jmp 0x140002752
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140002682
call fcn.140001b10
jmp 0x140002752
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x1400026a4
mov ebx, 0x8007000e
jmp 0x140002754
mov ecx, eax
test eax, eax
je 0x1400026d9
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000279b
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1400026d9
lea rcx, [rsp + 0x70]
call fcn.140008ff0
jmp 0x1400026e3
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x1400026f6
cmp qword [rsp + 0x70], 0
jne 0x140002705
mov ebx, 0x8007000e
jmp 0x140002754
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14000272f
call fcn.140001b10
jmp 0x140002752
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140003520
mov ebx, eax
test rdi, rdi
je 0x140002763
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000277a
lea rcx, [rsp + 0x70]
call fcn.140008fe0
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1400407e0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.140001a80
int3
Function at 0x1400064a0
Capabilities:
Enumerate gui resources

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rdx
test rdx, rdx
jne 0x1400064b9
mov eax, 0x80070057
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov qword [rsp + 0x60], rdi
lea rcx, [0x140007910]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x38], 1
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdx, qword [rsp + 0x30]
test rdx, rdx
jne 0x1400064f7
mov edi, 0x80004005
jmp 0x140006531
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.1400076a0
mov rbx, qword [rsp + 0x58]
mov edi, eax
test eax, eax
js 0x140006531
mov rcx, rbx
call fcn.1400074b0
test al, al
je 0x140006524
mov edi, 0x80004005
jmp 0x140006531
mov rdx, rsi
mov rcx, rbx
call fcn.140006160
mov edi, eax
test rbx, rbx
je 0x140006546
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
mov rcx, rbx
call qword [case.0x14004127e.0]
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
Function at 0x1400072b0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
lea rbp, [r11 - 0x1f8]
sub rsp, 0x2e8
mov rax, qword [0x14005d010]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rsi, r9
mov r8, rdx
test rdx, rdx
je 0x140007424
test r9, r9
je 0x140007424
mov qword [r11 + 0x18], rdi
mov rcx, r8
mov dword [r9], 2
xor edi, edi
mov rax, qword [rdx]
lea rdx, [rsp + 0x20]
mov qword [r11 - 0x18], r14
mov qword [rsp + 0x20], rdi
mov rax, qword [rax + 0x38]
call qword [case.0x14004127e.0]
mov r14d, eax
test eax, eax
js 0x1400073fc
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x300], rbx
call fcn.1400056b0
mov rax, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rax
call fcn.14000f0ac
xor edx, edx
lea r8d, [rdi + 0x70]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbp + 0x68]
mov ecx, 0xffffffff
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x34], 0x100
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x60], 5
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rcx, [rbp + 0x40]
mov ebx, eax
call fcn.14000f1f4
test ebx, ebx
lea rcx, [rbp - 0x10]
mov rbx, qword [rsp + 0x300]
je 0x1400073d9
mov dword [rsi], edi
call fcn.14000d2e8
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400073ff
call fcn.14000d2e8
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edi, r14d
mov rcx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x2e0]
test rcx, rcx
je 0x140007417
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, edi
mov rdi, qword [rsp + 0x310]
jmp 0x140007429
mov eax, 0x80070057
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400407e0
add rsp, 0x2e8
pop rsi
pop rbp
ret
Function at 0x1400110c8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x70]
call sub.VCRUNTIME140.dll_memset
or ecx, 0xffffffff
mov dword [rsp + 0x20], 0x70
mov dword [rsp + 0x24], 0x100
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], 5
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rbx, qword [rsp + 0xa0]
test eax, eax
setne al
add rsp, 0x90
pop rdi
ret
Function at 0x1400147e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, r8
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x140014800
mov r8, qword [rbx + 0x30]
mov r10, qword [rbx + 0x18]
and r8, r9
add r8, r8
mov r9, qword [r10 + r8*8]
mov rcx, r9
cmp r9, qword [rbx + 8]
jne 0x140014840
mov rax, qword [rbx + 8]
jmp 0x140014848
mov rax, qword [r10 + r8*8 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14001485b
mov rax, qword [r11]
cmp qword [rcx + 0x10], rax
je 0x14001485f
mov rcx, qword [rcx]
jmp 0x140014834
mov rcx, qword [rbx + 8]
mov qword [rdx], rcx
mov rax, rdx
mov rbx, qword [rsp + 8]
ret

Function at 0x14001486c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r9, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + r9]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r8
cmp r8, 8
jb 0x14001489b
mov r8, qword [rsi + 0x30]
and r8, rcx
add r8, r8
mov r11, qword [rsi + 0x18]
mov rbx, qword [r11 + r8*8]
mov rdx, qword [rsi + 8]
mov r10, rbx
cmp qword [r11 + r8*8], rdx
jne 0x1400148de
mov rax, rdx
jmp 0x1400148e6
mov rax, qword [r11 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140014924
mov rcx, qword [r9]
cmp qword [rbx + 0x10], rcx
je 0x1400148f9
mov rbx, qword [rbx]
jmp 0x1400148d0
mov rdi, rbx
cmp qword [r11 + r8*8], rdx
jne 0x140014907
mov rax, rdx
jmp 0x14001490f
mov rax, qword [r11 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14001491f
cmp rcx, qword [rbx + 0x10]
jne 0x14001491f
mov rbx, qword [rbx]
jmp 0x1400148fc
cmp r10, rbx
jne 0x14001492a
mov rdi, rdx
mov rbx, rdx
mov rax, rdi
xor ebp, ebp
cmp rdi, rbx
je 0x140014942
inc rbp
mov rcx, qword [rax]
mov rax, rcx
cmp rcx, rbx
jne 0x140014934
mov rcx, qword [rdx]
cmp rdi, rcx
jne 0x140014999
cmp rbx, rdx
jne 0x140014999
mov qword [rdx], rdx
mov rax, qword [rsi + 8]
mov qword [rax + 8], rax
and qword [rsi + 0x10], 0
cmp rcx, qword [rsi + 8]
je 0x140014977
mov rbx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
cmp rbx, qword [rsi + 8]
jne 0x140014965
mov edx, 8
mov rcx, rsi
call fcn.140014a78
jmp 0x14001499e
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400149b8
cmp rdi, rbx
jne 0x140014986
mov rax, rbp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400149b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 8
jb 0x1400149d5
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140014a2d
cmp qword [rcx + rdx*8], r8
jne 0x140014a22
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x140014a26
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140014a3a
cmp qword [rcx + rdx*8], r8
jne 0x140014a3a
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140015154
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r9]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x14001518c
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r10, qword [rcx + rax*8]
cmp r10, rdi
je 0x1400151d1
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r10
je 0x14001521b
mov rdi, qword [rdi + 8]
mov rdx, rdi
mov rax, qword [rdi + 0x10]
cmp qword [r9], rax
jne 0x1400151d4
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140015340
mov qword [rsp + 0x20], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x140015255
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140015275
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400152a4
cmp rax, rdx
jne 0x140015280
mov qword [r9 + r8*8], rbx
jmp 0x1400152a4
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400152a4
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14004ce30]
test rax, rax
jns 0x1400152c5
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400152d6
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140015335
cmp rdx, 0x200
jae 0x1400152ee
shl rdx, 3
jmp 0x140015300
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140015300
add rdx, rdx
mov rcx, rsi
call fcn.140014a78
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140015335
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140015154
cmp rdi, r15
jne 0x140015315
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14001aff8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
and qword [rax - 0x18], 0
and qword [rax + 8], 0
cmp dword [0x14005e864], 0
jne 0x14001b0c5
mov eax, dword [0x14005e86c]
test eax, eax
jne 0x14001b0c5
xor edi, edi
mov ecx, dword [0x14005e868]
test ecx, ecx
je 0x14001b056
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x14005e86c]
mov ecx, dword [0x14005e868]
test eax, eax
jne 0x14001b0c5
test ecx, ecx
jne 0x14001b06c
call fcn.14001b124
test eax, eax
jne 0x14001b06c
lea ebx, [rax + 1]
jmp 0x14001b088
lea rdx, [rsp + 0x40]
mov rcx, qword [0x14005d068]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ebx, 1
test eax, eax
cmovne edi, ebx
test edi, edi
jne 0x14001b0c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x7e]
cmp ecx, ebx
jbe 0x14001b0a7
cmp eax, 0x78
je 0x14001b0a7
cmp eax, ebx
je 0x14001b0a7
cmp eax, 0x32
jne 0x14001b0af
mov dword [0x14005e86c], ebx
mov edi, ebx
test edi, edi
jne 0x14001b0c5
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rcx, str.version.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp dword [0x14005e864], 0
je 0x14001b0ec
cmp dword [0x14005e86c], 0
jne 0x14001b11e
xor edi, edi
test rbx, rbx
sete dil
test edi, edi
je 0x14001b103
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14001b105
xor esi, esi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14001b11e
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
jmp 0x14001b0b5
Function at 0x14001b300
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
and qword [rbp - 0x10], 0
lea rax, [rbp - 0x10]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000000
lea rdx, str.CLSID
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b3cd
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and qword [rbp + 0x28], 0
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b3be
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rdx, str.InsecureQI
lea rax, [rbp + 0x20]
mov dword [rbp + 0x18], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b3be
cmp dword [rbp + 0x18], 4
jne 0x14001b3be
mov ebx, dword [rbp + 0x20]
cmp ebx, 3
ja 0x14001b3be
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14001b3cf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001b3cf
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14001b3cd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14001b3de
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x14001b794
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
mov rbp, rsp
sub rsp, 0x30
cmp byte [0x1400636f4], 0
je 0x14001b7ba
mov eax, dword [0x1400636f8]
jmp 0x14001b8be
and qword [rbp + 0x18], 0
lea rax, [rbp + 0x18]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 4
lea rsi, [0x1400636f8]
test eax, eax
jne 0x14001b826
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.CLSIDInterfaceTest
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rbp + 0x10], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b826
cmp dword [rbp + 0x10], ebx
je 0x14001b895
mov rcx, qword [rbp + 0x18]
and qword [rbp + 0x18], 0
test rcx, rcx
je 0x14001b83a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x18]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftSecurity
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b89d
mov rcx, qword [rbp + 0x18]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea rdx, str.CLSIDInterfaceTest
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rbp + 0x10], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b89d
cmp dword [rbp + 0x10], ebx
jne 0x14001b89d
mov ebx, dword [0x1400636f8]
jmp 0x14001b8a6
and dword [0x1400636f8], 0
xor ebx, ebx
mov rcx, qword [rbp + 0x18]
mov byte [0x1400636f4], 1
test rcx, rcx
je 0x14001b8bc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x140029254
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x18], 0x10
mov r15, rdx
mov r14, qword [r8 + 0x10]
mov rdx, r8
mov rdi, r8
mov rbp, rcx
jb 0x14002928a
mov rdx, qword [r8]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test r14, r14
je 0x1400292b8
movzx eax, byte [rcx + rdx]
movabs r9, 0x100000001b3
xor r8, rax
inc rcx
imul r8, r9
cmp rcx, r14
jb 0x14002929b
mov rax, qword [rbp + 0x18]
mov r12, qword [rbp + 0x30]
mov rbp, qword [rbp + 8]
and r12, r8
add r12, r12
mov qword [rsp + 0x50], rax
mov rbx, qword [rax + r12*8]
cmp qword [rax + r12*8], rbp
jne 0x1400292de
mov rax, rbp
jmp 0x1400292e6
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14002935b
cmp qword [rdi + 0x18], 0x10
lea rsi, [rbx + 0x10]
mov rdx, rdi
jb 0x1400292fc
mov rdx, qword [rdi]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r13, qword [rsi + 0x10]
jb 0x14002930d
mov rcx, qword [rsi]
cmp r13, r14
jne 0x14002931e
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140029328
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x50]
jmp 0x1400292d3
cmp qword [rsi + 0x18], 0x10
jb 0x140029332
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 0x10
jb 0x14002933c
mov rdi, qword [rdi]
cmp r14, r13
jne 0x140029353
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140029356
mov rbx, rbp
mov qword [r15], rbx
jmp 0x14002935e
mov qword [r15], rbp
mov rbx, qword [rsp + 0x58]
mov rax, r15
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140029fa8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 0x10
mov r11, rcx
mov rbx, qword [r9 + 0x10]
jb 0x140029fca
mov r9, qword [r9]
xor r10d, r10d
movabs rcx, 0xcbf29ce484222325
test rbx, rbx
je 0x140029ffa
movzx eax, byte [r10 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, rbx
jb 0x140029fdc
mov rdx, qword [r11 + 0x30]
and rdx, rcx
mov rcx, qword [r11 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14002a032
cmp qword [rcx + rdx*8], r8
jne 0x14002a027
mov rax, qword [r11 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
jmp 0x14002a02b
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14002a03f
cmp qword [rcx + rdx*8], r8
jne 0x14002a03f
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r11 + 8]
mov rdx, rdi
call fcn.140029e34
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret