joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009b190
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rsi
push rdi
sub rsp, 0x30
lea rdi, [rcx + 0x20]
mov r9d, edx
movzx ecx, dl
movabs rax, 0xcbf29ce484222325
xor rcx, rax
mov dword [rsp + 0x50], r9d
movzx eax, byte [rsp + 0x59]
movabs rdx, 0x100000001b3
imul rcx, rdx
mov rsi, r8
mov r8, qword [rdi + 0x30]
xor rcx, rax
movzx eax, byte [rsp + 0x5a]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rsp + 0x5b]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
mov rdx, qword [rdi + 8]
and r8, rcx
mov rcx, qword [rdi + 0x18]
add r8, r8
mov r10, qword [rcx + r8*8]
lea r11, [rcx + r8*8]
mov rax, r10
cmp r10, rdx
je 0x14009b26d
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14009b277
cmp dword [rax + 0x10], r9d
jne 0x14009b272
mov rcx, rax
cmp rcx, rdx
jne 0x14009b25d
lea rax, [rsp + 0x50]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x60], rax
lea rcx, [rdi + 8]
call fcn.14009b3b8
mov rax, qword [rdi + 8]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov r9, qword [rax]
lea r8, [r9 + 0x10]
call fcn.14009b288
mov rax, qword [rsp + 0x20]
inc dword [rax + 0x18]
add qword [rax + 0x20], rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, rdx
jmp 0x14009b215
mov rax, qword [rax]
jmp 0x14009b209
mov rax, rdx
mov rcx, rdx
jmp 0x14009b223

Function at 0x14009c0b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov rsi, rdx
mov rbp, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8]
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
inc r10
cmp r10, 8
jb 0x14009c0e6
mov rdx, qword [rbp + 0x30]
and rdx, r9
add rdx, rdx
mov r8, qword [rbp + 0x18]
mov rax, qword [r8 + rdx*8]
lea r14, [rbp + 8]
mov rbx, qword [r14]
cmp qword [r8 + rdx*8], rbx
jne 0x14009c1cb
mov rcx, rbx
cmp rax, rcx
jne 0x14009c1d8
mov rax, rbx
mov rcx, rbx
cmp rcx, rbx
jne 0x14009c205
mov rbx, qword [rbx]
movabs rax, 0x555555555555555
cmp qword [r14 + 8], rax
je 0x14009c1f1
mov rdi, qword [rbx + 8]
mov qword [rsp + 0x20], r14
and qword [rsp + 0x28], 0
mov ecx, 0x30
call fcn.14009b7d0
mov rcx, qword [r15]
mov qword [rax + 0x10], rcx
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 0x28], rcx
mov qword [rax], rbx
mov qword [rax + 8], rdi
inc qword [r14 + 8]
mov qword [rbx + 8], rax
mov qword [rdi], rax
mov rax, qword [r14]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rdx, rsi
mov rcx, rbp
call fcn.14009c214
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov rcx, qword [r8 + rdx*8 + 8]
mov rcx, qword [rcx]
jmp 0x14009c12b
mov rcx, qword [r15]
cmp qword [rax + 0x10], rcx
je 0x14009c1e9
mov rax, qword [rax]
jmp 0x14009c11e
mov rcx, rax
jmp 0x14009c13a
lea rcx, [0x1403a9b00]
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x14009c1ae
Function at 0x1400a0b5c
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov r14, rdx
mov rsi, rcx
lea rbp, [rcx + 0x18]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
nop
mov rbx, qword [r15]
mov rcx, rbx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov r8d, eax
mov rdx, rbx
call fcn.1400a1210
mov rdi, qword [rsi + 0x88]
and rdi, rax
add rdi, rdi
mov rbx, qword [rsi + 0x70]
mov rbx, qword [rbx + rdi*8]
mov rax, qword [rsi + 0x70]
mov rdx, qword [rsi + 0x60]
cmp qword [rax + rdi*8], rdx
jne 0x1400a0c9d
mov rax, rdx
cmp rbx, rax
je 0x1400a0ce4
mov rdx, qword [r15]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400a0caa
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
mov rdx, qword [rsi + 0x60]
test eax, eax
je 0x1400a0ce4
cmp rbx, rdx
je 0x1400a0d01
mov rdi, qword [rbx + 0x28]
cmp qword [rsi + 0x40], 0
jne 0x1400a0cec
mov rax, qword [rsi + 0x98]
cmp rdi, rax
je 0x1400a0c47
mov rcx, qword [rdi]
cmp rax, rcx
jne 0x1400a0cb2
mov rax, qword [rsi + 0x48]
lock inc qword [rax + 0x40]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x1400a0c61
lock inc dword [rdx + 8]
mov rdx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x18]
mov qword [r14], rax
mov qword [r14 + 8], rdx
test rbp, rbp
je 0x1400a0c80
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov rax, qword [rax + rdi*8 + 8]
mov rax, qword [rax]
jmp 0x1400a0bd8
mov rbx, qword [rbx]
jmp 0x1400a0bc3
mov rdx, qword [rdi + 8]
mov qword [rdx], rcx
mov rdx, qword [rcx + 8]
mov qword [rdx], rax
mov rdx, qword [rax + 8]
mov qword [rdx], rdi
mov r8, qword [rax + 8]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov qword [rdi + 8], r8
jmp 0x1400a0c47
mov rbx, rdx
jmp 0x1400a0c1b
lea rcx, [rdi + 0x18]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
jmp 0x1400a0c33
mov rax, qword [rsi + 0x48]
lock inc qword [rax + 0x48]
and qword [r14], 0
and qword [r14 + 8], 0
jmp 0x1400a0c6c
Function at 0x1400a0d20
Capabilities:
Compare security identifiers

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rbx, qword [r8]
mov rsi, rcx
mov rcx, rbx
mov r15, r8
mov rdi, rdx
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_GetLengthSid]
nop dword [rax + rax]
mov r8d, eax
mov rdx, rbx
call fcn.1400a1210
mov rbx, qword [rsi + 0x18]
mov r14, rax
and r14, qword [rsi + 0x30]
add r14, r14
mov rbx, qword [rbx + r14*8]
mov rax, qword [rsi + 0x18]
mov rcx, qword [rsi + 8]
cmp qword [rax + r14*8], rcx
jne 0x1400a0dd7
mov rax, rcx
cmp rbx, rax
je 0x1400a0dec
mov rdx, qword [r15]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400a0de1
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r15]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_EqualSid]
nop dword [rax + rax]
test eax, eax
je 0x1400a0de6
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
mov rax, qword [rax + r14*8 + 8]
mov rax, qword [rax]
jmp 0x1400a0d82
mov rbx, qword [rbx]
jmp 0x1400a0d71
mov rbx, qword [rsi + 8]
jmp 0x1400a0db5
mov qword [rdi], rcx
jmp 0x1400a0db8
Function at 0x1400a0e00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x20], r9b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov rdi, rdx
mov rbp, rcx
lea rsi, [rcx + 0x18]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [rsp + 0x20], rsi
mov r12, qword [r14 + 0x10]
mov rdx, r14
mov r15, qword [r14 + 0x18]
cmp r15, 8
jb 0x1400a0e4e
mov rdx, qword [r14]
lea r8, [r12 + r12]
call fcn.1400a1210
mov r11, rax
movzx r10d, byte [r14 + 0x20]
mov r8d, r10d
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rax, 0x100000001b3
imul r8, rax
mov rcx, r11
shl rcx, 6
mov rdx, r11
shr rdx, 2
add rcx, r8
mov eax, 0x9e3779b9
add rax, rdx
add rcx, rax
xor r11, rcx
mov rax, qword [rbp + 0x88]
and rax, r11
shl rax, 4
mov r8, qword [rbp + 0x70]
mov rdx, qword [r8 + rax]
mov rbx, rdx
lea r9, [rax + 8]
mov rcx, qword [rbp + 0x60]
cmp rdx, rcx
jne 0x1400a0f9f
mov rax, rcx
cmp rbx, rax
je 0x1400a1058
lea r13, [rbx + 0x10]
mov rax, r14
cmp r15, 8
jb 0x1400a0ee2
mov rax, qword [r14]
mov r11, qword [r13 + 0x10]
mov qword [rsp + 0x80], r13
mov rsi, qword [r13 + 0x18]
mov qword [rsp + 0x90], rsi
cmp rsi, 8
lea rsi, [rbp + 0x18]
jb 0x1400a0f14
mov rsi, qword [r13]
mov qword [rsp + 0x80], rsi
lea rsi, [rbp + 0x18]
cmp r11, r12
jne 0x1400a1050
test r11, r11
jne 0x1400a0fab
cmp byte [r13 + 0x20], r10b
jne 0x1400a1050
lea rax, [rbx + 0x10]
cmp qword [rsp + 0x90], 8
jb 0x1400a0f42
mov rax, qword [rax]
cmp r15, 8
jb 0x1400a0f4b
mov r14, qword [r14]
test r12, r12
jne 0x1400a102e
cmp rbx, rcx
jne 0x1400a0ff8
mov rax, qword [rbp + 0x48]
lock inc qword [rax + 0x48]
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
test rsi, rsi
je 0x1400a0f83
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, rdi
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [r9 + r8]
mov rax, qword [rax]
jmp 0x1400a0ec9
sub qword [rsp + 0x80], rax
mov rsi, qword [rsp + 0x80]
movzx esi, word [rax + rsi]
mov word [rsp + 0x98], si
cmp si, word [rax]
lea rsi, [rbp + 0x18]
mov rcx, qword [rbp + 0x60]
jb 0x1400a1050
movzx esi, word [rax]
cmp word [rsp + 0x98], si
lea rsi, [rbp + 0x18]
ja 0x1400a1050
cmp r11, 1
je 0x1400a0f26
dec r11
add rax, 2
jmp 0x1400a0fb3
mov rdx, qword [rbx + 0x48]
mov rcx, rbp
call fcn.1400a1308
mov rax, qword [rbp + 0x48]
lock inc qword [rax + 0x40]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1400a101e
lock inc dword [rcx + 8]
mov rcx, qword [rbx + 0x40]
mov rax, qword [rbx + 0x38]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
jmp 0x1400a0f6f
sub r14, rax
movzx edx, word [rax + r14]
cmp dx, word [rax]
jb 0x1400a1058
ja 0x1400a1058
cmp r12, 1
je 0x1400a0f54
dec r12
add rax, 2
jmp 0x1400a1031
mov rbx, qword [rbx]
jmp 0x1400a0ebd
mov rbx, rcx
jmp 0x1400a0f54
Function at 0x1400a1070
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, qword [r8 + 0x18]
mov rdi, r8
mov rbx, qword [r8 + 0x10]
mov rsi, rcx
mov rdx, r8
cmp rbp, 8
jb 0x1400a10ab
mov rdx, qword [r8]
lea r8, [rbx + rbx]
call fcn.1400a1210
movzx r15d, byte [rdi + 0x20]
mov r11, rax
mov r13, qword [rsi + 8]
movabs rax, 0xcbf29ce484222325
mov r8d, r15d
mov rcx, r11
xor r8, rax
shl rcx, 6
movabs rax, 0x100000001b3
mov rdx, r11
shr rdx, 2
imul r8, rax
mov eax, 0x9e3779b9
add rdx, rax
add rcx, r8
mov rax, qword [rsi + 0x18]
add rdx, rcx
xor rdx, r11
and rdx, qword [rsi + 0x30]
add rdx, rdx
mov r14, qword [rax + rdx*8]
lea r12, [rax + rdx*8]
mov rcx, r14
cmp r14, r13
jne 0x1400a11f3
mov rax, r13
cmp rcx, rax
je 0x1400a11cd
mov rax, rdi
cmp rbp, 8
jb 0x1400a1134
mov rax, qword [rdi]
mov rsi, qword [rcx + 0x28]
lea r10, [rcx + 0x10]
mov rdx, qword [rcx + 0x20]
cmp rsi, 8
jb 0x1400a114a
mov r10, qword [rcx + 0x10]
cmp rdx, rbx
jne 0x1400a1200
test rdx, rdx
je 0x1400a1184
sub r10, rax
nop dword [rax + rax]
movzx r8d, word [rax + r10]
cmp r8w, word [rax]
ja 0x1400a1200
jb 0x1400a1200
cmp rdx, 1
je 0x1400a1184
dec rdx
add rax, 2
jmp 0x1400a1160
cmp byte [rcx + 0x30], r15b
jne 0x1400a1200
lea rax, [rcx + 0x10]
cmp rsi, 8
jb 0x1400a1197
mov rax, qword [rax]
cmp rbp, 8
jb 0x1400a11a0
mov rdi, qword [rdi]
test rbx, rbx
je 0x1400a11ca
sub rdi, rax
nop dword [rax + rax]
movzx edx, word [rax + rdi]
cmp dx, word [rax]
ja 0x1400a11cd
jb 0x1400a11cd
cmp rbx, 1
je 0x1400a11ca
dec rbx
add rax, 2
jmp 0x1400a11b0
mov r13, rcx
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov qword [rax], r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [r12 + 8]
mov rax, qword [rax]
jmp 0x1400a111f
mov rcx, qword [rcx]
jmp 0x1400a1113

Function at 0x1400a1210
Capabilities:
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
test r8, r8
je 0x1400a1240
movzx eax, byte [r9 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, r8
jb 0x1400a1222
mov rax, rcx
ret
Function at 0x1400a1390
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call fcn.1400a1bb0
movups xmm0, xmmword [rbx + 0x18]
mov esi, eax
lea rbx, [rdi + 0x290]
mov rcx, rbx
mov dword [rsp + 0x20], esi
movups xmmword [rsp + 0x28], xmm0
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockShared]
nop dword [rax + rax]
movups xmm0, xmmword [rsp + 0x28]
movzx ecx, sil
movq rdx, xmm0
mov rax, rdx
mov r8, rdx
shr rax, 0x20
movzx eax, ax
shr r8, 0x30
xor r8, rax
mov eax, edx
xor r8, rax
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rsp + 0x21]
imul rcx, rdx
movups xmmword [rsp + 0x28], xmm0
xor rcx, rax
movzx eax, byte [rsp + 0x22]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rsp + 0x23]
imul rcx, rdx
xor rcx, rax
mov rax, r8
imul rcx, rdx
shl rax, 6
mov rdx, r8
shr rdx, 2
add rcx, rax
mov eax, 0x9e3779b9
add rdx, rax
mov rax, qword [rdi + 0x2c0]
add rdx, rcx
xor rdx, r8
mov r8, qword [rdi + 0x2b0]
and rdx, qword [rdi + 0x2d8]
add rdx, rdx
mov r9, qword [rax + rdx*8]
lea r10, [rax + rdx*8]
mov rdx, qword [rsp + 0x28]
mov rcx, r9
cmp r9, r8
je 0x1400a1514
mov rax, qword [r10 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x1400a14c0
mov rax, qword [rcx + 0x10]
sub rax, rdx
jne 0x1400a14b6
mov rax, qword [rcx + 0x18]
sub rax, qword [rsp + 0x30]
test rax, rax
je 0x1400a1519
mov rcx, qword [rcx]
jmp 0x1400a1493
mov rcx, r8
cmp rcx, r8
je 0x1400a14fc
test rbx, rbx
je 0x1400a14dc
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140112420
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
test rbx, rbx
je 0x1400a1510
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockShared]
nop dword [rax + rax]
xor al, al
jmp 0x1400a14de
mov rax, r8
jmp 0x1400a149f
mov eax, dword [rcx + 0x20]
cmp eax, esi
jne 0x1400a14bb
sub rdx, qword [rcx + 0x10]
jne 0x1400a152f
mov rdx, qword [rsp + 0x30]
sub rdx, qword [rcx + 0x18]
test rdx, rdx
jne 0x1400a14c0
cmp esi, eax
je 0x1400a14c3
jmp 0x1400a14c0
Function at 0x1400ab574
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r13, qword [rbp + 0x50]
xor r15d, r15d
mov rax, qword [rbp + 0x70]
mov r14, r9
mov r12, qword [rbp + 0x58]
mov rsi, r8
mov qword [r11 - 0x68], rax
mov rdi, rcx
lea rax, [rbp + 0x60]
mov byte [r13], 1
mov qword [r11 - 0x70], rax
lea r9d, [r15 + 2]
lea rax, [rbp + 0x78]
mov dword [r12], r15d
mov qword [r11 - 0x78], rax
lea rcx, [rbp + 0x50]
mov eax, dword [rbp + 0x68]
mov r8, r14
mov dword [rsp + 0x28], eax
mov rbx, rdx
mov byte [rsp + 0x20], r15b
mov qword [rbp + 0x50], r15
mov dword [rbp + 0x78], r15d
mov dword [rbp + 0x60], r15d
call fcn.1400ab80c
mov dword [r12], eax
test eax, eax
je 0x1400ab617
mov rdx, rsi
mov rcx, rdi
call fcn.140099980
lea rcx, [rbp + 0x50]
call fcn.1400f8348
jmp 0x1400ab766
mov r15d, dword [rbp + 0x60]
lea rcx, [rbp - 0x18]
mov edx, r15d
call fcn.1400ab794
cmp qword [rbx + 0x18], 8
mov r8, rbx
jb 0x1400ab634
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x78]
mov qword [rsp + 0x30], rax
xor edx, edx
mov rax, qword [rbp - 0x18]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9d, [rdx + 2]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov dword [r12], eax
test eax, eax
je 0x1400ab70c
call fcn.140091ae4
cmp dword [rax], 4
jbe 0x1400ab6f3
cmp qword [rsi + 0x18], 8
mov rcx, rsi
jb 0x1400ab685
mov rcx, qword [rsi]
cmp qword [r14 + 0x18], 8
mov qword [rbp + 0x58], rcx
mov ecx, dword [r12]
mov dword [rbp + 0x60], ecx
jb 0x1400ab69a
mov r14, qword [r14]
cmp qword [rbx + 0x18], 8
mov qword [rbp - 0x30], r14
jb 0x1400ab6a8
mov rbx, qword [rbx]
lea rcx, str.Failed_to_read_registry_value._Return_default_value
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rcx
lea rdx, [0x14044c710]
lea rcx, [rbp + 0x58]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.1400024fc
mov rdx, rsi
mov rcx, rdi
call fcn.140099980
lea rcx, [rbp - 0x18]
call fcn.1400f6764
jmp 0x1400ab609
mov rax, qword [rbp - 0x18]
lea ecx, [r15 - 1]
xor ebx, ebx
mov byte [r13], bl
mov word [rax + rcx*2], bx
mov rcx, rdi
mov rdx, qword [rbp - 0x18]
call fcn.14008c350
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400ab751
mov rdx, qword [rbp - 8]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
call fcn.14007e6f0
xorps xmm0, xmm0
mov qword [rbp - 8], rbx
movdqu xmmword [rbp - 0x18], xmm0
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x1400ab766
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
lea r11, [rsp + 0x80]
mov rax, rdi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400af5e8
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp + 0x37], rax
and qword [rbp - 9], 0
mov rsi, rdx
mov rdx, rcx
mov rbx, rcx
lea rcx, [rbp - 9]
mov r8d, 4
call fcn.14008f444
mov edi, eax
test eax, eax
jns 0x1400af67c
cmp qword [rbx + 0x18], 8
jb 0x1400af637
mov rbx, qword [rbx]
mov rcx, qword [rbp + 0x5f]
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x28], rbx
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov r9d, edi
mov qword [rsp + 0x20], rax
mov edx, 0x127
call fcn.14008f264
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400af675
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov eax, edi
jmp 0x1400af728
mov rcx, qword [rbp - 9]
lea rdx, [rbp + 0x17]
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
nop dword [rax + rax]
test eax, eax
jne 0x1400af6c3
cmp qword [rbx + 0x18], 8
jb 0x1400af69e
mov rbx, qword [rbx]
mov rcx, qword [rbp + 0x5f]
lea r9, str.Cannot_query_service_status_for_service__ls
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov qword [rsp + 0x20], rbx
mov edx, 0x12b
call fcn.1400929ac
mov ebx, eax
jmp 0x1400af71d
call fcn.140091ae4
cmp dword [rax], 4
jbe 0x1400af716
cmp qword [rbx + 0x18], 8
mov ecx, dword [rbp + 0x1b]
mov dword [rbp - 1], ecx
jb 0x1400af6dd
mov rbx, qword [rbx]
lea rcx, str.Read_current_state_of_service
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], rcx
lea rdx, [0x140451301]
lea rcx, [rbp - 1]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 7]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0xf]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140005ba8
mov eax, dword [rbp + 0x1b]
xor ebx, ebx
mov dword [rsi], eax
lea rcx, [rbp - 9]
call fcn.140092a20
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140112420
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b2bdc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
and qword [rbp - 0x20], 0
mov rbx, r8
mov r8, qword [rbp + 0x40]
mov r14, r9
mov esi, edx
mov byte [r9], 1
mov rdi, rcx
lea rdx, [rbp - 0x20]
mov rcx, rbx
mov r9d, 0x20019
call fcn.1400b2da8
mov r15d, eax
test eax, eax
je 0x1400b2c98
call fcn.140091ae4
cmp dword [rax], 3
jbe 0x1400b2c88
cmp qword [rbx + 0x18], 8
mov dword [rbp + 0x38], esi
jb 0x1400b2c42
mov rbx, qword [rbx]
lea rcx, str.Could_not_open_or_create_the_registry_path._Return_default_value
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rcx
lea rdx, [0x14044265a]
lea rcx, [rbp + 0x38]
mov dword [rbp - 0x30], r15d
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140003b00
lea rcx, [rbp - 0x20]
call fcn.1400f8348
mov eax, esi
jmp 0x1400b2d83
cmp qword [rdi + 0x18], 8
mov rdx, rdi
mov dword [rbp - 0x2c], 4
jb 0x1400b2cac
mov rdx, qword [rdi]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rbp - 0x28]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov r15d, eax
test eax, eax
je 0x1400b2d71
call fcn.140091ae4
cmp dword [rax], 4
jbe 0x1400b2d53
cmp qword [rbx + 0x18], 8
mov dword [rbp + 0x38], esi
mov dword [rbp - 0x30], r15d
jb 0x1400b2cfa
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
mov qword [rbp - 0x10], rbx
jb 0x1400b2d08
mov rdi, qword [rdi]
lea rcx, str.Failed_to_read_registry_value._Return_default_value
mov qword [rbp - 0x18], rdi
mov qword [rbp - 8], rcx
lea rdx, [0x14044260b]
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 8]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140006274
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400b2c91
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
jmp 0x1400b2c91
mov ebx, dword [rbp - 0x28]
lea rcx, [rbp - 0x20]
mov byte [r14], 0
call fcn.1400f8348
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400b34f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r14, qword [r8 + 0x18]
mov rbx, r8
mov r10, qword [r8 + 0x10]
mov r15, rdx
mov r11, rcx
mov r9, r8
cmp r14, 8
jb 0x1400b3522
mov r9, qword [r8]
lea r8, [r10 + r10]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r8, r8
je 0x1400b3555
movabs rdi, 0x100000001b3
movzx eax, byte [rdx + r9]
inc rdx
xor rcx, rax
imul rcx, rdi
cmp rdx, r8
jb 0x1400b3541
mov rax, qword [r11 + 0x18]
mov rdx, qword [r11 + 0x30]
mov rsi, qword [r11 + 8]
and rdx, rcx
add rdx, rdx
mov qword [rsp + 0x20], rbp
mov rdi, qword [rax + rdx*8]
lea r12, [rax + rdx*8]
mov rcx, rdi
jmp 0x1400b3642
mov rax, rsi
cmp rcx, rax
je 0x1400b361d
lea r11, [rcx + 0x10]
mov rax, rbx
cmp r14, 8
jb 0x1400b3598
mov rax, qword [rbx]
mov rbp, qword [r11 + 0x18]
mov rdx, qword [r11 + 0x10]
cmp rbp, 8
jb 0x1400b35a9
mov r11, qword [r11]
cmp rdx, r10
jne 0x1400b363f
test rdx, rdx
je 0x1400b35dc
sub r11, rax
nop word [rax + rax]
movzx r8d, word [rax + r11]
cmp r8w, word [rax]
ja 0x1400b363f
jb 0x1400b363f
cmp rdx, 1
je 0x1400b35dc
dec rdx
add rax, 2
jmp 0x1400b35c0
lea rax, [rcx + 0x10]
cmp rbp, 8
jb 0x1400b35e9
mov rax, qword [rax]
cmp r14, 8
jb 0x1400b35f2
mov rbx, qword [rbx]
test r10, r10
je 0x1400b361a
sub rbx, rax
nop word [rax + rax]
movzx edx, word [rax + rbx]
cmp dx, word [rax]
ja 0x1400b361d
jb 0x1400b361d
cmp r10, 1
je 0x1400b361a
dec r10
add rax, 2
jmp 0x1400b3600
mov rsi, rcx
mov rbp, qword [rsp + 0x20]
mov rax, r15
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov qword [r15], rsi
mov rsi, qword [rsp + 0x30]
pop r15
pop r14
pop r12
ret
mov rcx, qword [rcx]
cmp rdi, rsi
je 0x1400b357c
mov rax, qword [r12 + 8]
mov rax, qword [rax]
jmp 0x1400b357f