joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400db6b2
Capabilities:
Encode data using base64
Manually build aes constants

Disassembly:
xor r8w, 0x2783
not word [rsp + r9*2 - 0x19d4a]
and ax, 0x1717
xor bx, r8w
mul dword [rsp + r9 - 0xcea4]
lea r8, [rsp + r8 + 8]
mov qword [r8 + r9 - 0xcea7], rcx
lea r10, [r10 + r9 - 0xceab]
or ebp, dword [rsp + r9*2 - 0x19d4e]
bswap edi
mov ecx, r9d
mov ebp, dword [r10 + rdi*2 - 0x95956c4]
xor ebp, ebx
lea ebp, [rbp + rdi*2 - 0x8bfa5ac]
sar qword [rsp + rdi - 0x4acab62], 0x82
bswap ebp
xor ebp, 0x188edbb
add word [rsp + rdi*2 - 0x95956c2], 0x2037
inc ebp
xor ebp, 0xb6331627
movzx r8d, ax
bts ax, r9w
lea ebp, [rbp + rdi*4 - 0x7e5e01b3]
neg qword [rsp + rdi - 0x4acab62]
jnp 0x1400d6e0c
dec ebp
ror ebp, 1
jmp 0x1400c60db
inc dl
mov ecx, 0xbcae0b3d
bswap ebp
dec ebp
lea rcx, [rcx*8 + 0x7ba0fe29]
xor ebp, 0x1ebc7497
add rcx, rdx
bt dx, dx
movsx r8d, cx
push rbx
call fcn.1400beca5
xchg edi, eax
and bp, ax
lea r11, [rdi + r11 - 0x9bfd]
shr bpl, 0xe7
sal bpl, 0xe2
adc r9w, bp
shr dx, cl
mov word [r11 + rdi*2 - 0x137fe], dx
lea r9, [r9 + r9*4 + 0x60906b04]
lea rdx, [rdi*4 - 0x14e650d7]
movsx ecx, bp
jmp rsi
mov rdx, r11
lea r9, [rdi*2 + 0x22227410]
lea r11, [r11 + rcx - 0x3b0aff04]
mov dword [r11 + rbp*2 - 0x122], edx
ror word [rsp + rbp - 0x90], 0x43
pop rdx
jae fcn.1400b6e87
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x30], 0xffffffffee98af99
mov r11, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
xchg r8d, ecx
call fcn.1400c094c
xchg r8d, ebp
dec edx
mov edx, dword [r10 + rbp*2 - 0x634880]
jns 0x1400e3a6d
mov rcx, qword [r11]
mov ebp, 0xdc0383be
mov dx, word [r11 + riz + 8]
add r11, 0xa
movsx r9d, bpl
mov word [rcx + riz], dx
movsx ecx, bp
mov edi, 0xce347904
sub r10, 4
btc cx, cx
push rcx
jae 0x1400c440c
mov ebp, ecx
sub r11, 8
mov dword [r11 + riz + 4], eax
movzx r9d, bpl
sal bp, 0x87
not rbp
mov dword [r9 + r11 - 0x92], edx
lea r10, [r10 + r9 - 0x96]
btr bp, bp
bts rbp, rcx
movsx eax, r9w
mov edi, dword [r10 + r9 - 0x92]
xchg cl, bpl
xor edi, ebx
and bpl, al
mov r8d, 0xb59c8db1
mov edx, 0xea9f232d
lea edi, [rdi + rcx + 0x10f2ad0e]
mul r8
sbb r8w, dx
bswap edi
xor edi, 0x721e8e23
dec edx
je 0x1400c172c
cqo
not edi
xchg dx, cx
lea edi, [rdi + r9*2 + 0x2244c87]
and rdx, rbp
or cx, 0xdb3
push rbx
xor dword [rsp + r9 - 0x92], edi
sar al, 0x63
btr cx, bp
mov ebx, r8d
pop rbx
movsxd rdi, edi
bt cx, 0xbd
rol r8b, 0x21
add rsi, rdi
btr eax, edx
push rbp
ror dx, 0x8a
pop r9
jae fcn.1400b6e87
sub eax, 0x9f9088ac
pop r9
push rbx
sar cl, 0x85
xor dword [rsp + rbp*4 - 0x244], eax
btr cx, bp
movzx r8d, r9b
btc r9d, ecx
pop rbx
shl cx, 0x46
xor r8d, ebp
push r9
movsxd rax, eax
cmovo di, cx
add dword [rsp + rbp - 0x8d], r9d
adc rsi, rax
jmp 0x1400c86a9
btc bp, r8w
xor edx, ebx
xadd r8w, bp
movsx edi, cl
bts cx, r8w
lea edx, [rdx + r9*8 - 0x748a9e19]
sar di, cl
jbe 0x1400dad60
sub r10, 2
mov ebp, 0x94990ca3
movzx r8d, word [r10 + riz]
movzx edx, bp
movsx ecx, dx
xor r8w, bx
xor rcx, rcx
inc r8w
bswap ecx
add dx, dx
rol r8w, 1
jmp fcn.1400b5d8b

Function at 0x1400dd27e
Capabilities:
Manually build aes constants

Disassembly:
dec r8
xor cx, 0x2783
push r9
call fcn.1400c697e
Function at 0x1400e0b56
Capabilities:
Manually build aes constants

Disassembly:
mov qword [rsp], 0x7880e390
test ebx, ebx
jmp 0x1400e5275
call fcn.1400c0a92
Function at 0x1400e8a6c
Capabilities:
Manually build aes constants

Disassembly:
xor ecx, 0x770e1f2f
lea rax, [rdi*4 - 0x74cc186d]
ror ecx, 1
dec bp
neg ecx
inc bp
add rax, 0xffffffffd0841fad
not ecx
and byte [rsp + rdi*2 + 0xf], dh
call fcn.1400da59e
push 0xffffffffeb0a003e
test r8, r8
call fcn.1400efda5
mov edx, dword [rdx + r10 - 0x70bd8289]
ror r9b, 0xc4
movsx eax, r9b
add r8d, eax
xor edx, ebx
sal rax, 0xa6
jns 0x1400df50a
btr r9, r8
sbb edx, 0xbd9b45a6
lea r8, [r8*4 - 0x8fd31c2]
btc r9, 0xb9
mov ecx, r9d
bswap edx
shl rax, cl
btr rax, 0x2e
inc edx
not r9b
mov edi, ecx
bts rcx, r8
ror edx, 1
sub rcx, r8
and r9w, cx
push rbx
mov ebp, 0x362f9424
ror cl, 0x43
xor dword [rsp + rdi - 0x266e30a6], edx
mov ebx, ebp
pop rbx
sar ecx, 0x6c
xchg dil, r9b
movsxd rdx, edx
shl r8w, 0x8a
push rcx
xor rbp, r8
adc rsi, rdx
dec dword [rsp + rax*8]
pop rdx
shl r9, 0x37
mov rdi, qword [r11 + rax*2]
adc cl, 0x12
mov bp, word [rdi + rax]
shr rcx, 0xc5
adc r9w, 0x9c2d
xor r8, 0x320aa803
lea r11, [r11 + rax*8 + 6]
shl r9b, 0xc2
mov word [r11 + rax], bp
adc ecx, r9d
add rax, rsi
jmp rax
push rax
adc dl, 0x37
bswap rax
mov r9d, dword [rsp + rdi + 1]
ror dl, 1
xor bl, dl
add qword [rsp + rdi*2], 0xffffffffd7901bb1
lea rdx, [rsp + rdx + 0x10]
sbb qword [rsp + rdi + 8], r9
adc r8b, byte [rdx + rdi]
lea r11, [rdi + r11 - 2]
not edi
push rbp
pop rbp
mov word [rax + r11], r8w
shr ax, cl
lea r10, [r10 + rax - 4]
cmovp rdi, r9
lea rdx, [rdi + r9*8 + 0x300632a3]
mov r8d, dword [r10 + rdi*2]
pop rcx
and word [rsp + rcx + 0x286fe453], cx
ror r9, 0x24
xor r8d, ebx
not ecx
rol r8d, 2
bswap rax
neg qword [rsp + rcx - 0x286fe44e]
xor r8d, 0x770e1f2f
shl qword [rsp + rcx - 0x286fe44e], cl
call fcn.1400bda41
mov edx, 0x70bd8289
movsx r8d, dl
lea r9, [rdx + r8*8 - 0x4a4f4e67]
lea r10, [r10 + rdx - 0x70bd828d]
jmp 0x1400cf780
inc r9w
add al, r8b
sal r8, 0x43
imul r9, qword [rsp + rdi - 0x7bffbef6]
shr r8w, 0xae
not al
xor bl, al
sal word [rsp + rdi - 0x7bffbef1], 0x6f
or rdx, qword [rsp + rdi - 0x7bffbee8]
lea rax, [rsp + rax + 0x20]
movzx bp, byte [rax + rdi - 0x7bffbf00]
sbb dl, dil
rol dword [rsp + rdi - 0x7bffbee6], 0x87
mov word [rdi + r11 - 0x7bffbf00], bp
mov ebp, 0x3b23fb21
xor qword [rsp + rdi - 0x7bffbeee], rbp
mov ecx, dword [rdi + r10 - 0x7bffbf06]
setle dl
sub bp, r8w
lea r10, [r10 + rdi - 0x7bffbf06]
xor edx, dword [rsp + rbp*2 - 0x7647f631]
dec r9w
xor ecx, ebx
xor rdi, rdi
rol ecx, 2
neg dword [rsp + rdi*8 + 0x1b]
mov qword [rsp + rdi], 0xffffffffd9a162b2
js 0x1400b2db3
bswap r8d
mov edx, 0x782a472b
sub r15b, byte [r8 + 0x40]
sub ch, 0x1b
btc ax, 0x88
sbb r8d, 0x3aa8bba7
mov r9d, ebp
push r9
bt edi, edx
neg r8d
xchg ah, cl
mov qword [rsp + rdx - 0x782a472b], rbx
ror ax, 0xe1
cdq
xor dword [rsp], r8d
bt edx, edx
xor ax, ax
shr rdx, 0xe0
pop rbx
sub r9, 0x479dd920
movsxd r8, r8d
imul cl
call fcn.1400b4fa0
mov r8d, 0x9ab1cb08
movzx ebp, r8w
lea r10, [r10 + rbp - 0xcb0c]
shr r8, 0x2e
adc r8d, dword [r10 + r8*2]
movzx edx, bp
lea rdx, [rdx - 0x6d606668]
xor r8d, ebx
rol r8d, 1
inc rbp
imul dx, dx
push rbp
neg r8d
rol dl, 1
ror r8d, 2
xor r8d, 0x1ba78605
inc byte [rsp + rbp - 0xcb06]
neg dl
call fcn.1400ba06a
not dl
movzx ebp, di
jae 0x1400d3f7e
Function at 0x1401a8e49
Capabilities:
Encode data using xor

Disassembly:
lea eax, [rax + r8 - 0x7ab6a8e4]
lea rbp, [r9 + r9 - 0x52591047]
bswap eax
push r8
xor bp, 0x4b22
neg eax
xor ebp, dword [rsp + rdi - 0x109fff]
mov qword [rsp + rdi*2 - 0x213ff8], rbx
xor dword [rsp + rdi - 0x109ff8], eax
dec bp
imul bp, word [rsp + rdi*8 - 0x84fffa]
jno 0x1401e6852
mov edx, 0x8c1511a9
movzx r8d, dl
mov edi, r8d
lea r10, [r10 + r8*4 - 0x2a8]
dec di
movzx r9d, dl
btr r9d, 0x31
mov ebp, dword [r10 + rdi*8 - 0x540]
jae 0x1401b24a4
add r8w, 0xf6b7
xor ebp, ebx
lea rax, [rdi + r8*4 + 0x3180c506]
call fcn.1401e48d1
mov rbx, qword [rsp + rdi - 0x109ff8]
not cl
and r8, 0x6b0c160c
movsxd rax, eax
ror edi, cl
adc rsi, rax
sal byte [rsp + rdi*4 - 0x84fffd], 0xe1
jbe 0x1401c945b

Function at 0x1401c959f
Capabilities:
Manually build aes constants

Disassembly:
xor edx, ebx
btr cx, 0xa8
lea edx, [rdx + r8 + 0x360d3b0]
setb byte [rsp + rax - 0x30a]
inc rax
bswap edx
and r9d, ecx
sbb qword [rsp + rax*8 - 0x1918], rax
rol edx, 1
push rbp
and rax, rax
bswap edx
xadd r8b, al
mov qword [rsp + rax*2 - 0x7c8], rbx
and r8, 0x6930eb0f
shl ecx, 0x11
xor dword [rsp + rax - 0x3d4], edx
xor al, byte [rsp + rax - 0x3d7]
ror ebp, 0x8b
add rdi, rcx
mov rbx, qword [rsp + rax - 0x31c]
movsxd rdx, edx
jnp 0x1401c5123
shr dword [rsp + rax - 0x32b], 0x21
adc rsi, rdx
rol byte [rsp + rax - 0x33b], 0x22
movsx edx, r9w
shr edi, 6
mov rdx, qword [rax + r11 - 0x334]
cbw
bts r8, rbp
lea r11, [r11 + rax*2 - 0x68]
and dword [rsp + rax*4 - 0xe7], eax
rol cx, 0x63
movzx ebp, byte [r10 + rax*2 - 0x7f]
xor rcx, 0xffffffff9c8fed87
lea r10, [r10 + rax - 0x43]
sal qword [rsp + rax*2 - 0x6a], 0x2c
sub byte [rsp + rax - 0x23], dil
xor word [rsp + rax - 0x35], di
xor bpl, bl
ror rdi, 0xeb
or dil, al
or byte [rsp + rax - 0x2c], r9b
neg bpl
ror r8b, cl
shl r8w, 0x4f
imul r8d, dword [rsp + rax - 0x24]
ror bpl, 1
btc eax, 0xb0
xor bpl, 0x17
and r8, r9
inc bpl
lea rdi, [rcx*8 + 0x3493f28e]
btr r8d, 0x94
xor bl, bpl
xchg r9w, ax
dec r9
lea rbp, [rsp + rbp + 0x28]
sal qword [rsp + rax*4 - 0x411fe], cl
bts ax, ax
mov qword [rsp + rax*2 - 0x208ff], 0x2c0e8c8d
mov qword [rax + rbp - 0x10481], rdx
mov qword [rsp + rax - 0x10481], rsi
ret 0x20
rol cx, 1
mov qword [rsp + rdx - 0x1f], r9
push r8
lea rbp, [rdx + r9*2 + 0x56273d23]
not cx
neg r9b
and r9, 0xffffffff93b786b5
xor cx, 0x7630
shr al, 1
push rax
adc cx, 0xaaa1
jmp 0x1401e0c40
not cx
xor bx, cx
xor dword [rsp + rdx*8 - 0xee], eax
lea rcx, [rsp + rcx + 0x18]
push rbp
mov qword [rdx + rcx - 0x1f], rdi
movsx ecx, bpl
sar rax, 0xd6
mov edx, dword [r10 + rax*2 - 0x646]
bts ax, r9w
lea rdi, [rbp + rbp*8 + 0x65894793]
jae 0x1401beee1
mov r8d, 0x840f6187
movsx ebp, r8w
mov rcx, qword [r11 + rbp*4 - 0x1861c]
add r8d, ebp
shr r8w, 7
mov rbp, qword [r11 + rbp - 0x617f]
movsx eax, r8b
adc r11, 8
movsx r9d, ax
not rcx
xor r8d, 0x878119af
not rbp
and rcx, rbp
lea rdx, [rax + rax + 0x3391c590]
div eax
btc r9d, edx
mov qword [r11 + r8*4 - 0xe3860a4], rcx
mov ecx, edx
call fcn.1401e20bd

Function at 0x1401c9c9a
Capabilities:
Manually build aes constants

Disassembly:
mov qword [rsp + rbp*4 - 0x74], rbx
shr r8, 0x70
call fcn.1401e3873
Function at 0x1401c9ca8
Capabilities:
Manually build aes constants

Disassembly:
shl dx, 0xc7
lea rdi, [rcx + rdx - 0x3a65f4ec]
xor ax, 0xd609
rol dil, 0x84
dec cl
bswap r9d
sbb ax, 0xf722
xor ax, 0x2783
xadd qword [rsp + r9 - 0x6a4ac25], rdi
inc r9w
not dl
xor bx, ax
jmp 0x1401beb9b
lea r10, [r10 + rax*2 - 0x1ffb8]
mov ax, word [rax + r10 - 0xffdb]
not cx
sal r8d, 0xbd
xor ax, bx
pop rcx
push rdx
not ax
shl r9w, 0x63
sar di, 0xf
adc r9, rcx
dec ax
jmp 0x1401a66ba
neg qword [rsp + rdx - 0x25ab9a7f]
sar cx, 0x47
lea rax, [rsp + rax + 8]
or dword [rsp + rdx*2 - 0x4b5734fb], ecx
xchg byte [rsp + rdx - 0x25ab9a79], r8b
mov qword [rax + rdx*2 - 0x4b5734fe], rbp
shr dx, 0xe9
push r8
mov qword [rsp + rdx*2 - 0x4b56009a], rsi
ret 8
not r9
inc dl
mov eax, 0x35ba5ea4
xor bl, dl
xchg r8b, cl
inc edi
lea rdx, [rsp + rdx + 0x10]
mov byte [rdx + rdi*4 - 0xe42148], bpl
neg dword [rsp + rdi*2 - 0x7210a1]
not edi
lea r10, [r10 + rax - 0x35ba5ea8]
mov r8d, dword [r10 + rax*2 - 0x6b74bd48]
call fcn.1401c9f59
sub r10, 4
mov eax, 0x73bb789a
lea rdx, [rax + rax*8 + 0x41bd040d]
mov r8d, dword [r10 + rax - 0x73bb789a]
xor r8d, ebx
mov ebp, edx
lea r8d, [r8 + rax - 0x7321c782]
movzx r9d, ax
cwd
bswap r8d
xor r8d, 0x188edbb
inc r8d
bts edx, 0x86
mov ecx, r9d
bt r9, rcx
xor r8d, 0xb6331627
or dl, dh
sbb edx, r9d
shl cx, 5
lea r8d, [r9 + r8 - 0x6babccc5]
mul ebp
add al, 0x8f
ror r8d, 3
neg r8d
push rbx
xor dword [rsp + rdx*2 - 0x4b57be6a], r8d
lea rbx, [r9*8 - 0x69e100dd]
pop rbx
push rdx
xchg dword [rsp + rdx - 0x25abdf31], ecx
movzx edi, bp
movsxd r8, r8d
add rsi, r8
cbw
cwde
not dil
mov rbp, qword [r11 + rax - 0x25]
neg ax
sal rcx, 0xf
movsx r8d, cl
lea r11, [rax + r11 - 0xffd3]
rol r8w, 0x4e
sar byte [rsp + rax - 0xffd4], 0x63
jns 0x1401b2c8b
mov edi, dword [rsp + 0xa]
mov bp, word [r11 + riz]
neg word [rsp + 0xb]
adc r11, 1
sub r10, 1
mov byte [rsp + 0xf], dil
movzx edx, byte [r10 + riz]
xor dl, bl
mov ecx, 0xe421458a
ror dl, 1
ror byte [rsp + 9], 0x26
sbb dl, 0xb7
rol dl, 1
lea r8, [rcx*2 + 0x7914bc03]
mov qword [rsp], rdi
shl word [rsp + 5], cl
neg dl
dec dl
push rcx
dec qword [rsp + 0x10]
push rcx
not dl
pop rdi
pop r9
ror dl, 1
xor r8b, r8b
shr edi, cl
not dl
jae 0x1401c3593
Function at 0x140005ee0
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2068
call fcn.1400767e0
sub rsp, rax
mov rax, qword [0x1400aa008]
xor rax, rsp
mov qword [rsp + 0x2050], rax
mov rbx, r9
mov r14, qword [rsp + 0x20d0]
mov edi, r8d
mov r15, qword [rsp + 0x20d8]
mov ebp, edx
mov rsi, rcx
cmp r8d, dword [rsp + 0x20c0]
jg 0x140005fe7
mov edx, 0x5c
call fcn.140051344
test rax, rax
mov r8d, 0x1000
lea rcx, [rax + 2]
cmovne rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140052580
xor edx, edx
lea rcx, [rsp + 0x1050]
mov r8d, 0x1000
call fcn.140052580
call fcn.140005dc0
mov qword [rsp + 0x28], r15
lea rdx, [rsp + 0x50]
mov r9, r14
mov qword [rsp + 0x20], 0
mov r8d, 0x800
mov rcx, qword [rax]
call fcn.14005648c
cmp qword [rbx + 0x18], 8
jb 0x140005fa0
mov rbx, qword [rbx]
lea rax, [rsp + 0x50]
or r8, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
lea r9, str._s__s__d____d_:_trace__s_n
mov dword [rsp + 0x38], edi
lea rcx, [rsp + 0x1050]
mov dword [rsp + 0x30], ebp
mov edx, 0x800
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
call fcn.140005dd0
lea rcx, [rsp + 0x1050]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.140030090
add rsp, 0x2068
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140006130
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor edi, edi
lea rax, str.CBaseThread::Start
mov qword [rsp + 0x30], rax
lea rsi, [0x14008a330]
mov rbx, rcx
mov qword [rsp + 0x28], rsi
lea r8, [0x1400abd38]
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 3]
lea edx, [rdi + 0x25]
lea rcx, str...SharedBaseThread.cpp
call fcn.140005e30
mov byte [rbx + 0x1c], dil
cmp qword [rbx + 0x10], rdi
jne 0x1400061cf
lea rax, str.CreateEvent
mov qword [rsp + 0x30], rax
lea r9d, [rdi + 3]
mov qword [rsp + 0x28], rsi
lea r8, [0x1400abd38]
lea edx, [rdi + 0x2b]
mov qword [rsp + 0x20], rdi
lea rcx, str...SharedBaseThread.cpp
call fcn.140005e30
xor r9d, r9d
lea edx, [rdi + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x10], rax
cmp rax, rdi
je 0x14000623b
cmp qword [rbx + 8], rdi
jne 0x14000622d
mov r9d, 3
lea rax, [0x14008a3c8]
mov qword [rsp + 0x30], rax
lea r8, [0x1400abd38]
mov qword [rsp + 0x28], rsi
lea rcx, str...SharedBaseThread.cpp
mov qword [rsp + 0x20], rdi
lea edx, [r9 + 0x30]
call fcn.140005e30
lea rax, [rbx + 0x18]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140006080]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
cmp qword [rbx + 0x10], rdi
je 0x14000623b
mov al, 1
cmp qword [rbx + 8], rdi
jne 0x14000623f
movzx eax, dil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400063b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400063e3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000642a
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140006425
nop
cmp rbx, rcx
jae 0x14000642a
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140006410
cmp rbx, rcx
jb 0x14000642e
xor eax, eax
jmp 0x14000643a
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000f8b0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rbp, r8
mov rax, rdx
mov r14, rcx
xor edi, edi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rdi
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.1400270f0
mov rbx, qword [rsp + 0x38]
test al, al
je 0x14000f947
mov rsi, qword [rsp + 0x40]
sub rsi, rbx
mov dword [rsp + 0x88], esi
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
lea r8d, [rdi + 1]
mov rcx, qword [r14 + 8]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x14000f947
xor r9d, r9d
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call fcn.1400271b0
movzx edi, al
test rbx, rbx
je 0x14000f99c
mov rax, qword [rsp + 0x48]
sub rax, rbx
cmp rax, 0x1000
jb 0x14000f994
test bl, 0x1f
je 0x14000f967
call fcn.1400534c4
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x14000f976
call fcn.1400534c4
int3
sub rbx, rax
cmp rbx, 8
jae 0x14000f985
call fcn.1400534c4
int3
cmp rbx, 0x27
jbe 0x14000f991
call fcn.1400534c4
int3
mov rbx, rax
mov rcx, rbx
call fcn.1400300f0
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140012d20
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x278
mov rax, qword [0x1400aa008]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov qword [rsp + 0x280], rbx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.140052580
xor ebx, ebx
lea rcx, [rsp + 0x50]
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], bx
jne 0x140012d60
test rax, rax
jne 0x140012dd7
mov qword [rsp + 0x270], rdi
lea rdi, [0x1400aba00]
nop dword [rax]
cmp ebx, 7
jae 0x140012dcf
lea rcx, [rbx + rbx*4]
cmp dword [rdi + rcx*8], 1
jne 0x140012dac
mov r8, qword [rdi + rcx*8 + 0x10]
lea r9, str.Render
lea rcx, [rsp + 0x50]
lea rdx, str.SoundMode__s__s
call fcn.1400123e0
inc ebx
lea rcx, [rsp + 0x50]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140012dc0
test rax, rax
je 0x140012d80
mov rdi, qword [rsp + 0x270]
mov rbx, qword [rsp + 0x280]
lea rcx, [rsp + 0x50]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140012df0
test rax, rax
je 0x140012e9b
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0xffffffff
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], 0
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140012e7f
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140030090
add rsp, 0x278
ret
or eax, 0xffffffff
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140030090
add rsp, 0x278
ret
Function at 0x140015f30
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1400aa008]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rdi, r9
mov rsi, r8
xor bl, bl
xor r14d, r14d
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp qword [rsp + 0x50], r14
je 0x1400160b7
lea rax, [rbp - 0x68]
mov qword [rbp - 0x70], rax
lea r8d, [r14 + 3]
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.140003b70
nop
mov qword [rbp - 0x80], 0xf
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x68], r14b
mov rdx, qword [rbp - 0x70]
cmp byte [rdx], r14b
jne 0x140015fe7
mov r8d, r14d
jmp 0x140015ffa
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140015ff0
lea rcx, [rsp + 0x68]
call fcn.140003890
nop
lea rax, [rbp - 0x68]
mov rcx, qword [rbp - 0x70]
cmp rcx, rax
je 0x140016017
call fcn.14005392c
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r14
mov rax, qword [rbp - 0x80]
cmp rax, 0x10
jb 0x1400160b7
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, 0x1000
jb 0x1400160b2
test cl, 0x1f
je 0x140016085
call fcn.1400534c4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016094
call fcn.1400534c4
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400160a3
call fcn.1400534c4
int3
cmp rcx, 0x27
jbe 0x1400160af
call fcn.1400534c4
int3
mov rcx, rax
call fcn.1400300f0
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140030090
add rsp, 0x130
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140016a30
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x488]
sub rsp, 0x570
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400aa008]
xor rax, rsp
mov qword [rbp + 0x460], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x250]
call fcn.140052580
mov r8d, 1
lea rdx, str.Property_u
lea rcx, [rbp + 0x250]
call fcn.1400123e0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x40]
call fcn.140052580
lea r8, [rbp + 0x40]
mov edx, dword [rbx + 0x48]
mov ecx, dword [rbx + 0x38]
call fcn.14007b2d0
lea rdx, [rbp - 0x78]
mov rcx, qword [rbx + 0x50]
call fcn.140016780
nop
cmp qword [rax + 0x18], 8
jb 0x140016acf
mov rax, qword [rax]
lea rcx, [rbp - 0x48]
mov qword [rbp - 0x50], rcx
mov r8d, 3
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140003b70
nop
mov qword [rbp - 0x80], 0xf
xor r14d, r14d
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x68], r14b
mov rdx, qword [rbp - 0x50]
cmp byte [rdx], r14b
jne 0x140016b0d
mov r8d, r14d
jmp 0x140016b1a
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140016b11
lea rcx, [rsp + 0x68]
call fcn.140003890
nop
lea rax, [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
cmp rcx, rax
je 0x140016b38
call fcn.14005392c
nop
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x140016b52
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140009050
mov rsi, qword [rsp + 0x78]
lea rdi, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdi, qword [rsp + 0x68]
mov ebx, 0x80004005
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x58], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140016be9
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
mov rax, qword [rbp - 0x80]
cmp rax, 0x10
jb 0x140016c45
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, 0x1000
jb 0x140016c40
test cl, 0x1f
je 0x140016c13
call fcn.1400534c4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016c22
call fcn.1400534c4
int3
sub rcx, rax
cmp rcx, 8
jae 0x140016c31
call fcn.1400534c4
int3
cmp rcx, 0x27
jbe 0x140016c3d
call fcn.1400534c4
int3
mov rcx, rax
call fcn.1400300f0
movzx eax, bl
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.140030090
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret