joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140061de0
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x140061e0c
add rcx, 0xc
mov rbx, rcx
jmp 0x140061e0e
xor ebx, ebx
mov qword [rbp - 0x40], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x70], rcx
lea rcx, [rbp - 0x68]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x70]
call sub.KERNEL32.dll_DeleteFileW
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x140061e89
mov dword [rdi + 0x90], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rdi, rax
jmp 0x140061e6a

Function at 0x140062c54
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x140062c80
add rcx, 0xc
mov rbx, rcx
jmp 0x140062c82
xor ebx, ebx
mov qword [rbp - 0x40], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x70], rcx
lea rcx, [rbp - 0x68]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x70]
call sub.KERNEL32.dll_RemoveDirectoryW
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x140062cfd
mov dword [rdi + 0x90], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rdi, rax
jmp 0x140062cde

Function at 0x140062d10
Capabilities:
Set current directory

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x140062d3c
add rcx, 0xc
mov rbx, rcx
jmp 0x140062d3e
xor ebx, ebx
mov qword [rbp - 0x40], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x70], rcx
lea rcx, [rbp - 0x68]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x70]
call sub.KERNEL32.dll_SetCurrentDirectoryW
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x140062db9
mov dword [rdi + 0x90], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rdi, rax
jmp 0x140062d9a
Function at 0x140062dcc
Capabilities:
Set file attributes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov ebx, edx
test rcx, rcx
je 0x140062dfa
add rcx, 0xc
mov rsi, rcx
jmp 0x140062dfc
xor esi, esi
mov qword [rbp - 0x40], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rsi
mov qword [rbp - 0x74], rcx
mov edx, ebx
mov dword [rbp - 0x6c], edx
lea rcx, [rbp - 0x68]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x74]
mov edx, dword [rbp - 0x6c]
call sub.KERNEL32.dll_SetFileAttributesW
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x140062e7f
mov dword [rdi + 0x90], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rdi, rax
jmp 0x140062e60

Function at 0x1400631e4
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
mov r14, r9
mov r15, qword [rbp + 0x38]
xor ecx, ecx
mov dword [rbp - 0x3c], ecx
mov dword [r15], ecx
mov byte [rbp - 0x74], 0
lea rcx, [0x140131e58]
call fcn.1400caec8
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x48], r15
mov r13d, dword [rbp + 0x30]
mov dword [rsp + 0x20], r13d
mov qword [rsp + 0x28], r15
mov rdx, rsi
mov qword [rbp - 0x88], rdx
mov r8, rdi
mov qword [rbp - 0x90], r8
mov r9, r14
mov qword [rbp - 0x98], r9
mov rcx, rbx
mov qword [rbp - 0xa0], rcx
lea rcx, [rbp - 0x70]
call fcn.1400d29d0
mov rdx, qword [rbp - 0x88]
mov r8, qword [rbp - 0x90]
mov r9, qword [rbp - 0x98]
mov rcx, qword [rbp - 0xa0]
call sub.KERNEL32.dll_CreateThread
mov rbx, rax
lea rcx, [rbp - 0x70]
call fcn.1400d2a20
nop
xor eax, eax
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x3c], 1
mov byte [rbp - 0x74], 1
mov rax, qword [rbp - 0x80]
mov qword [rax + 8], rbx
mov rcx, rax
mov rax, rcx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140063344
Capabilities:
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov qword [rbp - 0x48], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140058880
mov rcx, qword [rbp - 0x48]
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x78], rcx
lea rcx, [rbp - 0x70]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x78]
call sub.KERNEL32.dll_ResumeThread
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.1400d2a20
nop
cmp byte [rbp - 0x40], 0
je 0x1400633b5
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400588c0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140063898
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rdx
mov esi, r8d
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140058880
mov rcx, qword [rbp - 0x48]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x7c], rcx
mov rdx, rbx
mov qword [rbp - 0x84], rdx
mov r8d, esi
mov dword [rbp - 0x74], r8d
mov r9, rdi
mov qword [rbp - 0x8c], r9
lea rcx, [rbp - 0x70]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x7c]
mov rdx, qword [rbp - 0x84]
mov r8d, dword [rbp - 0x74]
mov r9, qword [rbp - 0x8c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
cmp byte [rbp - 0x40], 0
je 0x14006395b
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400588c0
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x140063997
mov dword [rdi + 0x90], esi
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rdi, rax
jmp 0x14006397b

Function at 0x1400639e0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rdx
mov edi, r8d
mov rbx, r9
xor edx, edx
mov dword [rbx], edx
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140058880
nop
mov qword [rbp - 0x50], rbx
mov rcx, qword [rbp - 0x48]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x84], rcx
mov rdx, rsi
mov qword [rbp - 0x8c], rdx
mov r8d, edi
mov dword [rbp - 0x7c], r8d
mov r9, rbx
mov qword [rbp - 0x94], r9
lea rcx, [rbp - 0x78]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x84]
mov rdx, qword [rbp - 0x8c]
mov r8d, dword [rbp - 0x7c]
mov r9, qword [rbp - 0x94]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x140063abf
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400588c0
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x140063afb
mov dword [rdi + 0x90], esi
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rdi, rax
jmp 0x140063adf
Function at 0x140063e50
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov ebx, r8d
mov qword [rbp - 0x40], rdx
mov rsi, rdx
test rcx, rcx
je 0x140063e86
add rcx, 0xc
mov rdi, rcx
jmp 0x140063e88
xor edi, edi
mov qword [rbp - 0x48], rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rdi
mov qword [rbp - 0x7c], rcx
mov rdx, rsi
mov qword [rbp - 0x84], rdx
mov r8d, ebx
mov dword [rbp - 0x74], r8d
lea rcx, [rbp - 0x70]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x7c]
mov rdx, qword [rbp - 0x84]
mov r8d, dword [rbp - 0x74]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x140063f1d
mov dword [rdi + 0x90], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rdi, rax
jmp 0x140063f04

Function at 0x1400645f0
Capabilities:
Access the windows event log

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov rbx, rcx
mov esi, edx
mov edi, r8d
mov r14d, r9d
mov r15, qword [rbp + 0x30]
mov r13, qword [rbp + 0x50]
lea r12, [r13 + 0x10]
xor ecx, ecx
test r13, r13
cmove r12, rcx
mov qword [rbp - 0x40], r12
lea r13, [r15 + 0x10]
test r15, r15
cmove r13, rcx
mov qword [rbp - 0x48], r13
call sub.KERNEL32.dll_SetLastError
mov qword [rsp + 0x20], r13
movsx rdx, word [rbp + 0x38]
mov dword [rsp + 0x28], edx
mov r15d, dword [rbp + 0x40]
mov dword [rsp + 0x30], r15d
mov r15, qword [rbp + 0x48]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r12
movsx rdx, si
mov dword [rbp - 0x74], edx
movzx r8d, di
mov dword [rbp - 0x78], r8d
mov rcx, rbx
mov qword [rbp - 0x84], rcx
mov r9d, r14d
mov dword [rbp - 0x7c], r9d
lea rcx, [rbp - 0x70]
call fcn.1400d29d0
mov edx, dword [rbp - 0x74]
mov r8d, dword [rbp - 0x78]
mov rcx, qword [rbp - 0x84]
mov r9d, dword [rbp - 0x7c]
call sub.ADVAPI32.dll_ReportEventW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.1400d2a20
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rdi, qword [rdx]
test rdi, rdi
je 0x140064710
mov dword [rdi + 0x90], esi
test ebx, ebx
setne al
movzx eax, al
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x14005e84c]
call rax
mov rdi, rax
jmp 0x1400646ee
Function at 0x140064724
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc8
lea rbp, [rsp + 0x100]
xor eax, eax
mov qword [rbp - 0x78], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x70], xmm4
movaps xmmword [rbp - 0x60], xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov edi, edx
mov rbx, r8
mov rsi, r9
mov r14, qword [rbp + 0x30]
mov r15, qword [rbp + 0x38]
mov r13, qword [rbp + 0x40]
mov r12, qword [rbp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140058880
nop
lea rcx, [r12 + 0x10]
xor edx, edx
test r12, r12
cmove rcx, rdx
mov qword [rbp - 0x50], rcx
lea rdx, [r13 + 0x10]
xor r8d, r8d
test r13, r13
cmove rdx, r8
mov qword [rbp - 0x58], rdx
lea r8, [r15 + 0x10]
xor r9d, r9d
test r15, r15
cmove r8, r9
mov qword [rbp - 0x60], r8
lea r9, [r14 + 0x10]
xor eax, eax
test r14, r14
cmove r9, rax
mov qword [rbp - 0x68], r9
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x78], rbx
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
mov rcx, qword [rax + 8]
mov qword [rbp - 0xac], rcx
mov edx, edi
mov dword [rbp - 0xa4], edx
mov r8, rbx
mov qword [rbp - 0xb4], r8
mov r9, rsi
mov qword [rbp - 0xbc], r9
lea rcx, [rbp - 0xa0]
call fcn.1400d29d0
mov rcx, qword [rbp - 0xac]
mov edx, dword [rbp - 0xa4]
mov r8, qword [rbp - 0xb4]
mov r9, qword [rbp - 0xbc]
call sub.ADVAPI32.dll_RegEnumKeyExW
mov ebx, eax
lea rcx, [rbp - 0xa0]
call fcn.1400d2a20
nop
xor ecx, ecx
mov qword [rbp - 0x78], rcx
xor ecx, ecx
mov qword [rbp - 0x70], rcx
xor ecx, ecx
mov qword [rbp - 0x68], rcx
xor ecx, ecx
mov qword [rbp - 0x60], rcx
xor ecx, ecx
mov qword [rbp - 0x58], rcx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x140064887
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1400588c0
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140066aa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rcx, rdx
mov rbx, qword [rcx]
test rbx, rbx
je 0x1400669f4
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
jne 0x1400669e8
call fcn.140066944
mov rcx, rax
cmp dword [rcx], ecx
add rsp, 0x20
pop rbx
jmp 0x140066aa0
lea rax, [0x14005e84c]
call rax
mov rbx, rax
jmp 0x1400669d4
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
mov r8, qword [rcx + 0x18]
mov r10, qword [rcx + 0x20]
mov r9, rdx
shl r9, 0x11
xor r8, rax
xor r10, rdx
lea r11, [rdx + rdx*4]
rol r11, 7
lea r11, [r11 + r11*8]
xor rdx, r8
xor rax, r10
xor r8, r9
rol r10, 0x2d
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x20], r10
mov rax, r11
shr rax, 0x21
cmp rax, 0x7fffffff
je 0x140066aa0
ret
Function at 0x1400820d0
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
cmp edx, 0xffffffff
jne 0x1400820e4
mov esi, 0xd5313557
jmp 0x14008210b
mov ecx, edx
call fcn.140082000
mov rdx, rax
lea rcx, [0x140129560]
lea r8, [0x14012bb48]
call fcn.140016618
mov rcx, rax
call fcn.140081f80
mov esi, eax
mov eax, esi
rol eax, 0xd
add eax, esi
mov esi, eax
xor esi, ebx
mov eax, esi
rol eax, 0xf
add eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x1400849c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov qword [rsp + 0x20], rax
mov rbx, rcx
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov rcx, rbx
xor r8d, r8d
call fcn.1400c894c
mov eax, dword [rbx + 8]
test eax, eax
jle 0x140084a09
mov rax, qword [rbx]
neg dword [rax]
mov eax, dword [rbx + 8]
test eax, eax
je 0x140084a59
mov rcx, qword [rbx]
add rcx, 4
dec eax
mov qword [rbx], rcx
mov dword [rbx + 8], eax
mov eax, dword [rbx + 8]
test eax, eax
jne 0x140084a16
add rsp, 0x30
pop rbx
ret
xor ecx, ecx
mov rdx, qword [rbx]
cmp eax, 4
jl 0x140084a50
movsxd rax, ecx
movups xmm0, xmmword [rdx + rax*4]
pcmpeqd xmm1, xmm1
pxor xmm0, xmm1
movups xmmword [rdx + rax*4], xmm0
add ecx, 4
mov eax, dword [rbx + 8]
sub eax, ecx
cmp eax, 4
jge 0x140084a20
jmp 0x140084a50
cmp ecx, eax
jae 0x140084a5f
mov rax, qword [rbx]
mov edx, ecx
not dword [rax + rdx*4]
inc ecx
mov eax, dword [rbx + 8]
cmp ecx, eax
jl 0x140084a42
jmp 0x140084a10
call fcn.14002773c
int3
call fcn.140027714
int3

Function at 0x140099a4c
Capabilities:
Check for debugger via api

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov rsi, rcx
mov rbx, rdx
mov qword [rbp + 0x18], rbx
cmp byte [rbx], 0
setne cl
movzx ecx, cl
mov dword [rbp - 0x40], ecx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x78], rdx
mov rcx, rsi
mov qword [rbp - 0x80], rcx
lea rcx, [rbp - 0x68]
call fcn.1400d29d0
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x80]
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
mov ebx, eax
lea rcx, [rbp - 0x68]
call fcn.1400d2a20
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rcx, rdx
mov rsi, qword [rcx]
test rsi, rsi
je 0x140099b19
mov qword [rbp - 0x70], rsi
call sub.KERNEL32.dll_GetLastError
mov rsi, qword [rbp - 0x70]
mov dword [rsi + 0x90], eax
test ebx, ebx
setne dil
movzx edi, dil
movzx eax, byte [rbp - 0x40]
mov rbx, qword [rbp + 0x18]
mov byte [rbx], al
cmp dword [0x1401e9760], 0
jne 0x140099b2b
movzx eax, dil
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rax, [0x14005e84c]
call rax
mov rsi, rax
mov qword [rbp - 0x70], rsi
jmp 0x140099ad8
call fcn.1400d1b20
jmp 0x140099b04
Function at 0x140099fc4
Capabilities:
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x48], rax
mov rbx, rcx
mov esi, r8d
mov edi, r9d
mov rcx, qword [rbp + 0x30]
test rdx, rdx
jne 0x14009a000
xor r14d, r14d
jmp 0x14009a00c
add rdx, 0xc
mov qword [rbp - 0x40], rdx
mov r14, qword [rbp - 0x40]
test rcx, rcx
jne 0x14009a016
xor r15d, r15d
jmp 0x14009a022
add rcx, 0xc
mov qword [rbp - 0x48], rcx
mov r15, qword [rbp - 0x48]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov qword [rsp + 0x20], r15
mov r15d, dword [rbp + 0x38]
mov dword [rsp + 0x28], r15d
mov rcx, rbx
mov qword [rbp - 0x88], rcx
mov rdx, r14
mov qword [rbp - 0x90], rdx
mov r8d, esi
mov dword [rbp - 0x7c], r8d
mov r9d, edi
mov dword [rbp - 0x80], r9d
lea rcx, [rbp - 0x70]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x88]
mov rdx, qword [rbp - 0x90]
mov r8d, dword [rbp - 0x7c]
mov r9d, dword [rbp - 0x80]
call sub.ADVAPI32.dll_RegSetValueExW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.1400d2a20
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rcx, rdx
mov rsi, qword [rcx]
test rsi, rsi
je 0x14009a0dd
mov qword [rbp - 0x78], rsi
call sub.KERNEL32.dll_GetLastError
mov rsi, qword [rbp - 0x78]
mov dword [rsi + 0x90], eax
cmp dword [0x1401e9760], 0
jne 0x14009a0ef
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rax, [0x14005e84c]
call rax
mov rsi, rax
mov qword [rbp - 0x78], rsi
jmp 0x14009a0af
call fcn.1400d1b20
jmp 0x14009a0c7
Function at 0x14009a0f8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xe0]
xor eax, eax
mov qword [rbp - 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov esi, r8d
mov rdi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x38]
test rdx, rdx
jne 0x14009a13c
xor r15d, r15d
jmp 0x14009a148
add rdx, 0xc
mov qword [rbp - 0x40], rdx
mov r15, qword [rbp - 0x40]
mov qword [rbp - 0x48], r9
mov r13, r9
mov rcx, rdi
call fcn.140060730
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14009a20e
mov qword [rbp + 0x30], rdi
mov rcx, rdi
mov rdx, rax
call fcn.140056a30
mov qword [rbp - 0x58], r14
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r14
mov rcx, rbx
mov qword [rbp - 0x94], rcx
mov rdx, r15
mov qword [rbp - 0x9c], rdx
mov r8d, esi
mov dword [rbp - 0x8c], r8d
mov r9, r13
mov qword [rbp - 0xa4], r9
lea rcx, [rbp - 0x80]
call fcn.1400d29d0
mov rcx, qword [rbp - 0x94]
mov rdx, qword [rbp - 0x9c]
mov r8d, dword [rbp - 0x8c]
mov r9, qword [rbp - 0xa4]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x80]
call fcn.1400d2a20
mov rax, qword gs:[0x58]
mov ecx, dword [0x1401efa84]
mov edx, 0x10
add rdx, qword [rax + rcx*8]
mov rcx, rdx
mov rsi, qword [rcx]
test rsi, rsi
jne 0x14009a217
jmp 0x14009a250
mov qword [rbp + 0x30], rdi
jmp 0x14009a173
mov qword [rbp - 0x88], rsi
call sub.KERNEL32.dll_GetLastError
mov rsi, qword [rbp - 0x88]
mov dword [rsi + 0x90], eax
cmp dword [0x1401e9760], 0
jne 0x14009a265
mov rdi, qword [rbp + 0x30]
test rdi, rdi
je 0x14009a26c
mov rcx, rdi
mov rdx, qword [rbp - 0x50]
call fcn.14003edfc
jmp 0x14009a26c
lea rax, [0x14005e84c]
call rax
mov rsi, rax
mov qword [rbp - 0x88], rsi
jmp 0x14009a21e
call fcn.1400d1b20
jmp 0x14009a239
mov rdx, qword [rbp - 0x50]
test rdx, 0xffffffffffff0000
je 0x14009a281
mov rcx, rdx
call fcn.140064ba0
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400b50c0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x28
xor eax, eax
mov r8d, dword [rdx + 8]
test r8d, r8d
jle 0x1400b50fc
lea r10, [rdx + rax*8 + 0x10]
mov r10, qword [r10]
test r10, r10
jne 0x1400b50e1
xor r9d, r9d
jmp 0x1400b50e5
mov r9d, dword [r10 + 0x14]
mov r10d, ecx
rol r10d, 0xd
add r10d, ecx
mov ecx, r10d
xor ecx, r9d
inc eax
cmp r8d, eax
jg 0x1400b50cf
mov eax, ecx
rol eax, 0xf
add eax, ecx
add rsp, 0x28
ret