joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003df0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140003ec3
cmp byte [rcx + 0x71], 0
je 0x140003ec3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140003ebf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003e84
sub eax, 1
je 0x140003e88
cmp eax, 2
jne 0x140003ebf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140005940
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140003eb6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140003ebf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140003e6c
xor al, al
jmp 0x140003e6c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140005940
add rsp, 0x60
pop rbx
ret

Function at 0x140005384
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400053be
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400053c3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14000540c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140007550]
cmp byte [rcx + rax], 0
je 0x14000540c
dec r8
sub rdx, 1
jne 0x1400053f2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14000633c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006386
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006386
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006386
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006386
cmp dword [rcx + 0x84], 0xe
jbe 0x140006386
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006388
xor al, al
add rsp, 0x28
ret
Function at 0x180006120
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
movups xmm0, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x20]
movups xmm1, xmmword [rdx + 0x10]
mov rdx, r8
movd eax, xmm0
movups xmmword [rbp - 0x30], xmm1
and al, 0xf8
psrldq xmm1, 0xf
movups xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x40], al
movd eax, xmm1
and al, 0x3f
or al, 0x40
mov byte [rbp - 0x21], al
call fcn.180003e90
lea r9, [rsp + 0x20]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xa0]
call fcn.1800050f0
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x50]
call fcn.180005520
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x20]
call fcn.180003240
imul rax, qword [rbp - 0x50], 0x13
mov r9d, 5
add qword [rsp + 0x60], rax
imul rax, qword [rbp - 0x58], 0x13
add qword [rsp + 0x58], rax
imul rax, qword [rbp - 0x60], 0x13
add qword [rsp + 0x50], rax
imul rax, qword [rbp - 0x68], 0x13
add qword [rsp + 0x48], rax
imul rax, qword [rbp - 0x70], 0x13
add qword [rsp + 0x40], rax
imul rax, qword [rbp - 0x78], 0x13
add qword [rsp + 0x38], rax
imul rax, qword [rbp - 0x80], 0x13
add qword [rsp + 0x30], rax
imul rax, qword [rsp + 0x78], 0x13
add qword [rsp + 0x28], rax
imul rax, qword [rsp + 0x70], 0x13
mov qword [rsp + 0x70], 0
add qword [rsp + 0x20], rax
lea rax, [rsp + 0x30]
nop dword [rax + rax]
mov r8, qword [rax - 0x10]
lea rax, [rax + 0x10]
mov rdx, r8
shr rdx, 0x20
sar edx, 0x1f
shr rdx, 6
add rdx, r8
sar rdx, 0x1a
mov rcx, rdx
shl rcx, 0x1a
sub r8, rcx
mov qword [rax - 0x20], r8
mov r8, qword [rax - 0x18]
add r8, rdx
mov rdx, r8
shr rdx, 0x20
sar edx, 0x1f
shr rdx, 7
add rdx, r8
sar rdx, 0x19
add qword [rax - 0x10], rdx
mov rcx, rdx
shl rcx, 0x19
sub r8, rcx
mov qword [rax - 0x18], r8
sub r9, 1
jne 0x180006220
movaps xmm1, xmmword [rsp + 0x30]
imul rdx, qword [rsp + 0x70], 0x13
movaps xmmword [rbp], xmm1
movaps xmm1, xmmword [rsp + 0x50]
movaps xmmword [rbp + 0x20], xmm1
add rdx, qword [rsp + 0x20]
mov rcx, rdx
shr rcx, 0x20
sar ecx, 0x1f
shr rcx, 6
add rcx, rdx
sar rcx, 0x1a
add qword [rsp + 0x28], rcx
mov rax, rcx
shl rax, 0x1a
mov rcx, rbx
sub rdx, rax
mov qword [rsp + 0x20], rdx
lea rdx, [rbp - 0x10]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rbp - 0x10], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [rbp + 0x10], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rbp + 0x30], xmm0
call fcn.180004090
mov rbx, qword [rsp + 0x200]
xor eax, eax
add rsp, 0x1f0
pop rbp
ret
Function at 0x180007420
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0x38
cmp dword [rcx + 0x28], 2
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
je 0x180007448
mov eax, 2
add rsp, 0x38
pop r14
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
lea rdx, [rcx + 0x167]
mov qword [rsp + 0x70], r12
mov rcx, rbp
mov qword [rsp + 0x30], r15
call fcn.180002b90
test eax, eax
jle 0x18000747b
movsxd r15, eax
cmp r15, rdi
jae 0x18000747b
mov byte [rbx + 0x166], 1
jmp 0x180007497
mov r8, rdi
mov byte [rbx + 0x166], 0
mov rdx, rbp
lea rcx, [rbx + 0x167]
mov r15, rdi
call fcn.18000f6e6
xor esi, esi
mov ecx, 0x12345678
mov edx, esi
test rdi, rdi
je 0x1800074cb
nop word [rax + rax]
movzx eax, byte [rdx + rbp]
inc rdx
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor ecx, eax
cmp rdx, rdi
jb 0x1800074b0
lea r9, [rbx + 0x162]
mov qword [rsp + 0x28], rsi
mov dword [r9], ecx
lea rax, [r15 + 5]
lea rdi, [rbx + 0x8c]
mov qword [rsp + 0x20], rax
mov cl, 1
lea r8, [rbx + 0x4c]
mov rdx, rdi
call fcn.180000a80
movzx r9d, r15w
lea r10, [0x180013e9f]
test rdi, rdi
movzx eax, r9b
mov word [rsp + 0x60], r9w
lea r8, [rbx + 0x167]
cmovne r10, rdi
movzx r11d, r9b
cmovne r11d, eax
lea rcx, [rbx + 0x28]
mov rax, rsi
mov rdx, rdi
xor r11b, byte [r10]
test rdi, rdi
mov byte [rsp + 0x60], r11b
setne al
movzx eax, byte [rax + r10]
xor byte [rsp + 0x61], al
mov word [rbx + 0x160], r9w
call fcn.180008450
movzx eax, word [rsp + 0x60]
lea rbp, [r15 + 7]
mov r15, qword [rsp + 0x30]
xor dil, dil
mov r12, qword [rsp + 0x70]
mov word [rbx + 0x160], ax
mov rax, rsi
test dil, dil
je 0x18000758c
test rax, rax
jne 0x18000758f
mov rsi, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x38
pop r14
pop rdi
pop rbp
pop rbx
ret
mov dil, 1
add rsi, rax
cmp rsi, rbp
jae 0x18000757b
mov rax, qword [rbx + 0x18]
lea r8, [rbx + 0x160]
mov rcx, rbp
add r8, rsi
sub rcx, rsi
cmp dword [rbx + 0x14], 1
mov r10, qword [rax + 0x50]
jne 0x180007624
mov eax, dword [rbx + 0x303c4]
lea r9, [rsp + 0x78]
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], eax
call r10
cmp dword [rbx + 0x14], 1
mov ecx, eax
jne 0x180007624
mov eax, dword [rsp + 0x60]
mov dword [rbx + 0x303c4], eax
mov rax, qword [rsp + 0x78]
test ecx, ecx
jne 0x180007629
test rax, rax
je 0x18000760e
test ecx, ecx
je 0x180007571
mov rsi, qword [rsp + 0x68]
mov eax, ecx
add rsp, 0x38
pop r14
pop rdi
pop rbp
pop rbx
ret
mov rsi, qword [rsp + 0x68]
mov ecx, 4
mov eax, ecx
add rsp, 0x38
pop r14
pop rdi
pop rbp
pop rbx
ret
mov ecx, 8
mov rsi, qword [rsp + 0x68]
mov eax, ecx
add rsp, 0x38
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x180007740
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xd0
xor eax, eax
mov dword [rsp + 0x38], 0x67452301
mov rdi, r8
mov dword [rsp + 0x3c], 0xefcdab89
mov rbx, rcx
mov dword [rsp + 0x40], 0x98badcfe
xorps xmm0, xmm0
mov dword [rsp + 0x44], 0x10325476
lea r8d, [rax + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x20], xmm0
call fcn.18000d5f0
mov r8d, 0x20
lea rcx, [rsp + 0x30]
mov rdx, rbx
call fcn.18000d5f0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18000d6d0
mov eax, dword [rsp + 0x20]
mov rbx, qword [rsp + 0xe0]
mov dword [rdi], eax
add rsp, 0xd0
pop rdi
ret
Function at 0x180008450
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rbp, rdx
mov dword [rsp + 0x38], 0x67452301
lea rdx, [rcx + 4]
mov dword [rsp + 0x3c], 0xefcdab89
mov rsi, r8
mov dword [rsp + 0x40], 0x98badcfe
xor eax, eax
mov dword [rsp + 0x44], 0x10325476
mov ebx, 0x20
mov qword [rsp + 0x30], rax
mov r8d, ebx
lea rcx, [rsp + 0x30]
mov rdi, r9
call fcn.18000d5f0
cmp rdi, rbx
lea rcx, [rsp + 0x30]
mov rdx, rsi
cmovb ebx, edi
mov r8d, ebx
call fcn.18000d5f0
mov r8d, 0x10
lea rcx, [rsp + 0x30]
mov rdx, rbp
call fcn.18000d5f0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18000d6d0
movups xmm0, xmmword [rsp + 0x20]
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
movups xmmword [rbp], xmm0
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180008510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
xor edi, edi
lea rsi, [rcx + 0x10250]
mov eax, 7
mov qword [rcx + 0x20368], rsi
xor dl, dl
mov qword [rcx + 0x20370], rax
mov rbx, rcx
mov byte [rbp - 8], dl
mov r9, rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rax
mov r8d, edi
mov qword [rbp - 0x18], rdi
mov ecx, edi
nop
test dl, dl
je 0x180008679
test rcx, rcx
jne 0x18000867d
mov qword [rsp + 0x80], r14
lea rcx, [0x180013e9f]
lea r14, [rbx + 0x74]
mov qword [rbp - 0x18], rdi
test r14, r14
mov r8, rdi
cmovne rcx, r14
movzx eax, byte [rcx]
xor byte [rsi], al
mov rax, rdi
test r14, r14
setne al
movzx eax, byte [rax + rcx]
xor byte [rsi + 1], al
mov rax, qword [rbx + 0x20370]
movzx ecx, word [rsi]
add qword [rbx + 0x20368], rax
mov rax, rdi
mov r9, qword [rbx + 0x20368]
xor dl, dl
mov byte [rbp - 8], dl
mov qword [rbx + 0x20370], rcx
mov qword [rbp - 0x30], r9
mov qword [rbp - 0x28], rcx
test dl, dl
je 0x1800086ce
test rax, rax
jne 0x1800086d2
movups xmm0, xmmword [r14]
mov r9, qword [rbx + 0x20370]
mov rdx, r14
mov r8, qword [rbx + 0x20368]
mov rcx, rbx
movups xmmword [rbp - 0x40], xmm0
call fcn.180008450
mov rax, qword [rbx + 0x20370]
lea r8, [rbx + 0x24]
add rax, 5
mov qword [rsp + 0x28], rdi
lea r9, [rbx + 0x10252]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x40]
xor ecx, ecx
call fcn.180000a80
mov rax, qword [rbx + 0x20368]
mov r10, qword [rbx + 0x20370]
cmp byte [rbx + 0x10256], dil
je 0x180008726
lea rsi, [rbx + 0x20378]
mov r9d, 0xffff
mov rdx, rsi
mov r8d, r10d
mov rcx, rax
call fcn.180002bd0
test eax, eax
jle 0x18000871f
movsxd r10, eax
jmp 0x180008729
mov byte [rbp - 8], 1
add rcx, r8
mov qword [rbp - 0x20], rcx
cmp rcx, rax
jae 0x180008571
lea rdx, [rcx + r9]
sub rax, rcx
mov rcx, qword [rbx + 0x30390]
lea r8, [rbp - 0x10]
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rax
call qword [rbx + 0x30388]
test eax, eax
jne 0x180008784
movzx edx, byte [rbp - 8]
mov rcx, qword [rbp - 0x10]
mov r8, qword [rbp - 0x20]
mov rax, qword [rbp - 0x28]
mov r9, qword [rbp - 0x30]
jmp 0x180008560
mov byte [rbp - 8], 1
add rax, r8
mov qword [rbp - 0x20], rax
cmp rax, rcx
jae 0x1800085e7
sub rcx, rax
lea rdx, [rax + r9]
mov qword [rbp - 0x10], rcx
lea r8, [rbp - 0x10]
mov rcx, qword [rbx + 0x30390]
mov qword [rbp - 0x18], rdx
call qword [rbx + 0x30388]
test eax, eax
jne 0x18000877c
movzx edx, byte [rbp - 8]
mov rax, qword [rbp - 0x10]
mov r8, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
mov r9, qword [rbp - 0x30]
jmp 0x1800085d6
mov edi, 9
jmp 0x18000877a
mov rsi, rax
mov qword [rbx + 0x30378], rsi
mov edx, 0x12345678
mov qword [rbx + 0x30380], r10
mov r8, rdi
test r10, r10
je 0x18000876c
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsi + r8]
inc r8
xor eax, edx
imul edx, eax, 0x5bd1e995
mov ecx, edx
shr ecx, 0xf
xor edx, ecx
cmp r8, r10
jb 0x180008750
cmp edx, dword [rbx + 0x10252]
mov eax, 0x18
cmovne edi, eax
mov eax, edi
mov r14, qword [rsp + 0x80]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18000b8d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
mov ebx, 0x400
mov dword [rsp + 0x28], r8d
cmp rdx, rbx
mov r14, rcx
mov r11d, 0x811c9dc5
cmovb rbx, rdx
mov rsi, rbx
shr rsi, 2
test rsi, rsi
je 0x18000b971
mov qword [rsp + 0x18], rbp
lea rdx, [rcx + 2]
mov qword [rsp + 0x20], rdi
mov rdi, rsi
nop
mov eax, r11d
lea r8, [rsp + 0x28]
nop dword [rax + rax]
movzx ecx, byte [r8]
lea rbp, [rsp + 0x2c]
xor ecx, eax
inc r8
imul eax, ecx, 0x1000193
mov ecx, eax
mov r9d, eax
mov r10d, eax
shr ecx, 0x18
shr r9d, 0x10
shr r10d, 8
cmp r8, rbp
jb 0x18000b920
xor byte [rdx - 2], al
xor byte [rdx - 1], r10b
xor byte [rdx], r9b
xor byte [rdx + 1], cl
add rdx, 4
mov dword [rsp + 0x28], eax
sub rdi, 1
jne 0x18000b910
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
and ebx, 3
je 0x18000b9cb
lea rcx, [rsp + 0x28]
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rcx
xor eax, r11d
imul r11d, eax, 0x1000193
lea rax, [rsp + 0x2c]
cmp rcx, rax
jb 0x18000b980
xor ecx, ecx
mov dword [rsp + 0x28], r11d
test rbx, rbx
je 0x18000b9cb
lea rdx, [r14 + rsi*4]
mov r8, rdx
nop dword [rax]
movzx eax, byte [rsp + rcx + 0x28]
lea rdx, [rdx + 1]
xor al, byte [r8]
lea r8, [r8 + 1]
inc rcx
mov byte [rdx - 1], al
cmp rcx, rbx
jb 0x18000b9b0
mov rbx, qword [rsp + 0x30]
pop r14
pop rsi
ret
Function at 0x18000b9e0
Capabilities:
Enumerate pe sections

Disassembly:
push r14
sub rsp, 0x10
movsxd r8, dword [rcx + 0x3c]
mov r11, rdx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbp
sub r11d, ecx
mov qword [rsp + 0x30], rsi
xor ebp, ebp
movzx eax, word [r8 + rcx + 0x14]
xor esi, esi
movzx ebx, word [r8 + rcx + 6]
xor edx, edx
mov qword [rsp + 8], rdi
mov r14, rcx
lea rdi, [rcx + 0x18]
add rdi, r8
add rdi, rax
test ebx, ebx
je 0x18000ba79
mov qword [rsp], r15
lea r15, [0x180013e98]
nop word [rax + rax]
movsxd r10, edx
xor ecx, ecx
lea rax, [r10 + r10*4]
lea r8, [rdi + rax*8]
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
cmp al, byte [r15 + rcx - 1]
jne 0x18000bae1
cmp rcx, 7
jne 0x18000ba50
lea rax, [r10 + r10*4]
mov esi, dword [rdi + rax*8 + 0xc]
mov ebp, dword [rdi + rax*8 + 8]
mov r15, qword [rsp]
mov rdi, qword [rsp + 8]
movabs rax, 0xaaaaaaaaaaaaaaab
mov rbx, qword [rsp + 0x20]
xor r10d, r10d
mov ecx, ebp
mov rbp, qword [rsp + 0x28]
mul rcx
mov r8d, esi
mov rsi, qword [rsp + 0x30]
add r8, r14
shr rdx, 3
test rdx, rdx
je 0x18000bad7
nop
mov eax, dword [r8]
cmp r11d, eax
jb 0x18000babe
cmp r11d, dword [r8 + 4]
jb 0x18000baed
test eax, eax
jne 0x18000bac8
cmp dword [r8 + 4], r9d
je 0x18000bad7
inc r10d
add r8, 0xc
mov eax, r10d
cmp rax, rdx
jb 0x18000bab0
mov eax, r9d
add rsp, 0x10
pop r14
ret
inc edx
cmp edx, ebx
jl 0x18000ba40
jmp 0x18000ba75
mov eax, dword [r8 + 8]
test eax, eax
je 0x18000bad7
movzx r11d, byte [r14 + rax + 2]
lea r10, [r14 + rax]
xor eax, eax
test r11d, r11d
je 0x18000bada
nop word [rax + rax]
movsxd r8, eax
movzx edx, byte [r10 + r8*2 + 5]
movzx ecx, dl
and cl, 0xf
jne 0x18000bb27
add r9d, 8
jmp 0x18000bb97
cmp cl, 1
jne 0x18000bb51
shr dl, 4
test dl, dl
jne 0x18000bb42
movzx ecx, word [r10 + r8*2 + 6]
add eax, 2
lea r9d, [r9 + rcx*8]
jmp 0x18000bb99
cmp dl, 1
jne 0x18000bb99
add r9d, dword [r10 + r8*2 + 6]
add eax, 3
jmp 0x18000bb99
cmp cl, 2
jne 0x18000bb65
mov ecx, edx
shr ecx, 4
lea r9d, [r9 + rcx*8]
add r9d, 8
jmp 0x18000bb97
cmp cl, 3
je 0x18000bb97
cmp cl, 4
jne 0x18000bb74
add eax, 2
jmp 0x18000bb99
cmp cl, 5
jne 0x18000bb7e
add eax, 3
jmp 0x18000bb99
cmp cl, 8
jne 0x18000bb88
add eax, 2
jmp 0x18000bb99
cmp cl, 9
jne 0x18000bb92
add eax, 3
jmp 0x18000bb99
cmp cl, 0xa
jne 0x18000bbac
inc eax
cmp eax, r11d
jl 0x18000bb10
mov eax, r9d
add rsp, 0x10
pop r14
ret
xor eax, eax
add rsp, 0x10
pop r14
ret
Function at 0x14000b850
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14000b87e
xor eax, eax
jmp 0x14000b964
cmp qword [rcx + 0x68], 0
je 0x14000b88f
call fcn.14000afcc
jmp 0x14000b964
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b8a6
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b8a8
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000b8da
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400279a0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14000b95e
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x14000b911
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x14000b93a
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140013e48
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14000b95e
cmp rsi, rbx
ja 0x14000b918
test rsi, rsi
je 0x14000b95e
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140013e48
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000c688
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c6d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c6d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c6d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c6d2
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c6d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c6d4
xor al, al
add rsp, 0x28
ret

Function at 0x14000ffa0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400100e8
Function at 0x1400100e8
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400100e8
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140010157
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010157
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010157
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010157
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010157
cmp dword [rcx + 0x84], 0xe
jbe 0x140010157
cmp dword [rcx + 0xf8], 0
je 0x140010157
mov ecx, ebx
call fcn.140010020
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001027c
nop
cmp dword [rbp + 0x20], 0
je 0x1400101a5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400100b4
int3

Function at 0x140015060
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140015088
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140015088
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14001e454
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14001880c
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14001e4f5
cmp ebx, dword [rsp + 0x30]
je 0x14001e4ee
test esi, esi
je 0x14001e4ee
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14001e4c9
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14001e4d6
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14001e4b3
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14001e4da
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14001e4f7
mov eax, 1
jmp 0x14001e4f7
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001f46c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140009f40
sub rsp, rax
mov rax, qword [0x14003c240]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14001bab8
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14001f4bb
mov rax, rbp
jmp 0x14001f5c3
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x3e540]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14001f19c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x3e540]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14001f5bf
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001f5bf
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14001f19c
test rax, rax
js 0x14001f5bf
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14001f5bf
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14001f5b1
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14001f5b1
cmp byte [rcx], 0xd
jne 0x14001f597
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14001f5a6
cmp byte [rcx + 1], 0xa
jne 0x14001f5a6
inc rcx
jmp 0x14001f5a6
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x3cd40]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14001f579
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14001f5c3
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000d3a0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret