joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d79c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x238]
sub rsp, 0x320
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rsi, rcx
xor r14d, r14d
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x40], r14d
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x44]
call sub.msvcrt.dll_memset
lea edx, [r14 + 0x40]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x3f
ja 0x1400d7a62
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x20]
call fcn.1400d8f6c
mov ebx, eax
test eax, eax
js 0x1400d7a7f
lea rdx, str._DB
lea rcx, [rsp + 0x20]
call fcn.1400d9104
mov ebx, eax
jmp 0x1400d7a7f
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
test ebx, ebx
jns 0x1400d7ac1
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d7bb3
test byte [rcx + 0x1c], 1
je 0x1400d7bb3
mov edx, 0x45
mov r9d, ebx
lea r8, [0x1401285a0]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
jmp 0x1400d7bb3
lea rdx, str.drivers.mrk
lea rcx, [rsp + 0x20]
call fcn.1400d9104
mov ebx, eax
test eax, eax
jns 0x1400d7b00
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d7bb3
test byte [rcx + 0x1c], 1
je 0x1400d7bb3
mov edx, 0x46
jmp 0x1400d7aa9
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
or rcx, 0xffffffffffffffff
cmp rax, rcx
jne 0x1400d7b26
mov ebx, 0x80070490
jmp 0x1400d7bb3
mov word [rbp + 0x172], r14w
lea rax, [rsp + 0x6c]
inc rcx
cmp word [rax + rcx*2], r14w
jne 0x1400d7b33
sub ecx, 1
movsxd rax, ecx
js 0x1400d7b60
cmp word [rsp + rax*2 + 0x6c], 0x2e
je 0x1400d7b57
dec ecx
sub rax, 1
jns 0x1400d7b45
jmp 0x1400d7b60
movsxd rax, ecx
mov word [rsp + rax*2 + 0x6c], r14w
lea rdx, [rsp + 0x6c]
mov rcx, rsi
call fcn.1400d8f6c
mov ebx, eax
test eax, eax
jns 0x1400d7ba6
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x1400d7ba9
test byte [rcx + 0x1c], 1
je 0x1400d7ba9
mov edx, 0x47
mov r9d, ebx
lea r8, [0x1401285a0]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
jmp 0x1400d7ba9
mov ebx, r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.1400d9748
mov eax, ebx
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140106ed0
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400dc9ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r15d, r15d
lea rax, [rbp - 0x10]
mov r14, rdx
mov qword [rbp - 0x10], r15
lea rdx, str.SOFTWAREMicrosoftTelemetryClientOEMInfo
mov dword [rbp + 0x48], r15d
mov r9d, 0x101
mov dword [rbp + 0x30], r15d
xor r8d, r8d
mov dword [rbp + 0x40], r15d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400dca1a
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400dcb95
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x58], r15
xor r9d, r9d
mov qword [rsp + 0x50], r15
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400dca07
cmp dword [rbp + 0x48], r15d
jne 0x1400dca72
mov ebx, r15d
jmp 0x1400dcb95
mov eax, dword [rbp + 0x30]
inc eax
mov ecx, eax
mov dword [rbp + 0x30], eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14010617c
mov rsi, rax
test rax, rax
jne 0x1400dcaa9
mov ebx, 0x8007000e
jmp 0x1400dcb95
mov ecx, dword [rbp + 0x40]
add ecx, 2
mov eax, ecx
and eax, 1
add ecx, eax
mov dword [rbp + 0x40], ecx
call fcn.14010617c
mov rdi, rax
test rax, rax
jne 0x1400dcad0
mov ebx, 0x8007000e
jmp 0x1400dcb7e
mov ebx, r15d
cmp dword [rbp + 0x48], r15d
jbe 0x1400dcb7b
mov r8d, dword [rbp + 0x30]
xor edx, edx
add r8, r8
mov rcx, rsi
call sub.msvcrt.dll_memset
mov r8d, dword [rbp + 0x40]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
mov eax, dword [rbp + 0x30]
lea r9, [rbp - 0x1c]
mov rcx, qword [rbp - 0x10]
mov r8, rsi
mov dword [rbp - 0x1c], eax
mov edx, ebx
mov eax, dword [rbp + 0x40]
mov dword [rbp - 0x20], eax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_RegEnumValueW]
test eax, eax
jne 0x1400dcb70
cmp dword [rbp - 0x18], 1
jne 0x1400dcb70
lea rdx, str.OEMOptionalInfoId
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1400dcb70
mov eax, dword [rbp - 0x20]
lea rcx, [r14 + 8]
shr rax, 1
mov r8, rdi
mov rdx, rsi
mov word [rdi + rax*2 - 2], r15w
call fcn.1400db078
inc ebx
cmp ebx, dword [rbp + 0x48]
jb 0x1400dcadd
mov ebx, r15d
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
test rdi, rdi
je 0x1400dcb95
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400dcba4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e190c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor ebx, ebx
lea rax, [rcx + 0x48]
mov qword [rax + 0x30], rbx
mov rdi, rcx
mov dword [rax + 0x38], ebx
xor edx, edx
mov qword [rax + 0x28], rax
mov r8d, 0x110
lea rax, [rcx + 0x88]
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
lea rax, [rcx + 0xc8]
mov qword [rax + 0x30], rbx
mov dword [rax + 0x38], ebx
mov qword [rax + 0x28], rax
mov qword [rcx + 0x108], rbx
mov qword [rcx + 0x110], rbx
mov qword [rcx + 0x138], rbx
mov qword [rcx + 0x140], rbx
mov qword [rcx + 0x390], rbx
mov qword [rcx + 0x398], rbx
mov qword [rcx + 0x3a0], rbx
mov qword [rcx + 0x3a8], rbx
or dword [rcx + 0x350], 0xffffffff
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
mov qword [rcx + 0x28], rbx
mov qword [rcx + 0x30], rbx
mov qword [rcx + 0x368], rbx
mov qword [rcx + 0x370], rbx
mov qword [rcx + 0x378], rbx
mov qword [rcx + 0x380], rbx
mov qword [rcx + 0x118], rbx
mov qword [rcx + 0x120], rbx
mov qword [rcx + 0x128], rbx
mov dword [rcx + 0x130], ebx
mov dword [rcx + 0x388], ebx
lea rcx, [rsp + 0x24]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call sub.KERNEL32.dll_GetVersionExW
test eax, eax
jne 0x1400e1a5f
mov rax, qword [0x14014dd40]
lea rcx, [0x14014dd40]
cmp rax, rcx
je 0x1400e1a67
test byte [rax + 0x1c], 1
je 0x1400e1a67
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x14014dd40]
lea edx, [rbx + 0x3e]
mov r9d, eax
lea r8, [0x1401285a0]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
jmp 0x1400e1a67
cmp dword [rsp + 0x24], 6
setae bl
mov dword [rdi + 0x40], ebx
mov rax, rdi
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140106ed0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x1400e35f4
Capabilities:
Receive http response

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x840
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, rcx
mov byte [rsp + 0x30], 0
mov rcx, qword [rcx + 0x368]
mov ebx, edx
test rcx, rcx
je 0x1400e363a
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
and qword [rdi + 0x368], 0
and dword [rdi + 0x374], 0
mov edx, ebx
and dword [rdi + 0x370], 0
mov rcx, rdi
call fcn.1400e3858
mov ebx, eax
test eax, eax
jns 0x1400e3683
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e3829
test byte [rcx + 0x1c], 1
je 0x1400e3829
mov edx, 0x42
jmp 0x1400e3816
mov rcx, rdi
call fcn.1400e1bd4
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8d, 0x800
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov rcx, rdi
mov ebx, eax
call fcn.1400e1c24
test ebx, ebx
je 0x1400e37db
mov rcx, rdi
call fcn.1400e1f40
mov ebx, eax
test eax, eax
js 0x1400e37bb
mov esi, dword [rdi + 0x3b8]
test esi, esi
je 0x1400e37b7
mov r14, qword [rdi + 0x378]
test r14, r14
je 0x1400e3755
mov rax, qword [r14]
mov rbx, qword [rax + 0x20]
mov rcx, rbx
call qword [fcn.140009050]
lea r9, [rsp + 0x20]
mov r8d, esi
lea rdx, [rsp + 0x30]
mov rcx, r14
call rbx
mov ebx, eax
test eax, eax
js 0x1400e3797
mov eax, dword [rdi + 0x3b8]
cmp dword [rsp + 0x20], eax
jae 0x1400e3683
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e374b
test byte [rcx + 0x1c], 1
je 0x1400e374b
mov rcx, qword [rcx + 0x10]
lea r8, [0x140129d70]
mov edx, 0x46
call fcn.140003614
mov ebx, 0x8007001d
jmp 0x1400e3829
mov r8d, esi
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400e43bc
mov ebx, eax
test eax, eax
jns 0x1400e3683
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e3829
test byte [rcx + 0x1c], 1
je 0x1400e3829
mov edx, 0x47
jmp 0x1400e3816
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e3829
test byte [rcx + 0x1c], 1
je 0x1400e3829
mov edx, 0x45
jmp 0x1400e3816
xor ebx, ebx
jmp 0x1400e3829
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e3829
test byte [rcx + 0x1c], 1
je 0x1400e3829
mov edx, 0x44
jmp 0x1400e3816
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x1400e3829
test byte [rcx + 0x1c], 1
je 0x1400e3829
mov edx, 0x43
mov rcx, qword [rcx + 0x10]
lea r8, [0x140129d70]
mov r9d, ebx
call fcn.1400036d4
mov eax, ebx
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140106ed0
mov rbx, qword [rsp + 0x870]
add rsp, 0x840
pop r14
pop rdi
pop rsi
ret
Function at 0x1400e4244
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
call sub.KERNEL32.dll_SetEvent
test eax, eax
jne 0x1400e429b
mov rax, qword [0x14014dd40]
lea rcx, [0x14014dd40]
cmp rax, rcx
je 0x1400e429b
test byte [rax + 0x1c], 1
je 0x1400e429b
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [0x14014dd40]
lea r8, [0x140129d70]
mov r9d, eax
mov edx, 0x75
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
lea rdi, [rbx + 0x88]
mov rcx, rdi
call fcn.1400e75b0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400e42bc
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
and qword [rbx], 0
mov rcx, rdi
call fcn.1400e761c
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400e42dc
Function at 0x1400e6ef0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x30
and qword [rbp + 0x20], 0
or rbx, 0xffffffffffffffff
mov rdi, rcx
cmp rcx, rbx
jne 0x1400e6f13
xor eax, eax
jmp 0x1400e7030
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rbp + 0x28]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400e6f7c
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x1400e6f7c
xor edx, edx
lea r8, [rdi - 1]
mov rax, rbx
div r8
sub rbx, rdx
lea r8, [rbp + 0x20]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
cmp rax, rbx
ja 0x1400e6f4c
xor edx, edx
div rdi
inc rdx
mov qword [rbp + 0x20], rdx
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rax, qword [rbp + 0x20]
test rax, rax
jne 0x1400e7030
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rbp + 0x30]
xor ebx, dword [rbp + 0x34]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, 0xdeadbeef
xor ebx, eax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
xor ebx, eax
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_srand]
call qword [sym.imp.msvcrt.dll_rand]
xorps xmm1, xmm1
movd xmm0, eax
lea rax, [rdi - 1]
cvtdq2pd xmm0, xmm0
cvtsi2sd xmm1, rax
divsd xmm0, qword [0x14012ee48]
test rax, rax
jns 0x1400e6ff5
addsd xmm1, qword [0x14012ee60]
mulsd xmm0, xmm1
xor ecx, ecx
movsd xmm1, qword [0x14012ee58]
addsd xmm0, qword [0x14012ee00]
comisd xmm0, xmm1
jb 0x1400e7028
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x1400e7028
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rax, xmm0
add rax, rcx
add rsp, 0x30
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400e9c04
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov r14, rcx
mov rcx, qword [0x14014dd40]
lea r12, [0x14014dd40]
mov edi, 2
cmp rcx, r12
je 0x1400e9c50
test byte [rcx + 0x1c], dil
je 0x1400e9c50
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 8]
lea r8, [0x14012a0e8]
call fcn.140003614
mov eax, 0x1f40
xor ebx, ebx
mov dword [rsp + 0x58], eax
mov ecx, eax
lea rdx, [0x14011cc4a]
call fcn.1401084ac
mov rsi, rax
test rax, rax
je 0x1400e9d11
xor r8d, r8d
lea rax, [rsp + 0x58]
mov r9, rsi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r8 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov ebp, eax
cmp eax, 0x7a
je 0x1400e9c9d
cmp eax, 0x6f
jne 0x1400e9cb5
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
xor esi, esi
inc ebx
cmp ebx, 3
jae 0x1400e9cc7
mov eax, dword [rsp + 0x58]
jmp 0x1400e9c5b
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400e9d16
movzx ebx, bp
or ebx, 0x80070000
test ebp, ebp
cmovle ebx, ebp
test ebx, ebx
js 0x1400e9d16
mov qword [r14 + 0x10], rsi
xor esi, esi
call fcn.1401083a4
test al, al
je 0x1400e9d16
call qword [sym.imp.ext_ms_win_casting_receiver_l1_1_0.dll_GetXboxWirelessNetworkInterfaceIndex]
test eax, eax
je 0x1400e9d16
mov rcx, qword [r14 + 0x10]
jmp 0x1400e9d01
cmp dword [rcx + 4], eax
je 0x1400e9d08
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x1400e9cf8
jmp 0x1400e9d16
mov dword [rcx + 0x64], 0x47
jmp 0x1400e9d16
mov ebx, 0x8007000e
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [0x14014dd40]
cmp rcx, r12
je 0x1400e9d59
test byte [rcx + 0x1c], dil
je 0x1400e9d59
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, 5
cmovns edi, eax
cmp edx, edi
jl 0x1400e9d59
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 6]
mov r9d, ebx
lea r8, [0x14012a0e8]
call fcn.1400036d4
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x140106c20
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0xb0
xor r15d, r15d
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov r14d, r15d
xor eax, eax
lock cmpxchg qword [0x140151238], rbx
je 0x140106c89
cmp rax, rbx
jne 0x140106c7c
mov edi, 1
mov r14d, edi
jmp 0x140106c8e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140106c60
mov edi, 1
mov eax, dword [0x140151240]
cmp eax, edi
jne 0x140106ca6
mov esi, 0x1f
mov ecx, esi
call sub.msvcrt.dll__amsg_exit
jmp 0x140106d17
mov eax, dword [0x140151240]
test eax, eax
jne 0x140106d0c
mov dword [0x140151240], edi
lea r12, [0x140112fe0]
lea rbx, [0x140112fc8]
mov qword [rsp + 0x30], rbx
mov eax, r15d
mov dword [rsp + 0x24], eax
cmp rbx, r12
jae 0x140106cfe
test eax, eax
jne 0x140106d02
mov rsi, qword [rbx]
test rsi, rsi
je 0x140106cf3
mov rcx, rsi
mov rax, qword [fcn.140009050]
call rax
call rsi
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140106cd0
test eax, eax
je 0x140106d12
mov eax, 0xff
jmp 0x140106e73
mov dword [0x14014eaf0], edi
mov esi, 0x1f
mov eax, dword [0x140151240]
cmp eax, edi
jne 0x140106d3e
lea rdx, [0x140112fc0]
lea rcx, [0x140112e40]
call sub.msvcrt.dll__initterm
mov dword [0x140151240], 2
test r14d, r14d
jne 0x140106d4d
mov rax, r15
xchg qword [0x140151238], rax
cmp qword [0x140151258], r15
je 0x140106d84
lea rcx, [0x140151258]
call fcn.140107740
test eax, eax
je 0x140106d84
mov rbx, qword [0x140151258]
mov rcx, rbx
mov rax, qword [fcn.140009050]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rdx, qword [rax]
test rdx, rdx
jne 0x140106d9d
mov eax, 0xff
jmp 0x140106e73
mov qword [rsp + 0x28], rdx
mov ecx, dword [rsp + 0x20]
cmp word [rdx], 0x20
ja 0x140106e24
cmp word [rdx], r15w
je 0x140106db6
test ecx, ecx
jne 0x140106e24
movzx eax, word [rdx]
sub ax, di
cmp ax, si
ja 0x140106dcc
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140106db6
mov ecx, dword [rsp + 0x7c]
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
and cl, dil
cmovne r9d, eax
mov r8, rdx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003948
mov dword [0x14014eaec], eax
cmp dword [0x14014eb10], r15d
jne 0x140106e0d
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14014eaf0], r15d
jne 0x140106e22
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14014eaec]
jmp 0x140106e73
cmp word [rdx], 0x22
jne 0x140106e38
mov eax, r15d
test ecx, ecx
sete al
mov ecx, eax
mov dword [rsp + 0x20], eax
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140106da6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
sub rsp, 0x28
call fcn.1401fc000
add rsp, 0x28
jmp 0x140106c20
Function at 0x5926a5
Capabilities:
Encode data using xor

Disassembly:
movsxd rcx, ecx
adc edx, edx
dec qword [rsp + rdx*2 - 0x36]
adc r11, rcx
not dx
mov r9w, word [rsi + rdx*2 - 0x1ffc0]
mov qword [rsp + rdx*2 - 0x1ffc0], rdi
xor edi, r10d
sal r10d, 0x6d
lea rsi, [rsi + rdx - 0xffde]
push rdx
lea rdx, [rdi + rax - 0x77f9a7d4]
and edx, 0x68eec05
lea rbx, [rbx + rdx*2 - 0xc800b]
not dword [rsp + rdx - 0x63ff2]
xor di, word [rsp + rdx*8 - 0x320023]
movzx edx, byte [rdx + rbx - 0x64005]
xor r10, r10
call fcn.005b0645
mov edi, 0x23b18993
call fcn.005dc227
mov ebp, 0x2a06baa1
call fcn.005943c9
add byte [rsi + 0x18e41260], cl
mov edx, 0xaae82a06
sbb al, 0
add byte [rax], al
mov fs, word [rax + 0x12]
in al, 0x18
push rax
adc eax, 0x1c01a293
or dh, byte [rcx + rsi]
sbb edi, dword [rbp - 0x69]
movsb byte [rdi], byte [rsi]
jg 0x592717
add dword [rax + rdi*2 + 0x71c5bb94], edx
or eax, 0x7a76f52d
mov esp, 0x2aeac9e8
fmul st(6)
popfq
nop
mov edi, eax
add al, 6
mov ecx, 0x2ca573c0
movsb byte [rdi], byte [rsi]
in eax, dx
xor ebx, dword [rbx + riz*4]
invalid

Function at 0x599813
Capabilities:
Authenticate hmac

Disassembly:
ror ecx, 1
lea r9, [r10*4 - 0x3ec92ace]
mov qword [rsp + rax - 0x5c05cbf8], r9
sal edx, 0xc1
dec ecx
xadd byte [rsp + rdi*2 - 0x43bfb9ef], dil
mov qword [rsp + rdi*2 - 0x43bfb9f4], rdi
not ecx
and rax, 0xffffffffbeb28fb8
bswap rax
shl r9b, 0x84
ror ecx, 1
not byte [rsp + rdi*2 - 0x43bfb9f3]
mov qword [rsp + rdi - 0x21dfdcf6], r8
xor dword [rsp + rdi*2 - 0x43bfb9f4], ecx
ror r9b, 0xa3
not eax
mov r8, qword [rsp + rdi*2 - 0x43bfb9f4]
movsxd rcx, ecx
mov qword [rsp + rdi - 0x21dfdcf6], rdx
xor qword [rsp + rdi*2 - 0x43bfb9f8], r10
adc r11, rcx
jmp 0x5d4b04
movzx r10d, dx
shl ax, 0x81
xor dword [rsp + rax - 0x6fb50000], ebp
shl cl, 0x67
pop r8
call fcn.005a2f9b
lea eax, [rax + rbp*2 - 0x2e9b2a85]
adc dx, cx
sal cx, 0x89
push r8
not bpl
xor dword [rsp + rbp*8 - 0x7f8], eax
xadd r9b, dil
inc r9d
pop r8
sar bpl, 0x24
sal r9, 0x9c
movsxd rax, eax
seta r9b
adc r11, rax
ror edi, 0x89
mov r10, qword [rsi + rbp - 0xff]
movzx eax, di
lea rsi, [rsi + rbp*4 - 0x3f4]
lea rbx, [rbx + rdx - 0xd92e]
sar rbp, 0x74
movzx r9d, word [rbp + rbx]
xor r9w, r8w
jmp fcn.005c8f9d
pop rcx
add qword [rsp + rdi - 0x21dfdcfe], 0x5113699e
pop r9
jg fcn.005b825c
lea rsi, [rsi + rax - 4]
call fcn.005a2f85
rol ebp, 1
xchg word [rsp + r9*2 - 0x9602d8], ax
or word [rsp + rax - 0x6fb50000], 0x4896
and r9b, r9b
inc ebp
movsx edx, ax
not qword [rsp + r9*8 - 0x2580b78]
jmp 0x5d57d6
neg ebp
not ebp
add r9, rax
movzx ecx, dl
mov qword [rsp + rdx*2], r8
jne 0x5ca532
Function at 0x599ed6
Capabilities:
Authenticate hmac

Disassembly:
inc r9d
ror rcx, 0xa6
pop rdx
neg r9d
neg rbp
push r8
adc ecx, eax
call fcn.005a9b97
mov edx, 0x2509bf82
movzx eax, dx
xadd rax, rdx
lea rbx, [rdx + rbx - 0xbf86]
neg rax
jg 0x5adf44
mov ecx, dword [rbx + rdx*4 - 0x2fe08]
xor ecx, r8d
movsx ebp, dl
inc rdx
ror ecx, 1
sal al, 0xe5
ror eax, 0x91
add al, 0x93
bswap ecx
shl rax, 0xb3
xor ecx, 0x4032b326
ror ecx, 2
not ecx
mov r10d, eax
movzx r9d, dl
push r8
shr eax, 0x24
adc r9b, 0x99
adc ebp, eax
xor dword [rsp + rdx*8 - 0x5fc18], ecx
pop r8
dec ax
push r9
movsxd rcx, ecx
shr al, 0xe1
jnp 0x5ac82e
call fcn.005c9ee9
not ebp
not edi
call fcn.005d2d13
add r11, rcx
mov edi, 0xfb05d733
shr dword [rsp + rdx*2 - 0x17f03], 0x3e
setbe r9b
xor r10, qword [rsi + rdx*2 - 0x17f06]
movzx bp, byte ss:[r10 + rdx - 0xbf83]
add byte [rsp + rdx - 0xbf83], 0xa7
and rdx, 0x6795001b
call fcn.005afadd
mov qword [rsp], r8
bswap r9
xor dword [rsp], ebp
neg cx
movzx edx, dil
setnp cl
pop r8
inc r10w
movsxd rbp, ebp
or eax, 0x71a3452a
adc r11, rbp
jmp r11
push rax
call fcn.005a6997
adc r11, rdx
not r9d
sal r9d, cl
xor word [rsp + rdi*2 - 0x1d3], bp
mov ebp, dword [rdi + rsi - 0xf5]
mov qword [rsp + rdi*4 - 0x3b4], 0xffffffff9aaae090
mov edi, dword [rsi + rdi*4 - 0x3d0]
js 0x5c85ad
mov rdx, r9
push rax
movzx r9d, byte [rax + rbx - 0x85e6]
call fcn.005b5703
lea rsi, [rsi + rbp*2 - 0x55304c0e]
call fcn.005a4f67
inc bpl
push r10
lea edi, [rbp + rdi - 0x774b944f]
ror word [rsp + rbp - 0x623c752f], 0x67
rol edi, 1
sar qword [rsp + r10*2 - 0xea60], 0xfa
call fcn.005cedfc
ja 0x59e6c5
mov ebp, 0x623c7530
movsx r10d, bp
lea rbx, [rbp + rbx - 0x623c7534]
mov edi, dword [rbx + r10*2 - 0xea60]
movzx edx, bp
xor edi, r8d
neg edi
jmp 0x5b51e1

Function at 0x59bf43
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
not r9d
and r10b, 0xac
ror rbp, cl
movsx edi, word [rsp + 4]
bswap r9d
mov qword [rsp + rdi*2], r8
sar cl, 0xe7
xor dword [rsp + rdi*4], r9d
mov r8d, 0x931a47ae
ror ecx, 0xc3
pop r8
movzx edx, dil
setb dl
bswap r9d
mov qword [rsp], r10
inc r9d
xchg r10b, bpl
movsx ecx, r10w
jmp 0x59561c