joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032540
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x140032562
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x1400325f6
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x1400325d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400325d0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003269f
mov rcx, r8
call fcn.140053264
mov al, 1
mov rsi, qword [rsp + 0x78]
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x14003263b
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140032637
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140032632
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003269f
mov rcx, r8
call fcn.140053264
xor al, al
jmp 0x1400325d7
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x2000
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400d90c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140032688
cmp rax, 7
jbe 0x140032637
lea rdx, [rax*2 + 2]
jmp 0x14003260e
cmp rax, 7
jbe 0x1400325d5
lea rdx, [rax*2 + 2]
jmp 0x1400325a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140032e50
Capabilities:
Delete file
Terminate process

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rdx, str.a4bCZhMk.sys
lea rcx, [rsp + 0xb0]
call fcn.14002f630
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400320b0
nop
lea rdx, str.e8w8viNe.exe
lea rcx, [rsp + 0x28]
call fcn.14002f630
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400320b0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xb0]
call fcn.14004e340
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.14004e340
mov rcx, rax
call fcn.140032540
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x28]
call fcn.14004e340
mov rcx, rax
call fcn.1400323d0
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x28]
call fcn.14004e340
mov rbx, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.14004e340
nop
mov rdx, rbx
mov rcx, rax
call fcn.1400322d0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x70]
call fcn.14002f5b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x90]
call fcn.14002f5b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400326b0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140032fa0
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov esi, r8d
mov rcx, qword [0x1400fe430]
mov rdi, rdx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140032fe3
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x1400fe368]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rcx
mov r9d, 0x40
mov qword [rsp + 0x30], rcx
mov edx, 0x6ec314
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov byte [rsp + 0x60], cl
mov rcx, qword [0x1400fe360]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x68], 0x7baee4c
mov qword [rsp + 0x70], 0xa3def6c
mov qword [rsp + 0x78], 0xf5a8672
call qword [0x1400fe758]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140052e50
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400330f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x238
mov ecx, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140033150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14003317a
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x140033172
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140033138
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140052e50
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x14003bde0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1060
call fcn.1400546f0
sub rsp, rax
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov qword [rsp + 0x20], rcx
mov eax, edx
sar eax, 0x10
mov rdi, rcx
mov ebx, edx
xor esi, esi
lea ecx, [rax*8 + 0x10]
mov rax, qword [0x1400fe358]
add rax, 0xa7b6780
add rcx, rax
call fcn.140050430
mov rcx, rax
xor edx, edx
movzx eax, bx
mov r8d, 0x808
lea rbx, [rcx + rax*4]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x808
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140032fa0
lea rcx, [rsp + 0x840]
mov r8d, 0x808
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x1400fe328]
call fcn.140050430
mov qword [rsp + 0x20], rax
movzx r8d, si
movzx eax, word [rsp + 0x34]
shr ax, 1
cmp si, ax
jae 0x14003bed1
movzx ecx, r8w
lea rdx, [rsp + 0x846]
add rdx, rcx
movzx ecx, r8b
and ecx, 3
inc r8w
xor al, byte [rsp + rcx + 0x20]
xor byte [rdx], al
movzx eax, word [rsp + 0x844]
shr ax, 1
cmp r8w, ax
jb 0x14003bea0
xorps xmm0, xmm0
lea rax, [rsp + 0x846]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop
inc r8
cmp byte [rax + r8], sil
jne 0x14003bef0
lea rdx, [rsp + 0x846]
mov rcx, rdi
call fcn.14002fc00
mov rax, rdi
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140052e50
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400478a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
mov rdx, rcx
je 0x1400479e5
movdqa xmm3, xmmword [0x1400ccc50]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x1400cce30]
xor eax, eax
mov r9d, 0x7bce
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0x7bde
jb 0x1400478d0
cmp rax, 0x11
jae 0x1400479e1
mov r8d, 0x7bc7
nop word [rax + rax]
lea ecx, [r8 + rax]
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x11
jb 0x1400479d0
mov byte [rdx + 0x24], 0
mov rax, rdx
ret
Function at 0x14004d380
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x14004d3b1
xor eax, eax
jmp 0x14004d4fb
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14004d3ee
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14004d3ee
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x14004d4fb
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14004d4f0
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14004d435
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004d443
movzx ecx, di
jmp 0x14004d497
lea rax, [rsp + 0x48]
mov word [rsp + 0x40], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x42]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004d4b0
sub eax, 1
je 0x14004d4b0
cmp eax, 2
jne 0x14004d4f0
movzx ecx, word [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x14004d4f3
mov rbp, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14004d4de
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x14004d4f0
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x50], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140052e50
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004e9b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004ea85
cmp byte [rcx + 0x72], 0
je 0x14004ea85
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14004ea81
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004ea46
sub eax, 1
je 0x14004ea4a
cmp eax, 2
jne 0x14004ea81
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140052e50
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004ea78
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004ea81
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14004ea2e
xor al, al
jmp 0x14004ea2e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140052e50
add rsp, 0x60
pop rbx
ret

Function at 0x140050340
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov dword [rsp + 0x40], 0
mov rcx, qword [0x1400fe430]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140050383
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], ecx
mov r9d, 0x40
mov qword [rsp + 0x20], rcx
mov edx, 0x6ec314
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x71], ecx
mov word [rsp + 0x75], cx
mov byte [rsp + 0x77], cl
mov qword [rsp + 0x60], rax
mov eax, dword [0x1400fe368]
mov byte [rsp + 0x70], cl
mov rcx, qword [0x1400fe360]
mov qword [rsp + 0x68], 4
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x78], 0x7baee4c
mov qword [rsp + 0x80], 0xa3def6c
mov qword [rsp + 0x88], 0xf5a8672
call qword [0x1400fe758]
movss xmm0, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140052e50
add rsp, 0xa0
pop rbx
ret
Function at 0x140050430
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400fe430]
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140050476
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400fe360]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov r9d, 0x40
mov eax, dword [0x1400fe368]
mov edx, 0x6ec314
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x71], edi
mov word [rsp + 0x75], di
mov byte [rsp + 0x77], dil
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], 8
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x78], 0x7baee4c
mov qword [rsp + 0x80], 0xa3def6c
mov qword [rsp + 0x88], 0xf5a8672
mov qword [rsp + 0x20], rdi
call qword [0x1400fe758]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140052e50
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret

Function at 0x140050530
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xorps xmm0, xmm0
mov rbx, rcx
mov rcx, qword [0x1400fe430]
xorps xmm1, xmm1
movups xmmword [r11 - 0x48], xmm0
mov rdi, rdx
movups xmmword [r11 - 0x38], xmm1
movups xmmword [r11 - 0x28], xmm0
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140050589
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ecx
mov r9d, 0x40
mov qword [rsp + 0x20], rcx
mov edx, 0x6ec314
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov qword [rsp + 0x50], rax
mov eax, dword [0x1400fe368]
mov byte [rsp + 0x60], cl
mov rcx, qword [0x1400fe360]
mov qword [rsp + 0x58], 0x30
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x68], 0x7baee4c
mov qword [rsp + 0x70], 0xa3def6c
mov qword [rsp + 0x78], 0xf5a8672
call qword [0x1400fe758]
movups xmm0, xmmword [rsp + 0x80]
mov rax, rbx
movups xmm1, xmmword [rsp + 0x90]
movups xmmword [rbx], xmm0
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx + 0x20], xmm0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140052e50
mov rbx, qword [rsp + 0xe0]
add rsp, 0xc0
pop rdi
ret
Function at 0x140050660
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov rdi, r8
mov rcx, qword [0x1400fe430]
mov rsi, rdx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400506a3
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x1400fe368]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], rcx
mov r9d, 0x40
mov qword [rsp + 0x30], rcx
mov edx, 0x6ec314
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov rcx, qword [0x1400fe360]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xc
mov dword [rsp + 0x40], eax
mov byte [rsp + 0x60], 1
mov qword [rsp + 0x68], 0x7baee4c
mov qword [rsp + 0x70], 0xa3def6c
mov qword [rsp + 0x78], 0xf5a8672
call qword [0x1400fe758]
movsd xmm0, qword [rdi]
mov rax, rbx
movsd qword [rbx], xmm0
mov ecx, dword [rdi + 8]
mov dword [rbx + 8], ecx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140052e50
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret

Function at 0x140050750
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400fe430]
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140050796
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400fe360]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov r9d, 0x40
mov eax, dword [0x1400fe368]
mov edx, 0x6ec314
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x71], edi
mov word [rsp + 0x75], di
mov byte [rsp + 0x77], dil
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], 8
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x78], 0x7baee4c
mov qword [rsp + 0x80], 0xa3def6c
mov qword [rsp + 0x88], 0xf5a8672
mov qword [rsp + 0x20], rdi
call qword [0x1400fe758]
mov r8, qword [rsp + 0x40]
movabs rax, 0xffffffff00000000
mov rcx, r8
movabs rdx, 0xffffff8000000000
and rcx, rax
movabs r9, 0xffffff7fffffffff
lea rax, [rcx + rdx]
test r9, rax
jne 0x14005086c
add rdx, rcx
mov rcx, r8
and ecx, 0xffffff
add rcx, qword [0x1400fe350]
test r9, rdx
cmove r8, rcx
mov rax, r8
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140052e50
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
Function at 0x140050890
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400fe430]
mov dword [rsp + 0x40], edi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400508d5
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400fe360]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov r9d, 0x40
mov eax, dword [0x1400fe368]
mov edx, 0x6ec314
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x71], edi
mov word [rsp + 0x75], di
mov byte [rsp + 0x77], dil
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], 4
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x78], 0x7baee4c
mov qword [rsp + 0x80], 0xa3def6c
mov qword [rsp + 0x88], 0xf5a8672
mov qword [rsp + 0x20], rdi
call qword [0x1400fe758]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140052e50
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret

Function at 0x140050990
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400d9040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400fe430]
mov dword [rsp + 0x40], edi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400509d5
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400fe360]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov r9d, 0x40
mov eax, dword [0x1400fe368]
mov edx, 0x6ec314
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x71], edi
mov word [rsp + 0x75], di
mov byte [rsp + 0x77], dil
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], 4
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x78], 0x7baee4c
mov qword [rsp + 0x80], 0xa3def6c
mov qword [rsp + 0x88], 0xf5a8672
mov qword [rsp + 0x20], rdi
call qword [0x1400fe758]
movsxd rcx, dword [rsp + 0x40]
movabs rax, 0xffffffff00000000
mov r8, rcx
movabs r9, 0xffffff8000000000
and r8, rax
movabs r10, 0xffffff7fffffffff
mov rdx, rcx
lea rax, [r8 + r9]
test r10, rax
jne 0x140050ab1
mov rax, rdx
lea rcx, [r8 + r9]
and eax, 0xffffff
add rax, qword [0x1400fe350]
test r10, rcx
cmove rdx, rax
mov rcx, rdx
mov eax, ecx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140052e50
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret

Function at 0x140053b6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140053bb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140053bb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140053bb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140053bb6
cmp dword [rcx + 0x84], 0xe
jbe 0x140053bb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140053bb8
xor al, al
add rsp, 0x28
ret
Function at 0x140053e48
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140053e82
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140053e87
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140053ed0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140057c70]
cmp byte [rcx + rax], 0
je 0x140053ed0
dec r8
sub rdx, 1
jne 0x140053eb6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret