joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b7d4
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x1e0
mov rbx, qword [rsp + 0x220]
mov ebp, r8d
movzx r14d, dx
mov r15, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x198
mov esi, r9d
and qword [rbx], 0
call fcn.180016890
mov ecx, 0x202
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18000b83b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x18000b8b4
mov edx, 1
lea r12d, [rdx + 1]
mov ecx, r12d
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, r15
mov rdi, rax
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
mov ecx, dword [rdx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
and qword [rsp + 0x38], 0
mov rcx, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
movzx ecx, r14w
mov word [rsp + 0x30], r12w
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_htons]
mov r9d, ebp
mov dword [rsp + 0x20], esi
lea r8d, [r12 + 0xe]
mov word [rsp + 0x32], ax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.18000ba50
test eax, eax
jne 0x18000b8b4
mov qword [rbx], rdi
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18000b8d8
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x118]
sub rsp, 0x1f0
mov r12, qword [rbp + 0x148]
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x198
mov r13d, r9d
mov qword [r12], rbx
call fcn.180016890
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18000b949
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x18000ba27
xorps xmm0, xmm0
lea r9, [rbp + 0x148]
movups xmmword [rsp + 0x20], xmm0
mov r14d, reloc.WS2_32.dll_socket
mov dword [rsp + 0x2c], 6
lea r8, [rsp + 0x20]
mov dword [rsp + 0x24], r14d
mov rdx, rdi
mov rcx, rsi
movups xmmword [rsp + 0x30], xmm0
lea r15d, [r14 - 0x16]
mov dword [rsp + 0x28], r15d
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x18000b93e
lea r8d, [r14 - 0x11]
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_socket]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000b93e
mov r14d, ebx
call fcn.180006584
mov r15d, eax
call fcn.180006584
mov rdi, qword [rbp + 0x148]
jmp 0x18000b9ef
mov rax, qword [rdi + 0x20]
mov ecx, dword [rbp + 0x130]
mov dword [rax + 0x18], ecx
mov rcx, rsi
mov r8d, dword [rdi + 0x10]
mov rdx, qword [rdi + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
mov r14d, eax
cmp eax, 0xffffffff
jne 0x18000ba48
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x18000b9c5
mov ecx, dword [rbp + 0x140]
call fcn.180006528
call fcn.180006584
sub eax, r15d
cmp eax, r13d
jb 0x18000b9b7
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ebx, r14d
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, ebx
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [r12], rsi
jmp 0x18000ba18

Function at 0x18000ba50
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov esi, r9d
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
call fcn.180006584
mov ebp, eax
call fcn.180006584
mov r8d, r14d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18000bab3
mov ecx, dword [rsp + 0x60]
call fcn.180006528
call fcn.180006584
sub eax, ebp
cmp eax, esi
jb 0x18000ba7b
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18000bad0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [rcx + 8]
mov rsi, rcx
mov rcx, qword [rcx + 0x28]
mov edi, edx
mov rbx, qword [rax + 0x60]
call fcn.18000ed64
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
and dword [rsp + 0x250], 0
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], 1
lea rax, [rsp + 0x250]
mov dword [rsp + 0x254], edi
mov ecx, dword [rbx]
inc ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov rcx, qword [rsi + 0x28]
mov ebx, eax
call fcn.18000ed84
lea r11, [rsp + 0x240]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18000cb28
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx + 0x30]
mov r14d, 0xfe
movzx r12d, word [rcx]
sub r14, rax
mov esi, dword [rcx + 4]
xor ebx, ebx
add r14, r14
mov rdi, rcx
cmp word [rcx + 8], 0x30
lea r13, [rcx + rax*2]
mov eax, 0x248
lea r15d, [rax + 2]
cmovne r15d, eax
mov rax, qword [rdi + 0x10]
lea r8, str._d._s._s
mov qword [rsp + 0x28], rax
lea rcx, [r13 + 0x38]
mov rax, qword [rdi + 0x18]
mov rdx, r14
movzx r9d, r12w
mov qword [rsp + 0x20], rax
call fcn.18000d5e0
mov r9, qword [rdi + 0x28]
lea rax, [rdi + 0x20]
movzx edx, word [rdi + 8]
lea rcx, [rdi + 0x38]
mov qword [rsp + 0x28], rbx
mov r8d, r15d
mov qword [rsp + 0x20], rax
call sub.DNSAPI.dll_DnsQuery_W
inc r12w
mov ebp, eax
test eax, eax
je 0x18000cbd6
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, rsi
dec rsi
test rax, rax
je 0x18000cbe5
test ebp, ebp
jne 0x18000cb76
test rsi, rsi
jne 0x18000cbef
lea ebx, [rsi + 2]
jmp 0x18000cbf9
test ebp, ebp
mov eax, 3
cmovne ebx, eax
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18000eae0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
mov eax, 0xd20b8b82
cmp byte [rcx], r9b
je 0x18000eb0a
movzx ecx, word [rcx]
mov edx, eax
ror edx, 8
inc r9d
add edx, ecx
mov ecx, r9d
add rcx, r8
xor eax, edx
cmp byte [rcx], 0
jne 0x18000eaf0
ret
Function at 0x18000eb14
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [0x18003ca80], 0
jne 0x18000ec80
mov rax, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x18000eca2
mov r9d, 0x20202020
mov rdi, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + rdi + 0x88]
test ecx, ecx
je 0x18000eb97
lea rdx, [rdi + rcx]
mov ecx, dword [rdx + 0xc]
mov eax, dword [rcx + rdi]
or eax, r9d
cmp eax, 0x6c64746e
jne 0x18000eb97
mov eax, dword [rcx + rdi + 4]
or eax, r9d
cmp eax, 0x6c642e6c
je 0x18000eba3
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x18000eb63
test rdx, rdx
je 0x18000eca2
mov r15d, dword [rdx + 0x1c]
mov r14d, dword [rdx + 0x20]
add r15, rdi
mov r12d, dword [rdx + 0x24]
add r14, rdi
mov ebp, dword [rdx + 0x18]
add r12, rdi
xor esi, esi
dec ebp
mov eax, 0x775a
mov ecx, dword [r14 + rbp*4]
add rcx, rdi
cmp word [rcx], ax
jne 0x18000ec0a
call fcn.18000eae0
lea rcx, [0x18003ca80]
mov dword [rcx + rsi*8 + 4], eax
lea r13, [0x18003ca80]
movzx eax, word [r12 + rbp*2]
mov eax, dword [r15 + rax*4]
mov dword [r13 + rsi*8 + 8], eax
inc esi
cmp esi, 0x1f4
je 0x18000ec15
jmp 0x18000ec11
lea r13, [0x18003ca80]
test ebp, ebp
jne 0x18000ebc6
xor edx, edx
mov dword [0x18003ca80], esi
lea eax, [rsi - 1]
test eax, eax
je 0x18000ec80
mov eax, esi
xor ecx, ecx
sub eax, edx
cmp eax, 1
je 0x18000ec77
mov r9d, ecx
lea r10d, [rcx + 1]
mov r11d, dword [r13 + r10*8 + 8]
mov ebx, dword [r13 + r9*8 + 8]
cmp ebx, r11d
jbe 0x18000ec69
mov ecx, dword [r13 + r9*8 + 4]
mov eax, dword [r13 + r10*8 + 4]
mov dword [r13 + r9*8 + 4], eax
mov dword [r13 + r10*8 + 4], ecx
mov dword [r13 + r9*8 + 8], r11d
mov dword [r13 + r10*8 + 8], ebx
mov esi, dword [0x18003ca80]
mov eax, esi
mov ecx, r10d
sub eax, edx
dec eax
cmp r10d, eax
jb 0x18000ec2f
inc edx
lea eax, [rsi - 1]
cmp edx, eax
jb 0x18000ec24
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x18000ec85
Function at 0x18000ef8c
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, r9
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x18000efec
mov ecx, 0x38
call fcn.1800178f0
mov rbx, rax
test rax, rax
je 0x18000efec
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x38]
call fcn.180016890
call fcn.18000eda4
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x18000f009
mov rcx, rbx
call fcn.1800178e8
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov qword [rsp + 0x28], rbx
lea r8, [0x18000f174]
mov r9, rbx
mov dword [rsp + 0x20], 4
xor edx, edx
mov qword [rbx + 0x20], r14
xor ecx, ecx
mov qword [rbx + 0x28], rbp
mov qword [rbx + 0x30], rsi
mov qword [rbx + 0x18], rdi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 8], rax
test rax, rax
jne 0x18000f04e
mov rcx, qword [rbx + 0x10]
call fcn.18000ee00
jmp 0x18000efe4
mov rax, rbx
jmp 0x18000efee

Function at 0x18000f094
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x28
test rcx, rcx
jne 0x18000f0a1
xor eax, eax
jmp 0x18000f0b0
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
add rsp, 0x28
ret

Function at 0x18000f0d4
Capabilities:
Terminate thread

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x18000f0f5
mov rcx, qword [rcx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
je 0x18000f0f5
mov eax, 1
jmp 0x18000f0f7
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800102c8
Capabilities:
Compute adler32 checksum

Disassembly:
movzx r9d, cx
mov r10, rdx
shr ecx, 0x10
test rdx, rdx
jne 0x180010401
lea eax, [rdx + 1]
ret
mov edx, 0x15b0
cmp r8d, edx
cmovb edx, r8d
sub r8d, edx
cmp edx, 0x10
jl 0x1800103c5
mov r11d, edx
shr r11, 4
mov eax, r11d
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [r10]
add r9d, eax
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 0xf]
add ecx, r9d
add r10, 0x10
add r9d, eax
add ecx, r9d
sub r11, 1
jne 0x180010308
test edx, edx
je 0x1800103db
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
sub edx, 1
jne 0x1800103c9
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
test r8d, r8d
jne 0x1800102df
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret
Function at 0x180013b44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov esi, dword [rcx + 0x38]
mov rbx, rcx
mov r9d, dword [rcx + 0x94]
mov edi, dword [rbx + 0x50]
mov edx, dword [rbx + 0x8c]
sub edi, edx
sub edi, r9d
jne 0x180013b86
test edx, edx
jne 0x180013b95
test r9d, r9d
jne 0x180013b95
mov edi, esi
jmp 0x180013c1c
cmp edi, 0xffffffff
jne 0x180013b95
mov edi, 0xfffffffe
jmp 0x180013c1c
mov ecx, dword [rbx + 0x38]
add ecx, 0xfffffefa
add ecx, esi
cmp edx, ecx
jb 0x180013c1c
mov rcx, qword [rbx + 0x48]
mov r8, rsi
lea rdx, [rsi + rcx]
call fcn.180015fd0
mov r9d, dword [rbx + 0x6c]
mov rax, qword [rbx + 0x60]
sub dword [rbx + 0x90], esi
sub dword [rbx + 0x8c], esi
sub dword [rbx + 0x7c], esi
lea r8, [rax + r9*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, si
cmp edx, esi
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x180013bcf
mov rax, qword [rbx + 0x58]
mov r9d, esi
lea r8, [rax + rsi*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, si
cmp edx, esi
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x180013bfa
add edi, esi
mov rcx, qword [rbx]
cmp dword [rcx + 8], 0
je 0x180013c93
mov edx, dword [rbx + 0x94]
mov r8d, edi
mov eax, dword [rbx + 0x8c]
add rdx, rax
add rdx, qword [rbx + 0x48]
call fcn.180014754
add dword [rbx + 0x94], eax
mov r9d, dword [rbx + 0x94]
cmp r9d, 3
jb 0x180013c7d
mov eax, dword [rbx + 0x8c]
mov rdx, qword [rbx + 0x48]
mov ecx, dword [rbx + 0x78]
movzx r8d, byte [rax + rdx]
mov dword [rbx + 0x68], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbx + 0x74]
mov dword [rbx + 0x68], r8d
cmp r9d, 0x106
jae 0x180013c93
mov rax, qword [rbx]
cmp dword [rax + 8], 0
jne 0x180013b66
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140003360
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x13f0
call fcn.14000b310
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov r8d, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea eax, [rbx + 1]
nop dword [rax]
mov ecx, r8d
shr ecx, 0x1e
xor ecx, r8d
imul r8d, ecx, 0x6c078965
add r8d, eax
mov dword [rsp + rax*4 + 0x54], r8d
inc rax
cmp rax, 0x270
jb 0x1400033c0
mov dword [rsp + 0x50], 0x270
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov rsi, rbx
mov qword [rsp + 0x40], rbx
mov r14d, 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x30], bx
lea ebp, [r14 + 1]
lea r12, str.0123456789ABCDEF
lea rcx, [rsp + 0x50]
call fcn.140009930
mov eax, eax
shl rax, 4
shr rax, 0x20
cdqe
movzx r9d, word [r12 + rax*2]
cmp rsi, r14
jae 0x14000345a
lea rax, [rsi + 1]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp r14, 7
cmova rax, qword [rsp + 0x30]
mov word [rax + rsi*2], r9w
mov word [rax + rsi*2 + 2], bx
jmp 0x140003464
lea rcx, [rsp + 0x30]
call fcn.140008730
sub rbp, 1
je 0x140003476
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
jmp 0x140003416
mov rdx, rdi
mov rcx, r15
call fcn.140007150
mov r11, qword [rsp + 0x48]
mov r10, qword [rsp + 0x30]
cmp qword [rdi + 0x10], 0
jbe 0x1400034e7
mov rsi, qword [rsp + 0x40]
nop word [rax + rax]
mov r8, rdi
cmp qword [rdi + 0x18], 7
jbe 0x1400034ad
mov r8, qword [rdi]
lea rcx, [rsp + 0x30]
cmp r11, 7
cmova rcx, r10
xor edx, edx
mov rax, rbx
div rsi
movzx r9d, word [r8 + rbx*2]
xor r9w, word [rcx + rdx*2]
mov rax, r15
cmp qword [r15 + 0x18], 7
jbe 0x1400034d9
mov rax, qword [r15]
mov word [rax + rbx*2], r9w
inc rbx
cmp rbx, qword [rdi + 0x10]
jb 0x1400034a0
cmp r11, 7
jbe 0x140003525
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14000351d
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000351d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.14000a4d0
mov rax, r15
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.14000a4b0
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140006e60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x140006e91
xor eax, eax
jmp 0x140006fdb
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140006ece
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x140006ece
lea ecx, [r10 - 1]
movzx eax, di
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x140006fdb
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x140006fd0
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140006f15
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140006f23
movzx ecx, di
jmp 0x140006f77
lea rax, [rsp + 0x40]
mov word [rsp + 0x50], di
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x52]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006f90
sub eax, 1
je 0x140006f90
cmp eax, 2
jne 0x140006fd0
movzx ecx, word [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, si
cmove di, si
movzx eax, di
jmp 0x140006fd3
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x140006fbe
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x140006fd0
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
cmovne si, di
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000a4b0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140007720
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400077f5
cmp byte [rcx + 0x72], 0
je 0x1400077f5
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x1400077f1
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400077b6
sub eax, 1
je 0x1400077ba
cmp eax, 2
jne 0x1400077f1
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000a4b0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400077e8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400077f1
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14000779e
xor al, al
jmp 0x14000779e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000a4b0
add rsp, 0x60
pop rbx
ret
Function at 0x140009930
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140009991
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140009950
mov ecx, dword [r9]
jmp 0x140009a78
cmp ecx, 0x4e0
jb 0x140009a78
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400099b0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140009a00
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140009ad4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140009b0e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140009b13
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140009b5c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14000c680]
cmp byte [rcx + rax], 0
je 0x140009b5c
dec r8
sub rdx, 1
jne 0x140009b42
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14000b05c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000b0a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b0a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b0a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b0a6
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b0a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b0a8
xor al, al
add rsp, 0x28
ret