joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400505e0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
and qword [rsp + 0x50], 0
mov rdi, rdx
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, rax
lea rdx, str._ls__Reinvoke
lea rcx, [rsp + 0x50]
call fcn.1400fb304
mov ebx, eax
test eax, eax
jns 0x140050630
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140050629
call fcn.140030ba0
mov eax, ebx
jmp 0x1400506e0
mov rbx, qword [rsp + 0x50]
mov r8, rdi
mov rcx, rbx
mov edx, esi
call fcn.140050ca4
mov edi, eax
test eax, eax
jns 0x1400506a0
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x14005067d
test byte [rcx + 0x1c], 1
je 0x14005067d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cbf8]
mov edx, 0xc
mov dword [rsp + 0x20], edi
mov r9, rbx
call fcn.140044694
mov r8d, edi
lea rcx, str.ERROR:_RunWithRestrictedPriv__s__Failed__lx_n
mov rdx, rbx
call fcn.1400f5500
test rbx, rbx
je 0x14005069c
mov rcx, rbx
call fcn.140030ba0
mov eax, edi
jmp 0x1400506e0
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400506d1
test byte [rcx + 0x1c], 4
je 0x1400506d1
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cbf8]
mov edx, 0xd
mov r9, rbx
call fcn.140044638
test rbx, rbx
je 0x1400506de
mov rcx, rbx
call fcn.140030ba0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14005085c
Capabilities:
Get session user name

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor ebx, ebx
mov dword [rsp + 0x38], 0x104
and qword [rsp + 0x30], rbx
mov r15, r8
and qword [rsp + 0x40], rbx
mov r14d, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
lea edx, [rbx + 0xf]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r13, [0x14016d280]
test eax, eax
jne 0x140050905
call fcn.1400fb4fc
mov ebx, eax
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x1400508f7
test byte [rcx + 0x1c], 1
je 0x1400508f7
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cbf8]
mov edx, 0x12
mov r9d, eax
call fcn.140044380
mov edx, ebx
lea rcx, str.ERROR:_OpenProcessToken___Failed__lx_n
call fcn.1400f5500
mov rcx, qword [rsp + 0x30]
test ebx, ebx
jns 0x140050920
test rcx, rcx
je 0x140050919
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140050a8b
lea rdx, [rsp + 0x40]
call fcn.1400506f0
mov edi, eax
test eax, eax
jns 0x140050981
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x14005095a
test byte [rcx + 0x1c], 1
je 0x14005095a
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cbf8]
mov edx, 0x13
mov r9d, eax
call fcn.140044380
mov edx, edi
lea rcx, str.ERROR:_RestrictTokenPrivileges___Failed__lx_n
call fcn.1400f5500
mov rbx, qword [rsp + 0x40]
xor edi, edi
test rbx, rbx
je 0x140050986
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x140050986
mov rbx, qword [rsp + 0x40]
lea r8, [rsp + 0x38]
mov ecx, 0x10002
lea rdx, [rsp + 0x50]
call qword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x1400509de
call fcn.1400fb4fc
mov edi, eax
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x1400509d0
test byte [rcx + 0x1c], 1
je 0x1400509d0
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cbf8]
mov edx, 0x14
mov r9d, eax
call fcn.140044380
mov edx, edi
lea rcx, str.ERROR:_GetUserNameW___Failed__lx_n
call fcn.1400f5500
test edi, edi
jns 0x140050a07
test rbx, rbx
je 0x1400509f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140050a00
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x140050a8b
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x50]
test rbx, rbx
mov qword [rsp + 0x20], r15
mov r9d, r14d
mov rdx, rsi
cmovne rcx, rbx
call fcn.1400502d8
mov edi, eax
test eax, eax
jns 0x140050a6b
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x140050a58
test byte [rcx + 0x1c], 1
je 0x140050a58
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cbf8]
mov edx, 0x15
mov r9d, eax
call fcn.140044380
mov edx, edi
lea rcx, str.ERROR:_CreateProcessFromToken___Failed__lx_n
call fcn.1400f5500
jmp 0x1400509e2
test rbx, rbx
je 0x140050a79
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140050a89
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140030b80
add rsp, 0x270
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400529fc
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rdi, rcx
cmp rbx, rdi
je 0x140052a6b
mov rsi, qword [rbx + 0x10]
test rsi, rsi
je 0x140052a66
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140052a5d
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x140052a5d
test byte [rcx + 0x1c], 1
je 0x140052a5d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cc20]
mov edx, 0xa
mov r9, rsi
call fcn.140044638
mov rcx, rsi
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rbx, qword [rbx]
jmp 0x140052a11
mov rbx, qword [rdi]
mov esi, 0x18
cmp rbx, rdi
je 0x140052a9a
mov rdx, qword [rbx]
mov rcx, rbx
mov rbx, rdx
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, rsi
call fcn.140030ba0
dec qword [rdi + 0x10]
jmp 0x140052a73
cmp qword [rdi + 0x10], 0
je 0x140052acb
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140052acb
mov rdx, qword [rbx]
mov rcx, rbx
mov rbx, rdx
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, rsi
call fcn.140030ba0
dec qword [rdi + 0x10]
jmp 0x140052aa4
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14005570c
Capabilities:
Copy file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push r13
push r14
push r15
sub rsp, 0x30
and qword [rax - 0x28], 0
mov rbp, r9
and qword [rax - 0x20], 0
mov r15, r8
mov r14, rdx
mov rbx, rcx
mov rcx, qword [0x14016d280]
lea r13, [0x14016d280]
cmp rcx, r13
je 0x14005576c
test byte [rcx + 0x1c], 4
je 0x14005576c
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cc20]
mov edx, 0x99
mov r9, r14
call fcn.140044638
mov r9, r14
lea rdx, [0x14012d070]
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.1400fb304
mov esi, eax
test eax, eax
jns 0x1400557cb
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x1400557b3
test byte [rcx + 0x1c], 1
je 0x1400557b3
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cc20]
mov edx, 0x9a
mov r9d, eax
call fcn.140044380
mov edx, esi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.1400f5500
mov rbx, qword [rsp + 0x20]
jmp 0x14005590b
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov rdx, rbx
call fcn.1400fa5dc
mov esi, eax
test eax, eax
jns 0x140055820
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x14005580d
test byte [rcx + 0x1c], 1
je 0x14005580d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cc20]
mov edx, 0x9b
mov r9d, eax
call fcn.140044380
lea rcx, str.ERROR:_UtilExpandEnvironmentStrings___failed___lx__n
mov edx, esi
call fcn.1400f5500
jmp 0x1400558f9
test rbp, rbp
cmove rbp, r14
test rbx, rbx
je 0x14005583a
mov rcx, rbx
call fcn.140030ba0
and qword [rsp + 0x20], 0
mov r9, rbp
lea rdx, [0x14012d070]
mov r8, r15
lea rcx, [rsp + 0x20]
call fcn.1400fb304
mov esi, eax
test eax, eax
jns 0x140055896
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x140055881
test byte [rcx + 0x1c], 1
je 0x140055881
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cc20]
mov edx, 0x9c
mov r9d, eax
call fcn.140044380
mov edx, esi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.1400f5500
mov rbx, qword [rsp + 0x20]
jmp 0x1400558f9
mov rbx, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, qword [rsp + 0x28]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400558f7
call fcn.1400fb4fc
mov esi, eax
add eax, 0x7ff8fffe
cmp eax, 1
jbe 0x1400558f7
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x1400558eb
test byte [rcx + 0x1c], 1
je 0x1400558eb
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cc20]
mov edx, 0x9d
mov r9d, esi
call fcn.140044380
lea rcx, str.ERROR:_CopyFileW___failed___lx__n
jmp 0x140055814
xor esi, esi
cmp qword [rsp + 0x28], 0
je 0x14005590b
mov rcx, qword [rsp + 0x28]
call fcn.140030ba0
test rbx, rbx
je 0x140055918
mov rcx, rbx
call fcn.140030ba0
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x1400562b0
Capabilities:
Create directory

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x40
and qword [rcx], 0
lea rbx, [0x14012613c]
and qword [rbp - 0x10], 0
lea rdx, [rbp - 0x10]
and qword [rbp + 0x40], 0
mov rsi, rcx
and qword [rbp + 0x48], 0
mov rcx, rbx
call qword [sym.imp.mpclient.dll_MpConfigOpen]
mov edi, eax
test eax, eax
jns 0x14005633a
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x140056323
test byte [rcx + 0x1c], 1
je 0x140056323
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cc20]
mov edx, 0xb
mov dword [rsp + 0x20], edi
mov r9, rbx
call fcn.140044694
mov r8d, edi
lea rcx, str.ERROR:_MpConfigOpen__ls__failed___lx__n
mov rdx, rbx
call fcn.1400f5500
jmp 0x1400564c0
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x140056349
call qword [sym.imp.mpclient.dll_MpFreeMemory]
and dword [rbp + 0x30], 0
mov dword [rbp + 0x38], 2
and qword [rsp + 0x28], 0
lea rax, [rbp + 0x40]
mov rcx, qword [rbp - 0x10]
lea r15, str.ProductAppDataPath
mov rdx, r15
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x38]
call qword [sym.imp.mpclient.dll_MpConfigGetValueAlloc]
mov edi, eax
test eax, eax
jns 0x1400563d9
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x1400563bf
test byte [rcx + 0x1c], 1
je 0x1400563bf
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cc20]
mov edx, 0xc
mov dword [rsp + 0x28], edi
mov r9, rbx
mov qword [rsp + 0x20], r15
call fcn.140061b5c
mov r9d, edi
lea rcx, str.ERROR:_MpConfigGetValueString__ls_ls__failed___lx__n
mov r8, r15
mov rdx, rbx
call fcn.1400f5500
jmp 0x1400564c0
mov r8, qword [rbp + 0x40]
lea r9, str.Support
lea rdx, str._s_s
lea rcx, [rbp + 0x48]
call fcn.1400fb304
mov edi, eax
test eax, eax
jns 0x14005643f
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x14005642b
test byte [rcx + 0x1c], 1
je 0x14005642b
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cc20]
mov edx, 0xd
mov r9d, edi
call fcn.140044380
mov edx, edi
lea rcx, str.ERROR:_NewSprintfW___failed___lx__n
call fcn.1400f5500
mov rbx, qword [rbp + 0x48]
jmp 0x1400564b3
mov rbx, qword [rbp + 0x48]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400564ab
call fcn.1400fb4fc
mov edi, eax
cmp eax, 0x800700b7
je 0x1400564a9
mov rcx, qword [0x14016d280]
lea rax, [0x14016d280]
cmp rcx, rax
je 0x140056495
test byte [rcx + 0x1c], 1
je 0x140056495
mov rcx, qword [rcx + 0x10]
lea r8, [0x14012cc20]
mov edx, 0xe
mov dword [rsp + 0x20], edi
mov r9, rbx
call fcn.140044694
mov r8d, edi
lea rcx, str.ERROR:_CreateDirectoryW__ls__failed___lx__n
mov rdx, rbx
call fcn.1400f5500
jmp 0x1400564b3
xor edi, edi
mov rax, rbx
xor ebx, ebx
mov qword [rsi], rax
test rbx, rbx
je 0x1400564c0
mov rcx, rbx
call fcn.140030ba0
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x1400564cf
call qword [sym.imp.mpclient.dll_MpFreeMemory]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400564de
call qword [sym.imp.mpclient.dll_MpConfigClose]
mov eax, edi
add rsp, 0x40
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14006ba48
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
and qword [rax + 8], 0
and qword [rax + 0x18], 0
test rcx, rcx
jne 0x14006bb42
xor ebx, ebx
mov qword [rax + 0x20], rbx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [0x14013a4e8]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x140120450]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test eax, eax
js 0x14006bba1
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x40], rdx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rax + 0x18]
call fcn.140107c30
mov esi, eax
test eax, eax
js 0x14006bb5e
mov rax, qword [rsp + 0x70]
and qword [rsp + 0x70], 0
mov qword [r14], rax
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14006bb1d
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call fcn.140107c30
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14006bb34
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call fcn.140107c30
nop
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x14006bb9b
jmp 0x14006ba76
lea rdx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rdx
je 0x14006bb93
test byte [rcx + 0x1c], 1
je 0x14006bb93
mov edx, 0x15
mov dword [rsp + 0x20], esi
mov r9, rdi
lea r8, [0x14013a528]
mov rcx, qword [rcx + 0x10]
call fcn.140044694
mov ecx, esi
call fcn.1400f9fc4
nop
call fcn.14006ba24
nop
lea rdx, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, rdx
je 0x14006bbd2
test byte [rcx + 0x1c], 1
je 0x14006bbd2
mov edx, 0x14
mov r9d, esi
lea r8, [0x14013a528]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
mov ecx, esi
call fcn.1400f9fc4
int3
Function at 0x14006dc50
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
xor eax, eax
and dword [rsp + 0x30], eax
mov rbx, rcx
lea rcx, str._nState_of__s_service:_n
mov dword [rsp + 0x58], eax
movups xmmword [rsp + 0x38], xmm0
mov rdi, rdx
movups xmmword [rsp + 0x48], xmm0
call fcn.1400f55f0
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14006dcb7
call fcn.1400fb4fc
jmp 0x14006dd3e
mov r8d, 4
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14006dcda
call fcn.1400fb4fc
mov ebx, eax
jmp 0x14006dd33
lea rax, [rsp + 0x30]
mov r9d, 0x24
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14006dd10
call fcn.1400fb4fc
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x14006dd33
movups xmm0, xmmword [rsp + 0x38]
mov eax, dword [rsp + 0x58]
mov rcx, rdi
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140030b80
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400875e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea r13, [r8 - 1]
mov r12, r9
mov r14, r13
mov rbp, r8
sar r14, 1
mov rdi, rdx
mov rsi, rcx
mov r15, rdx
mov rbx, rdx
cmp rdx, r14
jge 0x140087660
add rbx, rbx
lea rcx, [rbx + 2]
shl rcx, 5
add rcx, rsi
lea rdx, [rcx - 0x20]
call fcn.14007f744
movzx ecx, al
xor rcx, 1
shl rdi, 5
inc rcx
add rbx, rcx
mov rdx, rbx
shl rdx, 5
lea rcx, [rsi + rdi]
add rdx, rsi
call fcn.140052ef4
mov rdi, rbx
cmp rbx, r14
jl 0x14008761d
cmp rbx, r14
jne 0x140087686
test bpl, 1
jne 0x140087686
shl rdi, 5
lea rdx, [rsi - 0x20]
shl rbp, 5
add rdx, rbp
lea rcx, [rsi + rdi]
call fcn.140052ef4
mov rdi, r13
cmp r15, rdi
jge 0x1400876c3
lea rbx, [rdi - 1]
mov rdx, r12
sar rbx, 1
mov rbp, rbx
shl rbp, 5
add rbp, rsi
mov rcx, rbp
call fcn.14007f744
test al, al
je 0x1400876c3
shl rdi, 5
mov rdx, rbp
lea rcx, [rsi + rdi]
call fcn.140052ef4
mov rdi, rbx
cmp r15, rbx
jl 0x14008768b
shl rdi, 5
mov rdx, r12
lea rcx, [rsi + rdi]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140052ef4

Function at 0x1400876f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rax, [r8 - 1]
mov r13, r9
mov r15, rax
mov qword [rsp + 0x50], rax
sar r15, 1
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov r12, rdx
mov r14, rdx
cmp rdx, r15
jge 0x140087789
lea rbx, [r14 + r14]
lea rcx, [rbx + 2]
shl rcx, 6
add rcx, rsi
lea rdx, [rcx - 0x40]
call fcn.14007f744
lea r14, [rbx + 1]
movzx ecx, al
xor rcx, 1
shl rdi, 6
add r14, rcx
add rdi, rsi
mov rbx, r14
mov rcx, rdi
shl rbx, 6
add rbx, rsi
mov rdx, rbx
call fcn.140052ef4
lea rdx, [rbx + 0x20]
lea rcx, [rdi + 0x20]
call fcn.140052ef4
mov rdi, r14
cmp r14, r15
jl 0x140087732
cmp r14, r15
jne 0x1400877c1
test bpl, 1
jne 0x1400877c1
shl rbp, 6
shl rdi, 6
add rdi, rsi
mov rcx, rdi
lea rbx, [rsi + rbp]
lea rdx, [rbx - 0x40]
call fcn.140052ef4
lea rdx, [rbx - 0x20]
lea rcx, [rdi + 0x20]
call fcn.140052ef4
mov rdi, qword [rsp + 0x50]
cmp r12, rdi
jge 0x14008780d
lea rbx, [rdi - 1]
mov rdx, r13
sar rbx, 1
mov rbp, rbx
shl rbp, 6
add rbp, rsi
mov rcx, rbp
call fcn.14007f744
test al, al
je 0x14008780d
shl rdi, 6
mov rdx, rbp
add rdi, rsi
mov rcx, rdi
call fcn.140052ef4
lea rdx, [rbp + 0x20]
lea rcx, [rdi + 0x20]
call fcn.140052ef4
mov rdi, rbx
cmp r12, rbx
jl 0x1400877c6
shl rdi, 6
mov rdx, r13
add rdi, rsi
mov rcx, rdi
call fcn.140052ef4
lea rdx, [r13 + 0x20]
lea rcx, [rdi + 0x20]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.140052ef4
Function at 0x1400a6290
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400a62be
xor eax, eax
jmp 0x1400a63a4
cmp qword [rcx + 0x68], 0
je 0x1400a62cf
call fcn.1400a63c0
jmp 0x1400a63a4
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x1400a62e6
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400a62e8
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400a631a
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400333b0
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rbp, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400a639e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400a6351
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400a637a
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14001a060
add r14, rax
sub rbp, rax
cmp rax, rbx
jne 0x1400a639e
cmp rbp, rbx
ja 0x1400a6358
test rbp, rbp
je 0x1400a639e
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.14001a060
sub rbp, rax
sub rdi, rbp
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400aeae8
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rcx + 8], ebx
lea rax, vtable.std::time_get_char__class_std::istreambuf_iterator_char__struct_std::char_traits_char___.0
mov qword [rcx], rax
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
mov qword [r11 + 0x18], rcx
lea rcx, [r11 - 0x48]
call fcn.1400a82a8
movups xmm0, xmmword [rax]
movups xmmword [rdi + 0x2c], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x3c], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rdi + 0x4c], xmm0
mov eax, dword [rax + 0x28]
mov dword [rdi + 0x54], eax
call fcn.14001c370
mov rbp, rax
lea rsi, [r14 + 8]
test rax, rax
je 0x1400aeb74
mov rdx, rax
mov rcx, rsi
call fcn.140090b60
mov rcx, rbp
call fcn.1400060ec
lea rcx, [0x140145600]
cmp qword [rsi], rbx
cmovne rcx, qword [rsi]
call fcn.14005180c
mov qword [rdi + 0x10], rax
call fcn.14001c4bc
mov rbp, rax
lea rsi, [r14 + 0x18]
test rax, rax
je 0x1400aebaf
mov rdx, rax
mov rcx, rsi
call fcn.140090b60
mov rcx, rbp
call fcn.1400060ec
lea rcx, str.:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
cmp qword [rsi], rbx
cmovne rcx, qword [rsi]
call fcn.14005180c
mov qword [rdi + 0x18], rax
lea rcx, [0x1401458c0]
call fcn.14005180c
mov qword [rdi + 0x20], rax
mov dword [rsp + 0x80], ebx
call fcn.14001a6a8
mov esi, 2
mov r9d, esi
lea r8, [rsp + 0x80]
lea edx, [rsi + 0x20]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x80]
sub ecx, 0x30
je 0x1400aec22
sub ecx, 1
je 0x1400aec1b
cmp ecx, 1
jne 0x1400aec24
lea ebx, [rsi + 1]
jmp 0x1400aec24
mov ebx, 1
jmp 0x1400aec24
mov ebx, esi
mov dword [rdi + 0x28], ebx
mov rax, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b5184
Capabilities:
Get geographical location

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], r8
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rcx + 8], ebx
lea rax, vtable.std::time_get_unsigned_short_int__class_std::istreambuf_iterator_unsigned_short_int__struct_std::char_traits_unsigned_short_int___.0
mov qword [rcx], rax
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
mov qword [r11 + 0x18], rcx
lea rcx, [r11 - 0x58]
call fcn.1400a82a8
lea r15, [rdi + 0x2c]
movups xmm0, xmmword [rax]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r15 + 0x10], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [r15 + 0x20], xmm0
mov eax, dword [rax + 0x28]
mov dword [r15 + 0x28], eax
call fcn.14001c370
mov rbp, rax
lea rsi, [r14 + 8]
test rax, rax
je 0x1400b5216
mov rdx, rax
mov rcx, rsi
call fcn.140090b60
mov rcx, rbp
call fcn.1400060ec
lea rcx, [0x140145600]
cmp qword [rsi], rbx
cmovne rcx, qword [rsi]
mov r8, r15
call fcn.140051870
mov qword [rdi + 0x10], rax
call fcn.14001c4bc
mov rbp, rax
lea rsi, [r14 + 0x18]
test rax, rax
je 0x1400b5254
mov rdx, rax
mov rcx, rsi
call fcn.140090b60
mov rcx, rbp
call fcn.1400060ec
lea rcx, str.:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December
cmp qword [rsi], rbx
cmovne rcx, qword [rsi]
mov r8, r15
call fcn.140051870
mov qword [rdi + 0x18], rax
mov r8, r15
lea rcx, [0x1401458c0]
call fcn.140051870
mov qword [rdi + 0x20], rax
mov dword [rsp + 0x90], ebx
call fcn.14001a6a8
mov esi, 2
mov r9d, esi
lea r8, [rsp + 0x90]
lea edx, [rsi + 0x20]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x90]
sub ecx, 0x30
je 0x1400b52cd
sub ecx, 1
je 0x1400b52c6
cmp ecx, 1
jne 0x1400b52cf
lea ebx, [rsi + 1]
jmp 0x1400b52cf
mov ebx, 1
jmp 0x1400b52cf
mov ebx, esi
mov dword [rdi + 0x28], ebx
mov rax, rdi
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret