joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017210
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
lea rdx, [0x1800561e4]
lea rcx, [rsp + 0xa0]
call fcn.180015ea0
mov rbx, rax
lea rcx, [rsp + 0x80]
call fcn.180005fb0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180014d10
nop
lea r8, [0x1800971b8]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180014d40
nop
lea rcx, [rsp + 0x60]
call fcn.180005410
nop
lea rcx, [rsp + 0x80]
call fcn.180005410
nop
lea rcx, [rsp + 0xa0]
call fcn.180005410
lea rcx, [rsp + 0x40]
call fcn.180019f10
mov qword [rsp + 0xd0], rax
xor r8d, r8d
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.180014cb0
nop
lea rcx, [rsp + 0x20]
call fcn.18001a160
movzx ebx, al
lea rcx, [rsp + 0x20]
call fcn.180016fd0
test bl, bl
je 0x1800172e9
lea rcx, [rsp + 0x40]
call fcn.180019f10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [0x1800a7a70]
call fcn.18001ab80
lea rcx, str.Cleaning_up_hooks
call fcn.18001d6f0
lea rcx, [0x1800a7960]
call fcn.180019e70
mov rsi, rax
lea rcx, [0x1800a7960]
call fcn.180019e60
mov rbx, rax
cmp rax, rsi
je 0x180017363
mov rdi, qword [rbx]
mov rcx, rdi
call fcn.180002138
test eax, eax
jne 0x180017341
lea rcx, str.Successfully_disabled_hooks
call fcn.18001d6f0
jmp 0x18001735a
mov ecx, eax
call fcn.180002140
mov r8, rax
mov rdx, rdi
lea rcx, str.Failed_to_disable_hookS__p___s_
call fcn.18001d6f0
add rbx, 8
cmp rbx, rsi
jne 0x180017324
mov dword [rsp + 0xd0], 0x32
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xd8]
call fcn.180004300
mov rcx, rax
call fcn.180004310
lea rcx, [0x1800a7960]
call fcn.180019e70
mov rsi, rax
lea rcx, [0x1800a7960]
call fcn.180019e60
mov rbx, rax
cmp rax, rsi
je 0x1800173fb
nop
mov rdi, qword [rbx]
mov rcx, rdi
call fcn.180001f84
test eax, eax
jne 0x1800173d9
lea rcx, str.Successfully_Cleaning_up_hooks
call fcn.18001d6f0
lea rcx, str.WOLF_Successfully_____unloaded.
call fcn.18001d6f0
jmp 0x1800173f2
mov ecx, eax
call fcn.180002140
mov r8, rax
mov rdx, rdi
lea rcx, str.Failed_to_unhook__p___s_
call fcn.18001d6f0
add rbx, 8
cmp rbx, rsi
jne 0x1800173b0
mov dword [rsp + 0xd0], 0x190
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0xd8]
call fcn.180004300
mov rcx, rax
call fcn.180004310
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor edx, edx
mov rcx, qword [0x1800a7918]
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
Function at 0x18001b120
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1800972c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x18001b14d
xor eax, eax
jmp 0x18001b2b6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x18001b18d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x18001b18d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x18001b2ae
cmp qword [rdi + 0x80], 0
je 0x18001b2a9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x18001b1c7
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x18001b1f2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x18001b2ae
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18001b261
sub eax, 1
je 0x18001b261
cmp eax, 2
jne 0x18001b2a9
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x18001b2ae
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x18001b28f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x18001b2a9
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x18001b2ae
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18004dca0
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18001b770
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x18001b7a1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x18001b7bf
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x18001b809
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x18001b881
mov rcx, rbp
call fcn.18001d920
cmp rbx, 0xfff
jbe 0x18001b861
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x18001b8a2
cmp rbx, rax
ja 0x18001b830
test rdi, rdi
je 0x18001b881
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x18001b884
Function at 0x18001b8b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x18001b8d8
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x18001b94c
test rax, rax
jle 0x18001b92c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x18001b94c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18001b94c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x18001d730
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800972c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18001d803
cmp byte [rcx + 0x71], 0
je 0x18001d803
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18001d7ff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18001d7c4
sub eax, 1
je 0x18001d7c8
cmp eax, 2
jne 0x18001d7ff
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004dca0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18001d7f6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18001d7ff
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18001d7ac
xor al, al
jmp 0x18001d7ac
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18004dca0
add rsp, 0x60
pop rbx
ret
Function at 0x18001e150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1800972c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rcx, [rsp + 0x20]
call fcn.180004eb0
nop
movabs r9, 0xcbf29ce484222325
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rax, qword [rsp + 0x20]
lea rdx, [rsp + 0x20]
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
add r8, rdx
cmp rax, r8
je 0x18001e1e3
movabs rdx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
imul r9, rdx
movsx rcx, byte [rax]
xor r9, rcx
inc rax
cmp rax, r8
jne 0x18001e1d0
mov qword [rsi + 0x40], r9
mov byte [rsi + 0x68], 0
lea r8, [rsi + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.18001e350
mov rax, qword [rsi + 0x30]
mov qword [rsi + 0x48], rax
mov rbx, qword [0x1800a8d28]
mov rax, qword [rbx + 8]
mov rcx, rax
mov rdi, rbx
cmp byte [rax + 0x19], 0
jne 0x18001e248
mov r8, qword [rsi + 0x40]
nop
mov rdx, qword [rcx + 0x20]
cmp rdx, r8
jae 0x18001e22f
mov rcx, qword [rcx + 0x10]
jmp 0x18001e242
cmp byte [rdi + 0x19], 0
je 0x18001e23c
cmp r8, rdx
cmovb rdi, rcx
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x18001e220
cmp byte [rdi + 0x19], 0
jne 0x18001e251
mov rax, qword [rdi]
cmp byte [rax + 0x19], 0
jne 0x18001e278
mov rcx, qword [rsi + 0x40]
nop dword [rax + rax]
cmp rcx, qword [rax + 0x20]
jae 0x18001e26e
mov rdi, rax
mov rax, qword [rax]
jmp 0x18001e272
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x18001e260
cmp rbx, rdi
je 0x18001e2f9
nop dword [rax]
mov rdx, qword [rbx + 0x28]
mov rcx, rsi
call fcn.18001dfa0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18001e2b8
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18001e2b3
cmp rbx, qword [rax + 0x10]
jne 0x18001e2b3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18001e2a0
mov rbx, rax
jmp 0x18001e2df
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x18001e2df
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x18001e2d0
cmp rbx, rdi
jne 0x18001e280
mov rax, qword [rsi + 0x58]
sub rax, qword [rsi + 0x50]
sar rax, 3
test rax, rax
je 0x18001e2f9
mov byte [rsi + 0x68], 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x18001e339
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e334
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001e334
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004d868
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18004dca0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004cc90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rsi, rdx
mov r15, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
movsxd r8, dword [rax + 0x3c]
mov r14d, dword [r8 + rax + 0x50]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor ebp, ebp
mov r11d, ebp
mov qword [rsp + 0x40], rbp
lea r12, [0x18005ff00]
mov r9, qword [rsp + 0x38]
nop word [rax + rax]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rbp
mov rdi, rbp
movzx edx, byte [rsi]
inc rsi
test dl, dl
je 0x18004cda7
nop dword [rax + rax]
movzx eax, dil
shl al, 2
not al
and al, 4
movzx ecx, dl
movzx r8d, byte [rcx + r12]
cmp r8b, 0xff
je 0x18004cd47
mov rdx, rdi
shr rdx, 1
movzx ecx, al
mov eax, 0xf
shl al, cl
or byte [rsp + rdx + 0x28], al
shl r8b, cl
or byte [rsp + rdx + 0x20], r8b
jmp 0x18004cd50
cmp dl, 0x3f
je 0x18004cd50
test al, al
jne 0x18004cd59
inc rdi
cmp rdi, 0x10
je 0x18004cd63
movzx edx, byte [rsi]
inc rsi
test dl, dl
jne 0x18004cd10
test rdi, rdi
je 0x18004cd9d
cmp r9, r11
je 0x18004cd81
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [r9], xmm0
add r9, 0x10
mov qword [rsp + 0x38], r9
jmp 0x18004cd9d
lea r8, [rsp + 0x20]
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.18004c860
mov r11, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
cmp rdi, 0x10
jae 0x18004ccf0
lea rax, [r14 + rbx]
mov r10, qword [rsp + 0x30]
cmp rbx, rax
jae 0x18004cdf8
sub r9, r10
sar r9, 4
mov rdx, rbp
test r9, r9
je 0x18004cdfb
mov r8, r10
nop word [rax + rax]
mov rcx, qword [rbx + rdx*8]
xor rcx, qword [r8]
test qword [r8 + 8], rcx
jne 0x18004cdeb
inc rdx
add r8, 0x10
cmp rdx, r9
jb 0x18004cdd0
jmp 0x18004cdfb
inc rbx
cmp rbx, rax
jae 0x18004cdf8
mov rdx, rbp
jmp 0x18004cdc4
mov rbx, rbp
test r10, r10
je 0x18004ce3a
sub r11, r10
and r11, 0xfffffffffffffff0
mov rax, r10
cmp r11, 0x1000
jb 0x18004ce2f
add r11, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004ce2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r11
mov rcx, r10
call fcn.18004d868
mov rax, r15
test rbx, rbx
je 0x18004ce47
mov qword [r15], rbx
jmp 0x18004ce4a
mov qword [r15], rbp
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18004d1b0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18004d1ea
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18004d1ef
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18004d238
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180060010]
cmp byte [rcx + rax], 0
je 0x18004d238
dec r8
sub rdx, 1
jne 0x18004d21e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140f75fa8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f75fb2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f75fdb
pop rbp
sub rbp, 0x33
sub rbp, 0xf75fa8
sub rsp, 0x20
jmp 0x140f75ffa
mov rax, 0xf75fa8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xfffffffff64ce446
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f76019
jmp 0x140f76030
invalid
Function at 0x140004d44
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1400d21f8]
mov r14, rdx
mov ebp, ecx
xor ebx, ebx
movabs rcx, 0xcccccccccccccccc
xor rcx, qword [rax + 0x6a670]
mov eax, ebp
sar eax, 0x10
add rcx, 0x10
shl eax, 3
cdqe
add rcx, rax
call fcn.14006a3d4
mov rdx, rax
lea rcx, [0x140077b22]
mov rdi, rax
call fcn.14006aca4
test rdi, rdi
jne 0x140004daf
lea rcx, [0x140077b66]
jmp 0x140004ed6
movzx eax, bp
lea rdx, [rsp + 0xe0]
mov r8d, 4
lea r15, [rdi + rax*4]
mov rcx, r15
call fcn.140068a8c
mov edx, dword [rsp + 0xe0]
lea rcx, [0x140077bb0]
call fcn.14006aca4
lea rcx, [r15 + 4]
mov r8d, 2
lea rdx, [rsp + 0xd0]
call fcn.140068a8c
movzx esi, word [rsp + 0xd0]
lea rcx, [0x140077bfa]
mov edx, esi
mov edi, esi
and edx, 1
call fcn.14006aca4
shr edi, 1
lea rcx, [0x140077c48]
mov edx, edi
call fcn.14006aca4
cmp dword [rsp + 0xe0], ebp
jne 0x140004ecf
test sil, 1
jne 0x140004ecf
shr si, 1
lea rcx, [r15 + 6]
mov edi, 0x7f
lea rdx, [rsp + 0x20]
cmp si, di
cmovb di, si
movzx r8d, di
call fcn.140068a8c
test al, al
jne 0x140004e66
lea rcx, [0x140077ccc]
jmp 0x140004ed6
mov rax, qword [0x1400d21f8]
movzx edx, di
mov ecx, dword [rax + 0x6a668]
xor ecx, 0xcccccccc
mov dword [rsp + 0xd0], ecx
cmp bx, di
jae 0x140004eb8
mov rdi, r14
mov r8d, edx
mov rax, rbx
and eax, 3
mov cl, byte [rsp + rax + 0xd0]
xor cl, byte [rsp + rbx + 0x20]
inc rbx
xor cl, sil
movsx eax, cl
not ax
mov word [rdi], ax
lea rdi, [rdi + 2]
sub r8, 1
jne 0x140004e8e
or word [r14 + rdx*2], 0xffff
lea rdi, [rsp + 0x20]
xor eax, eax
mov rcx, rdx
rep stosb byte [rdi], al
mov bl, 1
jmp 0x140004edb
lea rcx, [0x140077c8e]
call fcn.14006aca4
mov al, bl
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d0a0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r10, rcx
test edx, edx
je 0x14000d0d6
mov r9, rcx
mov rax, r9
lea rcx, [0x140078c30]
sub rax, r10
and eax, 0xf
mov cl, byte [rax + rcx]
xor cl, byte [r9]
xor cl, r8b
inc r8d
not cl
mov byte [r9], cl
inc r9
cmp r8d, edx
jb 0x14000d0ad
ret
Function at 0x140068e0c
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r12d, 1
cmp qword [0x1400d1e60], r15
jne 0x140068f6d
xor ecx, ecx
call fcn.14006f430
mov rcx, rax
mov rdi, rax
call fcn.140069a58
test al, al
jne 0x140068e5d
mov eax, r12d
jmp 0x140068fd6
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x140068e71
mov eax, 2
jmp 0x140068fd6
cmp dword [rdi + 0x3c], 0x400
jl 0x140068e84
mov eax, 3
jmp 0x140068fd6
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
cmp dword [rbx], 0x4550
je 0x140068e9d
mov eax, 4
jmp 0x140068fd6
mov qword [0x1400d1e60], r15
movzx r14d, r15w
movzx esi, word [rbx + 0x14]
add rsi, rbx
cmp r15w, word [rbx + 6]
jae 0x140068f8b
movsx rax, r14w
lea rbp, [rax + rax*4]
mov eax, dword [rsi + rbp*8 + 0x3c]
test eax, 0x22000020
jne 0x140068ef5
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x140068ef5
cmp dword [rsi + rbp*8 + 0x20], 0x10
jb 0x140068ef5
mov eax, dword [rsi + rbp*8 + 0x24]
test eax, eax
je 0x140068ef5
lea rcx, [rdi + rax]
call fcn.140069a58
test al, al
jne 0x140068f24
movzx ecx, word [rbx + 6]
add r14w, r12w
movsx eax, r14w
cmp eax, ecx
jl 0x140068eba
mov rcx, qword [0x1400d1e60]
test rcx, rcx
je 0x140068f8b
call fcn.140069a58
test al, al
jne 0x140068f3f
mov eax, 6
jmp 0x140068fd6
mov eax, dword [rsi + rbp*8 + 0x24]
mov ecx, dword [rsi + rbp*8 + 0x20]
add rax, rdi
add rcx, 0xfffffffffffffff0
add rcx, rax
mov qword [0x1400d1e60], rcx
jmp 0x140068f0c
mov rdx, qword [0x1400d1e60]
lea rcx, [0x1400d1e50]
mov r8d, 0x10
call sub.ntdll.dll_memcpy
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov dword [0x1400d1e68], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x4000
call fcn.140069038
test eax, eax
jne 0x140068f92
mov eax, 7
jmp 0x140068fd6
mov eax, 5
jmp 0x140068fd6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, r12d
call fcn.140069088
test eax, eax
jne 0x140068fae
mov eax, 8
jmp 0x140068fd6
mov rax, qword [0x1400d1e60]
movabs rcx, 0xcc873400686c031f
mov qword [rax], rcx
lea rcx, [0x1400d1de0]
mov rax, qword [0x1400d1e60]
mov qword [rax + 8], rcx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret