joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400860f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140086124
mov eax, esi
lea ecx, [rax + 0x46]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x140086110
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140037610
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140086149
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140092660
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400861c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400861be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400861be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400861d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x140086204
mov eax, esi
lea ecx, [rax + 0x46]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400861f0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140037610
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140086229
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140092660
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400862a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008629e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008629e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14008ca60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x14008ca83
lea edx, [rax + 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14008ca70
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140037610
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14008caa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x14008cac3
lea edx, [rax + 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x14008cab0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140037610
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14008d7b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14008d7d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14008d7c0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14008d7e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x14008d808
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x14008d7f0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x14008d810
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x14008d833
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x14008d820
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x14008d840
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x14008d863
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x46]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x14008d850
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x14008d870
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
xor eax, eax
cmp byte [0x140239458], al
jne 0x14008d921
movdqa xmm0, xmmword [0x1400b23d0]
movdqa xmm1, xmmword [0x1400b2240]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x1400b2360]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1400b24d0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x1400b24b0]
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm1
mov dword [rsp + 0x90], 0x100e4f8
nop dword [rax]
lea ecx, [rax + 0x46]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x14008d8e0
lea r9, [rsp + 0xb0]
mov byte [rsp + 0x93], 0
lea r8, [rsp + 0x92]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140037610
lea rcx, [rsp + 0x20]
call fcn.14008fee0
add rsp, 0xa8
ret
Function at 0x14008ddd0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x14008deb7
sub r10, rdx
cmp r8, 8
jb 0x14008de8c
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
orps xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rcx, rax
jb 0x14008de00
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x14008deb7
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x14008dea0
test r9d, r9d
sete al
ret
Function at 0x14008fee0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp + 0x27], rcx
movdqa xmm0, xmmword [0x1400b2390]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x39], 0x100
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 0x46]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x10
jb 0x14008ff20
mov byte [rbp - 0x38], 0
movdqa xmm0, xmmword [0x1400b22c0]
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [str.9_x_zz6]
movdqu xmmword [rbp - 0x21], xmm1
mov dword [rbp - 0x11], 0x491a0814
mov dword [rbp - 0xd], 0x84c4d4c
mov dword [rbp - 9], 0x511f070d
mov word [rbp - 5], 0x100
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx + 0x46]
xor byte [rbp + rcx - 0x31], al
inc rcx
cmp rcx, 0x2c
jb 0x14008ff70
mov byte [rbp - 4], 0
mov r8, rbx
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 7]
call fcn.140034e00
nop
lea rcx, [rbp - 0x49]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x14008ffa0
lea rdx, [rbp - 0x49]
mov rcx, rax
call fcn.140031900
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2f], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3f], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140090025
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090020
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140090020
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0x10
cmovae rcx, qword [rbp + 0x2f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
int 0x29
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x14009007b
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140090076
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140090076
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
movdqa xmm0, xmmword [0x1400b4610]
movdqu xmmword [rbp + 0x3f], xmm0
mov byte [rbp + 0x2f], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400900c2
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400900bd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400900f2
mov rcx, r8
call fcn.1400999e0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140099880
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140093f20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rdx
xor edi, edi
mov dword [rbp - 0x50], 0x2a2b3235
mov dword [rbp - 0x4c], 0x3f382f
mov byte [rbp - 0x48], 1
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x46]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x140093f60
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.140037610
nop
cmp byte [rbx], 0
jne 0x140093f9b
mov byte [rbx], 1
call fcn.140087ba0
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x140093fb2
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.14008c970
mov rcx, rax
jmp 0x140093fb6
mov rcx, qword [rbp - 0x18]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, rdi
movzx eax, byte [rax]
mov byte [rsi + 0x210], al
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140094008
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140094003
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140094003
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
mov dword [rbp - 0x50], 0x3a3b222b
mov dword [rbp - 0x4c], 0x292c2b
mov byte [rbp - 0x48], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx + 0x46]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x140094020
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.140037610
nop
cmp byte [rbx], 0
jne 0x14009405b
mov byte [rbx], 1
call fcn.140087ba0
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x14009406f
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.14008c970
jmp 0x140094073
mov rax, qword [rbp - 0x18]
cmp byte [rax], 3
jne 0x14009407c
mov rdi, qword [rax + 8]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140094089
mov rdx, qword [rdi]
lea rcx, [rsi + 0x218]
mov r8, qword [rdi + 0x10]
call fcn.1400317a0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400940d9
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400940d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400940d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
nop
lea rcx, [rbx + 8]
movzx edx, byte [rbx]
call fcn.14008e600
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140099880
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140098ac0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x140098c78
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x140098b38
cmp eax, 0x40
jae 0x140098b22
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x140098b10
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.140098da0
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x140098b40
lea rsi, [rbx + 0x2c]
jae 0x140098b52
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x140098b40
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.140098da0
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140098c90
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x14009a554
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009a59e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009a59e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009a59e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009a59e
cmp dword [rcx + 0x84], 0xe
jbe 0x14009a59e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14009a5a0
xor al, al
add rsp, 0x28
ret

Function at 0x14009a82c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14009a866
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14009a86b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14009a8b4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400b2680]
cmp byte [rcx + rax], 0
je 0x14009a8b4
dec r8
sub rdx, 1
jne 0x14009a89a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14000fd30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x70], 0
jg 0x14000fd52
xor eax, eax
jmp 0x14000fef5
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x68], 0
je 0x14000fd77
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.14000ff00
jmp 0x14000fef5
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x60]
call fcn.14000ac90
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x14000fe0d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140006d50
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x60]
call fcn.14000e160
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.14000cb10
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call fcn.14000e060
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x80], 0
je 0x14000fee5
mov rcx, qword [rsp + 0x60]
call fcn.14000bef0
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x14000fead
mov rax, qword [rsp + 0x60]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x68]
call fcn.140065120
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x14000feab
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x14000fef5
jmp 0x14000fe33
cmp qword [rsp + 0x20], 0
jbe 0x14000fee5
mov rax, qword [rsp + 0x60]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x68]
call fcn.140065120
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x58
ret
Function at 0x140011100
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x200
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
mov rdx, qword [rsp + 0x218]
lea rcx, [rsp + 0x80]
call fcn.140012d80
mov rax, qword [rsp + 0x80]
movsxd rax, dword [rax + 4]
lea rax, [rsp + rax + 0x80]
mov rcx, rax
call fcn.140008e40
movzx eax, al
test eax, eax
je 0x14001119c
lea rdx, str.Failed_to_open_temporary_file_for_writing.
lea rcx, [0x1400a6210]
call fcn.140004fa0
lea rdx, [0x140006a90]
mov rcx, rax
call fcn.140008c20
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x80]
call fcn.1400092e0
movzx eax, byte [rsp + 0x50]
jmp 0x14001130c
mov rcx, qword [rsp + 0x210]
call fcn.14000f400
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x210]
call fcn.14000cb50
mov rcx, qword [rsp + 0x58]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14000fc50
lea rcx, [rsp + 0x80]
call fcn.14000cac0
mov dword [rsp + 0x190], 0x68
lea rax, [rsp + 0x198]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x218]
call fcn.14000c880
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x190]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400112ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x54], eax
lea rdx, str.Failed_to_create_process._Error:
lea rcx, [0x1400a6210]
call fcn.140004fa0
mov ecx, dword [rsp + 0x54]
mov edx, ecx
mov rcx, rax
call fcn.140013290
lea rdx, [0x140006a90]
mov rcx, rax
call fcn.140008c20
mov byte [rsp + 0x51], 0
lea rcx, [rsp + 0x80]
call fcn.1400092e0
movzx eax, byte [rsp + 0x51]
jmp 0x14001130c
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.PE_file_executed_successfully.
lea rcx, [0x1400a60f0]
call fcn.140004fa0
lea rdx, [0x140006a90]
mov rcx, rax
call fcn.140008c20
mov byte [rsp + 0x52], 1
lea rcx, [rsp + 0x80]
call fcn.1400092e0
movzx eax, byte [rsp + 0x52]
add rsp, 0x200
pop rdi
ret
Function at 0x14002e4c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x1168
call fcn.14005d950
sub rsp, rax
mov rax, qword [0x1400a3f38]
xor rax, rsp
mov qword [rsp + 0x1150], rax
lea r8, [rsp + 0x30]
mov edx, 0x1000
lea rcx, [rsp + 0x40]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
jne 0x14002e508
xor al, al
jmp 0x14002e5b3
mov eax, dword [rsp + 0x30]
xor edx, edx
mov ecx, 4
div rcx
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 0
jmp 0x14002e52e
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x20], eax
jae 0x14002e5b1
mov eax, dword [rsp + 0x20]
mov r8d, dword [rsp + rax*4 + 0x40]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14002e5ac
mov r9d, 0x104
lea r8, [rsp + 0x1040]
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_K32GetModuleBaseNameA
test eax, eax
je 0x14002e5a1
mov rdx, qword [rsp + 0x1178]
lea rcx, [rsp + 0x1040]
call fcn.140069f90
test eax, eax
jne 0x14002e5a1
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14002e5b3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002e524
xor al, al
mov rcx, qword [rsp + 0x1150]
xor rcx, rsp
call fcn.14005d690
add rsp, 0x1168
ret