joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488060
Capabilities:
Inspect section memory permissions

Disassembly:
push rdi
push rsi
push rbx
mov r10d, ecx
mov r11d, edx
test ecx, 0x8000000
je 0x488084
xor ecx, ecx
xgetbv
mov edx, eax
and edx, 6
cmp edx, 6
je 0x4882d7
xor edi, edi
xor esi, esi
mov r9d, r11d
shr r9d, 0xf
and r9d, 1
mov eax, r9d
or eax, 2
test r11d, 0x800000
cmovne r9d, eax
mov eax, r9d
or eax, 8
test r11d, 0x2000000
cmovne r9d, eax
mov eax, r9d
or eax, 0x10
and r11d, 0x4000000
cmovne r9d, eax
mov eax, r9d
or eax, 4
test r10d, 0x800000
cmovne r9d, eax
mov eax, r9d
or eax, 0x40000
test r10d, 0x2000000
cmovne r9d, eax
mov eax, r9d
or eax, 0x80000
test r10b, 2
cmovne r9d, eax
mov eax, r9d
or eax, 0x20
test r10b, 1
cmovne r9d, eax
mov eax, r9d
or eax, 0x40
test r10d, 0x200
cmovne r9d, eax
mov eax, r9d
or al, 0x80
test r10d, 0x80000
cmovne r9d, eax
mov eax, r9d
or ah, 1
test r10d, 0x100000
cmovne r9d, eax
test esi, esi
je 0x48815b
test r10d, 0x10000000
je 0x48814e
or r9d, 0x200
and r10d, 0x1000
jne 0x4881ef
xor r10d, r10d
cmp r8d, 6
jle 0x48819d
mov eax, 7
mov ecx, r10d
cpuid
test bl, 8
je 0x48817a
or r9d, 0x10000
test esi, esi
je 0x48818a
test bl, 0x20
je 0x48818a
or r9d, 0x400
test bh, 1
je 0x488196
or r9d, 0x20000
xor r10d, r10d
test edi, edi
jne 0x4881fb
mov eax, 0x80000000
cpuid
cmp eax, 0x80000000
jbe 0x4881dd
mov eax, 0x80000001
cpuid
test cl, 0x40
je 0x4881be
or r9d, 0x800
test esi, esi
je 0x4881dd
test ecx, 0x10000
je 0x4881d1
or r9d, 0x1000
and ch, 8
je 0x4881dd
or r9d, 0x2000
mov dword [0x004a57bc], r9d
mov dword [0x004a62a8], r10d
pop rbx
pop rsi
pop rdi
ret
or r9d, 0x4000
jmp 0x48815b
test ebx, 0x10000
je 0x48820a
or r9d, 0x8000
test ebx, ebx
js 0x4882f1
test ebx, 0x40000000
je 0x488221
or r9d, 0x200000
test ebx, 0x20000
je 0x488230
or r9d, 0x400000
test ebx, 0x10000000
je 0x48823f
or r9d, 0x800000
test ebx, 0x4000000
je 0x48824e
or r9d, 0x2000000
test ebx, 0x8000000
je 0x48825d
or r9d, 0x1000000
and ebx, 0x200000
je 0x48826c
or r9d, 0x8000000
test cl, 2
je 0x488278
or r9d, 0x4000000
test cl, 0x40
je 0x488284
or r9d, 0x80000000
mov r10d, ecx
shr r10d, 8
and r10d, 1
test ch, 4
je 0x488298
or r10d, 2
test ch, 8
je 0x4882a1
or r10d, 4
test ch, 0x10
je 0x4882aa
or r10d, 8
and ch, 0x40
je 0x4882b6
or r9d, 0x40000000
test dl, 4
je 0x4882c2
or r9d, 0x10000000
and dl, 8
je 0x48819d
or r9d, 0x20000000
jmp 0x48819d
and eax, 0xe6
xor edi, edi
mov esi, 1
cmp eax, 0xe6
sete dil
jmp 0x488088
or r9d, 0x100000
jmp 0x488212
Function at 0x100002004
Capabilities:
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x2a8
mov rax, qword [0x100005110]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov esi, r9d
mov rbp, r8
mov edi, edx
call qword [sym.imp.ulib.dll_public:_void___cdecl_PATH::constructor_void____ptr64]
mov rax, qword [rbx]
mov r8d, 1
mov edx, edi
mov rcx, rbx
test rbp, rbp
je 0x10000205c
lea r9, [0x100001428]
mov qword [rsp + 0x20], rbp
call qword [rax + 0x10]
jmp 0x100002066
lea r9, [0x100001424]
call qword [rax + 0x10]
cmp byte [rbx + 0xf8], 0
mov rax, qword [rbx]
je 0x10000208a
mov ecx, dword [rbx + 0x100]
test ecx, ecx
jne 0x100002083
mov edx, 0x5221
jmp 0x100002099
mov edx, 0x521f
jmp 0x1000020a9
mov ecx, dword [rbx + 0x104]
test ecx, ecx
jne 0x1000020a4
mov edx, 0x5220
xor r8d, r8d
mov rcx, rbx
call qword [rax + 0x18]
jmp 0x1000020bd
mov edx, 0x521e
mov dword [rsp + 0x20], ecx
lea r9, [0x10000142c]
xor r8d, r8d
mov rcx, rbx
call qword [rax + 0x10]
mov ecx, esi
call qword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x10000286c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.ulib.dll_public:_static_unsigned_char___cdecl_KEYBOARD::GotABreak_void_]
test al, al
je 0x100002892
mov ecx, 3
call qword [sym.imp.msvcrt.dll_exit]
int3
cmp byte [rbx + 0xf8], 0
mov rdx, rdi
mov rcx, rbx
je 0x1000028a8
call fcn.1000028c0
jmp 0x1000028ad
call fcn.100002aa8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x100002e44
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, dword [rdx + 0x230]
mov rsi, r8
mov rbp, rdx
lea edi, [rax + rax + 2]
mov rbx, rcx
cmp edi, dword [rcx + 0x128]
jbe 0x100002e8f
mov rcx, qword [rcx + 0x120]
mov edx, edi
call qword [sym.imp.ulib.dll_void____ptr64___cdecl_UlibRealloc_void____ptr64__unsigned_long_int_]
mov dword [rbx + 0x128], edi
mov qword [rbx + 0x120], rax
mov eax, dword [rsi + 0x230]
lea edi, [rax + rax + 2]
cmp edi, dword [rbx + 0x138]
jbe 0x100002ebd
mov rcx, qword [rbx + 0x130]
mov edx, edi
call qword [sym.imp.ulib.dll_void____ptr64___cdecl_UlibRealloc_void____ptr64__unsigned_long_int_]
mov dword [rbx + 0x138], edi
mov qword [rbx + 0x130], rax
mov r9, qword [rbx + 0x120]
test r9, r9
je 0x100002f86
cmp qword [rbx + 0x130], 0
je 0x100002f86
mov eax, dword [rbx + 0x128]
or edi, 0xffffffff
lea rcx, [rbp + 0x218]
shr eax, 1
mov r8d, edi
xor edx, edx
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], eax
call qword [sym.imp.ulib.dll_public:_unsigned_short_int____ptr64___cdecl_WSTRING::QueryWSTR_unsigned_long_int__unsigned_long_int__unsigned_short_int____ptr64__unsigned_long_int__unsigned_char_const___ptr64]
mov r11d, dword [rbx + 0x138]
mov r9, qword [rbx + 0x130]
lea rcx, [rsi + 0x218]
shr r11d, 1
mov r8d, edi
xor edx, edx
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], r11d
call qword [sym.imp.ulib.dll_public:_unsigned_short_int____ptr64___cdecl_WSTRING::QueryWSTR_unsigned_long_int__unsigned_long_int__unsigned_short_int____ptr64__unsigned_long_int__unsigned_char_const___ptr64]
mov rdx, qword [rbx + 0x130]
mov rcx, qword [rbx + 0x120]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x100002f6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r10, qword [rbx]
lea r9, [0x10000142c]
mov edx, 3
mov r8d, 0x523f
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [r10 + 0x20]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov al, 1
add rsp, 0x30
pop rdi
ret
mov r9d, 8
xor r8d, r8d
mov edx, 0x5241
mov rcx, rbx
call fcn.100002004
int3
Function at 0x1000032b0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100005110]
jne 0x1000032cb
rol rcx, 0x10
test cx, 0xffff
jne 0x1000032c7
ret 0
ror rcx, 0x10
jmp 0x1000035bc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100005200]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x1000052f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100003641
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100005200]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100003663
mov rax, qword [rsp + 0x88]
mov qword [0x1000052f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100005298], rax
mov rax, qword [0x1000052f8]
mov qword [0x100005170], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100005280], rax
mov dword [0x100005160], 0xc0000409
mov dword [0x100005164], 1
mov rax, qword [0x100005110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100005118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1000013b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100003458
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1000034a5
cmp rcx, 0xffffffffffffffff
je 0x1000034a5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000349d
cmp dword [rcx + 0x3c], edx
jl 0x10000349d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000349d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1000034a5
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140002260
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14000229f
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [rsi + 0x10], 0
cmp dword [0x1400775c8], 0
jne 0x1400022f6
mov r15, qword [0x1400775c0]
test r15, r15
je 0x1400022c1
cmp byte [r15 + 0x1f], 0
jns 0x1400022e6
mov rcx, qword [r15 + 8]
jmp 0x1400022ea
mov ecx, 0x20
call fcn.140030b64
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [0x1400775c0], rax
cmp byte [r15 + 0x1f], 0
js 0x1400022bb
lea rcx, [r15 + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov byte [r15], 0
movzx ebp, byte [rsp + 0xe8]
mov r12, qword [rsp + 0xe0]
mov rcx, qword [0x1400775c0]
test rcx, rcx
jne 0x140002330
mov ecx, 0x20
call fcn.140030b64
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov qword [0x1400775c0], rax
lea r8, [rsi + 0x20]
mov rdx, r14
call fcn.140001ee0
mov r14, rax
mov rcx, qword [rbx]
mov edx, 2
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov rcx, rax
call qword [sym.imp.flutter_windows.dll_FlutterDesktopGetDpiForMonitor]
mov eax, eax
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
divsd xmm6, qword [0x14005b420]
xor r15d, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [r12 + 4]
mulsd xmm0, xmm6
cvttsd2si ecx, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [r12]
mulsd xmm0, xmm6
cvttsd2si edx, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [rbx + 4]
mulsd xmm0, xmm6
cvttsd2si r8d, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [rbx]
mulsd xmm0, xmm6
cvttsd2si r10d, xmm0
movzx r9d, bpl
shl r9d, 0x1c
or r9d, 0xcf0000
cmp byte [rdi + 0x17], 0
jns 0x1400023cf
mov rdi, qword [rdi]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rax
xorpd xmm0, xmm0
movupd xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r10d
xor ecx, ecx
mov rdx, r14
mov r8, rdi
call qword [sym.imp.USER32.dll_CreateWindowExW]
test rax, rax
je 0x14000248c
mov rdi, rax
mov dword [rsp + 0x68], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
lea r8, str.AppsUseLightTheme
mov rcx, 0xffffffff80000001
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140002480
xor eax, eax
cmp dword [rsp + 0x6c], 0
sete al
mov dword [rsp + 0x64], eax
lea r8, [rsp + 0x64]
mov rcx, rdi
mov edx, 0x14
mov r9d, 4
call qword [sym.imp.dwmapi.dll_DwmSetWindowAttribute]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
mov r15d, eax
mov eax, r15d
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400024b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rax, r9
mov rsi, rcx
mov r9, qword [rbp + 0x40]
cmp r8d, 5
jle 0x140002573
cmp r8d, 6
je 0x1400025cd
cmp r8d, 0x2e0
je 0x1400025e5
cmp r8d, 0x320
jne 0x140002685
mov rsi, rdx
mov dword [rbp - 0x10], 4
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
lea r8, str.AppsUseLightTheme
mov rcx, 0xffffffff80000001
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400026ba
xor eax, eax
cmp dword [rbp - 0x20], 0
sete al
mov dword [rbp - 0xc], eax
lea r8, [rbp - 0xc]
mov rcx, rsi
mov edx, 0x14
mov r9d, 4
call qword [sym.imp.dwmapi.dll_DwmSetWindowAttribute]
jmp 0x1400026ba
cmp r8d, 2
je 0x14000261e
cmp r8d, 5
jne 0x140002685
mov rcx, qword [rsi + 0x10]
lea rdx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1400026ba
mov eax, dword [rbp - 0x14]
mov edx, dword [rbp - 0x20]
mov r8d, dword [rbp - 0x1c]
sub eax, r8d
mov r9d, dword [rbp - 0x18]
sub r9d, edx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 1
call qword [sym.imp.USER32.dll_MoveWindow]
jmp 0x1400026ba
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1400026ba
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x1400026ba
mov ecx, dword [r9 + 8]
mov r8d, dword [r9]
mov eax, dword [r9 + 4]
sub ecx, r8d
mov r9d, dword [r9 + 0xc]
sub r9d, eax
mov dword [rsp + 0x28], r9d
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x30], 0x14
mov rcx, rdx
xor edx, edx
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x1400026ba
mov qword [rsi + 0x10], 0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x140002646
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [rsi + 0x10], 0
cmp dword [0x1400775c8], 0
jne 0x1400026ac
mov rdi, qword [0x1400775c0]
test rdi, rdi
jne 0x140002679
mov ecx, 0x20
call fcn.140030b64
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov qword [0x1400775c0], rax
cmp byte [rdi + 0x1f], 0
jns 0x14000269d
mov rcx, qword [rdi + 8]
jmp 0x1400026a1
mov rcx, qword [rsi + 0x10]
mov edx, r8d
mov r8, rax
add rsp, 0x60
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.USER32.dll_DefWindowProcW]
lea rcx, [rdi + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov byte [rdi], 0
cmp byte [rsi + 8], 1
jne 0x1400026ba
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400028a0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rbp - 0xc]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov qword [r12 + 0x10], 0
test rax, rax
je 0x140002a62
mov rsi, rax
mov r13d, 1
lea r15, [rbp - 0x28]
mov qword [rbp - 0x30], rax
mov qword [rbp - 8], r12
jmp 0x14000292f
mov rax, qword [rbp - 0x18]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [r14], xmm0
add r14, 0x18
mov rdi, r14
mov qword [r12 + 8], rdi
inc r13d
cmp r13d, dword [rbp - 0xc]
jge 0x140002a59
mov eax, r13d
mov rdx, qword [rsi + rax*8]
mov rcx, r15
call fcn.140002b20
mov r12, qword [rbp - 8]
mov r14, qword [r12 + 8]
mov rbx, qword [r12 + 0x10]
cmp r14, rbx
jb 0x140002910
mov r15, qword [r12]
sub r14, r15
mov r12, r14
sar r12, 3
movabs rcx, 0xaaaaaaaaaaaaaaab
imul r12, rcx
lea rdi, [r12 + 1]
movabs rax, 0xaaaaaaaaaaaaaab
cmp rdi, rax
jae 0x140002a76
sub rbx, r15
mov rax, rbx
sar rax, 3
imul rax, rcx
lea rcx, [rax + rax]
cmp rcx, rdi
cmova rdi, rcx
movabs rcx, 0x555555555555555
cmp rax, rcx
movabs rax, 0xaaaaaaaaaaaaaaa
cmovae rdi, rax
test rdi, rdi
je 0x1400029ee
movabs rax, 0xaaaaaaaaaaaaaab
cmp rdi, rax
jae 0x140002a7f
lea rax, [rdi*8]
lea rcx, [rax + rax*2]
call fcn.140030b64
jmp 0x1400029f0
xor eax, eax
lea rcx, [r12 + r12*2]
lea r12, [rax + rcx*8]
lea rdx, [rdi + rdi*2]
lea rsi, [rax + rdx*8]
mov rdx, qword [rbp - 0x18]
mov qword [rax + rcx*8 + 0x10], rdx
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rax + rcx*8], xmm0
lea rdi, [rax + rcx*8]
add rdi, 0x18
sub r12, r14
mov rcx, r12
mov rdx, r15
mov r8, r14
call fcn.140033190
mov rax, qword [rbp - 8]
mov qword [rax], r12
mov r12, rax
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
test r15, r15
je 0x140002a4c
mov rcx, r15
mov rdx, rbx
call fcn.140030ba0
mov rsi, qword [rbp - 0x30]
lea r15, [rbp - 0x28]
jmp 0x140002927
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, r12
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp - 8]
call fcn.140001840
call fcn.140002c90
int3

Function at 0x140006d90
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, r8
je 0x140006db8
movabs rcx, 0xf000000000000000
mov r9, r8
sub r9, rdx
dec r8
cmp r8, rdx
jne 0x140006dbb
xor r8d, r8d
test r9b, 1
jne 0x140006e1e
jmp 0x140006e34
xor eax, eax
ret
mov r8, r9
and r8, 0xfffffffffffffffe
xor eax, eax
nop word cs:[rax + rax]
shl rax, 4
movzx r10d, byte [rdx]
add r10, rax
mov rax, r10
shr rax, 0x38
and eax, 0xfffffff0
xor rax, r10
shl rax, 4
movzx r10d, byte [rdx + 1]
add r10, rax
mov r11, r10
and r11, rcx
mov rax, r11
shr rax, 0x38
or rax, r11
xor rax, r10
add rdx, 2
add r8, 0xfffffffffffffffe
jne 0x140006dd0
mov r8, rax
shl r8, 4
test r9b, 1
je 0x140006e34
movzx eax, byte [rdx]
add r8, rax
and rcx, r8
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r8
ret
Function at 0x140006f60
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140006fa7
movabs rcx, 0xf000000000000000
nop word cs:[rax + rax]
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x140006f80
ret

Function at 0x1400110f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
movzx ebx, byte [rbp + 0x58]
test byte [r9 + 8], 1
jne 0x140011139
movzx eax, byte [rbp + 0x50]
movzx edx, bl
mov r10, qword [rcx]
mov dword [rsp + 0x28], edx
mov byte [rsp + 0x20], al
mov rdx, rsi
mov r8, rdi
call qword [r10 + 0x30]
jmp 0x1400112aa
lea rdx, [rbp - 0x28]
mov rcx, r9
call fcn.140004d50
mov r14, qword [rbp - 0x28]
lea rax, [0x140078088]
mov qword [rbp - 0x30], rax
mov rax, qword [0x140078088]
cmp rax, 0xffffffffffffffff
je 0x140011188
lea rax, [rbp - 0x30]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x38], rax
lea rcx, [0x140078088]
lea r8, [0x14002b5e0]
lea rdx, [rbp - 0x38]
call fcn.1400304d0
movsxd rax, dword [0x140078090]
lea rdx, [rax - 1]
mov rcx, qword [r14 + 0x10]
mov r8, qword [r14 + 0x18]
sub r8, rcx
sar r8, 3
cmp r8, rdx
jbe 0x1400112b8
mov rcx, qword [rcx + rax*8 - 8]
test rcx, rcx
je 0x1400112b8
mov rax, qword [rbp - 0x28]
lea rdx, [0x140077eb0]
cmp rax, rdx
je 0x1400111e6
mov edx, 0xffffffff
lock xadd dword [rax + 8], edx
test edx, edx
jne 0x1400111e6
mov rdx, qword [rax]
mov r14, rcx
mov rcx, rax
call qword [rdx + 8]
mov rcx, r14
mov rax, qword [rcx]
xor bl, 1
movzx r8d, bl
lea rbx, [rbp - 0x20]
mov rdx, rbx
call qword [rax + r8*8 + 0x28]
movsx rax, byte [rbp - 9]
mov rdx, rax
test rax, rax
jns 0x14001120d
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
test rdx, rdx
je 0x140011290
test al, al
cmovns rcx, rbx
mov r14, rcx
jmp 0x14001123b
add rdx, r8
inc r14
cmp r14, rdx
je 0x140011290
test rdi, rdi
je 0x140011271
movzx eax, byte [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x140011260
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x140011273
movzx edx, al
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
jne 0x140011273
xor edi, edi
movsx rax, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, rbx
mov r8, rax
test rax, rax
jns 0x140011230
mov r8, qword [rbp - 0x18]
mov rdx, rcx
jmp 0x140011230
mov qword [rsi], rdi
test al, al
jns 0x1400112aa
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rbp - 0x10]
call fcn.140030ba0
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.140025020
int3
Function at 0x140012cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
movzx ebx, byte [rbp + 0x58]
test byte [r9 + 8], 1
jne 0x140012d0a
movzx eax, word [rbp + 0x50]
movzx edx, bl
mov r10, qword [rcx]
mov dword [rsp + 0x28], edx
mov word [rsp + 0x20], ax
mov rdx, rsi
mov r8, rdi
call qword [r10 + 0x30]
jmp 0x140012e75
lea rdx, [rbp - 0x28]
mov rcx, r9
call fcn.140004d50
mov r14, qword [rbp - 0x28]
lea rax, [0x140078098]
mov qword [rbp - 0x30], rax
mov rax, qword [0x140078098]
cmp rax, 0xffffffffffffffff
je 0x140012d59
lea rax, [rbp - 0x30]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x38], rax
lea rcx, [0x140078098]
lea r8, [0x14002b5e0]
lea rdx, [rbp - 0x38]
call fcn.1400304d0
movsxd rax, dword [0x1400780a0]
lea rdx, [rax - 1]
mov rcx, qword [r14 + 0x10]
mov r8, qword [r14 + 0x18]
sub r8, rcx
sar r8, 3
cmp r8, rdx
jbe 0x140012e83
mov rcx, qword [rcx + rax*8 - 8]
test rcx, rcx
je 0x140012e83
mov rax, qword [rbp - 0x28]
lea rdx, [0x140077eb0]
cmp rax, rdx
je 0x140012db7
mov edx, 0xffffffff
lock xadd dword [rax + 8], edx
test edx, edx
jne 0x140012db7
mov rdx, qword [rax]
mov r14, rcx
mov rcx, rax
call qword [rdx + 8]
mov rcx, r14
mov rax, qword [rcx]
xor bl, 1
movzx r8d, bl
lea rbx, [rbp - 0x20]
mov rdx, rbx
call qword [rax + r8*8 + 0x28]
movsx rax, byte [rbp - 9]
test rax, rax
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov r8, rax
cmovs r8, rdx
test r8, r8
je 0x140012e62
test al, al
mov r14, rbx
cmovs r14, rcx
jmp 0x140012e20
xor edi, edi
add r14, 2
test al, al
mov r8, rbx
cmovs r8, rcx
movzx r9d, al
cmovs r9, rdx
lea r8, [r8 + r9*2]
cmp r14, r8
je 0x140012e62
test rdi, rdi
je 0x140012e00
movzx eax, word [r14]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x140012e40
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
jmp 0x140012e4c
mov r8, qword [rdi]
mov rcx, rdi
mov edx, eax
call qword [r8 + 0x60]
cmp ax, 0xffff
jne 0x140012e54
xor edi, edi
movzx eax, byte [rbp - 9]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
jmp 0x140012e02
mov qword [rsi], rdi
test al, al
jns 0x140012e75
mov rdx, qword [rbp - 0x10]
add rdx, rdx
call fcn.140030ba0
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call fcn.140025020
int3

Function at 0x14003119c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400311e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400311e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400311e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400311e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400311e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400311e8
xor al, al
add rsp, 0x28
ret

Function at 0x14003bd4c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003be94
Function at 0x1400441a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400441c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400441c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14004e680
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140047d90
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14004e721
cmp ebx, dword [rsp + 0x30]
je 0x14004e71a
test esi, esi
je 0x14004e71a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14004e6f5
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14004e702
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14004e6df
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14004e706
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14004e723
mov eax, 1
jmp 0x14004e723
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret