joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001fd10
Capabilities:
Get socket status

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x14008e1c0]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, qword [rbp + 0x210]
mov rax, r8
mov qword [rsp + 0x30], rax
mov r10, r9
mov qword [rsp + 0x50], r9
movzx r13d, dl
mov r12, rcx
cmp rcx, 0xffffffffffffffff
jne 0x14001fd84
lea rsi, [0x14004dd00]
mov dword [rsp + 0x30], 0x2719
mov qword [rsp + 0x38], rsi
xor eax, eax
mov byte [rsp + 0x34], 1
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
jmp 0x14001ff13
mov qword [rsp + 0x2a8], r14
mov qword [rsp + 0x2a0], r15
movzx r15d, r13b
and r15b, 0x10
cmp byte [rbp + 0x208], 0
je 0x14001fdd2
test r15b, r15b
je 0x14001fdd2
xor r14d, r14d
lea rsi, [0x14004dd00]
mov dword [rsp + 0x30], r14d
xor eax, eax
mov byte [rsp + 0x34], r14b
mov qword [rsp + 0x38], rsi
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
jmp 0x14001ff03
mov r9d, dword [rbp + 0x200]
mov r8, r10
mov rdx, rax
mov qword [rsp + 0x2e8], rdi
mov qword [rsp + 0x20], rbx
call fcn.14001fbf0
test eax, eax
jg 0x14001fef9
lea rsi, [0x14004dd00]
xor r14d, r14d
movabs rcx, 0x8fafd21e25c5e09b
test r15b, r15b
je 0x14001fe1a
test eax, eax
je 0x14001ff31
test r13b, 1
jne 0x14001ff82
mov eax, dword [rbx]
cmp eax, 0x2733
je 0x14001fe38
cmp eax, 0x4d5
jne 0x14001ff82
mov rax, qword [rbx + 8]
cmp qword [rax + 8], rcx
jne 0x14001ff82
xor ecx, ecx
mov qword [rbp - 0x78], r12
mov dword [rbp - 0x80], 1
call qword [sym.imp.WS2_32.dll_WSASetLastError]
lea ecx, [r12 + 1]
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [rbp - 0x80]
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x60], rsi
setne byte [rsp + 0x5c]
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbx], xmm0
test edi, edi
jne 0x14001feb0
mov dword [rsp + 0x68], r14d
mov byte [rsp + 0x6c], r14b
mov qword [rsp + 0x70], rsi
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rbx], xmm0
jmp 0x14001fed3
jle 0x14001fecb
mov dword [rsp + 0x40], r14d
mov byte [rsp + 0x44], r14b
mov qword [rsp + 0x48], rsi
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
jmp 0x14001fed3
test edi, edi
js 0x14001ff82
mov r9d, dword [rbp + 0x200]
mov rcx, r12
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call fcn.14001fbf0
test eax, eax
jle 0x14001fe03
mov eax, eax
mov rdi, qword [rsp + 0x2e8]
mov r14, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x2a0]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400496c0
add rsp, 0x2b0
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [0x14008d0d8]
lea rdi, [0x14008d0d0]
mov dword [rsp + 0x40], 2
cmp rax, rcx
je 0x14001ff6f
movabs rcx, 0xb2ab117a257edf0d
cmp rax, rcx
je 0x14001ff6f
mov rax, qword [0x14008d0d0]
mov edx, 2
mov rcx, rdi
call qword [rax + 0x30]
jmp 0x14001ff71
mov al, 1
mov byte [rsp + 0x44], al
mov qword [rsp + 0x48], rdi
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
xor eax, eax
jmp 0x14001fefb
Function at 0x140027ce0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 0xf8
call fcn.14002be70
movabs rsi, 0x1f83d9abfb41bd6b
movabs rbp, 0x5be0cd19137e2179
mov qword [rdi + 0x30], rsi
movabs rcx, 0x6a09e667f3bcc908
mov qword [rdi + 0x38], rbp
movabs rdx, 0xbb67ae8584caa73b
mov qword [rdi], rcx
movabs r8, 0x3c6ef372fe94f82b
mov qword [rdi + 8], rdx
movabs r9, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x10], r8
movabs r10, 0x510e527fade682d1
mov qword [rdi + 0x18], r9
movabs r11, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x20], r10
mov qword [rdi + 0x28], r11
mov rax, qword [rbx]
xor rax, rcx
mov qword [rdi], rax
mov rax, qword [rbx + 8]
xor rax, rdx
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
xor rax, r8
mov qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
xor rax, r9
mov qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
xor rax, r10
mov qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
xor rax, r11
mov qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
xor rax, rsi
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x38]
xor rax, rbp
mov rbp, qword [rsp + 0x38]
mov qword [rdi + 0x38], rax
movzx eax, byte [rbx]
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 0xe8], rax
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14002b160
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x28], rax
mov dword [rcx + 0x24], eax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov qword [rcx + 0x1c], 0x5be0cd19
mov byte [rcx + 0x40], 0
ret
Function at 0x14002baf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx r10d, byte [rdx]
xor esi, esi
mov r15, r9
mov rdi, rcx
mov r14, r8
mov r9, rdx
mov ebx, esi
movabs rcx, 0xf33e5fb3c4
lea r11d, [rsi + 1]
movabs rbp, 0xae2eabe2a8
movabs r12, 0x79b76d99e2
movabs r13, 0x1e4f43e470
test r10b, r10b
je 0x14002bc0d
sub r9, rdi
nop dword [rax + rax]
lea eax, [r10 - 0x21]
cmp al, 0x5d
ja 0x14002bd93
mov rdx, r11
mov byte [rdi], r10b
shr rdx, 0x23
and r10d, 0x1f
mov eax, edx
inc rdi
shr eax, 2
inc rbx
and eax, 1
neg eax
movsxd r8, eax
mov eax, edx
shr eax, 3
and r8, rcx
and eax, 1
neg eax
cdqe
and rax, rbp
xor r8, rax
mov eax, edx
shr eax, 1
and eax, 1
neg eax
cdqe
and rax, r12
xor r8, rax
mov eax, edx
shr eax, 4
and edx, 1
neg eax
neg edx
movsxd rcx, eax
and rcx, r13
movsxd rax, edx
xor r8, rcx
movabs rcx, 0x98f2bc8e61
and rax, rcx
movabs rcx, 0xf33e5fb3c4
xor r8, rax
movabs rax, 0x7ffffffff
and rax, r11
xor r8, r10
movzx r10d, byte [r9 + rdi]
mov r11, r8
shl rax, 5
xor r11, rax
test r10b, r10b
jne 0x14002bb60
lea rax, [r15 + 9]
add rax, rbx
cmp rax, 0x81
ja 0x14002bd93
mov rcx, r11
call fcn.14002bdc0
mov rbp, qword [str.qpzry9x8gf2tvdw0s3jn54khce6mua7l]
mov byte [rdi], 0x3a
inc rdi
test r15, r15
je 0x14002bc6e
nop word [rax + rax]
movzx ecx, byte [r14]
cmp cl, 0x20
jae 0x14002bd93
mov ebx, ecx
mov rcx, rax
call fcn.14002bdc0
movzx ecx, byte [rbx + rbp]
xor rax, rbx
mov byte [rdi], cl
inc r14
inc rdi
inc rsi
cmp rsi, r15
jb 0x14002bc40
movabs rbx, 0x98f2bc8e61
mov r9d, 8
movabs r10, 0xf33e5fb3c4
movabs r11, 0xae2eabe2a8
mov rcx, rax
shr rcx, 0x23
movzx edx, cl
mov ecx, edx
shr ecx, 1
and ecx, 1
neg ecx
movsxd r8, ecx
mov ecx, edx
shr ecx, 4
and r8, r12
and ecx, 1
neg ecx
movsxd rcx, ecx
and rcx, r13
xor r8, rcx
mov ecx, edx
shr ecx, 2
and ecx, 1
neg ecx
movsxd rcx, ecx
and rcx, r10
xor r8, rcx
mov ecx, edx
shr ecx, 3
and edx, 1
and ecx, 1
neg edx
neg ecx
movsxd rcx, ecx
and rcx, r11
xor r8, rcx
movsxd rcx, edx
and rcx, rbx
xor r8, rcx
mov rcx, rax
shl rcx, 5
mov rax, r8
xor rax, rcx
sub r9, 1
jne 0x14002bc92
xor rax, 1
mov rcx, rax
shr rcx, 0x23
and ecx, 0x1f
movzx ecx, byte [rcx + rbp]
mov byte [rdi], cl
mov rcx, rax
shr rcx, 0x1e
and ecx, 0x1f
movzx ecx, byte [rcx + rbp]
mov byte [rdi + 1], cl
mov rcx, rax
shr rcx, 0x19
and ecx, 0x1f
movzx ecx, byte [rcx + rbp]
mov byte [rdi + 2], cl
mov rcx, rax
shr rcx, 0x14
and ecx, 0x1f
movzx ecx, byte [rcx + rbp]
mov byte [rdi + 3], cl
mov rcx, rax
shr rcx, 0xf
and ecx, 0x1f
movzx ecx, byte [rcx + rbp]
mov byte [rdi + 4], cl
mov rcx, rax
shr rcx, 0xa
and ecx, 0x1f
movzx ecx, byte [rcx + rbp]
mov byte [rdi + 5], cl
mov rcx, rax
shr rcx, 5
and ecx, 0x1f
and eax, 0x1f
movzx ecx, byte [rcx + rbp]
mov byte [rdi + 6], cl
movzx ecx, byte [rax + rbp]
lea eax, [r9 + 1]
mov byte [rdi + 7], cl
mov byte [rdi + 8], r9b
jmp 0x14002bd95
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14002c850
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov rax, qword [rdx]
xor qword [rcx], rax
mov rax, qword [rdx + 8]
xor qword [rcx + 8], rax
mov rax, qword [rdx + 0x10]
xor qword [rcx + 0x10], rax
mov rax, qword [rdx + 0x18]
xor qword [rcx + 0x18], rax
mov rax, qword [rdx + 0x20]
xor qword [rcx + 0x20], rax
mov rax, qword [rdx + 0x28]
xor qword [rcx + 0x28], rax
mov rax, qword [rdx + 0x30]
xor qword [rcx + 0x30], rax
mov rax, qword [rdx + 0x38]
xor qword [rcx + 0x38], rax
mov rax, qword [rdx + 0x40]
xor qword [rcx + 0x40], rax
cmp r8, 0x48
jbe 0x14002c8ff
mov rax, qword [rdx + 0x48]
xor qword [rcx + 0x48], rax
mov rax, qword [rdx + 0x50]
xor qword [rcx + 0x50], rax
mov rax, qword [rdx + 0x58]
xor qword [rcx + 0x58], rax
mov rax, qword [rdx + 0x60]
xor qword [rcx + 0x60], rax
cmp r8, 0x68
jbe 0x14002c8ff
mov rax, qword [rdx + 0x68]
xor qword [rcx + 0x68], rax
mov rax, qword [rdx + 0x70]
xor qword [rcx + 0x70], rax
mov rax, qword [rdx + 0x78]
xor qword [rcx + 0x78], rax
mov rax, qword [rdx + 0x80]
xor qword [rcx + 0x80], rax
cmp r8, 0x88
jbe 0x14002c8ff
mov rax, qword [rdx + 0x88]
xor qword [rcx + 0x88], rax
jmp fcn.14002c4f0

Function at 0x14002cb30
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
je 0x14002cb6d
push rbx
sub rsp, 0x20
movups xmm0, xmmword [0x140062f18]
mov rbx, rcx
mov edx, 0x40
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x140062f28]
movups xmmword [rcx + 0x10], xmm1
add rcx, 0x28
call fcn.14002be70
mov qword [rbx + 0x20], 0
add rsp, 0x20
pop rbx
ret
Function at 0x14002d830
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14008e1c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov edi, edx
mov rbx, rcx
mov edx, 0x5c
lea rcx, [rsp + 0x20]
mov rsi, r8
call fcn.14002be70
xor eax, eax
mov dword [rsp + 0x28], 0x67452301
mov r8d, edi
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov dword [rsp + 0x2c], 0xefcdab89
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
mov dword [rsp + 0x38], 0xc3d2e1f0
call fcn.14002dae0
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14002d8d0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400496c0
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret

Function at 0x140032720
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
mov r8d, esi
mov eax, 2
mul r8
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.140049364
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor esi, esi
test eax, eax
jne 0x140032792
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140032794
mov eax, esi
lea r8, str.boost::filesystem::current_path
mov rdx, rbp
mov ecx, eax
call fcn.140032800
mov qword [r14], rsi
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
nop dword [rax + rax]
inc rdi
cmp word [rbx + rdi*2], si
jne 0x1400327c0
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140030b90
nop
mov rcx, rbx
call fcn.14004935c
mov rax, r14
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140032be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14008e1c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140032c15
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15d, eax
cmp eax, 0xffffffff
jne 0x140032c36
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140032ac0
jmp 0x140032d9d
xor ebp, ebp
bt r15d, 0xa
jae 0x140032d68
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140032c50
mov rdx, qword [rdi]
mov qword [rsp + 0x48], rbp
movdqa xmm0, xmmword [0x14004f0c0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], bp
jne 0x140032c70
lea rcx, [rsp + 0x48]
call fcn.140030b90
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140032d08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032d02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032d02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004935c
nop
movdqa xmm0, xmmword [0x14004f0c0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], bp
cmp rbx, 0xffffffffffffffff
jne 0x140032d32
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140032ac0
nop
jmp 0x140032d9d
mov rcx, rdi
call fcn.1400328c0
test al, al
jne 0x140032d5e
mov edx, r15d
mov rcx, rdi
call fcn.140032990
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140032d9d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x140032d80
mov dword [r14], ebp
mov byte [r14 + 4], 0
lea rax, [0x14004dd00]
mov qword [r14 + 8], rax
mov ebx, r15d
mov edx, r15d
mov rcx, rdi
call fcn.140032990
and ebx, 0x10
setne bpl
add ebp, 2
mov dword [rsi], ebp
mov dword [rsi + 4], eax
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400496c0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140035730
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x18
mov rax, qword [0x14008e1c0]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r9d, edx
mov r11, rcx
test edx, edx
jne 0x140035764
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400496c0
add rsp, 0x18
ret
mov rcx, qword [r8]
mov qword [rsp], rcx
movzx eax, cl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [rsp + 1]
xor edx, eax
movzx eax, byte [rsp + 2]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 3]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 4]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 5]
imul edx, r8d, 0x1000193
xor edx, eax
movzx eax, byte [rsp + 6]
imul r8d, edx, 0x1000193
xor r8d, eax
movzx eax, byte [rsp + 7]
imul edx, r8d, 0x1000193
xor edx, eax
imul r8d, edx, 0x1000193
xor edx, edx
mov eax, r8d
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x140035804
cmp qword [rax + 8], rcx
je 0x140035804
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x1400357f3
test r10, r10
je 0x14003580c
mov dword [r10], r8d
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1400496c0
add rsp, 0x18
ret

Function at 0x140035f70
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400360a6
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov qword [rsp + 0x10], rbp
mov rdi, r8
lea rbp, [0x140073130]
mov rsi, rdx
mov r11, rcx
xor ebx, ebx
nop dword [rax + rax]
movzx r8d, byte [rbx + rsi]
movzx r10d, byte [r11 + 0x40]
movzx eax, r8b
xor al, byte [r11 + r10]
lea r9, [r11 + r10]
mov byte [r9 + 0x20], al
mov ecx, r8d
mov byte [r9 + 0x10], r8b
movzx eax, byte [r11 + 0x41]
xor rcx, rax
movzx eax, byte [r9 + 0x30]
movzx edx, byte [rcx + rbp]
xor edx, eax
lea eax, [r10 + 1]
and eax, 0xf
mov byte [r9 + 0x30], dl
mov byte [r11 + 0x41], dl
mov byte [r11 + 0x40], al
test al, al
jne 0x14003608a
xor dl, dl
xor r8b, r8b
nop dword [rax]
nop dword [rax + rax]
lea rax, [r11 + 1]
mov r9d, 8
nop word [rax + rax]
movzx ecx, dl
lea rax, [rax + 6]
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 7], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 6], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 5], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 4], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 3], dl
movzx edx, byte [rcx + rbp]
movzx ecx, byte [rax - 2]
xor edx, ecx
mov byte [rax - 2], dl
sub r9, 1
jne 0x140036010
add dl, r8b
inc r8b
cmp r8b, 0x12
jb 0x140036000
inc rbx
cmp rbx, rdi
jb 0x140035fa0
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
Function at 0x1400360b0
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, byte [rcx + 0x40]
lea r11, [0x140073130]
lea r8, [rcx + r9]
movzx eax, dl
mov byte [r8 + 0x10], dl
mov r10, rcx
xor al, byte [r8]
mov byte [r8 + 0x20], al
movzx eax, byte [rcx + 0x41]
movzx edx, dl
xor rdx, rax
movzx eax, byte [r8 + 0x30]
movzx ecx, byte [rdx + r11]
xor ecx, eax
lea eax, [r9 + 1]
and eax, 0xf
mov byte [r8 + 0x30], cl
mov byte [r10 + 0x41], cl
mov byte [r10 + 0x40], al
test al, al
jne 0x1400361a0
xor dl, dl
xor r8b, r8b
nop word [rax + rax]
lea rax, [r10 + 1]
mov r9d, 8
nop word [rax + rax]
movzx ecx, dl
lea rax, [rax + 6]
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 7], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 6], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 5], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 4], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [rax - 3], dl
movzx edx, byte [rcx + r11]
movzx ecx, byte [rax - 2]
xor edx, ecx
mov byte [rax - 2], dl
sub r9, 1
jne 0x140036120
add dl, r8b
inc r8b
cmp r8b, 0x12
jb 0x140036110
ret
Function at 0x140046bb0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, eax
test eax, eax
jne 0x140046bce
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor edx, edx
cmp rcx, rbx
cmovb ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140049020
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14004905a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14004905f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400490a8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14007d3a0]
cmp byte [rcx + rax], 0
je 0x1400490a8
dec r8
sub rdx, 1
jne 0x14004908e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140049fbc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004a006
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004a006
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004a006
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004a006
cmp dword [rcx + 0x84], 0xe
jbe 0x14004a006
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004a008
xor al, al
add rsp, 0x28
ret
Function at 0x140005660
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rax, qword [0x140030010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
test edx, edx
jne 0x1400056b9
lea r8d, [rdi + 7]
lea rdx, str._Error_
lea rcx, [rsp + 0x30]
call fcn.14000f6a0
mov r8d, 0x10
lea rdx, [0x140021e48]
lea rcx, [rsp + 0x30]
call fcn.14000f6a0
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400056dd
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000f6a0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
jae 0x14000571b
lea rax, [rcx + 1]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, qword [rsp + 0x30]
mov dword [rax + rcx*2], 0xa
jmp 0x14000572b
mov r9d, 0xa
lea rcx, [rsp + 0x30]
call fcn.14000ff80
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140005788
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005783
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005783
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001d9e0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400057d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400057d1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400057fd
mov rcx, r8
call fcn.14001d9e0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001d660
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3