joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180096a40
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0xb0
mov rax, qword [0x1800e3db0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov esi, ecx
mov r9d, 0x78
and ecx, 0x3ff
mov rbp, r8
mov ebx, edx
lea edx, [r9 - 0x77]
lea r8, [rsp + 0x20]
bts ecx, 0xa
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x180096b29
movzx ecx, byte [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0xc8], rdi
test cl, cl
lea r8, [rsp + 0x20]
mov edi, edx
je 0x180096ada
nop
lea eax, [rcx - 0x61]
add r8, 1
cmp al, 5
ja 0x180096ac0
add cl, 0xd9
jmp 0x180096aca
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x180096aca
add cl, 0xf9
movsx eax, cl
mov cl, byte [r8]
add edi, edi
test cl, cl
lea edi, [rax + rdi*8 - 0x30]
jne 0x180096ab0
cmp esi, edi
je 0x180096b1c
test ebx, ebx
je 0x180096b1c
mov rdi, qword [rbp]
movzx eax, byte [rdi]
lea rcx, [rdi + 1]
nop
cmp al, 0x41
jl 0x180096af8
cmp al, 0x5a
jle 0x180096afe
sub al, 0x61
cmp al, 0x19
ja 0x180096b09
mov al, byte [rcx]
add edx, 1
add rcx, 1
jmp 0x180096af0
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp edx, ecx
je 0x180096b21
mov eax, 1
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18007e6b0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x180097b50
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1800e3db0]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x180097b97
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18007e6b0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.1800b17d0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18007e6b0
add rsp, 0x38
ret
Function at 0x1800aa9e0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.18008bf90
xor ebx, ebx
cmp qword [0x1801118e8], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x1800aab0c
lea rcx, [0x1800f0eb0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x1800aac1f
lea rdx, [0x1800f0ea0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800aac1f
mov rcx, rax
call fcn.18008bec0
lea rdx, [0x1800f0e90]
mov rcx, rsi
mov qword [0x1801118e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.18008bec0
lea rdx, [0x1800f0e78]
mov rcx, rsi
mov qword [0x1801118f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.18008bec0
lea rcx, [rsp + 0x98]
mov qword [0x1801118f8], rax
call fcn.180080480
test eax, eax
je 0x1800aaabf
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.18007f2c0
cmp dword [rsp + 0x98], 2
jne 0x1800aab0c
lea rdx, [0x1800f0e58]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.18008bec0
test rax, rax
mov qword [0x180111908], rax
je 0x1800aab0c
lea rdx, [0x1800f0e40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.18008bec0
mov qword [0x180111900], rax
mov rcx, qword [0x180111900]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x1800aabb8
cmp qword [0x180111908], rbp
je 0x1800aabb8
call fcn.18008c080
mov rcx, qword [0x180111908]
mov rsi, rax
call fcn.18008c080
test rsi, rsi
mov r12, rax
je 0x1800aabb8
test rax, rax
je 0x1800aabb8
call rsi
test rax, rax
je 0x1800aab83
lea rcx, [rsp + 0x34]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800aab83
test byte [rsp + 0x40], 1
jne 0x1800aabb8
lea rcx, [rsp + 0x30]
call fcn.180080570
test eax, eax
je 0x1800aaba5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.18007f2c0
cmp dword [rsp + 0x30], 4
jb 0x1800aabb2
bts edi, 0x15
jmp 0x1800aabf6
bts edi, 0x12
jmp 0x1800aabf6
mov rcx, qword [0x1801118f0]
cmp rcx, rbp
je 0x1800aabf6
call fcn.18008c080
test rax, rax
je 0x1800aabf6
call rax
test rax, rax
mov rbx, rax
je 0x1800aabf6
mov rcx, qword [0x1801118f8]
cmp rcx, rbp
je 0x1800aabf6
call fcn.18008c080
test rax, rax
je 0x1800aabf6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1801118e8]
call fcn.18008c080
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x1800aac1f
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800aac21
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800aacc0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1800e3db0]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x180111910]
mov r15, r9
mov r13d, r8d
test eax, eax
mov r14d, edx
mov rbx, rcx
jne 0x1800aad41
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1800aad24
mov dword [0x180111910], 1
jmp 0x1800aad46
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1800aad3b
mov dword [0x180111910], 2
jmp 0x1800aad6b
mov eax, dword [0x180111910]
cmp eax, 1
jne 0x1800aad5e
mov r9d, dword [rbp + 0x60]
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1800aae72
cmp eax, 2
je 0x1800aad6b
test eax, eax
jne 0x1800aae70
mov esi, dword [rbp + 0x68]
xor edi, edi
test esi, esi
jne 0x1800aad7a
mov rax, qword [rbx]
mov esi, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
movsxd r12, eax
je 0x1800aae70
jle 0x1800aae70
xor edx, edx
mov rax, 0xffffffffffffffe0
mov rcx, r12
div r12
cmp rax, 1
jb 0x1800aae70
add rcx, 0x10
cmp rcx, 0x400
ja 0x1800aadf8
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1800aadd6
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800c9a20
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1800aae70
mov dword [rbx], 0xcccc
jmp 0x1800aae0b
call fcn.18008cec0
test rax, rax
mov rbx, rax
je 0x1800aae0f
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x1800aae70
mov r9d, r12d
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1800aae5a
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
mov r8, rbx
test eax, eax
lea edx, [r9 + 2]
mov ecx, esi
jne 0x1800aae49
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1800aae52
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x1800aae6c
call fcn.18007fd70
mov eax, edi
jmp 0x1800aae72
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.18007e6b0
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800aafd0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1800e3db0]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x180111914]
mov r15, r9
mov r13d, r8d
test eax, eax
mov r14d, edx
mov rbx, rcx
jne 0x1800ab088
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1800ab034
mov dword [0x180111914], 1
jmp 0x1800ab096
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1800ab082
mov dword [0x180111914], 2
mov r9d, dword [rbp + 0x60]
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.18007e6b0
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, dword [0x180111914]
cmp eax, 2
je 0x1800ab049
test eax, eax
je 0x1800ab049
cmp eax, 1
jne 0x1800ab0be
mov esi, dword [rbp + 0x68]
xor edi, edi
test esi, esi
jne 0x1800ab0a5
mov rax, qword [rbx]
mov esi, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
movsxd r12, eax
jne 0x1800ab0c2
xor eax, eax
jmp 0x1800ab05c
jle 0x1800ab0be
xor edx, edx
mov rax, 0xffffffffffffffe0
div r12
cmp rax, 2
jb 0x1800ab0be
lea rcx, [r12 + r12 + 0x10]
cmp rcx, 0x400
ja 0x1800ab115
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1800ab0f7
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800c9a20
sub rsp, rax
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x1800ab0be
mov dword [rbx], 0xcccc
jmp 0x1800ab128
call fcn.18008cec0
test rax, rax
mov rbx, rax
je 0x1800ab12c
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x1800ab0be
mov r9d, r12d
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1800ab17f
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
xor edx, edx
test eax, eax
mov qword [rsp + 0x38], rdi
mov r8, rbx
mov ecx, esi
mov qword [rsp + 0x30], rdi
jne 0x1800ab16e
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1800ab177
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x1800ab191
call fcn.18007fd70
mov eax, edi
jmp 0x1800ab05c
Function at 0x1800bdf60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x44]
mov qword [rsp + 0x40], r12
mov rbp, rcx
mov qword [rsp + 0x48], r13
nop
mov edx, dword [rbp + 0x94]
mov ebx, dword [rbp + 0x58]
mov eax, dword [rbp + 0x44]
sub ebx, dword [rbp + 0x9c]
lea ecx, [rdi + rax - 0x106]
sub ebx, edx
cmp edx, ecx
jb 0x1800be01c
mov rcx, qword [rbp + 0x50]
mov r8, rdi
lea rdx, [rcx + rdi]
call fcn.180080e60
mov r8d, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
sub dword [rbp + 0x98], edi
sub dword [rbp + 0x94], edi
sub dword [rbp + 0x84], edi
lea rdx, [rax + r8*2]
nop
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, edi
jb 0x1800bdfe0
sub eax, edi
jmp 0x1800bdfe2
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x1800bdfd0
mov rax, qword [rbp + 0x60]
mov edx, edi
lea rcx, [rax + rdi*2]
nop
nop
nop
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, edi
jb 0x1800be010
sub eax, edi
jmp 0x1800be012
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x1800be000
add ebx, edi
mov rsi, qword [rbp]
cmp dword [rsi + 8], 0
je 0x1800be0fb
mov eax, dword [rbp + 0x94]
mov r13d, dword [rbp + 0x9c]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rbp + 0x50]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x1800be0a2
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x1800be074
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.1800c20e0
mov dword [rsi + 0x4c], eax
jmp 0x1800be08a
cmp ecx, 2
jne 0x1800be08a
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.1800c20d0
mov dword [rsi + 0x4c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call fcn.180080e60
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rbp + 0x9c], r12d
mov r9d, dword [rbp + 0x9c]
cmp r9d, 3
jb 0x1800be0e4
mov eax, dword [rbp + 0x94]
mov rdx, qword [rbp + 0x50]
mov ecx, dword [rbp + 0x80]
movzx r8d, byte [rax + rdx]
add eax, 1
mov dword [rbp + 0x70], r8d
movzx eax, byte [rax + rdx]
shl r8d, cl
xor r8d, eax
and r8d, dword [rbp + 0x7c]
mov dword [rbp + 0x70], r8d
cmp r9d, 0x106
jae 0x1800be0fb
mov rax, qword [rbp]
cmp dword [rax + 8], 0
jne 0x1800bdf80
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001487
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14007ed80]
mov dword [rax], 1
mov rax, qword [0x14007ed90]
mov dword [rax], 1
mov rax, qword [0x14007eda0]
mov dword [rax], 1
mov rax, qword [0x14007ed00]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d8
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001504
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000152a
cmp eax, 0x20b
je 0x140001551
jmp 0x140001580
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000153d
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000156c
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140058c30
Capabilities:
Encode data using xor
Extract resource via kernel32 functions
Hash data with crc32

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
cmp byte [0x140088cb8], 0
mov r12, rcx
mov rdi, rdx
je 0x140058cb8
lea rdx, [0x14007d56a]
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140058dc0
mov rsi, qword [0x140088cb0]
jmp 0x140058c75
lea rsi, [rdx + rax + 4]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strcmp
mov rcx, rsi
mov ebx, eax
call sub.msvcrt.dll_strlen
lea rdx, [rsi + rax + 1]
mov eax, dword [rdx]
test ebx, ebx
jne 0x140058c70
movzx r8d, word [rdx + 4]
lea r9, [rdx + 6]
mov rcx, r12
mov rdx, r9
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.140051f70
mov r8d, 0xa
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
mov r9d, dword [rax]
mov eax, dword [rax + 4]
lea rcx, [rdx + 8]
mov qword [0x140088cb0], rcx
test eax, eax
je 0x140058da8
sub eax, 1
lea r8, [rdx + rax + 9]
mov eax, 0xffffffff
nop dword [rax + rax]
movzx edx, byte [rcx]
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
mov eax, edx
shr eax, 1
and edx, 1
add rcx, 1
neg edx
and edx, 0xedb88320
xor eax, edx
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, 0xedb88320
xor eax, edx
cmp r8, rcx
jne 0x140058d10
not eax
cmp r9d, eax
jne 0x140058e5d
mov byte [0x140088cb8], 1
jmp 0x140058c49
cmp byte [0x140088ca8], 0
jne 0x140058c60
mov rbx, qword [sym.imp.python38.dll_PyDict_New]
lea rsi, [0x140088d68]
call rbx
mov qword [0x140088d00], rax
call rbx
mov qword [0x140088cf8], rax
call rbx
mov qword [0x140088cf0], rax
call rbx
mov qword [0x140088d30], rax
call rbx
mov qword [0x140088d28], rax
call rbx
mov qword [0x140088d20], rax
call rbx
mov qword [0x140088d10], rax
call rbx
mov rbp, qword [sym.imp.python38.dll_PyLong_FromLong]
mov rbx, 0xfffffffffffffffb
mov qword [0x140088d08], rax
nop dword [rax]
mov ecx, ebx
call rbp
add qword [rax], 1
mov qword [rsi + rbx*8], rax
add rbx, 1
cmp rbx, 0x102
jne 0x140058e38
mov byte [0x140088ca8], 1
jmp 0x140058c60
lea rcx, str.Error__corrupted_constants_object
call sub.msvcrt.dll_puts
call sub.msvcrt.dll_abort
nop
nop
Function at 0x140069150
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.140070f10
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.140070f10
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x140069e02
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400896c8]
test eax, eax
je 0x140069e9a
lea rax, [0x1400896a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400896d0]
mov qword [rbp - 8], rax
jmp 0x140069e7e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140069e72
cmp qword [rbp - 0x10], 0
je 0x140069e72
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140069e38
lea rax, [0x1400896a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140069e9b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140069fa0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140069fc8
mov eax, 0
jmp 0x14006a016
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140069ff1
mov eax, 0
jmp 0x14006a016
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14006a011
mov eax, 0
jmp 0x14006a016
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14006a01c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14006a09a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14006a091
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14006a091
mov rax, qword [rbp - 8]
jmp 0x14006a0af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14006a064
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000309c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400030e6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400030e6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400030e6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400030e6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400030e6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400030e8
xor al, al
add rsp, 0x28
ret
Function at 0x14003e500
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14003e542
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14003e54a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14003e55b
jmp 0x14003e572
xor r10d, r10d
jmp 0x14003e5fd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14003e572
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14003e589
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14003e5a9
add r11, r8
jmp 0x14003e6da
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14003e672
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14003e620
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x14003e690
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14003e6a2
jmp 0x14003e6bc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14003e6bc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14003e6d6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret