joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400af730
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14037da08]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5f1c], ecx
test rbx, rbx
je 0x1400af79f
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.1400af600
lea rdx, [0x140327200]
mov rcx, rbx
mov rdi, rax
call fcn.1400c7020
mov rbx, rax
test rax, rax
je 0x1400af79a
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x1400afa00
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [0x1403271f8]
call fcn.1400c7020
mov rbx, rax
test rax, rax
je 0x1400afb86
mov qword [rsp + 0x30], rsi
mov rcx, rax
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400afb73
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400afb73
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400afb73
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400afb73
cmp rdi, 0xffffffffffffffff
je 0x1400afb73
mov rcx, rdi
call fcn.1400c1c60
mov rsi, rax
test rax, rax
je 0x1400afb73
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1400afad7
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp fcn.1400c1bd0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1400afaed
mov rdx, rdi
mov rcx, rsi
call fcn.1400af7b0
mov r8, qword [0x14037da08]
test r8, r8
je 0x1400afb5a
movsx rdx, word [r8 + 0x6078]
lea rcx, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f90]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x1400afb4f
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rcx, [r8 + 0x607c]
lea rcx, [rcx + rax*8]
xor eax, eax
mov dword [rcx], r9d
mov dword [rcx + 4], eax
inc word [rcx + 6]
inc dword [r8 + 0x6074]
mov rcx, rsi
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x1400afba0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14037da08]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1400afc03
mov qword [rsp], rbx
lea rbx, [0x140130f00]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400afbe3
cmp byte [r8], r9b
jne 0x1400afbe3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400afbd0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f30]
not eax
mov r8, qword [r10 + 0x5f38]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x1400afc2f
cmp dword [r8 + 8], eax
je 0x1400afc36
add r8, 0x48
cmp r8, rcx
jne 0x1400afc20
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret

Function at 0x1400b0170
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5fc0], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x1400b01f3
xor edx, edx
add rcx, 0x5fc8
call fcn.14001a780
mov r8, rsi
lea rcx, [rbx + 0x5fc8]
mov rdx, rbp
call fcn.1400c5a80
mov eax, dword [rbx + 0x5fc8]
xor edx, edx
mov r9, qword [rbx + 0x5fc0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x5fd0]
cmove ecx, edx
test rax, rax
movsxd r8, ecx
mov edx, 1
lea rcx, [0x14037d18c]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400b01ff
add rcx, 0x5fc8
call fcn.1400c5a80
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c2960
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x120]
lea r10, [0x140130f00]
mov rax, qword [rcx + 0x108]
movss xmm1, dword [rcx + 0x124]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0x100]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret

Function at 0x1400c2b60
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x140130f00]
mov rax, qword [rcx + 0x108]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
sar eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
sar eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov eax, r10d
xor rdx, rcx
sar eax, 0x18
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x4084], ebx
jne 0x1400c2bf8
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.1400ae040
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400c6830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x10
mov qword [rsp + 0x30], rbx
lea r13, [0x140000000]
mov qword [rsp + 0x38], rbp
mov rdi, rdx
mov qword [rsp + 0x40], rsi
mov rax, rcx
mov qword [rsp + 8], r14
xor r12d, r12d
mov qword [rsp], r15
test rdi, rdi
je 0x1400c6870
cmp rax, rdi
jae 0x1400c69e8
movzx r8d, byte [rax]
test r8b, r8b
je 0x1400c69e8
xor ebx, ebx
mov ecx, r8d
shr rcx, 3
mov rdx, rdi
movsx r9, byte [rcx + r13 + 0x327410]
test r9d, r9d
sete bl
add ebx, r9d
test rdi, rdi
jne 0x1400c68a6
movsxd rdx, ebx
add rdx, rax
xor esi, esi
lea rcx, [rax + 1]
cmp rax, rdx
cmovb esi, r8d
cmp rcx, rdx
jae 0x1400c68be
movzx r15d, byte [rcx]
jmp 0x1400c68c1
xor r15b, r15b
lea rcx, [rax + 2]
cmp rcx, rdx
jae 0x1400c68d0
movzx r14d, byte [rcx]
jmp 0x1400c68d3
xor r14b, r14b
lea rcx, [rax + 3]
cmp rcx, rdx
jae 0x1400c68e1
movzx ebp, byte [rcx]
jmp 0x1400c68e4
xor bpl, bpl
lea r10, [r9*4]
movzx ecx, sil
mov r9d, dword [r10 + r13 + 0x327448]
and r9d, ecx
movzx r8d, r15b
shl r9d, 6
mov ecx, r8d
and ecx, 0x3f
movzx edx, r14b
or r9d, ecx
movzx r11d, bpl
shl r9d, 6
and r8d, 0xc0
mov ecx, edx
and edx, 0xc0
and ecx, 0x3f
or r9d, ecx
mov ecx, r11d
shr r11d, 2
and ecx, 0x3f
or r11d, edx
shl r9d, 6
shr r11d, 2
or r9d, ecx
mov ecx, dword [r10 + r13 + 0x3273f8]
or r11d, r8d
shr r9d, cl
shr r11d, 2
mov edx, r9d
cmp r9d, dword [r10 + r13 + 0x3273e0]
sbb ecx, ecx
and edx, 0xfffff800
and ecx, 0x40
xor r8d, r8d
or r11d, ecx
mov ecx, 0x80
cmp edx, 0xd800
cmove r8d, ecx
xor edx, edx
or r11d, r8d
mov ecx, 0x100
cmp r9d, 0xffff
cmova edx, ecx
mov ecx, dword [r10 + r13 + 0x327430]
or r11d, edx
xor r11d, 0x2a
sar r11d, cl
test r11d, r11d
je 0x1400c69da
xor edx, edx
test bpl, bpl
setne dl
xor ecx, ecx
test r14b, r14b
setne cl
add edx, ecx
xor ecx, ecx
test r15b, r15b
setne cl
add edx, ecx
xor ecx, ecx
test sil, sil
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
movsxd rcx, ebx
add rax, rcx
inc r12d
jmp 0x1400c6862
mov r15, qword [rsp]
mov eax, r12d
mov r14, qword [rsp + 8]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x10
pop r13
pop r12
pop rdi
ret
Function at 0x1400c6a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
movsxd rax, edx
mov rdi, rcx
dec rax
mov qword [r11 + 0x20], rsi
mov rsi, r9
xor r9d, r9d
lea rax, [rcx + rax*2]
mov qword [rsp], rax
cmp rcx, rax
jae 0x1400c6c37
mov qword [r11 + 0x18], rbp
lea rbp, [0x140000000]
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
nop
test rsi, rsi
je 0x1400c6a7e
cmp r8, rsi
jae 0x1400c6c14
movzx edx, byte [r8]
test dl, dl
je 0x1400c6c14
xor ebx, ebx
mov eax, edx
shr rax, 3
mov rcx, rsi
movsx r9, byte [rax + rbp + 0x327410]
test r9d, r9d
sete bl
add ebx, r9d
test rsi, rsi
jne 0x1400c6ab2
movsxd rcx, ebx
add rcx, r8
xor r14d, r14d
lea rax, [r8 + 1]
cmp r8, rcx
cmovb r14d, edx
cmp rax, rcx
jae 0x1400c6acb
movzx r13d, byte [rax]
jmp 0x1400c6ace
xor r13b, r13b
lea rax, [r8 + 2]
cmp rax, rcx
jae 0x1400c6add
movzx r12d, byte [rax]
jmp 0x1400c6ae0
xor r12b, r12b
lea rax, [r8 + 3]
cmp rax, rcx
jae 0x1400c6aef
movzx r15d, byte [rax]
jmp 0x1400c6af2
xor r15b, r15b
lea r10, [r9*4]
movzx eax, r14b
mov ebp, dword [r10 + rbp + 0x327448]
and ebp, eax
movzx r9d, r13b
shl ebp, 6
mov eax, r9d
and eax, 0x3f
movzx edx, r12b
or ebp, eax
movzx r11d, r15b
shl ebp, 6
and r9d, 0xc0
mov eax, edx
and edx, 0xc0
and eax, 0x3f
or ebp, eax
mov eax, r11d
shr r11d, 2
and eax, 0x3f
or r11d, edx
shl ebp, 6
or ebp, eax
shr r11d, 2
or r11d, r9d
lea rax, [0x140000000]
mov ecx, dword [r10 + rax + 0x3273f8]
shr r11d, 2
shr ebp, cl
mov ecx, 0x100
cmp ebp, dword [r10 + rax + 0x3273e0]
sbb eax, eax
xor r9d, r9d
and eax, 0x40
mov edx, r9d
or r11d, eax
mov eax, ebp
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0x80
cmove edx, eax
mov eax, r9d
or r11d, edx
cmp ebp, 0xffff
cmova eax, ecx
lea rcx, [0x140000000]
mov ecx, dword [r10 + rcx + 0x327430]
or r11d, eax
xor r11d, 0x2a
sar r11d, cl
test r11d, r11d
je 0x1400c6bf6
test r15b, r15b
mov eax, r9d
mov ecx, r9d
mov ebp, 0xfffd
setne cl
test r12b, r12b
setne al
add ecx, eax
mov eax, r9d
test r13b, r13b
setne al
add ecx, eax
mov eax, r9d
test r14b, r14b
setne al
add ecx, eax
cmp ebx, ecx
cmovl ecx, ebx
mov ebx, ecx
mov word [rdi], bp
add rdi, 2
movsxd rax, ebx
lea rbp, [0x140000000]
add r8, rax
cmp rdi, qword [rsp]
jb 0x1400c6a70
mov rcx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov word [rdi], r9w
test rax, rax
je 0x1400c6c4d
mov qword [rax], r8
sub rdi, rcx
sar rdi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1400c7160
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400c71bd
lea rbx, [0x140130f00]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400c71a4
cmp r10, 2
jb 0x1400c71a4
cmp byte [r9], r8b
jne 0x1400c71a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400c7180
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400c71ff
lea rbx, [0x140130f00]
cmp r8b, 0x23
jne 0x1400c71e3
cmp byte [r9], r8b
jne 0x1400c71e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400c71d0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x1400cce60
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov r10, rdx
mov eax, 0x5e6ea9af
mul r8d
mov ebx, r8d
xor r9d, r9d
shr edx, 0xb
mov esi, r8d
imul eax, edx, 0x15b0
mov ecx, 1
sub ebx, eax
test r8d, r8d
je 0x1400ccfac
mov qword [rsp + 0x20], rdi
xor r11d, r11d
cmp ebx, 7
jbe 0x1400ccf0e
mov edx, 7
nop word [rax + rax]
movzx eax, byte [r10]
add r11d, 8
add ecx, eax
add edx, 8
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add ecx, eax
add r10, 8
add r9d, ecx
cmp edx, ebx
jb 0x1400cceb0
xor edx, edx
xor r8d, r8d
cmp r11d, ebx
jae 0x1400ccf74
mov eax, ebx
sub eax, r11d
cmp eax, 2
jb 0x1400ccf61
mov eax, ebx
sub eax, r11d
sub eax, 2
shr eax, 1
inc eax
mov edi, eax
lea r11d, [r11 + rax*2]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add edx, ecx
add r10, 2
add ecx, eax
add r8d, ecx
sub rdi, 1
jne 0x1400ccf40
cmp r11d, ebx
jae 0x1400ccf6d
movzx eax, byte [r10]
add ecx, eax
add r9d, ecx
inc r10
lea eax, [r8 + rdx]
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
sub esi, ebx
mov ebx, 0x15b0
jne 0x1400cce98
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
shl r9d, 0x10
lea eax, [rcx + r9]
pop rsi
ret
Function at 0x1400e6550
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14037da08]
test rax, rax
je 0x1400e656b
mov rbx, qword [rax + 0x90]
jmp 0x1400e656d
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400e6598
mov dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x140001240
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, r8
mov rsi, rcx
mov r14, qword [rdx]
mov bl, byte [r14 + 0x18]
mov r15, rdi
add r15, 0x10
mov r8, qword [rdi + 0x10]
cmp qword [rdi], r8
je 0x14000126d
jmp 0x140001290
mov rcx, rdi
mov rdx, r8
mov r8d, 1
mov r9d, 1
mov qword [rsp + 0x20], 1
call fcn.140053080
mov r8, qword [r15]
mov eax, dword [0x1400d4010]
sub eax, dword [0x1400d4014]
mov ecx, 0x69054e13
xor edx, edx
div ecx
and eax, 0x7e9b7c79
and eax, 0x51312571
cmp eax, 0x998d2183
je 0x1400013df
jmp 0x1400012bc
mov ecx, dword [0x1400d4018]
sub ecx, dword [0x1400d401c]
xor ecx, 0xbafc8017
add ecx, 0x8e41a0fe
or ecx, 0x6cc44cda
mov r12, rdi
add r12, 8
mov rax, qword [rdi + 8]
mov byte [rax + r8], bl
mov rdx, r8
add rdx, 1
mov qword [r15], rdx
mov bpl, byte [r14 + 0x19]
cmp qword [rdi], rdx
sete al
cmp ecx, 0x58e88cc
jbe 0x1400012bc
test al, 1
jne 0x14000130b
jmp 0x14000132b
mov rcx, rdi
mov r8d, 1
mov r9d, 1
mov qword [rsp + 0x20], 1
call fcn.140053080
mov rdx, qword [r15]
mov rax, qword [r12]
mov byte [rax + rdx], bpl
add rdx, 1
mov qword [r15], rdx
mov rbx, qword [r14 + 0x10]
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov r8d, 1
mov r9, rbx
call fcn.1400511b0
mov rax, qword [rsp + 0x30]
cmp rax, 8
jne 0x1400013af
mov r14, qword [r14 + 8]
mov rdx, qword [r15]
mov rax, qword [rdi]
sub rax, rdx
cmp rax, rbx
jb 0x140001373
jmp 0x140001390
mov rcx, rdi
mov r8, rbx
mov r9d, 1
mov qword [rsp + 0x20], 1
call fcn.140053080
mov rdx, qword [r15]
add rdx, qword [r12]
mov rcx, rdx
mov rdx, r14
mov r8, rbx
call fcn.1400ae6d0
add rbx, qword [r15]
mov qword [r15], rbx
mov eax, 8
jmp 0x1400013ca
mov rcx, qword [rsp + 0x38]
mov qword [rsi + 8], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsi + 0x10], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x18], rcx
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
test al, 0xbf
sbb byte [rsi - 0x40], al
jmp 0x1400013bd
Function at 0x140010d40
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400d4380]
and eax, dword [0x1400d4384]
mov r9d, 0x4eb0ba83
xor edx, edx
div r9d
mov r9d, 0x2f714d74
xor edx, edx
div r9d
mov r9d, 0x74e8dd7c
xor edx, edx
div r9d
cmp eax, 0xd4f15845
je 0x140010dda
jmp 0x140010d79
mov eax, dword [0x1400d4388]
add eax, dword [0x1400d438c]
mov r9d, 0x6c0f8359
xor edx, edx
div r9d
int1
mov edx, eax
or edx, 0x2264d247
sub edx, 0x5bd0e178
mov eax, 0xc9b86fad
sub rax, r8
mov r9, rax
shr r9, 5
xor r9, rax
mov rax, r9
rol rax, 6
xor rax, r9
mov r9, rax
rol r9, 7
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x74fb9ba3
je 0x140010d79
ret
ja 0x140010d8f
int1
shr byte [rbx], 1
stosd dword [rdi], eax
scasb al, byte [rdi]
scasd eax, dword [rdi]
jmp 0x140010d77

Function at 0x1400112c0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400d4390]
xor eax, dword [0x1400d4394]
mov r9d, 0xd800f4dc
xor edx, edx
div r9d
mov r9d, 0x7ff8d20a
xor edx, edx
div r9d
sub eax, 0xce71c50
cmp eax, 0xc3921c8
jb 0x140011351
jmp 0x1400112f3
mov eax, dword [0x1400d4398]
or eax, dword [0x1400d439c]
mov r9d, 0xae605689
xor edx, edx
div r9d
add eax, 0xd944b814
mov r9d, 0xe85465ee
xor edx, edx
div r9d
mov edx, eax
mov rax, r8
xor rax, 0x687ec922
add rax, 0x4cbfa8e9
xor rax, 0x4d373659
mov r9, rax
rol r9, 2
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x9378c3bb
jae 0x1400112f3
ret
nop
cmpsb byte [rsi], byte [rdi]
hlt

Function at 0x140011940
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400d43c0]
and eax, dword [0x1400d43c4]
mov r9d, 0xe14e4a88
xor edx, edx
div r9d
add eax, 0x46039f46
and eax, 0x52dadd6
cmp eax, 0x26849863
ja 0x1400119c7
jmp 0x14001196d
mov edx, dword [0x1400d43c8]
xor edx, dword [0x1400d43cc]
add edx, 0x99702ef2
add edx, 0x77ed84d1
or edx, 0x4546a1b1
mov rax, r8
add rax, 0xffffffffc70d4b39
mov r9, rax
shr r9, 0xd
xor r9, rax
mov rax, 0xffffffffce0a0523
sub rax, r9
mov r9, rax
rol r9, 1
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x29c11c16
jb 0x14001196d
ret
xchg esi, eax
pop rdx
push rbx
or ebx, dword [rdi - 0x53]
clts
jmp 0x14001196b

Function at 0x140012050
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400d43e0]
xor eax, dword [0x1400d43e4]
mov r9d, 0xdaa177f1
xor edx, edx
div r9d
imul eax, eax, 0x9a8af70c
mov r9d, 0x184236c4
xor edx, edx
div r9d
cmp eax, 0x9c35938c
ja 0x1400120d9
jmp 0x140012084
mov eax, dword [0x1400d43e8]
xor edx, edx
div dword [0x1400d43ec]
mov edx, eax
or edx, 0x3d0b797b
or edx, 0xb35f2ac7
xor edx, 0xeec7cfed
mov rax, r8
add rax, 0xffffffffc59430d2
mov r9, rax
rol r9, 7
xor r9, rax
mov r10, r9
rol r10, 4
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x50a5cb6
jbe 0x140012084
ret
iretd
Function at 0x1400127c0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400d4420]
xor edx, edx
div dword [0x1400d4424]
add eax, 0xcb9aba6e
imul eax, eax, 0xb06bfa21
add eax, 0x1d7967d6
cmp eax, 0x81a6cfb8
ja 0x140012842
jmp 0x1400127ea
mov eax, dword [0x1400d4428]
imul eax, dword [0x1400d442c]
add eax, 0xc5715e03
imul edx, eax, 0x1235802d
add edx, 0xe4b18049
imul rax, r8, 0xffffffffd7597ab1
movabs r9, 0xbe5d08ef7c1918c
add rax, r9
xor rax, 0x51df1264
mov r9, rax
rol r9, 7
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x4d8d4fab
je 0x1400127ea
ret
sub al, byte [rdi - 0xe]
pop rdx
fadd qword [rdi + 0x70]
sar dword [rsi + 0x5a], cl
jmp 0x1400127e8

Function at 0x140012850
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400d4430]
and eax, dword [0x1400d4434]
and eax, 0xe0ef6b58
xor eax, 0x2e7bfc72
or eax, 0xdbb4248b
cmp eax, 0xbc1f54e0
je 0x1400128c6
jmp 0x140012877
mov eax, dword [0x1400d4438]
xor edx, edx
div dword [0x1400d443c]
or eax, 0x8987920
imul eax, eax, 0xd4c89aa2
imul edx, eax, 0x13564952
mov rax, r8
rol rax, 1
xor rax, r8
imul rax, rax, 0x7a57585d
mov r9, rax
rol r9, 2
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x1256b034
jb 0x140012877
ret
xchg ebp, eax
push rdi
fmul qword [rcx + 0x39]
push rdi
shr byte [rcx + 0x2c], 1
sal dword [rbp + rbx*4 - 0x15], 1
movabs eax, dword [0xcccccccccccccccc]
int3

Function at 0x1400139b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400d4470]
xor edx, edx
div dword [0x1400d4474]
sub eax, 0x10fafee3
imul eax, eax, 0x95e1dfd6
imul eax, eax, 0x1455435f
cmp eax, 0xc98676fe
je 0x140013a23
jmp 0x1400139db
mov edx, dword [0x1400d4478]
and edx, dword [0x1400d447c]
or edx, 0x6df602b1
or edx, 0x507801ab
sub edx, 0x8eeb32c6
mov rax, 0xffffffffb4f70442
sub rax, r8
mov r9, rax
rol r9, 2
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x6df7567
jb 0x1400139db
ret
sal cl, 1
add eax, 0xaca070ee
xlatb
push rsi
invalid
Function at 0x140014360
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
movzx eax, byte [rsi + 0x18]
test eax, eax
je 0x140014394
jmp 0x140014374
mov ecx, eax
sub ecx, 3
je 0x140014404
jmp 0x140014381
sub eax, 4
je 0x14001442d
jmp case.0x140014486.0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rdi, qword [rsi]
cmp rdi, 0
je case.0x140014486.0
mov eax, dword [0x1400d4510]
and eax, dword [0x1400d4514]
xor eax, 0xa6ed5085
sub eax, 0x34bffe81
add eax, 0x821b3563
cmp eax, 0xaaf8bc05
ja 0x1400144d8
jmp 0x1400143c5
mov eax, dword [0x1400d4518]
and eax, dword [0x1400d451c]
mov ecx, 0xcfa8e658
xor edx, edx
div ecx
mov ebx, eax
sub ebx, 0x41359402
xor ebx, 0x755b7741
mov rcx, qword [rsi + 8]
mov rdx, rdi
mov r8d, 1
call fcn.1400541d0
cmp ebx, 0xfdbb9dda
je 0x1400143c5
jmp case.0x140014486.0
cmp word [rsi + 0x20], 3
jne case.0x140014486.0
mov rsi, qword [rsi + 0x28]
mov rcx, rsi
call fcn.14005e720
test al, 1
jne 0x140014420
jmp case.0x140014486.0
mov rcx, rsi
call fcn.14005f740
jmp case.0x140014486.0
cmp byte [rsi + 0xb8], 3
jne 0x140014442
mov rcx, rsi
add rcx, 0x70
call fcn.140017100
cmp dword [rsi + 0x28], 0
je 0x140014465
mov rdx, qword [rsi + 0x40]
cmp rdx, 0
je 0x140014465
mov rcx, qword [rsi + 0x30]
shl rdx, 5
mov r8d, 4
call fcn.1400541d0
mov rax, qword [rsi + 0x20]
cmp rax, 0
je case.0x140014486.0
mov ecx, eax
and ecx, 3
lea rdx, [0x1400b4104]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
push rdi
mov dh, 0x2f
push 0xffffffffffffff93
imul dx, word [rdx + 0x48], 0xff8b
or byte [rax - 0x77], r9b
cli
mov r8d, 1
call fcn.1400541d0
jmp 0x1400143c3