joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1807eda32
Capabilities:
Enumerate files on windows
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + rdx - 0x3eed02e]
je 0x1806208fd
cmp dword [rsp + 0x70], 0x338a2e79
not dword [rsp + 0x70]
not qword [rsp + 0x68]
call fcn.180084a99
or word [rsp + 0x30], 0x3850
cmp byte [rsp + 0x30], 0xf7
jae 0x1804b87b5
shl word [rsp + 0x20], 0xea
je 0x1800702be
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x58]
ret
add qword [rsp + 0x10], 0x7f98ca71
movabs rbp, 0x712c60542fc71fdc
call fcn.1808605f9
xchg edi, eax
invalid
cmp eax, 0x36916c0
xchg edi, eax
cmp al, 0xe9
clc
stosd dword [rdi], eax
mov bl, 0x37
jmp 0x146ce9fb8
invalid
jns 0x180350522
mov r15b, 0xa
mov bh, 0xa
bnd jbe 0x1803c7b7b
jp 0x1803c7b6b
jp 0x1803c7bca
cmp esp, dword [rsi + 0x5f44adfb]
sar qword [0x1c397ba14], cl
xchg edi, eax
jmp qword [rbx + 0x12a16925]
jge 0x180688ddc
invalid
or bx, 0x40da
xor bl, 0xed
mov rdx, qword [rsp + 0x38]
mov rdx, qword [rdx]
mov qword [rsp + 0x38], rbx
movsx ecx, byte [rsp + rsi*8 - 0x883afb5]
and cl, ch
neg word [rsp + 0x10]
cmp qword [rsp + 0x10], 0x47131b5a
jo 0x1802264d8
shl bpl, 0x1a
cmp byte [rsp + 0x28], 0x7d
not qword [rsp + 0x28]
xchg qword [rsp + rbp - 0xe3ffd0], rsi
mov rbp, qword [rsp + rbp - 0xe3ffe8]
jo 0x1803c7bc2
jae fcn.1800893fe
cmp dword [rsp + 0x10], 0x24d01f6f
mov r8d, 0x6b2233b3
mov r8w, 0x7ecb
call fcn.180938be5
pushfq
push rdx
invalid

Function at 0x18082d8c9
Capabilities:
Packed with generic packer

Disassembly:
sub r10d, r10d
call fcn.1804489cb
pushfq
add qword [rsp + 8], 0x7f43c29b
mov qword [rsp + 8], 0x749bec4f
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.180b8a82a
jl 0x1807a78ab
movabs r14, 0x251673ff5cd93d7a
sub r14w, 0x61d3

Function at 0x180834d80
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
call fcn.180b5900d

Function at 0x18083c0eb
Capabilities:
Encode data using xor

Disassembly:
jge 0x1806607db
jmp loc.18039dae2
mov rbx, qword [rsp + 0x18]
mov rbx, qword [rbx]
or r8, 0x442d550f
movabs r14, 0x16fe2b1549215c38
call fcn.1802456ba
add qword [rsp], 0xffffffffffd730d6
push r8
push r14
push r11
mov r8, qword [rsp]
add byte [rsp], 0x2a
not qword [rsp]
jo 0x180048966
mov dh, 0x55
cmpsd dword [rsi], dword [rdi]
xor bl, byte [rsi]
invalid

Function at 0x1808765e9
Capabilities:
Packed with generic packer
Resume thread

Disassembly:
mov qword [rsp + r14 + 0x1244], r14
push r10
push r8
jns 0x18058c469

Function at 0x18088d004
Capabilities:
Enumerate files on windows
Packed with generic packer

Disassembly:
shufps xmm1, xmmword [rax - 0x73], 0x64
and al, 0x18
call fcn.180b5900d
call fcn.1809fc726
add qword [rsp + 0x28], 0x7f5cfc03
call fcn.1806d73cf
fdiv dword [rdi]
jns 0x1804dffde
push rbp
sub rax, r12
xchg ecx, eax
imul esi, esp, 0x934262e
cmp eax, 0x78b72ac3
invalid
movabs rdi, 0x3e8562a7135438c2
push 0x66f038a0
mov di, r11w
pushfq
and r11, rdi
mov qword [rsp + 0x38], rsi
jne 0x1804dffef
Function at 0x18089b295
Capabilities:
Packed with generic packer

Disassembly:
lea rdx, [rdx + rdx*8 + 0x5f0c0614]
and byte [rsp + 0x18], 0x13
mov eax, 0x45b1cfe8
push rsi
invalid
add al, 0x53
invalid
mov qword [rsp + rdx - 0xd446953], rdx
jae 0x1801f51b9
pop rdi
jrcxz 0x18085883e
scasd eax, dword [rdi]
shr byte [rsi + 0x6afb2d9], 1
sbb al, 0xd
jne 0x18085890b
invalid
je 0x180858879
adc byte [rax + 0x518b79af], cl
mov dl, 0xaf
sub al, 0xee
push rcx
jp 0x180858938
fdiv dword [rsi]
push r8
in al, dx
xchg edi, eax
mov gs, word [rdi - 0x47fbea61]
scasd eax, dword [rdi]
mov edx, 0xaf84db6c
invalid
sti
adc eax, 0x8caf8bf4
test dword [rdx - 0x14], ebx
jg 0x180858937
loopne 0x1808588d9
xchg edi, eax
jg 0x180858956
mov dword [rcx + 0x4878edda], eax
mov edi, 0x7e42e1af
movabs byte [0x5e4295669a7c477f], al
invalid
xor eax, 0x298e1220
and byte [rdx], dl
mov gs, word [rcx]
push rax
cmpsb byte [rsi], byte [rdi]
sbb eax, 0x1e506867
pop rbx
sbb eax, edx
sbb cl, dh
push rbp
xchg r14d, eax
int1
invalid
and eax, 0x155ed1ed
sti
popfq
sti
xchg r9, rax
invalid
add dl, byte [rsp + rdx*2 + 0xf]
setb byte [rsp + rdx*2 + 8]
add qword [rsp + 0x18], 0xffffffffffda91f9
mov rcx, rdx
and edx, dword [rsp + rdx*4 + 8]
sub qword [rsp + rdx + 8], 0x5c163b70
sub byte [rsp + rdx*4 + 8], 0x93
add qword [rsp + rdx], 0x7fa83c05
add edx, 0xd44696b
mov rcx, qword [rsp + rcx*8 + 0x18]
mov rcx, qword [rcx + rdx*2 - 0x1a88d2d6]
add word [rsp + rdx*4 - 0x3511a5a4], 0x4cc
and qword [rsp + rdx*8 - 0x6a234b50], 0x6efa7d69
jne 0x18085889f

Function at 0x18089b309
Capabilities:
Packed with generic packer

Disassembly:
setl cl
mov qword [rsp + 0x48], rsi
call fcn.1809acdf4
Function at 0x18089b32d
Capabilities:
Packed with generic packer

Disassembly:
js 0x1808b5c9a
lea rdx, [rdx + 0x4b082167]
neg dword [rsp + r13 - 0x47e500f0]
not r8d
or r8, qword [rsp + 0x10]
call fcn.18058c7c0
add r9d, dword [rsp + 2]
or bx, r9w
test dword [rsp + rbx - 0x5e27adf8], ecx
mov qword [rsp + rcx*2 + 0x220], r9
jo 0x180988153
lea rax, [rax + r9*2 - 0x30e5ceea]
bswap r15
call fcn.1804dd218
push rax
call fcn.18076d6c5
mov rdi, qword [rsp + r8*2 - 0x230]
mov rdi, qword [rdi + r8 - 0x120]
call fcn.18095853d
lodsb al, byte [rsi]
and dword [rax], eax
add byte [rax], al
loopne 0x1802605cf
invalid
invalid
je 0x180260587
invalid
push rbx
setb r9b
mov qword [rsp + 0x38], rax
mov rbx, r9
push rbx
movabs r13, 0x50f806a70a560b85
js 0x1809ad5eb
pop rbp
call fcn.1802922b4
mov ah, 0xec
or ebp, dword [rbp + 0x3d708346]
push rdi
fdiv dword [rax - 0x22573b78]
je 0x18040c030
push rdi
fmul qword [rbp - 0x9a8c273]
invalid
push rdi
mov byte [rdi - 0x3f573d88], cl
in eax, dx
push rdi
push rdi
cmpsb byte [rsi], byte [rdi]
push rdx
push rdi
invalid
ja 0x18040c095
cmp dl, byte [rdi + 0x10]
movsd dword [rdi], dword [rsi]
mov dl, 0xc9
test al, 0xca
add cl, byte [rax + 0x34]
push rdi
jnp 0x18040c00b
sahf
cmp edx, dword [rdi - 0x72]
cmp esi, esi
shr byte [rax + 0x213903da], 0x93
invalid
invalid
mov rax, qword [rsp + 0x20]
push rsi
push r13
jl 0x180201ee4
movabs rsi, 0x472a60c603aa0f08
shr esi, 0x1a
lea rax, [rax + rsi*2 + 1]
xor esi, r9d
jge 0x1805b281e
shl r9w, 0x62
jae 0x18040bfc1
in eax, 0xe
scasd eax, dword [rdi]
movabs eax, dword [0x51f9a14582bc5f9b]
xchg esi, eax
mov dword [rdi], 0x1c3d148f
jno 0x1805b288d
xchg bl, al
loopne 0x1805b2873
and r13d, dword [rax - 0x4595bac6]
and ebp, dword [rax - 0x4595bac6]
invalid
pushfq
sal ch, 1
xchg ebx, eax
xor eax, 0xb9edc4fd
stc
invalid
invalid
call 0x1bbae9e01
nop
jnp 0x1805b2843
or dword [rbp + rcx*8 + 0x59], ebp
outsd dx, dword [rsi]
push 0xffffffffffffff9c
lodsb al, byte [rsi]
push 0xffffffff82d49dec
sbb edx, dword [rbx - 9]
adc eax, 0x56a78de0
js 0x1805b2920
or al, 0x95
jrcxz 0x1805b285d
invalid
mov bh, ah
retf
lea r8, [r13*4 + 0x481646e1]
neg rbx
add r13d, ebx
jle 0x1805669ca
mov rdx, qword [rsp + r13 - 0x47e50174]
mov rdx, qword [rdx + r13 - 0x47e5017c]
shr r13b, 0xad
mov qword [rsp + 0x10], r13
cmp byte [rsp + 0x10], bh
jb 0x1800195be
pushfq
movabs rcx, 0x6f6a72214b1438e9
lea rcx, [rcx + rcx + 0xa3e1c2b]
bswap rcx
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x2238dbf
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.180ab50a8
push rbx
jge 0x180260559
push r8
movabs r8, 0x1afe7b2a0cf05bae
add qword [rsp + 8], 0xffffffffffeefeda
movabs rdx, 0x303642b90d9c0c9c
neg r8d
jbe 0x180798983
add qword [rsp + 0x30], 0x3ae3b4
Function at 0x1808b638d
Capabilities:
Packed with generic packer

Disassembly:
and word [rsp + 0x88], 0x37dc
neg dword [rsp + 0x88]
or dword [rsp + 0x88], 0x37f66f1e
or word [rsp + 0x88], 0x34a1
shr byte [rsp + 0x88], 0x14
ja 0x1802716c2
call fcn.18067d714
mov rbp, qword [rsp + 0x88]
jg 0x180a07454
adc byte [0x12d205a9e], dl
mov esp, 0xfbf7b7c
invalid
not dword [rsp + rbp*4 - 0x40848344]
jge 0x180a74192
xor dword [rsp + rbp - 0x1021206b], 0x3873252f
mov rbp, qword [rsp + rbp*2 - 0x20424196]
jl 0x1807a2f94
mov ch, 0x96
xchg ecx, eax
loope 0x1808b6398
invalid

Function at 0x18093a6d1
Capabilities:
Packed with generic packer

Disassembly:
or r11, 0xc6f4339
jne 0x180047b1f
idiv dword [rax]
invalid
xchg qword [rsp + rbx + 0x58], rsi
mov r13, qword [rsp + rbx + 0x38]
shl bl, 0x3d
cmp byte [rsp + rbx + 0x28], 0xc3
mov ebx, dword [rsp + rbx + 0x2b]
mov rdx, rbx
lea rdx, [rdx*4 + 0x1f200232]
mov rdx, qword [rsp + 0x10]
ja 0x180a256f3
call fcn.18084e429
push r11
mov r11, r9
neg r9w
jns 0x180368fc4

Function at 0x18093ff71
Capabilities:
Packed with generic packer

Disassembly:
jge 0x1808bd173
mov edx, 0xec1f0ab5
adc dword [rcx - 0x67], 0xffffffcc
fistp dword [rcx + 0x15]
pushfq
mov word [rcx + 0xc9d1995], es
adc ebx, ecx
xor ah, byte [rax + 0x33]
mov dl, 0x92
add al, 0x9a
invalid

Function at 0x18094c1db
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], 0xffffffffd971c540
lea rsp, [rsp + 0x10]
call fcn.180bbd96c

Function at 0x18094f908
Capabilities:
Read file on windows

Disassembly:
xchg qword [rsp + r15 - 0x5aa41b97], rax
mov rdx, qword [rsp + rbp*4 - 0x13ffc4]
shr qword [rsp + r15 - 0x5aa41bbf], 5
add bp, bp
xor qword [rsp + rbp*8 - 0x27ffb0], 0x351d4ba1
call fcn.1802112b3
scasb al, byte [rdi]
invalid

Function at 0x1809500b8
Capabilities:
Packed with generic packer

Disassembly:
jne 0x18066c5ed
jb 0x1809cf2b0
add qword [rsp], 0x7fb946ce
add qword [rsp + 0x20], 0xffffffffffa52955
mov r14, qword [rsp + 0x18]
mov rcx, qword [rsp + r14*2 - 0x30c08daa]
mov qword [rsp + r14 - 0x186046d9], r14
push rbx
lea rcx, [r14*4 + 0x341f7691]
mov rbx, rcx
shr byte [rsp + r14*2 - 0x30c08da2], cl
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + r14*4 - 0x61811b84]
mov qword [rsp + 0x28], r14
je 0x18092614e

Function at 0x1809842b3
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.180b8a82a
imul ebp, dword [rcx - 0x76], 0xffffffe5
fbstp tbyte [rdx + rbp*8]
add al, 0x3c
sub eax, 0xa82611be
or esp, ebx
invalid

Function at 0x18098eeed
Capabilities:
Query environment variable

Disassembly:
movabs rbx, 0x46f03a0480b4443
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x28]
mov rsi, qword [rsi]
jbe 0x1804cc36e
movzx r10d, r10w
movabs rbx, 0x24d18a00bb12610
movsx r10, r11b
call fcn.180895897
Function at 0x180993335
Capabilities:
Encode data using xor

Disassembly:
mov r12, r8
jle 0x1807dc761
push rdx
call fcn.180370880
hlt
pop rdi
push rbx
movabs rbx, 0x481071f331270da6
pushfq
push r8
mov r8, rbx
push rbx
xchg qword [rsp + 0x20], rdi
test ebx, r8d
mov r8, qword [rsp]
movzx r8d, bx
mov bx, r8w
push r9
mov rbx, qword [rsp + r8*8 - 0x6d10]
mov qword [rsp + 0x20], rdi
push r12
push r15
jns 0x18086efeb

Function at 0x18099659c
Capabilities:
Encode data using xor

Disassembly:
sub byte [rbp + 0x24648d48], bl
cmp bl, al
test qword [rsp + 0x10], 0x340772c2
call fcn.18093a179
setns r14b
xor r14d, dword [rsp + 0x12]
mov qword [rsp + r14*2 - 0x9dfcdb4], rcx
lea rsi, [rsi + rdi + 0x533a240e]
add qword [rsp], 0x57dfab
call fcn.18020fd9b
jge 0x18034f63a
loope 0x18034f65b
xor byte [rbx + 0xec07ec7], 0x5b
sar byte [rsi - 1], 0xb8
insb byte [rdi], dx
cmp al, 0x7f
js 0x18034f5fd
int 0xc6
cmp byte [rsi], 0xd5
push rdx
invalid
jg 0x18034f6b9
invalid
invalid
shl r13d, cl
not r9
shr byte [rsp + r9 + 0x1dfc9d0d], cl
mov rsi, qword [rsp + rsi - 0x1dfc9cd4]
mov rsi, qword [rsi]
test rcx, r9
mov r14, qword [rsp + rdi*8 - 0x277f11e8]
jle 0x1808b732d
ja 0x18034f613

Function at 0x1809a0d3f
Capabilities:
Packed with generic packer

Disassembly:
not dword [rsp + 0x28]
sub cl, byte [rsp + rcx - 0x4ebb7d90]
jge 0x1809f0065
call fcn.18044b9a6

Function at 0x1809a337f
Capabilities:
Encode data using xor

Disassembly:
or rax, 0xffffffffffffffff
jmp 0x18003a26c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, rbx
call fcn.18002e03c
jmp 0x18003a210
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rdi, r9
test rdi, rdi
push rcx
not di
movabs rcx, 0x39f491b02d13562
lea r9, [rcx*4 + 0x50fd0f42]
mov rdi, qword [rsp + 0x10]
mov rdi, qword [rdi]
jg 0x180a5d06e
lea rbx, [r9 + r8*8 + 0x36f30d9f]
sub r13d, 0x4dc81167
mov dl, r9b
shr r8b, 0x3b
call fcn.18007c446
test r12b, r12b
jae 0x18086d92a
js 0x1801ec722
mov rbx, r12
shr bx, 0xfd
mov qword [rsp + r12*8 + 0x40], rsi
test bx, 0x36d1
push rsi
call fcn.1805c843b
neg r9
bswap r9d
xchg qword [rsp + r9 - 0x361bbe7b], rdi
mov r9, qword [rsp + 8]
xor dword [rsp + 0x10], ecx
lea rcx, [rcx + riz + 0x82b036a]
call fcn.1807aed53
push rsi
jns 0x180238bd2
out dx, eax
invalid
js 0x18003a22e
test cx, 0x32df
mov qword [rsp + 0x10], rcx
lea rdi, [rdi + 0x5879784b]
jne 0x1805f07f4
invalid

Function at 0x1809ba973
Capabilities:
Packed with generic packer

Disassembly:
movabs rcx, 0x7ff3dc26e85284b
lea rbx, [rbx + 1]
call fcn.1809b184e

Function at 0x1809ba986
Capabilities:
Packed with generic packer

Disassembly:
or r8d, 0x34430c36
xchg qword [rsp + r8 - 0x3fe73cd6], rax
mov r8, qword [rsp + 0x58]
cmp ebx, 0x612d601b
js 0x1804e4047

Function at 0x1809c82cb
Capabilities:
Encode data using xor

Disassembly:
lea rbx, [rbx + r8 + 0x27197397]
jg 0x1807358de
add eax, 0x59ffd6d6
pop rcx
shr dword [rbp + 0x66], 1
pop rax
xchg ebp, eax
adc byte [rdx], 0xbe
xor byte [rdi], al
jle 0x1809c82d5
xor r12, qword [rdx + 0x5d323415]
cmp esi, dword [rbx + 0x3df523ce]
std
invalid
Function at 0x1809e2718
Capabilities:
Query environment variable

Disassembly:
mov r14, qword [rsp + r15 - 0xd083]
jo 0x1805c145a
shr qword [rsp + 0x68], cl
neg ecx
sete cl
and r9b, byte [rsp + rcx - 0x6793]

Function at 0x1809e5f84
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0xffffffffffe79bc3
movabs rcx, 0x1fca1b27635270fe
add r10b, 0x29
xor cl, 0xaf
mov rcx, qword [rsp]
mov rcx, qword [rcx]
mov r10b, 0xd8
sub r10, r10
xor r10w, r10w
and r10d, 0x484f308b
cmp r10b, 0x83
js 0x1806c7226
mov r10d, 0x18b3510c
lea rcx, [rcx + r10 + 0x43ede7fe]
sub r10b, 0x4d
neg r10w
seta r10b
xor r10b, 0x8b
xchg qword [rsp + r10*2 - 0x31675cfe], rcx
mov r10, qword [rsp + r10*4 - 0x62ceba1c]
call fcn.18028453c

Function at 0x1809effe1
Capabilities:
Packed with generic packer

Disassembly:
mov rdx, qword [rsp + 0x48]
mov edi, dword [rsp + rdi*2 - 0x17427f36]
call fcn.1805f3463

Function at 0x1809efff2
Capabilities:
Packed with generic packer

Disassembly:
lea r8, [r8 + riz + 0x18f46d6e]
mov qword [rsp + 0x28], rax
not r8b
push r8
test r8w, r8w
jge 0x18046c74a
and dword [rsp], r8d
neg r8
shr word [rsp], 0x2f
add qword [rsp + 0x20], 0xffffffffffe957c6
sub r8, qword [rsp]
add qword [rsp + 8], 0x19281f
add qword [rsp], 0x2b4e4fda
push rbp
mov rbp, qword [rsp + 8]
mov rax, qword [rsp + 8]
movzx r8d, word [rsp + 0xb]
mov rax, qword [rsp + r8*2 - 0x822]
mov rax, qword [rax + r8*2 - 0x832]
mov qword [rsp + r8*2 - 0x822], rbp
call int.1802ba805

Function at 0x180a1dcae
Capabilities:
Write file on windows

Disassembly:
jae 0x180039bc9
lea rax, [rsp + 0x50]
cmp rdi, r14
jae 0x180039b32
movzx ecx, word [rdi]
add rdi, 2
cmp cx, 0xa
jne 0x180039b1e
mov edx, 0xd
mov word [rax], dx
add rax, 2
mov word [rax], cx
add rax, 2
lea rcx, [rsp + 0x6f8]
cmp rax, rcx
jb 0x180039b00
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x50]
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
lea rcx, [rsp + 0x700]
sar rax, 1
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov ecx, 0xfde9
xor edx, edx
call fcn.180034cf0
mov ebp, eax
test eax, eax
je 0x180039bc1
xor esi, esi
test eax, eax
je 0x180039bb1
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
mov ecx, esi
lea r9, [rsp + 0x40]
mov r8d, ebp
add rdx, rcx
mov rcx, r12
sub r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180039bc1
add esi, dword [rsp + 0x40]
cmp esi, ebp
jb 0x180039b7e
mov eax, edi
sub eax, r15d
mov dword [rbx + 4], eax
cmp rdi, r14
jmp 0x180039af5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rax, rbx
mov rcx, qword [rsp + 0x1460]
xor rcx, rsp
call fcn.180020ef0
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
add qword [rsp + 0x28], 0xffffffffffd99bf6
movabs rbx, 0x20435ff1563818dc
neg r8b
mov word [rsp + 0x10], di
add bx, di
not qword [rsp + 0x10]
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx]
add qword [rsp + 8], 0x7f7b022b
mov qword [rsp + 0x28], r8
neg r8d
cmp r8w, 0x6603
lea rbx, [rbx + r8 - 0x2124738e]
jbe 0x180039b9f
call fcn.1801f5e6e
Function at 0x180a36d10
Capabilities:
Query environment variable

Disassembly:
mov rdi, qword [rsp + r12*2 - 0x2aa83fc8]
mov rdi, qword [rdi + r12*4 - 0x55508000]
mov qword [rsp + r12*4 - 0x55507fc8], r12
lea r12, [r12 + r12 + 0x53e00f22]
and r12b, r12b
and word [rsp + r12 - 0x7e884eea], 0x2ff4
movabs rbp, 0x22fe72b23efd25d7
shr qword [rsp + 0x38], 0xc9
lea rdi, [rdi + r12 - 0x26563ec8]
push rcx
xor r12b, bpl
and rbp, 0x18a22e44
movabs rcx, 0xf0177fb520b0752
mov r15, rbp
call fcn.18066c598
xor dil, r12b
push r15
jg 0x1800845c0
Function at 0x180a41ec5
Capabilities:
Get geographical location

Disassembly:
and r8d, r10d
shl r12, 0xfe
mov r14, qword [rsp + 0x50]
test word [rsp + 0x14], r8w
jge 0x1806c5b40

Function at 0x180a41edd
Capabilities:
Get geographical location

Disassembly:
adc eax, 0x19b1a21
test eax, eax
je 0x180041453
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call fcn.18003d1e0
mov ecx, dword [rdi]
test eax, eax
jne 0x18004131d
or ecx, 0x304
mov dword [rdi + 4], ebx
jmp 0x180041383
test cl, 2
jne 0x180041388
cmp dword [rsi + 0x14], r14d
je 0x180041361
movsxd r8, dword [rsi + 0x14]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsi]
call fcn.180043ec8
mov ecx, dword [rdi]
test eax, eax
jne 0x180041361
or ecx, 2
mov dword [rdi + 8], ebx
mov dword [rdi], ecx
mov rax, rbp
mov rcx, qword [rsi]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x18004134d
cmp eax, dword [rsi + 0x14]
jne 0x180041388
mov dword [rdi + 4], ebx
jmp 0x180041388
test cl, 1
jne 0x180041388
mov edx, r14d
lea rax, [0x180054a48]
cmp bx, word [rax]
je 0x180041388
inc edx
add rax, 2
cmp edx, 0xa
jb 0x180041370
or ecx, 1
mov dword [rdi + 8], ebx
mov dword [rdi], ecx
mov eax, dword [rdi]
mov ecx, 0x300
and eax, ecx
cmp eax, ecx
je 0x180041447
mov eax, dword [rsi + 0x18]
lea r8, [rsp + 0x20]
neg eax
mov r9d, 0x78
mov ecx, ebx
sbb edx, edx
and edx, 0xfffff002
add edx, 0x1001
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x180041453
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call fcn.18003d1e0
test eax, eax
jne 0x18004140d
mov eax, dword [rdi]
bts eax, 9
mov dword [rdi], eax
cmp dword [rsi + 0x18], r14d
je 0x1800413ee
bts eax, 8
mov dword [rdi], eax
jmp 0x18004143e
cmp dword [rsi + 0x14], r14d
je 0x1800413e6
mov rcx, qword [rsi]
inc rbp
cmp word [rcx + rbp*2], r14w
jne 0x1800413f7
cmp ebp, dword [rsi + 0x14]
jne 0x1800413e6
mov edx, 1
jmp 0x18004142c
cmp dword [rsi + 0x18], r14d
jne 0x180041447
cmp dword [rsi + 0x14], r14d
je 0x180041447
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call fcn.18003d1e0
test eax, eax
jne 0x180041447
xor edx, edx
mov r8, rdi
mov ecx, ebx
call fcn.18004168c
test eax, eax
je 0x180041447
bts dword [rdi], 8
cmp dword [rdi + 4], r14d
jne 0x180041447
mov dword [rdi + 4], ebx
mov eax, dword [rdi]
shr eax, 2
not eax
and eax, 1
jmp 0x18004145b
mov dword [rdi], r14d
mov eax, 1
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.180020ef0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
add byte [rsp + 0x60], 0xaa
test dword [rsp + 0x58], 0xbf826d6
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x70]
ret
sets byte [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
jbe 0x1800412f2
sub dword [rsp + 0x58], 0x8157563
neg byte [rsp + 0x60]
jno 0x180861870

Function at 0x180a4c114
Capabilities:
Query environment variable

Disassembly:
add qword [rsp + r11*4 + 0x3c], r9
jl fcn.18025ee95
shl word [rsp + r8 - 0x20], 0xa0
mov r11b, 0x76
mov r8, qword [rsp + r8 + 0x28]
jns fcn.1804b45ad
Function at 0x180a68acd
Capabilities:
Get geographical location

Disassembly:
cmp ebp, 0x67630abb
jns 0x1808c4977
movabs r15, 0x1e54611316ec680e
ja 0x180731701
neg rbp
movzx r15, r15b
mov qword [rsp + r15*4 - 0x10], rax
neg bp
and r15, 0x35ed235d
push r11
lea r15, [r15*4 + 0xcf14d01]
nop
push rdi
jo 0x180957e74
not ebp
bswap rbp
call fcn.18055af9a
or rbx, 0x15d566db
mov r15, qword [rsp + 0x18]
call fcn.1805ab916
bswap r13d
push rcx
lea rax, [rax + 0x3c767d89]
test r14w, 0x5b51
mov qword [rsp + 0x38], 0x506a6287
movzx r14w, r14b
jbe 0x1807cbe06
or r14, 0x79130c53
jae 0x1809aafe0
popfq
lea rsp, [rsp + 0x70]
ret
jle 0x1809c3486
xchg qword [rsp + 0x40], rax
mov r13, qword [rsp + 0x10]
mov rcx, r14
and r14b, byte [rsp + 0x3f]
add qword [rsp + 0x30], 0x7f5cdc2a
sub cx, word [rsp + 0x3c]
sub rcx, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0x170f5955
and r14d, dword [rsp + 0x3b]
mov r14, qword [rsp + 8]
sub dword [rsp + 0x38], 0x27e42b41
xor byte [rsp + 0x38], cl
test word [rsp + 0x38], cx
jno 0x180828128
jl 0x1809ab018
imul esp, dword [rcx + 0x21], 0x7f91c4a7
push rsi
insb byte [rdi], dx
pop rbx
nop
or dword [rdi - 0x7f918b2d], 0x641a9ee5
jle 0x1809ab034
cmpsd dword [rsi], dword [rdi]
invalid
mul byte fs:[rdx + 0x7e]
invalid
push r15
mov rsi, qword [rsp + 0x20]
mov qword [rsp + 0x20], rbx
or bpl, r8b
mov r15, r8
sub r15d, 0x773b3541
shr r8w, 0x37
neg rbp
not bp
push rdx
call fcn.1802f7a95
push r13
movabs r13, 0x23eb61790a4c7810
lea r13, [r13 + r13*8 + 0x6a6a2ccf]
add qword [rsp + 0x28], 0x754f39
mov rax, r13
shl r13, 0xc
add qword [rsp + 8], 0x7fa4153d
or r13, 0x7a5d1aa9
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], r13
push r14
mov r14, r13
jo 0x180490725
shl r13w, 0x58
jae 0x18081df20
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00404590]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x004045a0]
mov dword [rax], 1
mov rax, qword [0x004045b0]
mov dword [rax], 1
mov rax, qword [0x00404580]
mov dword [rax], 1
mov rax, qword [0x00404440]
cmp word [rax], 0x5a4d
je 0x4010b0
mov rax, qword [0x00404570]
mov dword [0x00407008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010a0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x00404530]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x004043f0]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401103
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058