joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5dfd90
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5dffa7
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x008b403f]
cmp al, 1
jbe 0x5dfdcd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x5dfdd6
call fcn.00429680
ud2
mov byte [0x008b403f], 1
call fcn.004cb700
call fcn.0045cd90
lea rax, [0x006d9c6b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x23
call fcn.0045a4a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x00897690], rcx
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x5dff8d
mov qword [0x00897698], rax
lea rax, [0x006d8379]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x008976a0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x5dff73
mov qword [0x008976a8], rcx
lea rax, [0x006dc11e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2d
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00897680], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x5dff59
mov qword [0x00897688], rcx
lea rax, [0x006dbb91]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x008976b0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x5dff42
mov qword [0x008976b8], rcx
lea rax, [0x006d8e0b]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x008976c0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x5dff2b
mov qword [0x008976c8], rcx
mov byte [0x008b403f], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x008976c8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x5dff1a
lea rax, [0x008976b8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x5dfedf
lea rax, [0x00897688]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x5dfea4
lea rax, [0x008976a8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x5dfe65
lea rcx, [0x00897698]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x5dfe26
call fcn.00452210
jmp fcn.005dfd90
Function at 0x5f0a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp]
movzx eax, byte [rsp + 0x20]
test al, al
je 0x5f0b69
mov rax, qword [rsp + 0x18]
cmp rax, 1
jle 0x5f0b5f
mov rcx, qword [rsp + 0x10]
movzx edx, byte [rcx]
cmp dl, 0x22
jne 0x5f0add
lea rdx, [rax - 1]
cmp rdx, rax
jae 0x5f0b58
movzx ebx, byte [rcx + rax - 1]
cmp bl, 0x22
jne 0x5f0add
cmp rdx, 1
jb 0x5f0b51
lea rdx, [rax - 3]
sar rdx, 0x3f
xor rdx, 0xffffffffffffffff
and rdx, 1
add rcx, rdx
add rax, 0xfffffffffffffffe
xor edx, edx
cmp rdx, rax
jge 0x5f0b0d
movzx ebx, byte [rcx + rdx]
lea esi, [rbx - 0x20]
cmp sil, 0x5f
jae 0x5f0b4d
cmp bl, 0x22
je 0x5f0b49
cmp bl, 0x3b
je 0x5f0b45
cmp bl, 0x5c
setne bl
test bl, bl
je 0x5f0b25
inc rdx
cmp rdx, rax
jl 0x5f0ae4
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x38], 1
mov rbp, qword [rsp]
add rsp, 8
ret
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x38], 0
mov rbp, qword [rsp]
add rsp, 8
ret
xor ebx, ebx
jmp 0x5f0b01
xor ebx, ebx
jmp 0x5f0b01
xor ebx, ebx
jmp 0x5f0b01
call fcn.00429450
ud2
call fcn.004293e0
ud2
mov rcx, qword [rsp + 0x10]
jmp 0x5f0add
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
jmp 0x5f0add
Function at 0x6308c0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x630964
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov eax, dword [rsp + 0x40]
cmp eax, 0x1a
jb 0x630953
lea ecx, [rax - 0x1a]
cmp ecx, 0xa
jae 0x63090a
add eax, 0x16
mov byte [rsp + 0x48], al
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
lea rax, [0x006dc25c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x2e
lea rax, [0x0066fb00]
mov qword [rsp], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 8], rax
call fcn.0040ccd0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a540
ud2
add eax, 0x61
mov byte [rsp + 0x48], al
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
call fcn.00452210
jmp fcn.006308c0

Function at 0x630df0
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x631013
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movzx eax, byte [0x008b4011]
cmp al, 1
jbe 0x630e2d
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
jne 0x630e36
call fcn.00429680
ud2
mov byte [0x008b4011], 1
call fcn.004b9c90
call fcn.0054d9b0
call fcn.00623800
call fcn.005cf4a0
call fcn.004e5430
call fcn.004c82e0
call fcn.0045bcb0
call fcn.0047cd30
lea rax, [0x006db592]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2a
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x008974e0], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x630ff9
mov qword [0x008974e8], rcx
lea rax, [0x006dbc3f]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2c
call fcn.0045a4a0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [0x008974f0], rcx
mov ecx, dword [0x008b4340]
test ecx, ecx
jne 0x630fdf
mov qword [0x008974f8], rax
lea rax, [0x006db860]
mov qword [rsp], rax
mov qword [rsp + 8], 0x2b
call fcn.0045a4a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x00897500], rax
mov eax, dword [0x008b4340]
test eax, eax
jne 0x630fc5
mov qword [0x00897508], rcx
mov qword [rsp], 0x270f
mov qword [rsp + 8], 0xc
mov qword [rsp + 0x10], 0x1f
mov qword [rsp + 0x18], 0x17
mov qword [rsp + 0x20], 0x3b
mov qword [rsp + 0x28], 0x3b
mov qword [rsp + 0x30], 0
mov rax, qword [0x0088e7d0]
mov qword [rsp + 0x38], rax
call fcn.0047aa30
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov qword [0x008978d0], rax
mov dword [0x008978d8], ecx
mov eax, dword [0x008b4340]
test eax, eax
jne 0x630fae
mov qword [0x008978e0], rdx
mov byte [0x008b4011], 2
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
lea rax, [0x008978e0]
mov qword [rsp], rax
mov qword [rsp + 8], rdx
call fcn.00410240
jmp 0x630f9d
lea rax, [0x00897508]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x630f22
lea rcx, [0x008974f8]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00410240
jmp 0x630ee3
lea rax, [0x008974e8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00410240
jmp 0x630ea4
call fcn.00452210
jmp fcn.00630df0
Function at 0x637a40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x637b3e
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
lea rax, [0x0066fcc0]
mov qword [rsp], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rax
call fcn.0043e630
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x40], rdx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
cmp rbx, rcx
jge 0x637afa
mov qword [rsp], 0x56
call fcn.004cc270
mov rax, qword [rsp + 8]
cmp rax, 0x56
jae 0x637b37
lea rsi, [0x006df39a]
movzx edi, byte [rsi + rax]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov byte [rax + r8], dil
lea rbx, [r8 + 1]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rbx
cmp rbx, rcx
jl 0x637ab1
mov rbx, qword [0x008962c0]
mov qword [rsp], rbx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
call fcn.004e24e0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.004293e0
ud2
call fcn.00452210
jmp fcn.00637a40
Function at 0x638e40
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x638fed
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
lea rax, [0x006835e0]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
call fcn.00407900
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea rcx, [0x006dc1d2]
mov qword [rsp], rcx
mov qword [rsp + 8], 0x2e
call fcn.005099d0
mov rax, qword [rsp + 0x10]
mov qword [rsp], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 0xffffffffffffffff
call fcn.0050aba0
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x38], rcx
test rcx, rcx
je 0x638fd6
xor edx, edx
mov qword [rsp + 0x40], rdx
cmp rdx, rcx
jge 0x638fa3
lea rbx, [rdx + rdx*2]
mov qword [rsp + 0x48], rbx
mov rsi, qword [rax + rbx*8 + 8]
mov rdi, qword [rax + rbx*8]
cmp rsi, 1
jbe 0x638fcf
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x10], rsi
lea rsi, [0x006835e0]
mov qword [rsp], rsi
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 8], rdi
call fcn.00408570
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx + rax*8]
mov rax, qword [rcx + rax*8 + 8]
mov rbx, qword [rsp + 0x18]
cmp rax, 2
jbe 0x638fcf
mov rax, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
mov qword [rbx + 8], rdx
mov edx, dword [0x008b4340]
test edx, edx
jne 0x638fba
mov qword [rbx], rax
mov rbx, qword [rsp + 0x40]
lea rdx, [rbx + 1]
mov rax, rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rdx
cmp rdx, rcx
jl 0x638f0e
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov qword [rsp], rbx
mov qword [rsp + 8], rax
call fcn.00410240
mov rcx, qword [rsp + 0x58]
jmp 0x638f84
call fcn.004293e0
ud2
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x80], rax
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.00452210
jmp fcn.00638e40
Function at 0x63d950
Capabilities:
Reference http user-agent string

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x63da4b
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
lea rax, [0x0066fcc0]
mov qword [rsp], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rax
call fcn.0043e630
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x38], rdx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
cmp rbx, rdx
jge 0x63da0a
mov qword [rsp], 0x3d
call fcn.004cc270
mov rax, qword [rsp + 8]
cmp rax, 0x3d
jae 0x63da44
lea rsi, [0x006de5d2]
movzx edi, byte [rsi + rax]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov byte [rax + r8], dil
lea rbx, [r8 + 1]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rbx
cmp rbx, rdx
jl 0x63d9c1
mov qword [rsp], 0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], rcx
call fcn.004426a0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.004293e0
ud2
call fcn.00452210
jmp fcn.0063d950
Function at 0x63ff60
Capabilities:
Reference http user-agent string

Disassembly:
xor eax, eax
cmp rax, 0x100
jge 0x63ff80
lea rcx, [0x008b45a0]
mov byte [rcx + rax], 0xff
inc rax
cmp rax, 0x100
jl 0x63ff6a
xor eax, eax
cmp rax, 0x20
jge 0x63ffa6
lea rcx, [0x006d8eab]
movzx edx, byte [rcx + rax]
lea rbx, [0x008b45a0]
mov byte [rbx + rdx], al
inc rax
cmp rax, 0x20
jl 0x63ff88
ret

Function at 0x640050
Capabilities:
Encrypt data using rc4 prga
Reference http user-agent string

Disassembly:
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x28]
xor ecx, ecx
mov rdi, rcx
cmp rcx, rax
jge 0x64016c
test rdx, rdx
jbe 0x64017f
movzx r8d, byte [rsi]
cmp rdx, 1
jle 0x6401fc
movzx r9d, byte [rsi + 1]
mov r10, rcx
sar rcx, 0x3f
and rcx, 7
lea r11, [r10 + rcx]
and r11, 7
sub r11, rcx
cmp r11, 4
jae 0x6401a3
lea rcx, [r11 - 3]
neg rcx
mov r9d, 0x1f
shl r9d, cl
cmp rcx, 0x20
sbb r12d, r12d
and r12d, r9d
and r8d, r12d
shr r8b, cl
cmp rcx, 8
sbb r9d, r9d
and r9d, r8d
test rax, rax
jl 0x64019b
lea rcx, [r10 + 5]
cmp rcx, rax
jle 0x64019b
sub rcx, rax
mov r8d, 0xffffffff
shl r8d, cl
cmp rcx, 0x20
sbb r12d, r12d
and r12d, r8d
and r12d, r9d
movzx r8d, r12b
cmp r8, 0x20
jae 0x640194
lea r9, [0x006d8eab]
movzx r8d, byte [r9 + r8]
mov r12, qword [rsp + 0x18]
cmp rdi, r12
jae 0x640194
mov r13, qword [rsp + 0x10]
mov byte [r13 + rdi], r8b
cmp r11, 2
jbe 0x64015c
lea r8, [rbx - 2]
sar r8, 0x3f
xor r8, 0xffffffffffffffff
and r8, 1
add rsi, r8
dec rdx
dec rbx
lea rcx, [r10 + 5]
inc rdi
cmp rcx, rax
jl 0x64007e
test rax, rax
jge 0x640186
test rdx, rdx
jle 0x640186
test rdx, rdx
ja 0x640087
call fcn.004293e0
ud2
mov qword [rsp + 0x48], rdi
mov rbp, qword [rsp]
add rsp, 8
ret
call fcn.004293e0
ud2
mov r12d, r9d
jmp 0x640113
lea rcx, [r11 - 3]
mov r12d, 0x1f
shr r12b, cl
cmp rcx, 8
sbb r13d, r13d
and r12d, r13d
and r8d, r12d
shl r8d, cl
cmp rcx, 0x20
sbb r12d, r12d
and r8d, r12d
lea rcx, [r11 - 0xb]
neg rcx
mov r12d, 0xffffffff
shl r12d, cl
cmp rcx, 0x20
sbb r13d, r13d
and r12d, r13d
and r9d, r12d
shr r9b, cl
cmp rcx, 8
sbb r12d, r12d
and r9d, r12d
or r9d, r8d
jmp 0x6400e4
xor r9d, r9d
jmp 0x64009a
Function at 0x6403c0
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
lea rax, [rsp - 8]
cmp rax, qword [rcx + 0x10]
jbe 0x6406b4
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xa8]
mov rsi, rax
xor edi, edi
mov qword [rsp + 0x20], rdi
test rax, rax
jle 0x6405c9
mov qword [rsp + 0x28], 0
xor r8d, r8d
cmp r8, 8
jge 0x640481
test rax, rax
je 0x640481
movzx r9d, byte [rbx]
lea r10, [0x008b45a0]
movzx r9d, byte [r10 + r9]
mov byte [rsp + r8 + 0x28], r9b
lea r11, [rdx - 2]
sar r11, 0x3f
xor r11, 0xffffffffffffffff
and r11, 1
add rbx, r11
dec rax
dec rdx
cmp r9b, 0xff
je 0x640657
inc r8
cmp r8, 8
jl 0x64043b
movzx r9d, byte [rsp + 0x28]
movzx r10d, byte [rsp + 0x29]
shr r10b, 2
shl r9d, 3
or r10d, r9d
mov r9, qword [rsp + 0x98]
cmp rdi, r9
jae 0x640650
mov r11, qword [rsp + 0x90]
mov byte [r11 + rdi], r10b
movzx r10d, byte [rsp + 0x29]
movzx r12d, byte [rsp + 0x2a]
shl r12d, 1
shl r10d, 6
or r12d, r10d
movzx r10d, byte [rsp + 0x2b]
shr r10b, 4
or r12d, r10d
lea r10, [rdi + 1]
cmp r10, r9
jae 0x640649
mov byte [r11 + rdi + 1], r12b
movzx r10d, byte [rsp + 0x2b]
movzx r12d, byte [rsp + 0x2c]
shl r10d, 4
shr r12b, 1
or r10d, r12d
lea r12, [rdi + 2]
cmp r12, r9
jae 0x640642
mov byte [r11 + rdi + 2], r10b
movzx r10d, byte [rsp + 0x2c]
movzx r12d, byte [rsp + 0x2d]
shl r10d, 7
shl r12d, 2
or r10d, r12d
movzx r12d, byte [rsp + 0x2e]
shr r12b, 3
or r12d, r10d
lea r10, [rdi + 3]
cmp r10, r9
jae 0x64063b
mov byte [r11 + rdi + 3], r12b
movzx r10d, byte [rsp + 0x2e]
movzx r12d, byte [rsp + 0x2f]
shl r10d, 5
or r10d, r12d
lea r12, [rdi + 4]
cmp r12, r9
jae 0x640634
mov byte [r11 + rdi + 4], r10b
test rcx, rcx
jge 0x640600
mov r10, qword [0x006f1480]
mov qword [rsp + 0x38], r10
mov r10, rdi
lea rdi, [rsp + 0x40]
mov r12, rsi
lea rsi, [0x006f1488]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004551a8
mov rbp, qword [rbp]
cmp r8, 9
jae 0x6405f9
mov r8, qword [rsp + r8*8 + 0x38]
add r8, r10
mov rsi, r12
mov rdi, r8
mov qword [rsp + 0x20], rdi
test rax, rax
jg 0x640429
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
call fcn.004293e0
ud2
cmp rcx, 0x28
jle 0x64062f
mov r8, 0x28
lea r10, [r8 + 7]
sar r10, 0x3f
shr r10, 0x3d
lea r10, [r8 + r10 + 7]
sar r10, 3
lea r8, [r10 + rdi]
add rcx, 0xffffffffffffffd8
mov r12, rsi
jmp 0x6405b5
mov r8, rcx
jmp 0x64060d
call fcn.004293e0
ud2
call fcn.004293e0
ud2
call fcn.004293e0
ud2
call fcn.004293e0
ud2
call fcn.004293e0
ud2
sub rsi, rax
lea rax, [rsi - 1]
mov qword [rsp + 0x30], rax
lea rax, [0x007e5340]
mov qword [rsp], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 8], rax
call fcn.0040cd80
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xd8], rax
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
call fcn.00452210
jmp fcn.006403c0
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rdi, 0x551cda10237cc0cf
invalid
Function at 0x140084920
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x140084952
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x1400849fa
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x140084996
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x1400849e5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1400849b2
mov dword [rsp + 0x1c], 1
jmp 0x1400849ba
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x1400849e3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x14008498c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x140084948
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret
Function at 0x140113fd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.140118850
sub rsp, rax
mov rax, qword [0x14015be58]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x140114092
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14011403d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x140114030
cmp rcx, 1
jb 0x1401140ea
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x140114060
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.140127aa4
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x140114020
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1401140c3
lea rcx, [rsp + 0x80]
call fcn.14012a7ac
jmp 0x1401140c5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140118580
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14011c770
int3