joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002370
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea rax, [rcx + 8]
mov r9d, 0x270
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x180002380
ret

Function at 0x1800023e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
mov r11, rcx
test r9, r9
je 0x1800024c5
cmp r9, 0x40
jb 0x1800024a3
movsx eax, byte [rcx]
lea rcx, [rdx - 1]
add rcx, r9
movd xmm2, eax
lea rax, [r8 - 1]
punpcklbw xmm2, xmm2
add rax, r9
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
cmp rdx, rax
ja 0x18000242d
cmp rcx, r8
jae 0x1800024a3
cmp rdx, r11
ja 0x180002437
cmp rcx, r11
jae 0x1800024a3
mov rcx, r9
mov qword [rsp + 0x10], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp], rdi
mov rbx, r8
lea rax, [rdx + 0x10]
sub rbx, rdx
movdqu xmm0, xmmword [rbx + rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rbx + rax]
lea rax, [rax + 0x40]
xorps xmm0, xmm2
xorps xmm1, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm0, xmmword [rbx + rax - 0x30]
movdqu xmmword [rax - 0x40], xmm1
xorps xmm0, xmm2
movdqu xmm1, xmmword [rbx + rax - 0x20]
movdqu xmmword [rax - 0x30], xmm0
xorps xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp r10, rcx
jb 0x180002451
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
cmp r10, r9
jae 0x1800024c5
sub r8, rdx
lea rax, [r10 + rdx]
sub r9, r10
nop dword [rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor cl, byte [r11]
mov byte [rax - 1], cl
sub r9, 1
jne 0x1800024b0
add rsp, 8
ret

Function at 0x180002970
Capabilities:
Encode data using xor

Disassembly:
mov dword [rcx + 4], edx
lea r10, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r9d, edx
lea r10, [r10 + 4]
shr r9d, 0x1e
xor edx, r9d
imul edx, r8d
add edx, eax
inc rax
mov dword [r10 - 4], edx
cmp rax, 0x270
jb 0x180002980
mov dword [rcx], 0x270
ret

Function at 0x1800086c0
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret
Function at 0x18000c5a0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x18000c758
cmp ecx, 0x7c
je 0x18000c758
cmp ecx, 0x29
jne 0x18000c5e8
cmp dword [rbx + 0x1c], 0
jne 0x18000c758
test dword [rbx + 0x80], 0x10000000
je 0x18000c771
jmp 0x18000c728
cmp ecx, 0x2e
jne 0x18000c5fb
lea rcx, [rbx + 0x40]
call fcn.18000be40
jmp 0x18000c735
cmp ecx, 0x5c
jne 0x18000c65f
mov rcx, rbx
call fcn.18000fce0
test byte [rbx + 0x80], 0x80
je 0x18000c652
movzx eax, byte [rbx + 0x78]
cmp al, 0x62
jne 0x18000c62f
lea rcx, [rbx + 0x40]
call fcn.18000c4c0
mov rcx, rbx
call fcn.18000fce0
jmp 0x18000c745
cmp al, 0x42
jne 0x18000c652
lea rcx, [rbx + 0x40]
call fcn.18000c4c0
lea rcx, [rbx + 0x40]
call fcn.18000fc60
mov rcx, rbx
call fcn.18000fce0
jmp 0x18000c745
mov rcx, rbx
call fcn.18000c7f0
jmp 0x18000c73d
cmp ecx, 0x5b
jne 0x18000c68c
mov rcx, rbx
call fcn.18000fce0
mov rcx, rbx
call fcn.18000d400
mov edx, 0x5d
mov r8d, 4
mov rcx, rbx
call fcn.18000ea80
jmp 0x18000c73d
cmp ecx, 0x28
jne 0x18000c6c2
mov rcx, rbx
call fcn.18000fce0
mov rcx, rbx
call fcn.180010950
mov edx, 0x29
mov r8d, 5
mov rcx, rbx
movzx edi, al
call fcn.18000ea80
test dil, dil
je 0x18000c745
jmp 0x18000c73d
cmp ecx, 0x5e
jne 0x18000c6da
lea rcx, [rbx + 0x40]
call fcn.18000bbd0
mov rcx, rbx
call fcn.18000fce0
jmp 0x18000c745
cmp ecx, 0x24
jne 0x18000c6f2
lea rcx, [rbx + 0x40]
call fcn.18000bef0
mov rcx, rbx
call fcn.18000fce0
jmp 0x18000c745
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x18000c763
cmp ecx, 0x3f
je 0x18000c763
cmp ecx, 0x7b
je 0x18000c763
cmp ecx, 0x7d
jne 0x18000c717
test dword [rbx + 0x80], 0x10000000
je 0x18000c77f
jmp 0x18000c728
cmp ecx, 0x5d
jne 0x18000c728
test dword [rbx + 0x80], 0x10000000
je 0x18000c78d
movzx edx, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.18000bbe0
mov rcx, rbx
call fcn.18000fce0
mov rcx, rbx
call fcn.18000fd90
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
je 0x18000c758
cmp ecx, 0x7c
jne 0x18000c5c4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.18000ea30
int3
mov edx, 5
mov rcx, rbx
call fcn.18000ea30
int3
mov edx, 6
mov rcx, rbx
call fcn.18000ea30
int3
mov edx, 4
mov rcx, rbx
call fcn.18000ea30
int3
Function at 0x180017640
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.1800173b0
movzx edx, byte [rsp + 0x58]
mov rcx, rax
call fcn.180016830
mov rcx, rax
xor edx, edx
call fcn.180017d80
mov rcx, rsi
call rax
mov rdi, rax
test rax, rax
jne 0x18001768b
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call fcn.180017cb0
test eax, eax
je 0x180017706
mov edx, dword [rdi + 0x50]
xor ecx, ecx
mov r9d, 0x40
mov qword [rsp + 0x50], rbx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800176cb
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rdx, rbx
mov rcx, rdi
call fcn.180017760
mov rcx, rbx
call fcn.1800178c0
mov edi, eax
test eax, eax
je 0x1800176ee
mov rcx, rsi
call fcn.180017b70
mov edi, eax
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180017c20
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x28]
xor ebx, ebx
mov r8d, 0x30
movups xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], ebx
mov rdi, rcx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180017c95
mov rdx, qword [rsp + 0x40]
lea r9, [rsp + 0x20]
mov eax, 0x40
mov r8d, 1
cmp dword [rsp + 0x4c], eax
mov rcx, rdi
cmovne r8d, eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180018a70
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x180017cb0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180043040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
mov rbx, rcx
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edi, word [rbx + 0x14]
xor r8d, r8d
movzx r9d, word [rbx + 6]
add rdi, rbx
mov esi, dword [rsp + 0x48]
movzx eax, r8w
cmp r8w, r9w
jae 0x180017d45
mov r10, qword [rbx + 0x30]
lea r11d, [rsi - 1]
nop dword [rax]
nop word [rax + rax]
movzx ecx, ax
lea rdx, [rcx + rcx*4]
mov ecx, dword [rdi + rdx*8 + 0x24]
mov edx, r8d
add rcx, r10
test r11, rcx
sete dl
test r11, rcx
jne 0x180017d70
inc ax
cmp ax, r9w
jb 0x180017d20
lea edx, [rsi - 1]
test qword [rbx + 0x30], rdx
sete r8b
mov eax, r8d
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180018a70
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov eax, edx
jmp 0x180017d53
Function at 0x180017d80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x180017d91
mov ecx, edx
jmp 0x180017dda
mov ecx, 1
call fcn.180017e90
mov rcx, rax
call fcn.180017e00
mov rcx, rax
mov rdx, rbx
call 0x180017f90
test rax, rax
jne 0x180017df7
mov ecx, 3
call fcn.180017e90
mov rcx, rax
call fcn.180017e00
mov rcx, rax
mov rdx, rbx
call 0x180017f90
test rax, rax
jne 0x180017df7
mov ecx, 2
call fcn.180017e90
mov rcx, rax
call fcn.180017e00
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x180017f90
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbp, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r12d, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x24]
add r12, rcx
add r13, rcx
cmp rdx, 0xffff
ja 0x180017fef
sub bp, word [rdi + 0x10]
movzx eax, bp
cmp eax, dword [rdi + 0x14]
jae 0x18001801a
movzx eax, bp
mov eax, dword [r12 + rax*4]
add rax, rcx
jmp 0x18001801c
mov r15d, dword [rdi + 0x20]
xor ebx, ebx
add r15, rsi
cmp dword [rdi + 0x18], ebx
jbe 0x18001801a
nop dword [rax]
mov edx, dword [r15 + rbx*4]
mov rcx, rbp
add rdx, rsi
call 0x1800184a0
test eax, eax
je 0x180018039
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x180018000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r13 + rbx*2]
mov eax, dword [r12 + rax*4]
add rax, rsi
jmp 0x18001801c

Function at 0x180017f30
Capabilities:
Access peb ldr_data

Disassembly:
cmp qword [rcx + 0x30], 0
jne 0x180017f4e
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
jmp 0x180017f52
mov rdx, qword [rcx + 0x10]
movups xmm0, xmmword [rdx - 0x10]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x60], xmm0
mov rax, qword [rcx + 0x30]
ret
Function at 0x180017f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x180017d91
mov ecx, edx
jmp 0x180017dda
mov ecx, 1
call fcn.180017e90
mov rcx, rax
call fcn.180017e00
mov rcx, rax
mov rdx, rbx
call 0x180017f90
test rax, rax
jne 0x180017df7
mov ecx, 3
call fcn.180017e90
mov rcx, rax
call fcn.180017e00
mov rcx, rax
mov rdx, rbx
call 0x180017f90
test rax, rax
jne 0x180017df7
mov ecx, 2
call fcn.180017e90
mov rcx, rax
call fcn.180017e00
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x180017f90
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbp, rdx
mov rsi, rcx
mov edi, dword [rax + rcx + 0x88]
add rdi, rcx
mov r12d, dword [rdi + 0x1c]
mov r13d, dword [rdi + 0x24]
add r12, rcx
add r13, rcx
cmp rdx, 0xffff
ja 0x180017fef
sub bp, word [rdi + 0x10]
movzx eax, bp
cmp eax, dword [rdi + 0x14]
jae 0x18001801a
movzx eax, bp
mov eax, dword [r12 + rax*4]
add rax, rcx
jmp 0x18001801c
mov r15d, dword [rdi + 0x20]
xor ebx, ebx
add r15, rsi
cmp dword [rdi + 0x18], ebx
jbe 0x18001801a
nop dword [rax]
mov edx, dword [r15 + rbx*4]
mov rcx, rbp
add rdx, rsi
call 0x1800184a0
test eax, eax
je 0x180018039
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x180018000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx eax, word [r13 + rbx*2]
mov eax, dword [r12 + rax*4]
add rax, rsi
jmp 0x18001801c

Function at 0x180018050
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x180018094
nop word [rax + rax]
cmp qword [rax + 0x30], rcx
je 0x18001807f
mov rax, qword [rax]
test rax, rax
jne 0x180018070
ret
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
ret
Function at 0x18001fa00
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18001fa6f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18001fa6f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18001fa6f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18001fa6f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18001fa6f
cmp dword [rcx + 0x84], 0xe
jbe 0x18001fa6f
cmp dword [rcx + 0xf8], 0
je 0x18001fa6f
mov ecx, ebx
call fcn.18001fb14
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18001f908
nop
cmp dword [rbp + 0x20], 0
jne 0x18001fad0
call fcn.180023864
cmp eax, 1
jne 0x18001fac0
xor dl, dl
jmp 0x18001faca
call fcn.180023830
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x18001fadb
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18001fae4
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x18001fa00

Function at 0x180020e3c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x18004c050]
mov ebx, r9d
mov rdi, r8
mov esi, edx
mov rbp, rcx
cmp rax, 0xffffffffffffffff
je 0x180020ea1
test rax, rax
jne 0x180020e8f
lea r9, str.GetLocaleInfoEx
lea r8, [0x1800347c8]
lea rdx, str.GetLocaleInfoEx
lea ecx, [rax + 0xa]
call fcn.180020b10
test rax, rax
je 0x180020ea1
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
call fcn.18002f860
jmp 0x180020ebb
xor edx, edx
mov rcx, rbp
call fcn.18002112c
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800253b4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800253e4
xor eax, eax
jmp 0x1800254a7
mov rbp, rbx
cmp word [rax], si
je 0x180025409
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800253f0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800253ec
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800252d4
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x18002544a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800253dd
call fcn.1800237d0
mov rdi, rax
test rax, rax
jne 0x180025460
xor ecx, ecx
call fcn.1800232f0
jmp 0x18002543f
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800252d4
test eax, eax
jne 0x180025491
mov rcx, rdi
call fcn.1800232f0
jmp 0x18002549b
xor ecx, ecx
call fcn.1800232f0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180029908
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov dword [rsp + 0x30], esi
mov rbx, rcx
test rcx, rcx
je 0x18002997b
cmp word [rcx], si
je 0x18002997b
lea rdx, [0x180039c50]
call fcn.18002c688
test eax, eax
je 0x18002997b
lea rdx, [0x180039c68]
mov rcx, rbx
call fcn.18002c688
test eax, eax
jne 0x180029971
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x180029998
mov eax, dword [rsp + 0x30]
jmp 0x1800299aa
mov rcx, rbx
call fcn.180020828
jmp 0x1800299aa
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x18002999c
xor eax, eax
jmp 0x1800299aa
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x1800299aa
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800299bc
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov ebp, edx
mov dword [rax + 8], ebx
mov edi, ecx
call fcn.180021884
mov ecx, edi
lea r9d, [rbx + 2]
and ecx, 0x3ff
lea r8, [rsp + 0x30]
bts ecx, 0xa
mov edx, 0x20000001
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x180029a5f
cmp edi, dword [rsp + 0x30]
je 0x180029a58
test ebp, ebp
je 0x180029a58
mov r9, qword [rsi + 0x98]
mov r8d, ebx
movzx edx, word [r9]
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp ax, 0x19
jbe 0x180029a34
sub dx, 0x61
cmp dx, 0x19
ja 0x180029a40
movzx edx, word [rcx]
inc r8d
add rcx, 2
jmp 0x180029a21
or rax, 0xffffffffffffffff
inc rax
cmp word [r9 + rax*2], bx
jne 0x180029a44
cmp r8d, eax
setne bl
mov eax, ebx
jmp 0x180029a61
mov eax, 1
jmp 0x180029a61
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18002e9e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18002ea08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18002ea08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x180135983
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
xor dword [rsp], edx
pop rsi
clc
movsxd rdx, edx
jmp 0x18015c2fa
pushfq
cdqe
movabs rdi, 0
cbw
push rdi
mov r11, qword [rsp + 0x90]
dec r11d
rol bpl, cl
ror r11d, 3
add r11d, 0x1752163d
rol rsi, cl
bts bp, di
mov ah, ah
ror r11d, 1
or cl, 0xe3
sub bpl, 0x4c
mov sil, r12b
lea r11, [r11 + rdi]
movabs rax, 0x100000000
ror r9, cl
lea r11, [r11 + rax]
mov r9, rsp
sub rsp, 0x180
shl dl, cl
and rsp, 0xfffffffffffffff0
clc
movsx rbp, r8w
btr rsi, 0xe2
mov rsi, r11
movabs rcx, 0
rcr bpl, cl
sub rsi, rcx
rol bp, cl
lea rbp, [0x180116f32]
clc
mov edx, r8d
mov edx, dword [r11]
jmp 0x180117b35
add r11, 4
xor edx, esi
neg edx
bswap edx
cmc
test r8b, 0x38
neg edx
jmp 0x18016a73f
push rbx
jmp 0x1801612da
push r9
push r10
cwde
not ebp
cdq
push r13
mov dx, 0x5db0
cdqe
lahf
push r14
cmova bp, r13w
cdq
xchg r11w, si
push rcx
push rdi
movsx rsi, r15w
bswap esi
mov dl, spl
push r8
movsx edx, r9w
push r15
movsx si, dl
jmp 0x180116eab
add rbp, rdx
push rbp
ret
push rdx
cmovae edx, r13d
cwd
movzx rdx, r13w
push rbp
movzx dx, r12b
push rax
movzx rax, bp
cwd
push rsi
seta ah
cdq
rdtsc
push r12
xchg dh, ah
push r11
setb dl
rdtsc
jmp 0x180144075
rol edx, 1
jmp 0x180188622
inc edx
test dh, al
jmp 0x1800e5471
Function at 0x100401e40
Capabilities:
Delete directory
Get file attributes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa0
lea rdx, [rsp + 0x20]
mov rbx, rcx
call sub.msys_2.0.dll_stat
cmp eax, 0xffffffff
je 0x100401e80
mov eax, dword [rsp + 0x30]
mov rcx, rbx
and eax, 0xf000
cmp eax, 0x4000
je 0x100401ea0
call sub.msys_2.0.dll_unlink
cmp eax, 0xffffffff
je 0x100401e80
xor esi, esi
jmp 0x100401e88
call sub.msys_gpg_error_0.dll_gpg_err_code_from_syserror
movzx esi, ax
mov eax, esi
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call sub.msys_2.0.dll_opendir
lea rbp, str._s__s
mov rdi, rax
test rax, rax
je 0x100401e80
nop dword [rax]
mov rcx, rdi
call sub.msys_2.0.dll_readdir
test rax, rax
je 0x100401f60
cmp byte [rax + 0x18], 0x2e
lea r8, [rax + 0x18]
jne 0x100401eda
cmp byte [r8 + 1], 0
je 0x100401eb8
cmp byte [rax + 0x18], 0x2e
jne 0x100401ef0
cmp byte [r8 + 1], 0x2e
jne 0x100401ef0
cmp byte [r8 + 2], 0
je 0x100401eb8
nop
mov rdx, rbx
mov rcx, rbp
call fcn.10041e8d0
mov r12, rax
test rax, rax
je 0x100401f80
mov rcx, rax
call fcn.100401e40
mov rcx, r12
mov esi, eax
call sub.msys_gcrypt_20.dll_gcry_free
mov ecx, 2
call sub.msys_gpg_error_0.dll_gpg_err_code_from_errno
test eax, eax
jne 0x100401f40
test esi, esi
je 0x100401eb8
mov rcx, rdi
call sub.msys_2.0.dll_closedir
mov eax, esi
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movzx eax, ax
cmp eax, esi
je 0x100401eb8
test esi, esi
jne 0x100401f27
mov rcx, rdi
call sub.msys_2.0.dll_readdir
test rax, rax
jne 0x100401ec9
mov rcx, rdi
call sub.msys_2.0.dll_closedir
mov rcx, rbx
xor esi, esi
call sub.msys_2.0.dll_rmdir
jmp 0x100401e88
call sub.msys_gpg_error_0.dll_gpg_err_code_from_syserror
test eax, eax
je 0x100401f60
movzx esi, ax
mov rcx, rdi
call sub.msys_2.0.dll_closedir
test esi, esi
jne 0x100401e88
jmp 0x100401f68

Function at 0x100409e70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rax, [rsp + 0x34]
mov rbp, rcx
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.1004097e0
mov rax, qword [rbp + 0x1c8]
mov esi, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rax + 8]
test byte [rbx], 1
jne 0x100409f00
test esi, esi
jne 0x100409ec7
jmp 0x100409ef0
lea rdx, [rax + 1]
add rdi, 1
mov qword [rbx + 0x18], rdx
movzx edx, byte [rdi - 1]
mov byte [rax], dl
sub esi, 1
je 0x100409ef0
mov rax, qword [rbx + 0x18]
cmp rax, qword [rbx + 0x10]
jne 0x100409eb0
test byte [rbx], 4
je 0x100409ec2
mov rdx, rbx
mov rcx, rbp
call fcn.100409640
test eax, eax
je 0x100409ec2
mov rax, qword [rbx + 0x18]
jmp 0x100409eb0
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r9, qword [rbx + 8]
movsxd r8, esi
mov edx, 1
mov rcx, rdi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
jmp sub.msys_2.0.dll_fwrite
Function at 0x10040a520
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [r8]
and eax, 0x3f
mov r10, rdx
cmp rax, 7
jne 0x10040a614
mov r11, qword [rcx + 0xc8]
cmp rdx, r11
je 0x10040a5c0
mov rbx, rdx
mov rcx, qword [rbx + 8]
lea rsi, [rbx + 8]
mov rax, qword [rcx]
and eax, 0x3f
cmp rax, 0x17
je 0x10040a5c8
cmp r11, rcx
je 0x10040a598
mov rdx, qword [rcx + 8]
mov rax, qword [rdx + 8]
cmp rax, r8
jb 0x10040a588
cmp r8, rax
jb 0x10040a598
mov rax, rdx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rsi, [rcx + 0x10]
mov rcx, qword [rcx + 0x10]
cmp r11, rcx
jne 0x10040a563
nop dword [rax]
cmp r10, rbx
jne 0x10040a5ad
cmp qword [rsp + 0x70], 0
je 0x10040a5ad
mov rax, qword [rsp + 0x70]
mov qword [rax], rsi
test r9d, r9d
je 0x10040a5c0
mov rbx, qword [rbx + 0x10]
cmp r11, rbx
jne 0x10040a54a
nop dword [rax + rax]
mov rdx, r11
jmp 0x10040a575
mov rax, qword [r8 + 8]
mov rdi, qword [rcx + 8]
mov rsi, qword [rax + 8]
mov ebp, edi
movsx edx, byte [rsi]
test dl, dl
je 0x10040a60e
xor eax, eax
nop
rol eax, 5
add rsi, 1
xor eax, edx
movsx edx, byte [rsi]
test dl, dl
jne 0x10040a5e0
xor edx, edx
div ebp
movsxd rax, edx
cmp rax, rdi
jae 0x10040a633
movsxd rdx, edx
lea rsi, [rcx + rax*8 + 0x10]
mov rcx, qword [rcx + rdx*8 + 0x10]
jmp 0x10040a55e
xor eax, eax
xor edx, edx
jmp 0x10040a5f7
lea r9, str.is_symbol_hdl_
lea r8, str.find_slot_spec_in_env
mov edx, 0xabe
lea rcx, str.scheme.c
call sub.msys_2.0.dll___assert_func
call fcn.100409f60
nop
nop dword [rax]
mov rax, qword [rcx + 8]
ret