joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400047a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x1400047c4
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x140004852
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140004820
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x140004820
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.1401653e0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000483d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140004845
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x1400047e1
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x140004930
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x140004869
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000486b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000489d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1401653e0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000492d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400048d8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x14000490e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1401432f8
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x14000492d
cmp rsi, rax
ja 0x1400048e1
test rsi, rsi
je 0x14000492d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1401432f8
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret

Function at 0x140009e40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140009e74
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140009e60
ret
Function at 0x140010700
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400107c5
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1400107c5
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1400107de
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x1400107b5
cmp byte [rcx], 0x5c
jne 0x1400107ae
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x1400107ae
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14001079c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x1400107ab
test r8b, 0x10
jne 0x1400107ae
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x1400107ae
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.14000bf30
test edi, edi
jne 0x140010720
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.14000bf20
int3
Function at 0x140025f10
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1401a5100]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdx
xor ebp, ebp
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov edi, ebp
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x50], ebp
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x140025f67
mov rcx, qword [rdx]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x140025fda
lea rdx, str.CryptStringToBinaryA__1__:_Failed_to_convert_BASE64_private_key.__n
lea rcx, [0x1401ab090]
call fcn.140008250
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], rbp
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [r8 + rbp], 0
jne 0x140025fc0
xor edx, edx
mov rcx, rsi
call fcn.140008cb0
nop
jmp 0x1400260aa
mov edx, dword [rsp + 0x50]
test rdx, rdx
je 0x140025ff2
lea rcx, [rsp + 0x58]
call fcn.14000b550
mov rdi, qword [rsp + 0x68]
mov rcx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140025fff
mov rcx, qword [r14]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x58]
mov r9, rbx
xor edx, edx
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x1400260da
lea rdx, str.CryptStringToBinaryA__2__:_Failed_to_convert_BASE64_private_key.__n
lea rcx, [0x1401ab090]
call fcn.140008250
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], rbp
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [r8 + rbp], 0
jne 0x140026060
xor edx, edx
mov rcx, rsi
call fcn.140008cb0
nop
test rbx, rbx
je 0x1400260aa
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x14002609e
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026114
mov rdx, rdi
mov rcx, rbx
call fcn.1401391f0
nop
mov rcx, r14
call fcn.140006f30
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401391d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov r8, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, rsi
call fcn.140008590
nop
test rbx, rbx
je 0x1400260aa
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x14002609e
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002609e
call fcn.140143b1c
int3
Function at 0x14003a960
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x20
mov rbp, rdx
mov ebx, ecx
call fcn.1401003d0
test eax, eax
jne 0x14003ab65
cmp byte [0x1401a5f44], al
mov qword [rsp + 0x38], rdi
jne 0x14003a98d
xor edi, edi
jmp 0x14003a9a9
mov ecx, 5
call qword [0x1401a5fb0]
mov rdi, rax
test rax, rax
je 0x14003a9a9
mov rcx, rax
call qword [0x1401a5fc0]
test ebx, ebx
jle 0x14003ab48
test rbp, rbp
je 0x14003ab48
cmp dword [0x1401accd0], 0
mov qword [rsp + 0x30], rsi
jne 0x14003aacf
call fcn.1401003d0
test eax, eax
je 0x14003a9e5
movups xmm0, xmmword [str.expand_32_byte_k]
movaps xmmword [0x1401accd0], xmm0
jmp 0x14003aa49
cmp byte [0x1401a5f44], 0
jne 0x14003a9f7
mov rsi, qword [0x1401aca10]
jmp 0x14003aa36
mov ecx, 2
mov qword [rsp + 0x40], r14
call qword [0x1401a5fb0]
mov r14, rax
test rax, rax
je 0x14003aa2a
mov rcx, rax
call qword [0x1401a5fc0]
mov rsi, qword [0x1401aca10]
mov rcx, r14
call qword [0x1401a5fd0]
jmp 0x14003aa31
mov rsi, qword [0x1401aca10]
mov r14, qword [rsp + 0x40]
movups xmm0, xmmword [str.expand_32_byte_k]
movaps xmmword [0x1401accd0], xmm0
test rsi, rsi
jne 0x14003aa6b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1401acce0], xmm0
mov qword [0x1401acd00], rax
movups xmmword [0x1401accf0], xmm0
mov dword [0x1401acd08], eax
jmp 0x14003aaaf
mov eax, dword [0x1401a60f0]
test eax, eax
je 0x14003aa9d
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [0x1401acce0], xmm0
mov dword [0x1401acce0], eax
movups xmmword [0x1401accf0], xmm0
mov qword [0x1401acd00], rcx
mov dword [0x1401acd08], ecx
jmp 0x14003aaaf
lea r8, [0x1401acce0]
mov edx, 0x2c
mov rcx, rsi
call qword [rsi + 0x68]
mov eax, dword [0x1401acd00]
xor cl, cl
mov byte [0x1401acd50], cl
mov dword [0x1401acd0c], eax
mov dword [0x1401acd00], 0
jmp 0x14003aad6
movzx ecx, byte [0x1401acd50]
movzx eax, cl
lea rsi, [0x1401acd10]
cmp ebx, eax
jle 0x14003ab25
test cl, cl
je 0x14003ab03
movzx r8d, cl
mov rdx, rsi
mov rcx, rbp
call fcn.1401653e0
movzx ecx, byte [0x1401acd50]
sub ebx, ecx
add rbp, rcx
inc dword [0x1401acd00]
lea rdx, [0x1401accd0]
mov rcx, rsi
call fcn.14003a5b0
mov cl, 0x40
mov byte [0x1401acd50], cl
cmp ebx, 0x40
jg 0x14003aae4
movzx eax, cl
mov rcx, rbp
sub eax, ebx
movsxd r8, ebx
movsxd rdx, eax
add rdx, rsi
call fcn.1401653e0
sub byte [0x1401acd50], bl
mov rsi, qword [rsp + 0x30]
jmp 0x14003ab52
mov dword [0x1401accd0], 0
test rdi, rdi
je 0x14003ab60
mov rcx, rdi
call qword [0x1401a5fd0]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
Function at 0x140056790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
mov r9, rcx
jne 0x1400567e7
movzx eax, byte [rcx + 0x10]
test al, al
je 0x1400567e7
cmp al, 1
jne 0x1400567a9
test edx, edx
jne 0x1400567e7
mov r10, qword [rcx + 8]
test r8, r8
je 0x1400567c2
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + 0x50]
mov eax, dword [rcx + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
je 0x1400567e4
mov rax, qword [r9]
mov rcx, qword [r10]
mov edx, dword [rax + 0x2f0]
cmp edx, dword [rcx + 0x80]
jle 0x1400567e4
cmp byte [rcx + 0xa], 0
jne fcn.14004dac0
xor eax, eax
ret
jmp fcn.140056430
Function at 0x14006a8e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x14006a90f
lea r8d, [rdx + 1]
nop dword [rax]
mov ecx, dword [rax + 0xc8]
mov edx, r8d
xor edx, ecx
and edx, 3
xor edx, ecx
mov dword [rax + 0xc8], edx
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14006a8f0
ret
Function at 0x1400890d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rsi, qword [rcx + 0x58]
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
test r8d, r8d
jns 0x140089137
test rsi, rsi
je 0x140089137
mov ebp, dword [rsi]
lea rbx, [rsi + 8]
test ebp, ebp
jle 0x140089137
nop dword [rax]
test byte [rbx + 0x14], 8
je 0x14008912d
mov rdx, qword [rbx]
mov r9d, 0xffffffff
mov r8, r15
xor ecx, ecx
call fcn.14008a720
test eax, eax
je 0x14008919a
add rbx, 0x20
dec ebp
test ebp, ebp
jg 0x140089110
test r15, r15
je 0x140089237
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
call fcn.140080c30
mov rbp, rax
mov rdx, rax
test rax, rax
je 0x140089239
test byte [rax + 4], 8
je 0x140089239
mov rbx, qword [rdi + 0x10]
xor edx, edx
movsxd rsi, dword [rbx + 0x90]
cmp dword [rbx + 0x94], esi
jg 0x1400891a2
mov dword [rsp + 0x20], edx
xor r9d, r9d
mov edx, 0xf
xor r8d, r8d
mov rcx, rbx
call fcn.1400653b0
mov esi, eax
jmp 0x1400891c8
mov eax, dword [rbx + 0x18]
jmp 0x1400892c2
lea rcx, [rsi + rsi*2]
lea eax, [rsi + 1]
mov dword [rbx + 0x90], eax
mov rax, qword [rbx + 0x88]
mov qword [rax + rcx*8], 0xf
mov qword [rax + rcx*8 + 8], rdx
mov qword [rax + rcx*8 + 0x10], rdx
mov rax, qword [rdi]
mov byte [rdi + 0x23], 0
cmp byte [rax + 0x67], 0
jne 0x1400891ef
test r14d, r14d
jns 0x1400891e1
inc dword [rdi + 0x3c]
mov r14d, dword [rdi + 0x3c]
mov r8d, r14d
mov rdx, rbp
mov rcx, rdi
call fcn.140089420
mov rcx, qword [rdi]
mov rdx, rbp
mov byte [rdi + 0x23], 1
call fcn.140080920
mov rax, qword [rbx]
mov edx, dword [rbx + 0x90]
cmp byte [rax + 0x67], 0
je 0x14008921c
lea rax, [0x1401acba0]
mov dword [rax + 8], edx
jmp 0x1400892bf
movsxd rax, esi
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x88]
mov dword [rax + rcx*8 + 8], edx
lea rax, [rax + rcx*8]
jmp 0x1400892bf
xor edx, edx
test rsi, rsi
jne 0x140089248
mov rcx, qword [rdi]
call fcn.140081cc0
jmp 0x140089261
movsxd rax, dword [rsi]
lea ecx, [rax + 1]
cmp dword [rsi + 4], ecx
jge 0x14008926b
mov rcx, qword [rdi]
mov r8, rdx
mov rdx, rsi
call fcn.140081da0
mov rsi, rax
test rax, rax
je 0x1400892bb
jmp 0x14008928e
movups xmm0, xmmword [0x14017aea8]
shl rax, 5
movups xmm1, xmmword [0x14017aeb8]
mov dword [rsi], ecx
movups xmmword [rax + rsi + 8], xmm0
movups xmmword [rax + rsi + 0x18], xmm1
mov qword [rax + rsi + 8], rdx
movsxd rdx, dword [rsi]
mov ecx, r14d
shl rdx, 5
shr ecx, 0x1c
and ecx, 8
mov eax, dword [rdx + rsi - 4]
and eax, 0xfffffff7
or ecx, eax
mov dword [rdx + rsi - 4], ecx
test r14d, r14d
jns 0x1400892b7
inc dword [rdi + 0x3c]
mov r14d, dword [rdi + 0x3c]
mov dword [rdx + rsi], r14d
mov qword [rdi + 0x58], rsi
mov eax, r14d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400ae370
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0xa8]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x1400ae564
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x60], rbp
nop dword [rax + rax]
movsxd r14, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r15d, dword [rsi + 0x14]
shl r14, 5
add r14, qword [r12 + 0x20]
test al, al
jne 0x1400ae3d1
inc dword [rbx + 0x3c]
mov ebp, dword [rbx + 0x3c]
jmp 0x1400ae3e0
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0xe8]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r15 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x1400ae40d
mov r9d, edx
mov dword [rsp + 0x20], r15d
mov edx, 0x38
mov rcx, rdi
call fcn.1400653b0
jmp 0x1400ae43b
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], 0x38
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r15d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [r14 + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x71
mov r9, qword [r9 + 0x68]
call fcn.1400ad650
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x1400ae47a
mov rcx, rdi
call fcn.140065270
test eax, eax
jne 0x1400ae550
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x34
mov dword [rax + rcx*8 + 4], r13d
lea rax, [rax + rcx*8]
mov ecx, dword [rdi + 0x90]
mov dword [rax + 0xc], r13d
add ecx, 2
mov dword [rax + 8], ecx
mov byte [rax + 1], r13b
mov qword [rax + 0x10], r13
mov word [rax + 2], r13w
mov qword [rax + 0x18], 0x7f
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], 0x61
mov qword [rax + 0x38], 2
mov qword [rax + 0x40], r13
mov qword [rax + 0x48], 0x80
mov qword [rax + 0x50], r13
mov qword [rax + 0x58], r13
mov qword [rax + 0x60], 0x7a
mov qword [rax + 0x68], r13
mov qword [rax + 0x70], r13
add dword [rdi + 0x90], 5
test rax, rax
je 0x1400ae550
mov dword [rax + 0x3c], ebp
lea edx, [r15 + 1]
mov dword [rax + 4], edx
lea ecx, [r15 - 1]
mov dword [rax + 0x20], edx
mov dword [rax + 0x34], ecx
mov dword [rax + 0x54], edx
mov dword [rax + 0x50], ebp
mov word [rax + 0x4a], 8
test ebp, ebp
je 0x1400ae544
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x1400ae544
mov dword [rbx + rax*4 + 0xe8], ebp
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400ae3b0
mov rbp, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140110d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x18], 0xb
mov rbp, rcx
jne 0x140110d5b
mov eax, dword [rcx + 0x1c]
lea rdx, [rcx + 0x38]
mov r9, qword [rcx + 0x28]
dec eax
mov ecx, 0x1e
lea r8, [rax + rax*2]
mov r9, qword [r9 + r8*8 + 0x10]
lea r8, str.__lld_
add rsp, 0x30
pop rbp
jmp fcn.140107150
mov edx, dword [rcx + 0xc]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x48], rsi
add rcx, 0xc0
xor esi, esi
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x40], esi
call fcn.140109a50
add eax, dword [rbp + 0xc]
mov r9d, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov edx, eax
add rdx, qword [rbp + 0xc0]
test r9d, r9d
je 0x140110dcf
movzx eax, byte [rdx]
lea r8, [0x14017b610]
test byte [rax + r8], 2
je 0x140110dcf
test r9d, r9d
je 0x140110dc2
movzx ecx, byte [rsi + rdx]
test byte [rcx + r8], 6
je 0x140110dcf
inc esi
cmp esi, r9d
jb 0x140110db0
lea ecx, [r9 + 2]
lea r8, str.._.s
jmp 0x140110dda
lea ecx, [r9 + 4]
lea r8, str..__.s_
add rbp, 0x38
mov qword [rsp + 0x20], rdx
mov rdx, rbp
call fcn.140107150
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rbp
ret

Function at 0x140118590
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1401185ca
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1401185cf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140118618
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14016d0c0]
cmp byte [rcx + rax], 0
je 0x140118618
dec r8
sub rdx, 1
jne 0x1401185fe
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140118cc4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140118630
mov ebx, eax
test eax, eax
jne 0x140118cf4
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140118d50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140118d47
test al, 0x10
je 0x140118d47
bt eax, 0xa
jae 0x140118d40
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140118d68
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140118d3c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140118d60
test edi, edi
jne 0x140118d47
and dword [rsp + 0x3c], 0
jmp 0x140118d4c
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.140149f6c
int3
Function at 0x14012fa78
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x14011c1d6
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x14011c1b9
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x14011c1a4

Function at 0x140138cd0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
call fcn.140149058
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140138d22
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov r9d, 2
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x140138d22
sub ecx, 1
je 0x140138d1b
cmp ecx, 1
je 0x140138d14
xor eax, eax
jmp 0x140138d27
mov eax, 3
jmp 0x140138d27
mov eax, 1
jmp 0x140138d27
mov eax, 2
add rsp, 0x28
ret

Function at 0x14013a134
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14013a17e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14013a17e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14013a17e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14013a17e
cmp dword [rcx + 0x84], 0xe
jbe 0x14013a17e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14013a180
xor al, al
add rsp, 0x28
ret

Function at 0x14014860c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x140148643
call fcn.140148228
mov dword [rax], 0x16
call fcn.140143afc
xor eax, eax
jmp 0x1401486d5
mov rdx, r9
mov rcx, r8
call fcn.1401485a8
mov rbx, rax
test rax, rax
je 0x1401486d2
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x28], rax
lea r8, [0x1401484dc]
mov eax, dword [rsp + 0x60]
mov rdx, rsi
mov r9, rbx
mov dword [rsp + 0x20], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1401486bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401481b8
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1401486a6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1401486b5
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.140151960
jmp 0x1401486d2
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1401486cf
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14014d140
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14014d1af
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14014d1af
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14014d1af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14014d1af
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14014d1af
cmp dword [rcx + 0x84], 0xe
jbe 0x14014d1af
cmp dword [rcx + 0xf8], 0
je 0x14014d1af
mov ecx, ebx
call fcn.14014d254
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14014d048
nop
cmp dword [rbp + 0x20], 0
jne 0x14014d210
call fcn.140156730
cmp eax, 1
jne 0x14014d200
xor dl, dl
jmp 0x14014d20a
call fcn.14015a440
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x14014d21b
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14014d224
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14014d140

Function at 0x14014d328
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14014d140

Function at 0x1401500f0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140150106
mov al, 1
jmp 0x140150172
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140150117
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140150170
mov ecx, dword [rcx + 0x18]
nop
call fcn.14015cc34
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140150170
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140150170
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140150170
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140150172
xor al, al
add rsp, 0x20
pop rbx
ret