joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53da00
Capabilities:
Encode data using base64

Disassembly:
push r13
push rdi
push rsi
push rbx
mov r10, rcx
mov r11, rdx
xor ecx, ecx
xor r9, r9
mov ebx, 1
mov esi, 3
mov eax, r8d
cdq
idiv esi
mov rsi, rax
mov eax, ebx
cmp eax, esi
jg 0x53db06
sub esi, ebx
add esi, 1
movsxd rax, ecx
movsxd rdx, r9d
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rdi, byte [r10 + rax]
shr edi, 2
mov edi, edi
movzx rbx, byte [rbx + rdi]
mov byte [r11 + rdx], bl
mov edx, ecx
add edx, 1
movsxd rdx, edx
mov ebx, r9d
add ebx, 1
movsxd rbx, ebx
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rax, byte [r10 + rax]
and al, 3
movzx rax, al
shl eax, 4
movzx r13, byte [r10 + rdx]
shr r13d, 4
add eax, r13d
mov eax, eax
movzx rax, byte [rdi + rax]
mov byte [r11 + rbx], al
mov eax, ecx
add eax, 2
movsxd rax, eax
mov ebx, r9d
add ebx, 2
movsxd rbx, ebx
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rdx, byte [r10 + rdx]
and dl, 0xf
movzx rdx, dl
add edx, edx
add edx, edx
movzx r13, byte [r10 + rax]
shr r13d, 6
add edx, r13d
mov edx, edx
movzx rdx, byte [rdi + rdx]
mov byte [r11 + rbx], dl
mov edx, r9d
add edx, 3
movsxd rdx, edx
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rax, byte [r10 + rax]
and al, 0x3f
movzx rax, al
movzx rax, byte [rbx + rax]
mov byte [r11 + rdx], al
add r9d, 4
add ecx, 3
sub esi, 1
test esi, esi
jne 0x53da32
nop
mov ebx, 3
mov eax, r8d
cdq
idiv ebx
mov rax, rdx
sub eax, 1
test eax, eax
je 0x53db29
sub eax, 1
test eax, eax
jne 0x53dc23
jmp 0x53db92
movsxd rcx, ecx
movsxd rax, r9d
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rbx, byte [r10 + rcx]
shr ebx, 2
mov ebx, ebx
movzx rdx, byte [rdx + rbx]
mov byte [r11 + rax], dl
mov eax, r9d
add eax, 1
movsxd rax, eax
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rcx, byte [r10 + rcx]
and cl, 3
movzx rcx, cl
shl ecx, 4
mov ecx, ecx
movzx rcx, byte [rdx + rcx]
mov byte [r11 + rax], cl
mov eax, r9d
add eax, 2
movsxd rax, eax
mov byte [r11 + rax], 0x3d
add r9d, 3
movsxd r9, r9d
mov byte [r11 + r9], 0x3d
jmp 0x53dc23
movsxd rax, ecx
movsxd rdx, r9d
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rsi, byte [r10 + rax]
shr esi, 2
mov esi, esi
movzx rbx, byte [rbx + rsi]
mov byte [r11 + rdx], bl
add ecx, 1
movsxd rcx, ecx
mov edx, r9d
add edx, 1
movsxd rdx, edx
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rax, byte [r10 + rax]
and al, 3
movzx rax, al
shl eax, 4
movzx rsi, byte [r10 + rcx]
shr esi, 4
add eax, esi
mov eax, eax
movzx rax, byte [rbx + rax]
mov byte [r11 + rdx], al
mov eax, r9d
add eax, 2
movsxd rax, eax
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx rcx, byte [r10 + rcx]
and cl, 0xf
movzx rcx, cl
add ecx, ecx
add ecx, ecx
mov ecx, ecx
movzx rcx, byte [rdx + rcx]
mov byte [r11 + rax], cl
add r9d, 3
movsxd r9, r9d
mov byte [r11 + r9], 0x3d
mov eax, r8d
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x53dd80
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x10
mov rbp, rsp
mov r10, rcx
mov r11, rdx
xor edx, edx
xor r9, r9
xor eax, eax
mov ebx, 1
test r8d, r8d
jns 0x53dda5
add r8d, 3
sar r8d, 2
mov ecx, ebx
cmp ecx, r8d
jg 0x53dee5
sub r8d, ebx
add r8d, 1
mov ebx, 4
lea rcx, [rbp + 0xc]
movsxd rax, edx
movzx rax, byte [r10 + rax]
movzx rsi, al
cmp esi, 0x3d
jg 0x53ddf2
cmp esi, 0x3d
je 0x53de23
sub esi, 0x2b
test esi, esi
je 0x53de19
sub esi, 4
test esi, esi
je 0x53de1e
sub esi, 1
cmp esi, 0xa
jae 0x53de26
jmp 0x53de12
sub esi, 0x41
cmp esi, 0x1a
jb 0x53de04
sub esi, 0x20
cmp esi, 0x1a
jae 0x53de26
jmp 0x53de0b
sub al, 0x41
mov byte [rcx], al
jmp 0x53de26
add al, 0xb9
mov byte [rcx], al
jmp 0x53de26
add al, 4
mov byte [rcx], al
jmp 0x53de26
mov byte [rcx], 0x3e
jmp 0x53de26
mov byte [rcx], 0x3f
jmp 0x53de26
mov byte [rcx], 0xff
add edx, 1
add rcx, 1
sub ebx, 1
test ebx, ebx
jne 0x53ddc4
nop
movsxd rax, r9d
movzx rcx, byte [rbp + 0xc]
add ecx, ecx
add ecx, ecx
movzx rbx, byte [rbp + 0xd]
shr ebx, 4
or cl, bl
mov byte [r11 + rax], cl
mov eax, r9d
add eax, 1
movzx rcx, byte [rbp + 0xe]
cmp cl, 0xff
je 0x53de8f
cmp byte [rbp + 0xf], 0xff
jne 0x53de8f
mov eax, r9d
add eax, 1
movsxd rax, eax
movzx rbx, byte [rbp + 0xd]
shl ebx, 4
movzx rcx, cl
shr ecx, 2
or bl, cl
mov byte [r11 + rax], bl
mov eax, r9d
add eax, 2
add r9d, 1
jmp 0x53ded4
cmp cl, 0xff
je 0x53ded4
mov eax, r9d
add eax, 1
movsxd rax, eax
movzx rbx, byte [rbp + 0xd]
shl ebx, 4
movzx rcx, cl
shr ecx, 2
or bl, cl
mov byte [r11 + rax], bl
mov eax, r9d
add eax, 2
movsxd rax, eax
movzx rcx, byte [rbp + 0xe]
shl ecx, 6
or cl, byte [rbp + 0xf]
mov byte [r11 + rax], cl
mov eax, r9d
add eax, 3
add r9d, 2
add r9d, 1
sub r8d, 1
test r8d, r8d
jne 0x53ddbb
nop
lea rsp, [rbp + 0x10]
pop rbx
pop rsi
pop rbp
ret

Function at 0x5416a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9, r9
mov r10d, r8d
sub r10d, 1
mov eax, r9d
cmp eax, r10d
ja 0x5416d4
sub r10d, r9d
add r10d, 1
mov r8d, eax
lea r9, [rcx + r8]
movzx r8, byte [rdx + r8]
xor byte [r9], r8b
add eax, 1
sub r10d, 1
test r10d, r10d
jne 0x5416b9
nop
ret

Function at 0x543a50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
xor r8, r8
movzx r9, dl
sub r9d, 1
mov eax, r8d
cmp eax, r9d
ja 0x543adb
sub r9d, r8d
add r9d, 1
mov edx, eax
add edx, edx
add edx, edx
mov r8d, edx
lea r10, [0x0058d754]
mov r11d, edx
movzx r11, byte [rcx + r11]
lea rbx, [0x0058db54]
mov esi, edx
add esi, 1
mov esi, esi
movzx rsi, byte [rcx + rsi]
mov r10d, dword [r10 + r11*4]
xor r10d, dword [rbx + rsi*4]
lea r11, [0x0058df54]
mov ebx, edx
add ebx, 2
mov ebx, ebx
movzx rbx, byte [rcx + rbx]
xor r10d, dword [r11 + rbx*4]
lea r11, [0x0058e354]
add edx, 3
mov edx, edx
movzx rdx, byte [rcx + rdx]
xor r10d, dword [r11 + rdx*4]
mov dword [rcx + r8], r10d
add eax, 1
sub r9d, 1
test r9d, r9d
jne 0x543a6c
nop
pop rbx
pop rsi
ret
Function at 0x5446d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
test rax, rax
je 0x5446dc
mov rax, qword [rax - 8]
mov r9, qword [rdx]
mov r8, r9
test r8, r8
je 0x5446eb
mov r8, qword [r8 - 8]
movsxd r10, eax
cmp r8, r10
jge 0x5446ff
mov rax, r9
test rax, rax
je 0x5446ff
mov rax, qword [rax - 8]
xor r8, r8
mov r9d, eax
sub r9d, 1
mov eax, r8d
cmp eax, r9d
jg 0x544739
sub r9d, r8d
add r9d, 1
movsxd r8, eax
mov r10, qword [rcx]
lea r10, [r10 + r8]
mov r11, qword [rdx]
movzx r8, byte [r11 + r8]
xor byte [r10], r8b
add eax, 1
sub r9d, 1
test r9d, r9d
jne 0x544718
nop
ret

Function at 0x546330
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x80], rcx
lea rcx, [rbp + 0x80]
call fcn.00410ce0
nop
xor eax, eax
mov byte [rbp + 0x4f], al
mov rcx, qword [rbp + 0x80]
call fcn.00412160
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x546428
mov rcx, rbx
lea rdx, [rbp + 0x58]
call sub.kernel32.dll_GetFileSizeEx
test eax, eax
jne 0x5463b5
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x546428
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x004482e0]
call fcn.00415bd0
mov rcx, qword [rbp + 0x40]
mov rdx, qword [0x004482e0]
mov r8d, 1
mov r9, qword [rbp + 0x58]
call fcn.00415a00
mov dword [rbp + 0x54], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
je 0x54641a
mov rcx, rbx
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax]
mov r8d, dword [rbp + 0x58]
lea r9, [rbp + 0x54]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov al, 1
mov byte [rbp + 0x4f], al
nop
lea rcx, [rbp + 0x80]
call fcn.00410b70
movzx rax, byte [rbp + 0x4f]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret

Function at 0x546b40
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
jmp 0x546b69
mov rcx, qword [0x005907f0]
lea rdx, [0x00546b98]
call fcn.0040cb70
mov rcx, rax
call fcn.0040ccd0
call fcn.00409570
mov ecx, 1
xor edx, edx
mov r8d, ebx
call sub.kernel32.dll_OpenProcess
mov rcx, rax
xor edx, edx
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x546b49
add rsp, 0x20
pop rbx
ret
Function at 0x547ca0
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rsi
push rbx
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
nop
lea rcx, [rbp + 0x68]
mov rax, qword [0x00590880]
mov rdx, qword [rax + 0x110]
lea r8, [0x00547ea8]
call fcn.00412210
mov rcx, qword [rbp + 0x68]
call fcn.00448f90
test al, al
je 0x547e3d
mov rcx, 0xffffffff80000001
lea rdx, [0x00547ece]
lea r8, [rbp + 0x78]
call sub.advapi32.dll_RegOpenKeyW
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x78]
test rax, rax
je 0x547d35
mov rax, qword [rax - 8]
lea rcx, [rbp + 0x50]
mov rdx, qword [0x00590880]
mov rdx, qword [rdx + 0x78]
mov r8d, eax
call fcn.00539ff0
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x50]
call fcn.00539f30
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x60]
call fcn.00412130
mov rcx, qword [rbp + 0x48]
call fcn.00412160
mov rsi, rax
lea rcx, [rbp + 0x40]
mov rax, qword [0x00590880]
mov rdx, qword [rax + 0x110]
lea r8, [0x00547ea8]
call fcn.00412210
mov rax, qword [rbp + 0x40]
xor ebx, ebx
test rax, rax
je 0x547da1
mov ebx, dword [rax - 4]
shr ebx, 1
lea rcx, [rbp + 0x38]
mov rax, qword [0x00590880]
mov rdx, qword [rax + 0x110]
lea r8, [0x00547ea8]
call fcn.00412210
mov rcx, qword [rbp + 0x38]
call fcn.00412160
mov rcx, qword [rbp + 0x78]
mov rdx, rsi
xor r8, r8
mov r9d, 1
mov qword [rsp + 0x20], rax
add ebx, ebx
mov dword [rsp + 0x28], ebx
call sub.advapi32.dll_RegSetValueExW
mov rcx, qword [rbp + 0x78]
call sub.advapi32.dll_RegCloseKey
lea rcx, [rbp + 0x30]
mov rax, qword [0x00590880]
mov rdx, qword [rax + 0x110]
lea r8, [0x00547ea8]
call fcn.00412210
mov rcx, qword [rbp + 0x30]
call fcn.00412160
xor ecx, ecx
lea rdx, [0x00547f2a]
mov r8, rax
xor r9, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 5
call sub.shell32.dll_ShellExecuteW
nop
lea rcx, [rbp + 0x30]
mov edx, 4
call fcn.00410c50
lea rcx, [rbp + 0x60]
call fcn.00410b20
lea rcx, [rbp + 0x68]
call fcn.00410b70
lea rsp, [rbp + 0x80]
pop rbx
pop rsi
pop rbp
ret
Function at 0x547f40
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
nop
mov rax, qword [0x00590880]
lea rcx, [rax + 0x90]
mov rdx, qword [0x004482e0]
call fcn.00415bd0
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x547fd3
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x00548244]
mov rax, qword [0x00590880]
mov r9, qword [rax + 0x110]
lea rax, [0x00548278]
mov qword [rsp + 0x20], rax
call fcn.00412510
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.00412820
mov rcx, qword [rbp + 0x50]
mov dl, 1
call fcn.005471f0
lea rcx, [rbp + 0x48]
mov rax, qword [0x00590880]
mov rdx, qword [rax + 0x110]
lea r8, [0x00548278]
call fcn.00412210
mov rcx, qword [rbp + 0x48]
call fcn.00412160
mov rcx, rax
mov edx, 0x80000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x54805d
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5481e5
lea rcx, [0x005482ac]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
jmp 0x5481e5
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x54807b
lea rcx, [0x005482f4]
mov dl, 1
call fcn.005471f0
mov rcx, rbx
lea rdx, [rbp + 0x60]
call sub.kernel32.dll_GetFileSizeEx
test al, al
jne 0x5480bd
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5480b0
lea rcx, [0x00548330]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
jmp 0x5481e5
mov rax, qword [0x00590880]
lea rcx, [rax + 0x90]
mov rdx, qword [0x004482e0]
mov r8d, 1
mov r9, qword [rbp + 0x60]
call fcn.00415a00
mov dword [rbp + 0x6c], 0
jmp 0x5481b2
mov dword [rbp + 0x6c], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x548133
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5481b2
lea rcx, [0x00548380]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
jmp 0x5481b2
mov rcx, rbx
mov rax, qword [0x00590880]
mov rdx, qword [rax + 0x90]
mov r8d, dword [rbp + 0x60]
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x548185
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5481b2
lea rcx, [0x005483ec]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
jmp 0x5481b2
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x60]
je 0x5481b2
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5481b2
lea rcx, [0x00548448]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
mov eax, dword [rbp + 0x6c]
cmp eax, dword [rbp + 0x60]
jne 0x5480ed
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x5481e4
lea rcx, [0x005484b4]
mov dl, 1
call fcn.005471f0
nop
lea rcx, [rbp + 0x48]
call fcn.00410b70
lea rcx, [rbp + 0x50]
call fcn.00410ad0
lea rcx, [rbp + 0x58]
call fcn.00410b70
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x548b00
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x90], rcx
lea rcx, [rbp + 0x90]
call fcn.00410ce0
nop
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x548b8c
lea rcx, [rbp + 0x58]
mov edx, 3
lea r8, [0x00548dd0]
mov rax, qword [0x00590880]
mov r9, qword [rax + 0x110]
lea rax, [0x00548e18]
mov qword [rsp + 0x20], rax
call fcn.00412510
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
call fcn.00412820
mov rcx, qword [rbp + 0x50]
mov dl, 1
call fcn.005471f0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x90]
lea r8, [0x00548e18]
call fcn.00412210
mov rcx, qword [rbp + 0x48]
call fcn.00412160
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
jne 0x548c0f
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x548d54
lea rcx, [0x00548e4c]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
jmp 0x548d54
mov dword [rbp + 0x6c], 0
jmp 0x548d0d
mov dword [rbp + 0x6c], 0
mov rcx, rbx
xor edx, edx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test eax, eax
jne 0x548c64
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x548d0d
lea rcx, [0x00548ea8]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
jmp 0x548d0d
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x90]
test rax, rax
je 0x548c7b
mov rax, qword [rax - 8]
mov rcx, rbx
mov rdx, qword [0x00590880]
mov rdx, qword [rdx + 0x90]
mov r8d, eax
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
test eax, eax
jne 0x548ccc
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x548d0d
lea rcx, [0x00548f14]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
jmp 0x548d0d
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x90]
test rax, rax
je 0x548ce3
mov rax, qword [rax - 8]
cmp dword [rbp + 0x6c], eax
je 0x548d0d
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x548d0d
lea rcx, [0x00548f6c]
mov dl, 1
call fcn.005471f0
xor ecx, ecx
call fcn.00547430
mov rax, qword [0x00590880]
mov rax, qword [rax + 0x90]
test rax, rax
je 0x548d24
mov rax, qword [rax - 8]
cmp dword [rbp + 0x6c], eax
jne 0x548c1b
mov rcx, rbx
call sub.kernel32.dll_CloseHandle
mov rax, qword [0x00590880]
cmp byte [rax + 0x12c], 0
je 0x548d53
lea rcx, [0x00548fd8]
mov dl, 1
call fcn.005471f0
nop
lea rcx, [rbp + 0x48]
call fcn.00410b70
lea rcx, [rbp + 0x50]
call fcn.00410ad0
lea rcx, [rbp + 0x58]
call fcn.00410b70
lea rcx, [rbp + 0x90]
call fcn.00410b70
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x54e1b0
Capabilities:
Get geographical location

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x420
mov rbp, rsp
mov rbx, rcx
mov esi, edx
call fcn.0043ca30
cmp eax, 2
jne 0x54e1f0
mov ecx, esi
mov edx, 2
lea r8, [rbp + 0x20]
mov r9d, 0x200
call sub.kernel32.dll_GetLocaleInfoW
mov rcx, rbx
lea rdx, [rbp + 0x20]
call fcn.00414f80
jmp 0x54e21e
mov ecx, esi
mov edx, 2
lea r8, [rbp + 0x220]
mov r9d, 0x200
call sub.kernel32.dll_GetLocaleInfoW
mov rcx, rbx
lea rdx, [rbp + 0x220]
mov r8d, pe_nt_image_headers64
call fcn.004127b0
mov rax, rbx
lea rsp, [rbp + 0x420]
pop rbx
pop rsi
pop rbp
ret

Function at 0x54e230
Capabilities:
Get keyboard layout

Disassembly:
push rbp
push rbx
sub rsp, 0x68
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x80], rcx
nop
mov rcx, qword [rbp + 0x80]
lea rdx, [0x0054e3fc]
call fcn.00411240
mov qword [rbp + 0x58], 0
xor ecx, ecx
mov rdx, qword [rbp + 0x58]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x54], eax
cmp dword [rbp + 0x54], 0
jbe 0x54e332
mov ecx, dword [rbp + 0x54]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov ecx, ecx
call fcn.00409230
mov qword [rbp + 0x58], rax
nop
mov ecx, dword [rbp + 0x54]
mov rdx, qword [rbp + 0x58]
call sub.user32.dll_GetKeyboardLayoutList
mov rcx, qword [rbp + 0x80]
call fcn.00410b70
xor eax, eax
mov ebx, dword [rbp + 0x54]
sub ebx, 1
mov dword [rbp + 0x50], eax
cmp dword [rbp + 0x50], ebx
ja 0x54e31c
sub ebx, eax
add ebx, 1
mov rax, qword [rbp + 0x58]
mov ecx, dword [rbp + 0x50]
movzx eax, word [rax + rcx*8]
mov dword [rbp + 0x4c], eax
lea rcx, [rbp + 0x30]
mov edx, dword [rbp + 0x4c]
call fcn.0054e1b0
lea rcx, [rbp + 0x30]
lea rdx, [0x0054e420]
call fcn.00412a40
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.00412850
mov rcx, qword [rbp + 0x80]
mov rdx, qword [rbp + 0x28]
call fcn.00412180
add dword [rbp + 0x50], 1
sub ebx, 1
test ebx, ebx
jne 0x54e2ca
nop
nop
mov rcx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x54]
add edx, edx
add edx, edx
add edx, edx
mov edx, edx
call fcn.00409260
mov dword [rbp + 0x44], 0
mov rax, qword [rbp + 0x80]
mov rax, qword [rax]
test rax, rax
je 0x54e351
mov eax, dword [rax - 4]
shr eax, 1
mov dword [rbp + 0x44], eax
mov rcx, qword [rbp + 0x80]
mov rax, qword [rbp + 0x80]
mov rdx, qword [rax]
mov r8d, 1
mov r9d, dword [rbp + 0x44]
sub r9d, 4
call fcn.00412630
nop
lea rcx, [rbp + 0x28]
call fcn.00410b70
lea rcx, [rbp + 0x30]
call fcn.00410ad0
mov rax, qword [rbp + 0x80]
lea rsp, [rbp + 0x68]
pop rbx
pop rbp
ret
Function at 0x551720
Capabilities:
Clear file content

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rdx
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0xa0], r8
lea rcx, [rbp + 0xa0]
call fcn.00410ce0
nop
mov al, 1
mov byte [rbp + 0x5f], al
mov bl, 1
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0xffffffffffffffff
jne 0x5517c1
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0xa0]
call fcn.00448890
mov rcx, qword [rbp + 0x68]
call fcn.00412160
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
jmp 0x55184d
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
mov rdx, qword [rbp + 0x50]
xor r8, r8
xor r9, r9
call sub.kernel32.dll_SetFilePointerEx
test al, al
je 0x5517eb
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_SetEndOfFile
test eax, eax
jne 0x551860
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax]
call sub.kernel32.dll_CloseHandle
mov ecx, 0x64
call sub.kernel32.dll_Sleep
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0xa0]
call fcn.00448890
mov rcx, qword [rbp + 0x60]
call fcn.00412160
mov rcx, rax
mov edx, 0xc0000000
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x30], 0
call sub.kernel32.dll_CreateFileW
mov rcx, qword [rbp + 0x48]
mov qword [rcx], rax
add bl, 1
cmp bl, 0xb
jne 0x55175c
nop
xor eax, eax
mov byte [rbp + 0x5f], al
nop
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.00410c50
lea rcx, [rbp + 0xa0]
call fcn.00410b70
movzx rax, byte [rbp + 0x5f]
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
Function at 0x551960
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x38], 0
nop
mov rax, qword [rbp + 0x28]
add dword [rax], 1
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0x28]
mov edx, dword [rax]
call fcn.00449aa0
mov eax, 1
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movzx rdx, byte [rdx]
xor byte [rcx], dl
add eax, 1
cmp eax, 0x10
jne 0x551994
nop
xor eax, eax
movsxd r9, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movzx rdx, byte [rcx + r9]
mov ecx, edx
shl ecx, 4
movzx rcx, cl
shr ecx, 4
movzx r8, cl
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movzx rcx, byte [rcx + r8]
mov r10, qword [rbp + 0x20]
mov r10, qword [r10]
mov byte [r10 + r8], dl
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
mov byte [rdx + r9], cl
add eax, 1
cmp eax, 0x10
jne 0x5519ba
nop
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movzx rdx, byte [rdx + 0xf]
xor byte [rcx], dl
add eax, 1
cmp eax, 0xf
jne 0x551a06
nop
mov rax, qword [rbp + 0x38]
movzx rcx, byte [rax + 3]
shl ecx, 6
movzx rcx, cl
shr ecx, 6
xor eax, eax
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
movsxd r8, eax
lea rdx, [rdx + r8]
mov r8, qword [rbp + 0x38]
movzx r9, cl
movzx r8, byte [r8 + r9]
xor byte [rdx], r8b
add eax, 1
cmp eax, 0x10
jne 0x551a40
nop
xor eax, eax
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx]
movsxd rdx, eax
lea rcx, [rcx + rdx]
mov rdx, qword [rbp + 0x38]
mov r8d, eax
and r8d, 0x80000003
jns 0x551a93
sub r8d, 1
or r8d, 0xfffffffc
add r8d, 1
movsxd r8, r8d
movzx rdx, byte [rdx + r8]
xor byte [rcx], dl
add eax, 1
cmp eax, 0x10
jne 0x551a69
nop
nop
lea rcx, [rbp + 0x38]
mov rdx, qword [0x004482e0]
call fcn.00415bd0
lea rsp, [rbp + 0x40]
pop rbp
ret