joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800763f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x278
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov edi, dword [rdx + 8]
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov qword [rsp + 0x60], rcx
mov qword [rax - 0x18], r14
mov qword [rax - 0x20], r15
mov r15, qword [rdx + 0x20]
lea rcx, [rax - 0x1d8]
add edi, 0xfffffff0
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x68], r8
call fcn.180083c10
lea rsi, [r15 + 0x10]
lea rcx, [rsp + 0xa0]
mov rdx, rsi
mov r8d, edi
call fcn.1800860b0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x40]
call fcn.1800861a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov r8d, setsockopt
call fcn.180079270
lea rax, [rsp + 0x30]
lea r10, [rsp + 0x30]
lea rbx, [rsp + 0x70]
lea rbp, [rsp + 0x31]
lea r12, [rsp + 0x71]
lea r13, [rsp + 0x32]
lea r14, [rsp + 0x72]
mov r9, r15
mov r8, 0xffffffffffffffff
sub r10, r15
sub rbx, r15
sub r9, rax
sub rbp, r15
sub r12, r15
sub r13, r15
sub r14, r15
lea r11, [r15 + 1]
sub r8, r15
nop
nop
nop
lea rdx, [r8 + r11]
add r11, 4
lea rax, [rsp + rdx + 0x30]
movzx ecx, byte [rax + r9]
xor cl, byte [rax]
movzx eax, byte [r10 + r11 - 4]
mov byte [rsp + rdx + 0x70], cl
xor al, byte [r11 - 4]
mov byte [rbx + r11 - 4], al
movzx eax, byte [r11 + rbp - 4]
xor al, byte [r11 - 3]
mov byte [r12 + r11 - 4], al
movzx eax, byte [r13 + r11 - 4]
xor al, byte [r11 - 2]
mov byte [r14 + r11 - 4], al
lea rax, [r8 + r11]
cmp rax, 0x10
jl 0x1800764d0
xor edx, edx
lea r9, [rsp + 0x70]
lea rcx, [rsp + 0x58]
lea r8d, [rdx + 3]
mov dword [rsp + 0x20], setsockopt
call fcn.180075ee0
mov r14, qword [rsp + 0x260]
mov r13, qword [rsp + 0x268]
test eax, eax
mov r12, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x288]
jne 0x18007667c
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x90]
call fcn.180079270
lea rdx, [rsp + 0x80]
mov r8d, setsockopt
mov rcx, r15
call fcn.180079270
lea r9, [rsp + 0x90]
lea rcx, [rsp + 0x100]
xor edx, edx
mov r8d, pe_nt_image_headers64
mov ebx, edi
and edi, 0xf
call fcn.180096180
lea rcx, [rsp + 0x58]
xor r8d, r8d
mov dl, 2
call fcn.1800962f0
shr ebx, 4
je 0x1800765e7
mov r9d, ebx
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x58]
mov r8, rsi
shl r9d, 7
mov qword [rsp + 0x20], rsi
call fcn.180096340
test edi, edi
je 0x18007667a
add ebx, 0xffffffff
lea rcx, [rsp + 0x40]
mov r8d, setsockopt
shl ebx, 4
add rbx, rsi
mov rdx, rbx
call fcn.180077c40
test edi, edi
je 0x180076631
lea rcx, [rsp + 0x40]
lea rdx, [rbx + 0x10]
mov r10d, edi
nop
nop
movzx eax, byte [rdx]
inc rcx
inc rdx
xor byte [rcx - 1], al
dec r10
jne 0x180076620
lea rax, [rsp + 0x40]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x58]
mov r9d, pe_nt_image_headers64
mov qword [rsp + 0x20], rax
call fcn.180096340
lea rcx, [rbx + 0x10]
mov r8d, edi
mov rdx, rbx
call fcn.180077c40
lea rdx, [rsp + 0x40]
mov r8d, setsockopt
mov rcx, rbx
call fcn.180077c40
xor eax, eax
mov r15, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov rbx, qword [rsp + 0x280]
add rsp, 0x278
ret
Function at 0x180076ed0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x1c8
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov ebx, r8d
mov edi, r8d
mov rbp, rcx
mov rsi, rdx
lea rcx, [rsp + 0x70]
mov r8d, pe_nt_image_headers64
mov dl, 1
and edi, 0xf
shr ebx, 4
call fcn.180096180
lea rcx, [rsp + 0x50]
xor r8d, r8d
mov dl, 2
call fcn.1800962f0
cmp ebx, 1
jbe 0x180076f3d
lea edx, [rbx - 2]
lea rcx, [rsp + 0x40]
mov r8d, setsockopt
shl edx, 4
add rdx, rbp
call fcn.180077c40
jmp 0x180076f4d
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x10]
call fcn.180077c30
test ebx, ebx
je 0x180076f6f
mov r9d, ebx
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov r8, rbp
shl r9d, 7
mov qword [rsp + 0x20], rsi
call fcn.180096a00
test edi, edi
je 0x180077095
lea esi, [rbx - 1]
lea r8, [rsp + 0x40]
lea r9, [rsp + 0x41]
shl esi, 4
lea r10, [rsp + 0x42]
lea r11, [rsp + 0x43]
add rsi, rbp
mov ebx, 4
sub r8, rsi
sub r9, rsi
sub r10, rsi
sub r11, rsi
mov rcx, rsi
mov rdx, rbx
nop
nop
movzx eax, byte [r8 + rcx]
xor byte [rcx], al
movzx eax, byte [r9 + rcx]
xor byte [rcx + 1], al
movzx eax, byte [r10 + rcx]
xor byte [rcx + 2], al
movzx eax, byte [r11 + rcx]
xor byte [rcx + 3], al
add rcx, rbx
dec rdx
jne 0x180076fb0
test edi, edi
je 0x180076fef
mov rcx, rsi
mov edx, edi
movzx eax, byte [rcx + 0x10]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x180076fe0
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0x30]
mov r8d, edi
call fcn.180077c40
mov r8d, setsockopt
lea rdx, [rdi + rsi]
lea rcx, [rsp + rdi + 0x30]
sub r8d, edi
call fcn.180077c40
lea r11, [rsp + 0x30]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov r9d, pe_nt_image_headers64
mov qword [rsp + 0x20], r11
call fcn.180096a00
xor r11d, r11d
nop
movzx eax, byte [rsp + r11 + 0x40]
add r11, 4
xor byte [rsp + r11 + 0x2c], al
movzx eax, byte [rsp + r11 + 0x3d]
xor byte [rsp + r11 + 0x2d], al
movzx eax, byte [rsp + r11 + 0x3e]
xor byte [rsp + r11 + 0x2e], al
movzx eax, byte [rsp + r11 + 0x3f]
xor byte [rsp + r11 + 0x2f], al
dec rbx
jne 0x180077040
lea rcx, [rsi + 0x10]
mov r8d, edi
mov rdx, rsi
call fcn.180077c40
lea r8d, [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.180077c40
mov rdi, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1d8]
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c8
ret
Function at 0x1800770d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xb8
mov qword [rax + 0x10], rbx
mov ebx, dword [rdx + 8]
mov qword [rax + 0x18], rsi
mov rsi, qword [rdx + 0x20]
mov qword [rax - 0x60], rcx
mov qword [rax - 0x68], rdx
mov qword [rax - 0x58], r8
lea rcx, [rax - 0x30]
mov r8d, setsockopt
mov rdx, rsi
call fcn.180079270
mov edx, 1
lea r9, [rsp + 0x88]
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 2]
mov dword [rsp + 0x20], setsockopt
call fcn.180075ee0
test eax, eax
jne 0x18007720b
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0xd8], rdi
call fcn.180079270
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x68]
mov r8d, setsockopt
call fcn.180079270
add ebx, 0xfffffff0
lea r9, [rsp + 0x40]
lea rdx, [rsi + 0x10]
lea rcx, [rsi + 0x10]
mov r8d, ebx
call fcn.180076ed0
lea r8, [rsp + 0x30]
lea rcx, [rsi + 0x10]
mov edx, ebx
call fcn.180075e60
mov rdi, qword [rsp + 0xd8]
lea rax, [rsp + 0x69]
lea r9, [rsp + 0x69]
lea r10, [rsp + 0x31]
mov r8, rsi
xor r11d, r11d
sub r8, rax
sub r9, rsi
sub r10, rsi
lea rdx, [rsi + 2]
nop
nop
movzx eax, byte [rsp + r11 + 0x30]
lea rcx, [rsp + r11 + 0x69]
add r11, 4
xor al, byte [rsp + r11 + 0x64]
add rdx, 4
mov byte [r8 + rcx], al
movzx eax, byte [rsp + r11 + 0x2d]
xor al, byte [rcx]
mov byte [rdx - 5], al
movzx eax, byte [rsp + r11 + 0x66]
xor al, byte [rsp + r11 + 0x2e]
mov byte [rdx - 4], al
movzx eax, byte [r10 + rdx - 4]
xor al, byte [r9 + rdx - 4]
cmp r11, 0x10
mov byte [rdx - 3], al
jl 0x1800771c0
xor eax, eax
mov rsi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb8
ret

Function at 0x180078ab0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1800ac390
sub rsp, 0x28
mov ecx, dword [0x18014ea80]
cmp ecx, 0xffffffff
jne 0x1800ac3bb
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor edx, edx
mov ecx, eax
mov dword [0x18014ea80], eax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x18014ea80]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x180083c10
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.1800b0d50
xor eax, eax
mov dword [rbx], 0x67452301
mov dword [rbx + 0x18], eax
mov dword [rbx + 0x14], eax
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
Function at 0x18008a5a0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 0x28
cmp r9d, 1
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x18], r13
mov r13, rcx
mov r11d, r9d
mov rdi, rdx
jae 0x18008a5d4
xor r10d, r10d
xor eax, eax
mov dword [rdx], r10d
mov r13, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
xor r10d, r10d
test r9d, r9d
mov dword [rdx], r10d
je 0x18008a718
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x10], r14
mov qword [rsp + 8], r15
mov qword [rsp + 0x30], rbx
lea ecx, [r11 - 1]
mov eax, 0xaaaaaaab
mov qword [rsp + 0x40], rsi
lea r9, [r8 + 1]
lea r15d, [r10 + 3]
mul ecx
shr edx, 1
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov qword [rsp + 0x20], r12
lea ebp, [rdx + 1]
mov eax, 0xaaaaaaab
mov ebx, r11d
mul r10d
movzx eax, byte [r9 - 1]
shr edx, 1
mov r12d, eax
mov r8d, edx
add r8, r13
cmp r11d, r15d
cmovae ebx, r15d
shr r12d, 2
cmp ebx, 1
jle 0x18008a65c
movzx edx, byte [r9]
and eax, r15d
shr edx, 4
shl eax, 4
or edx, eax
jmp 0x18008a664
mov edx, eax
and edx, r15d
shl edx, 4
cmp ebx, 2
jle 0x18008a67e
mov cl, byte [r9]
movzx eax, byte [r9 + 1]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
jmp 0x18008a687
mov cl, byte [r9]
and ecx, 0xf
shl ecx, 2
mov sil, byte [r9 + 1]
mov eax, r12d
and eax, 0x3f
and esi, 0x3f
movzx eax, byte [rax + r14]
mov byte [r8], al
mov eax, edx
and eax, 0x3f
cmp ebx, 1
movzx eax, byte [rax + r14]
mov byte [r8 + 1], al
jne 0x18008a6bb
mov byte [r8 + 2], 0x3d
mov byte [r8 + 3], 0x3d
jmp 0x18008a6e3
mov eax, ecx
and eax, 0x3f
cmp ebx, 2
movzx eax, byte [rax + r14]
mov byte [r8 + 2], al
jne 0x18008a6d5
mov byte [r8 + 3], 0x3d
jmp 0x18008a6e3
mov eax, esi
and eax, 0x3f
movzx eax, byte [rax + r14]
mov byte [r8 + 3], al
add dword [rdi], 4
add r11d, 0xfffffffd
add r10d, 0xc
add r9, r15
dec rbp
jne 0x18008a620
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r12, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r13, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x28
ret

Function at 0x18008b020
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
lea r9, [rsp + 0x50]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x50]
test eax, eax
cmove ecx, ebx
mov eax, ecx
add rsp, 0x30
pop rbx
ret
Function at 0x18008b790
Capabilities:
Encode data using xor

Disassembly:
movzx eax, word [r8 + 0x2c]
mov qword [rsp + 0x18], rsi
mov r11, rcx
mov word [rcx], ax
movzx eax, word [r8 + 0x2e]
mov r10, r8
mov word [rcx + 2], ax
movzx eax, word [r8 + 0x28]
mov rsi, rdx
mov word [rcx + 4], ax
movzx eax, word [r8 + 0x2a]
mov word [rcx + 6], ax
add word [r8 + 0x18], 0xffff
mov rax, qword [r9]
bt word [rax + 0x4c], 8
movzx ecx, word [r8 + 0x18]
jb 0x18008b7ef
movzx eax, byte [r8 + 0x1c]
cmp al, 2
jb 0x18008b7e5
cmp al, 0x34
jbe 0x18008b7ef
mov ax, 7
mov rsi, qword [rsp + 0x18]
ret
test cx, cx
je 0x18008b973
cmp cx, 0x1fff
ja 0x18008b973
add r11, 8
test cx, cx
je 0x18008b973
mov qword [rsp + 0x10], rbp
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
nop
movzx eax, word [r11]
mov r9d, 5
mov rbx, r10
mov word [r10 + 0x28], ax
movzx eax, word [r11 + 2]
lea rdi, [r10 + 2]
mov word [r10 + 0x2a], ax
movzx eax, word [r11 + 4]
mov word [r10 + 0x2c], ax
movzx eax, word [r11 + 6]
mov word [r10 + 0x2e], ax
nop
nop
nop
movzx r8d, word [r10 + 0x2e]
movzx eax, word [r10 + 0x2c]
add rbx, 4
mov word [r10 + 0x20], ax
movzx ecx, al
shr ax, 8
xor al, cl
mov word [r10 + 0x22], r8w
add rdi, 4
movzx edx, al
movzx eax, r8w
shr ax, 8
shl dx, 8
add dx, cx
xor al, r8b
and r8w, 0xff00
mov word [r10 + 0x2c], dx
movzx ecx, al
add cx, r8w
mov word [r10 + 0x2e], cx
xor dx, word [rbx - 4]
mov word [r10 + 0x2c], dx
xor cx, word [rdi - 4]
mov word [r10 + 0x2e], cx
movzx ecx, byte [rsi + 1]
add cl, byte [rsi + 2]
inc cl
rol cl, 1
rol cl, 1
mov byte [rsi + 1], cl
movzx eax, cl
add cl, byte [rsi + 2]
add al, byte [rsi]
rol al, 1
rol al, 1
rol cl, 1
mov byte [rsi], al
rol cl, 1
mov byte [rsi + 2], cl
add cl, byte [rsi + 3]
inc cl
rol cl, 1
rol cl, 1
mov byte [rsi + 3], cl
movzx eax, word [r10 + 0x28]
xor word [r10 + 0x2c], ax
movzx eax, word [r10 + 0x2a]
xor word [r10 + 0x2e], ax
dec r9
movzx eax, word [r10 + 0x20]
mov word [r10 + 0x28], ax
movzx eax, word [r10 + 0x22]
mov word [r10 + 0x2a], ax
jns 0x18008b860
movzx eax, word [r10 + 0x2c]
add r11, 8
mov word [r11 - 8], ax
movzx eax, word [r10 + 0x2e]
mov word [r11 - 6], ax
movzx eax, word [r10 + 0x28]
mov word [r11 - 4], ax
movzx eax, word [r10 + 0x2a]
mov word [r11 - 2], ax
add word [r10 + 0x18], 0xffff
cmp word [r10 + 0x18], 0
ja 0x18008b820
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x18]
xor ax, ax
ret
Function at 0x18008d430
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov r8d, edx
mov rbx, rcx
mov qword [rsp + 0x48], rdi
mov edi, edx
mov rdx, rcx
lea rcx, str.HL_LICENSEDIR
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
mov r11d, eax
je 0x18008d4fe
lea r8d, [rdi - 1]
cmp eax, r8d
jae 0x18008d4e2
movzx r10d, byte [rbx]
xor r8d, r8d
test r10b, r10b
mov edx, r8d
je 0x18008d48a
mov rcx, rbx
nop
inc rcx
inc edx
cmp byte [rcx], r8b
jne 0x18008d480
movsxd rax, edx
cmp byte [rax + rbx - 1], 0x5c
je 0x18008d4e2
lea r9, [0x1801175c0]
mov edx, r8d
mov rax, r9
inc rax
inc edx
cmp byte [rax], r8b
jne 0x18008d4a1
test r10b, r10b
je 0x18008d4be
mov rax, rbx
inc rax
inc r8d
cmp byte [rax], 0
jne 0x18008d4b3
inc edx
movsxd rax, r8d
lea rcx, [rax + rbx]
je 0x18008d4df
sub r9, rax
sub r9, rbx
nop
movzx eax, byte [r9 + rcx]
inc rcx
dec edx
mov byte [rcx - 1], al
jne 0x18008d4d0
inc r11d
test r11d, r11d
je 0x18008d4fe
cmp r11d, edi
jae 0x18008d4fe
mov eax, r11d
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
mov r8d, edi
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
mov r11d, eax
jne 0x18008d522
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
cmp byte [r11 + rbx], 0x5c
movsxd rcx, r11d
je 0x18008d549
lea rax, [rcx + rbx]
cmp byte [rax], 0x3a
je 0x18008d549
test r11d, r11d
je 0x18008d549
mov byte [rax], 0
dec rax
add r11d, 0xffffffff
cmp byte [rax], 0x5c
jne 0x18008d530
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea eax, [r11 + 1]
add rsp, 0x28
ret
Function at 0x1800902c0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov qword [rax - 0x18], r14
mov rbx, rdx
mov r13d, ecx
xor r14d, r14d
mov edx, 0x10000
xor ecx, ecx
mov rdi, r14
mov r12, r8
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rsi, rax
je 0x1800904bf
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x180090488
lea r9, [rsp + 0x40]
mov r8d, 0x10000
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [rsp + 0x40]
mov rcx, rbp
test eax, eax
cmove ebx, r14d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
mov rdi, rax
je 0x180090488
test ebx, ebx
mov r8d, r14d
mov r9d, r14d
mov rcx, r14
je 0x1800903d1
mov rdx, rax
nop
nop
movzx eax, byte [rcx + rsi]
mov byte [rdx], al
cmp byte [rcx + rsi], 0xd
jne 0x1800903c3
lea eax, [rbx - 1]
cmp r8d, eax
jae 0x1800903c0
cmp byte [rcx + rsi + 1], 0xa
jne 0x1800903c0
inc r9d
jmp 0x1800903c6
mov byte [rdx], 0xa
inc rdx
inc r8d
inc rcx
cmp r8d, ebx
jb 0x1800903a0
sub ebx, r9d
mov r8d, r14d
mov r9, r14
je 0x180090488
lea r10, str.Begin_HL_RUS_License_______________________
nop
nop
nop
cmp byte [r9 + rdi], 0x42
lea rdx, [r9 + rdi]
jne 0x18009042b
mov ecx, r8d
mov eax, ebx
add rcx, 0x2d
cmp rcx, rax
ja 0x180090488
mov rcx, r14
nop
movzx eax, byte [rcx + r10]
cmp byte [rdx + rcx], al
jne 0x18009042b
inc rcx
cmp rcx, 0x2b
jl 0x180090410
cmp byte [r9 + rdi + 0x2b], 0xa
je 0x180090438
inc r8d
inc r9
cmp r8d, ebx
jb 0x1800903f0
jmp 0x180090488
add r8d, 0x2c
mov eax, ebx
sub eax, r8d
cmp eax, 0x31
jb 0x180090488
cmp r8d, ebx
mov ecx, r8d
movsxd rax, r8d
jae 0x18009046e
add rax, rdi
cmp byte [rax], 0xa
je 0x180090464
inc ecx
inc rax
cmp ecx, ebx
jb 0x180090454
jmp 0x18009046e
cmp ecx, ebx
mov eax, ecx
mov byte [rax + rdi], r14b
jb 0x180090473
mov byte [rbx + rdi - 1], r14b
mov ecx, r8d
mov edx, r13d
mov r8, r12
add rcx, rdi
call fcn.180090100
test eax, eax
jne 0x1800904a3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x18009049f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x1800904ba
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
mov rbp, qword [rsp + 0x78]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x180093030
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
sub rsp, 0x258
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13d, ecx
mov rsi, rdx
mov ebp, r8d
lea rcx, str.HL_LICENSEDIR
lea rdx, [rsp + 0x20]
mov r8d, 0x105
mov r12, r9
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor ebx, ebx
test eax, eax
mov edi, eax
je 0x180093114
cmp eax, 0x104
jae 0x180093108
movzx r8d, byte [rsp + 0x20]
mov edx, ebx
test r8b, r8b
je 0x1800930a9
lea rcx, [rsp + 0x20]
nop
nop
inc rcx
inc edx
cmp byte [rcx], bl
jne 0x1800930a0
movsxd rax, edx
cmp byte [rsp + rax + 0x1f], 0x5c
je 0x180093108
lea r9, [0x1801175c0]
mov edx, ebx
mov rax, r9
nop
inc rax
inc edx
cmp byte [rax], bl
jne 0x1800930c0
test r8b, r8b
mov ecx, ebx
je 0x1800930de
lea rax, [rsp + 0x20]
inc rax
inc ecx
cmp byte [rax], bl
jne 0x1800930d5
lea eax, [rdx + 1]
movsxd r8, ecx
test eax, eax
lea rcx, [rsp + r8 + 0x20]
je 0x180093106
mov rdx, rcx
sub rdx, r8
lea r8, [rsp + 0x20]
sub rdx, r8
mov r8d, eax
add rdx, r9
call fcn.180005f30
inc edi
test edi, edi
je 0x180093114
cmp edi, 0x105
jb 0x180093159
lea rdx, [rsp + 0x20]
mov r8d, 0x105
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x18009315d
mov ecx, eax
movsxd rdx, eax
cmp byte [rsp + rcx + 0x20], 0x5c
je 0x180093156
lea rcx, [rsp + rdx + 0x20]
nop
cmp byte [rcx], 0x3a
je 0x180093156
test eax, eax
je 0x180093156
mov byte [rcx], bl
dec rcx
add eax, 0xffffffff
cmp byte [rcx], 0x5c
jne 0x180093140
lea edi, [rax + 1]
test edi, edi
jne 0x180093169
movzx eax, word [0x180120860]
mov word [rsp + 0x20], ax
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x20]
mov r9, r12
mov ecx, r13d
call fcn.180092d60
mov r13, qword [rsp + 0x248]
mov r12, qword [rsp + 0x250]
test rax, rax
mov r11, rax
je 0x1800931d7
cmp byte [rax], bl
je 0x1800931aa
mov rcx, rax
inc rcx
inc ebx
cmp byte [rcx], 0
jne 0x1800931a0
inc ebx
mov rcx, rsi
je 0x1800931cf
sub r11, rsi
nop
nop
nop
movzx eax, byte [r11 + rcx]
inc rcx
dec ebx
mov byte [rcx - 1], al
jne 0x1800931c0
mov rax, rsi
jmp 0x180093276
test ebp, ebp
je 0x180093274
cmp byte [rsp + 0x20], bl
mov edi, ebx
je 0x1800931f9
lea rax, [rsp + 0x20]
nop
inc rax
inc edi
cmp byte [rax], bl
jne 0x1800931f0
lea eax, [rdi + 1]
test eax, eax
je 0x180093210
lea rdx, [rsp + 0x20]
mov r8d, eax
mov rcx, rsi
call fcn.180005f30
cmp edi, 0x104
jge 0x18009322a
movsxd rax, edi
cmp byte [rax + rsi - 1], 0x5c
je 0x18009322a
mov byte [rax + rsi], 0x5c
mov byte [rax + rsi + 1], bl
cmp byte [rsi], bl
je 0x18009323b
mov rax, rsi
inc rax
inc ebx
cmp byte [rax], 0
jne 0x180093231
movsxd r9, ebx
lea rax, [r9 + 0x17]
cmp rax, 0x104
jae 0x180093274
lea r8, str.hlrus_license_file.alf
mov edx, reloc.WSOCK32.dll_socket
lea rcx, [r9 + rsi]
sub r8, r9
sub r8, rsi
movzx eax, byte [r8 + rcx]
inc rcx
dec edx
mov byte [rcx - 1], al
jne 0x180093260
mov rax, rsi
jmp 0x180093276
xor eax, eax
mov rdi, qword [rsp + 0x278]
mov rsi, qword [rsp + 0x270]
mov rbp, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x260]
add rsp, 0x258
ret
Function at 0x180096770
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x68
test rcx, rcx
mov qword [rax - 0x10], rbp
mov qword [rax - 0x20], rdi
mov qword [rax - 0x38], r14
mov rdi, r8
mov rbp, rdx
mov r14d, r9d
mov r10, rcx
je 0x1800969d8
test rdx, rdx
je 0x1800969d8
cmp byte [rdx], 1
je 0x1800969d8
test r8, r8
je 0x1800969c2
test r9d, r9d
jle 0x1800969c2
mov qword [rax - 8], rbx
mov qword [rax - 0x18], rsi
mov qword [rax - 0x28], r12
mov qword [rax - 0x30], r13
mov eax, r9d
cdq
and edx, 0xf
lea r12d, [rdx + rax]
movzx eax, byte [rcx + 0x14]
sar r12d, 4
dec eax
je 0x180096929
dec eax
je 0x180096818
mov eax, 0xfffffffb
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov r13, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x68
ret
test r12d, r12d
mov esi, r12d
jle 0x180096882
mov rbx, qword [rsp + 0x90]
nop
nop
mov eax, dword [rdi]
mov r9d, dword [rbp + 0x4c]
lea r8, [rbp + 0x54]
xor eax, dword [r10]
lea rcx, [rsp + 0x20]
mov rdx, rbx
mov dword [rsp + 0x20], eax
mov eax, dword [r10 + 4]
xor eax, dword [rdi + 4]
mov dword [rsp + 0x24], eax
mov eax, dword [r10 + 8]
xor eax, dword [rdi + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [r10 + 0xc]
xor eax, dword [rdi + 0xc]
mov dword [rsp + 0x2c], eax
call fcn.1800c3bd0
dec esi
mov r10, rbx
add rdi, 0x10
add rbx, 0x10
test esi, esi
jg 0x180096830
jmp 0x18009688a
mov rbx, qword [rsp + 0x90]
shl r12d, 4
mov r11d, setsockopt
mov r9d, r12d
sub r9d, r14d
add r9d, 0x10
sub r11d, r9d
test r11d, r11d
jle 0x1800968d4
lea r8, [rsp + 0x20]
mov rdx, r10
mov ecx, r11d
sub rdx, rdi
sub r8, rdi
nop
nop
nop
movzx eax, byte [rdx + rdi]
inc rdi
xor al, byte [rdi - 1]
dec rcx
mov byte [r8 + rdi - 1], al
jne 0x1800968c0
movsxd r8, r11d
cmp r8, 0x10
jge 0x18009690a
lea rax, [rsp + 0x20]
sub r10, rax
nop
nop
nop
lea rax, [r10 + r8]
inc r8
movzx ecx, byte [rsp + rax + 0x20]
xor cl, r9b
cmp r8, 0x10
mov byte [rsp + r8 + 0x1f], cl
jl 0x1800968f0
mov r9d, dword [rbp + 0x4c]
lea r8, [rbp + 0x54]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1800c3bd0
lea eax, [r12 + 0x10]
jmp 0x1800967f0
test r12d, r12d
mov ebx, r12d
jle 0x180096963
mov rsi, qword [rsp + 0x90]
nop
nop
mov r9d, dword [rbp + 0x4c]
lea r8, [rbp + 0x54]
mov rdx, rsi
mov rcx, rdi
call fcn.1800c3bd0
dec ebx
add rdi, 0x10
add rsi, 0x10
test ebx, ebx
jg 0x180096940
jmp 0x18009696b
mov rsi, qword [rsp + 0x90]
mov r11d, setsockopt
shl r12d, 4
lea rcx, [rsp + 0x20]
mov ebx, r12d
mov rdx, rdi
sub ebx, r14d
add ebx, 0x10
sub r11d, ebx
movsxd r8, r11d
call fcn.180005f30
movsxd r8, ebx
lea rcx, [rsp + 0x30]
sub rcx, r8
mov edx, ebx
call fcn.18000abd0
mov r9d, dword [rbp + 0x4c]
lea r8, [rbp + 0x54]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1800c3bd0
lea eax, [r12 + 0x10]
jmp 0x1800967f0
xor eax, eax
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x68
ret
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
mov eax, 0xfffffffb
add rsp, 0x68
ret