joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801cc8e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov r10, qword [rsp + 0xd0]
mov rax, qword [rcx + 0x28]
mov r15, qword [rcx + 0x30]
mov rbp, r9
mov r13, r8
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x40], r10
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x38], rax
test dil, 0x40
jne 0x1801cc942
lea rdx, [rcx + 0x10]
mov r8, r15
call rax
mov r10, qword [rsp + 0x40]
movzx eax, dil
mov edi, reloc.WS2_32.dll_ntohs
xor esi, esi
and eax, 7
mov r14d, edi
mov ecx, esi
sub r14d, eax
mov byte [rbx], al
cmp r14d, edi
jae 0x1801cc986
mov edx, r14d
add rdx, rbx
sub edi, r14d
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
dec rdi
jne 0x1801cc970
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rbp
je 0x1801cc99e
or eax, 0xffffffff
jmp 0x1801ccaab
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x1801cca21
lea rax, [rbx + 0x10]
mov r9, r15
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x20], rbx
call r10
shl rdi, 4
add r12, rdi
add r13, rdi
sub rbp, rdi
je 0x1801cca69
lea r9, [rbx + 8]
shr rdi, 4
mov rdx, rsi
lea r8, [r9 + 8]
neg r9
nop dword [rax]
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
movzx ecx, dil
add rdx, rax
lea rax, [r9 + r8]
shr rdi, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x1801cca21
test rdi, rdi
jne 0x1801cc9f0
test rdx, rdx
jne 0x1801cc9f0
test rbp, rbp
je 0x1801cca69
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov r8, r15
mov rcx, rbx
call rdi
test rbp, rbp
je 0x1801cca5d
mov rdx, rsi
movzx ecx, byte [rdx + r12]
movzx eax, byte [rsp + rdx + 0x48]
inc esi
xor ecx, eax
mov byte [rdx + r13], cl
xor byte [rdx + rbx + 0x10], cl
mov edx, esi
cmp rdx, rbp
jb 0x1801cca40
lea rcx, [rbx + 0x10]
mov r8, r15
mov rdx, rcx
call rdi
cmp r14d, 0x10
jae 0x1801cca81
mov ecx, reloc.WS2_32.dll_recv
mov edi, r14d
sub ecx, r14d
add rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
lea rdx, [rsp + 0x48]
mov r8, r15
mov rcx, rbx
call qword [rsp + reloc.WS2_32.dll_getservbyport]
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180243450
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801cd4d0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [rsp + 0x30], 0
je 0x1801cd4e8
lea rax, [0x1801cd440]
mov qword [rsp + 0x30], rax
jmp fcn.1801ca230
lea rax, [0x1801cd420]
mov qword [rsp + 0x30], rax
jmp fcn.1801c9f70
Function at 0x1801cdba0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movzx ecx, byte [rcx + 0x80]
mov r11, r9
mov r10, r8
test cl, cl
je 0x1801cdcb3
movzx eax, cl
mov r8, rbx
movzx ecx, cl
sub r8, rax
sub r8, 0xffffffffffffff80
cmp r9, rax
ja 0x1801cdbd6
mov ecx, r9d
xor r9d, r9d
test ecx, ecx
jle 0x1801cdca7
cmp ecx, 0x20
jb 0x1801cdc77
lea eax, [rcx - 1]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
movsxd rdi, eax
lea rax, [rdi + r10]
lea rsi, [rdi + rdx]
cmp rdx, rax
ja 0x1801cdc0c
cmp rsi, r10
jae 0x1801cdc6d
lea rax, [rdi + r8]
cmp rdx, rax
ja 0x1801cdc1a
cmp rsi, r8
jae 0x1801cdc6d
mov eax, ecx
and eax, 0x8000001f
jge 0x1801cdc2a
dec eax
or eax, 0xffffffe0
inc eax
mov edi, ecx
sub edi, eax
nop
movdqu xmm0, xmmword [r10]
movdqu xmm1, xmmword [r8]
add r9d, 0x20
add rdx, 0x20
add r8, 0x20
add r10, 0x20
pxor xmm1, xmm0
movdqu xmmword [rdx - 0x20], xmm1
movdqu xmm1, xmmword [r8 - 0x10]
movdqu xmm0, xmmword [r10 - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rdx - 0x10], xmm1
cmp r9d, edi
jl 0x1801cdc30
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
cmp r9d, ecx
jge 0x1801cdca7
mov eax, ecx
sub r8, rdx
sub eax, r9d
mov r9d, eax
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
inc rdx
inc r10
xor al, byte [r10 - 1]
mov byte [rdx - 1], al
dec r9
jne 0x1801cdc90
sub byte [rbx + 0x80], cl
movsxd rax, ecx
sub r11, rax
mov r8, rdx
mov r9d, r11d
mov rcx, rbx
mov rdx, r10
add rsp, 0x20
pop rbx
jmp fcn.1801cdd10
Function at 0x1801ce950
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movzx eax, byte [rdx + 2]
movzx r9d, byte [rdx + 3]
mov r10, rcx
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx + 1]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx]
shl r9d, 8
or r9d, eax
mov dword [rcx + 0x10], r9d
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x18], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x1c], ecx
cmp r8d, 0x100
jne 0x1801ce9fb
add rdx, 0x10
lea r8, str.expand_32_byte_kexpand_16_byte_k
jmp 0x1801cea02
lea r8, [0x180381450]
movzx eax, byte [rdx + 2]
movzx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x20], ecx
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x24], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x28], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x2c], ecx
movsx eax, byte [r8 + 2]
movsx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [r10], ecx
movsx eax, byte [r8 + 6]
movsx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 4], ecx
movsx eax, byte [r8 + 0xa]
movsx ecx, byte [r8 + 0xb]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 9]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 8], ecx
movsx ecx, byte [r8 + 0xf]
movsx eax, byte [r8 + 0xe]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 0xd]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0xc], ecx
ret
Function at 0x1801e3ed0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
xor r11d, r11d
mov r9d, r8d
test r8d, r8d
jle 0x1801e3fc9
mov qword [rsp], rbx
lea r10, [rdx + 1]
lea rbx, [0x180384790]
movzx edx, byte [r10 - 1]
cmp r9d, 3
jl 0x1801e3f50
movzx eax, byte [r10]
shl edx, 8
or edx, eax
movzx eax, byte [r10 + 1]
shl edx, 8
or edx, eax
mov eax, edx
mov r8d, edx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov eax, edx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
mov eax, edx
shr rax, 6
and eax, 0x3f
and r8d, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 2], al
movzx eax, byte [r8 + rbx]
mov byte [rcx + 3], al
jmp 0x1801e3fa1
shl edx, 0x10
cmp r9d, 2
jne 0x1801e3f62
movzx eax, byte [r10]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [rcx + 1], al
cmp r9d, 1
jne 0x1801e3f8f
lea eax, [r9 + 0x3c]
jmp 0x1801e3f9a
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + rbx]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
sub r9d, 3
add rcx, 4
add r11d, 4
add r10, 3
test r9d, r9d
jg 0x1801e3ef2
mov rbx, qword [rsp]
mov byte [rcx], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret

Function at 0x1801e4200
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
cmp rdx, 0x100
ja 0x1801e425c
lea rcx, [rsp + 0x48]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1801e425c
mov rcx, qword [rsp + 0x48]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x48]
xor edx, edx
test eax, eax
jne 0x1801e4275
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.18023193c
mov dword [rax], 5
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1801e4290
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov r10, r8
mov r11, rdx
mov r9d, eax
test r8, r8
je 0x1801e42c7
sub r11, rcx
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [r11 + rcx]
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
xor r8d, edx
or r9d, r8d
dec r10
jne 0x1801e42b0
test r9d, r9d
setne al
ret
Function at 0x1801e57a0
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x38
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x1801e5890
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x1801e5890
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x1801e5839
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x1801e5808
nop dword [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x1801e57f6
cmp cl, 0xbb
jne 0x1801e57fe
inc eax
cmp eax, ebx
jl 0x1801e57e0
test eax, eax
je 0x1801e5808
sub ebx, eax
jmp 0x1801e583d
mov dword [rsp + 0x20], 0x7b
jmp 0x1801e5810
mov dword [rsp + 0x20], 0x81
lea r9, str.Z:metasploit_payloadscmeterpreterdepslibresslcrypto_rsa_rsa_x931.c
mov edx, 0xfff
mov ecx, 4
mov r8d, 0x8a
call fcn.1801727e0
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
lea ebx, [r9 - 2]
test ebx, ebx
js 0x1801e585f
movsxd r8, ebx
cmp byte [r8 + rdx], 0xcc
jne 0x1801e585f
mov rcx, r11
call fcn.180230800
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
lea r9, str.Z:metasploit_payloadscmeterpreterdepslibresslcrypto_rsa_rsa_x931.c
mov edx, 0xfff
mov ecx, 4
mov r8d, 0x8b
mov dword [rsp + 0x20], 0x8a
call fcn.1801727e0
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
lea r9, str.Z:metasploit_payloadscmeterpreterdepslibresslcrypto_rsa_rsa_x931.c
mov edx, 0xfff
mov ecx, 4
mov r8d, 0x89
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
call fcn.1801727e0
or eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1801ff470
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], eax
jge 0x1801ff493
mov rbx, r8
jmp 0x1801ff499
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
cmp edx, dword [rcx + 0xc]
jg 0x1801ff4a6
mov rax, rcx
jmp 0x1801ff4ab
call fcn.18018a410
test rax, rax
jne 0x1801ff4c0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x1801ff4f4
mov r9d, r8d
nop dword [rax]
mov rax, qword [rbx]
mov rcx, qword [rsi]
inc r8d
mov edx, dword [rcx + r9]
lea r9, [r9 + 4]
xor edx, dword [rax + r9 - 4]
mov rax, qword [rdi]
mov dword [r9 + rax - 4], edx
cmp r8d, dword [rsi + 8]
jl 0x1801ff4d0
cmp r8d, dword [rbx + 8]
jge 0x1801ff52a
movsxd rax, r8d
lea rdx, [rax*4]
nop word [rax + rax]
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov eax, dword [rdx + rax]
lea rdx, [rdx + 4]
mov dword [rdx + rcx - 4], eax
cmp r8d, dword [rbx + 8]
jl 0x1801ff510
mov edx, dword [rbx + 8]
mov dword [rdi + 8], edx
test edx, edx
jle 0x1801ff555
lea eax, [rdx - 1]
movsxd rcx, eax
mov rax, qword [rdi]
lea r8, [rax + rcx*4]
mov eax, dword [r8]
lea r8, [r8 - 4]
test eax, eax
jne 0x1801ff552
dec edx
test edx, edx
jg 0x1801ff541
mov dword [rdi + 8], edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x180229870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [rdx + 4]
xor r12d, r12d
mov r13d, r9d
mov ebx, eax
mov edi, r8d
mov qword [rsp + 0x28], rdx
sub ebx, r8d
mov rsi, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x20], eax
mov r15d, r12d
mov dword [rsp + 0x24], ebx
cmp r9d, r8d
jae 0x1802298df
lea r8, str.orig_len___md_size
lea rcx, str.Z:metasploit_payloadscmeterpreterdepslibressl_ssl_s3_cbc.c
mov edx, 0xd9
call fcn.1801734c0
cmp edi, 0x40
jbe 0x1802298fc
lea r8, str.md_size___EVP_MAX_MD_SIZE
lea rcx, str.Z:metasploit_payloadscmeterpreterdepslibressl_ssl_s3_cbc.c
mov edx, 0xda
call fcn.1801734c0
lea rax, [rsp + 0x40]
lea rbp, [rsp + 0x40]
neg rax
and eax, 0x3f
add rbp, rax
lea eax, [rdi + 0x100]
cmp r13d, eax
jbe 0x180229927
mov r15d, r13d
sub r15d, edi
sub r15d, 0x100
xor edx, edx
mov eax, edi
mov r8, rdi
and eax, 0xfffffffe
mov rcx, rbp
mov r14, rdi
shl eax, 0x17
sub eax, r15d
add eax, ebx
div edi
mov ebx, edx
xor edx, edx
call fcn.180231610
cmp r15d, r13d
jae 0x1802299ac
mov esi, dword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov r8d, r15d
sub r8d, esi
sub esi, dword [rsp + 0x24]
mov r9d, r15d
add r9, qword [rax + 0x10]
sub r13d, r15d
mov r10d, r13d
nop
mov ecx, r8d
lea edx, [rsi + r8]
inc r8d
not ecx
not edx
lea r9, [r9 + 1]
sar ecx, 0x1f
sar edx, 0x1f
not cl
and cl, byte [r9 - 1]
and cl, dl
or byte [r12 + rbp], cl
inc r12d
mov eax, r12d
sub eax, edi
sar eax, 0x1f
and r12d, eax
dec r10
jne 0x180229970
mov rsi, qword [rsp + 0x30]
test edi, edi
je 0x1802299d7
mov eax, ebx
mov ecx, ebx
inc ebx
xor rax, 0x20
lea rsi, [rsi + 1]
movzx eax, byte [rax + rbp]
movzx eax, byte [rcx + rbp]
mov byte [rsi - 1], al
mov eax, ebx
sub eax, edi
sar eax, 0x1f
and ebx, eax
dec r14
jne 0x1802299b0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180243450
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18022a260
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov rax, qword [rcx + 8]
inc r9d
mov rcx, qword [rax + 0x28]
mov rax, qword [rcx + 0x78]
test byte [rax], 1
je 0x18022a29d
mov ecx, dword [rdx + 4]
lea eax, [r9 + r8]
cmp eax, ecx
jbe 0x18022a28a
xor eax, eax
add rsp, 8
ret
mov eax, r8d
add qword [rdx + 0x10], rax
add qword [rdx + 0x18], rax
sub ecx, r8d
mov dword [rdx + 4], ecx
jmp 0x18022a2a3
cmp r9d, dword [rdx + 4]
ja 0x18022a283
mov r11d, dword [rdx + 4]
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, qword [rdx + 0x10]
lea ecx, [r11 - 1]
mov qword [rsp], rdi
movzx ebx, byte [rcx + rsi]
mov edi, 0xff
mov r8d, r11d
sub r8d, ebx
sub r8d, r9d
not r8d
sar r8d, 0x1f
cmp ecx, edi
cmovb edi, ecx
xor r9d, r9d
test edi, edi
je 0x18022a31b
mov r10d, ebx
nop word [rax + rax]
mov eax, r11d
sub eax, r9d
inc r9d
dec eax
movzx ecx, byte [rax + rsi]
mov eax, r10d
dec r10d
xor ecx, ebx
not eax
sar eax, 0x1f
movzx eax, al
and ecx, eax
not ecx
and r8d, ecx
cmp r9d, edi
jb 0x18022a2f0
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov eax, r8d
shr eax, 4
and r8d, eax
mov eax, r8d
shr eax, 2
and r8d, eax
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x10]
lea ecx, [r8 + r8]
and ecx, r8d
shl ecx, 0x1e
sar ecx, 0x1f
and eax, ecx
sub r11d, eax
mov dword [rdx + 8], eax
mov eax, ecx
and eax, 1
not ecx
mov dword [rdx + 4], r11d
or eax, ecx
add rsp, 8
ret

Function at 0x18023ca80
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.18023c8e8

Function at 0x18024fe14
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18024fe2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18024fe2c
xor eax, eax
test eax, eax
je 0x18024fe3c
mov ecx, eax
call fcn.1802318ec
or eax, 0xffffffff
jmp 0x18024fe3e
xor eax, eax
add rsp, 0x28
ret
Function at 0x140030e60
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
xor ecx, ecx
call fcn.140030b20
lea rcx, [0x1401c5a80]
mov edx, 6
call fcn.140032cd0
cmp eax, 1
jne 0x140030e92
xor ecx, ecx
mov edx, esi
add rsp, 0x20
pop rsi
jmp 0x1400332a0
test eax, eax
js 0x140030e9c
add rsp, 0x20
pop rsi
ret
mov ecx, 1
xor edx, edx
xor r8d, r8d
call fcn.140033180
mov ecx, 1
mov edx, 0x3a
xor r8d, r8d
call fcn.140033180
mov ecx, 1
xor edx, edx
xor r8d, r8d
call fcn.140033180
mov ecx, 1
call fcn.1401158c0
int3
push rsi
push rdi
push rbx
sub rsp, 0x250
mov esi, edx
mov rax, qword [0x1401c30e8]
xor rax, rsp
mov qword [rsp + 0x248], rax
mov ebx, edx
and ebx, 4
mov edi, edx
and edi, 2
je 0x1400332d1
mov eax, ecx
and eax, 2
je 0x1400332e1
xor eax, eax
test ebx, ebx
je 0x14003330e
mov eax, 1
test cl, 4
jne 0x14003330e
lea rcx, [rsp + 0x40]
mov r8d, 0x200
xor edx, edx
call fcn.140099390
fxsave [rsp + 0x40]
mov eax, dword [rsp + 0x5c]
mov ecx, eax
shl ecx, 0x19
sar ecx, 0x1f
and edi, ecx
shl eax, 0xe
sar eax, 0x1f
and eax, ebx
test sil, 1
je 0x14003332b
stmxcsr dword [rsp + 0x3c]
mov ecx, 0x8000
or ecx, dword [rsp + 0x3c]
mov dword [rsp + 0x38], ecx
ldmxcsr dword [rsp + 0x38]
test edi, edi
je 0x140033344
stmxcsr dword [rsp + 0x34]
mov ecx, dword [rsp + 0x34]
or ecx, 0x40
mov dword [rsp + 0x30], ecx
ldmxcsr dword [rsp + 0x30]
test eax, eax
je 0x14003335f
stmxcsr dword [rsp + 0x2c]
mov eax, 0x20000
or eax, dword [rsp + 0x2c]
mov dword [rsp + 0x28], eax
ldmxcsr dword [rsp + 0x28]
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.140092cc0
nop
add rsp, 0x250
pop rbx
pop rdi
pop rsi
ret
Function at 0x14008dcf0
Capabilities:
Get geographical location

Disassembly:
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call fcn.14008dce0
mov dword [rsp + 0x28], eax
call fcn.1401021c0
mov ecx, 8
imul rcx, rcx, 5
mov rax, qword [rax + rcx]
mov qword [rsp + 0x30], rax
mov r9d, dword [rsp + 0x28]
lea r8, [rsp + 0x20]
mov edx, 0x22
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x20]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x30
je 0x14008dd6f
cmp dword [rsp + 0x24], 0x31
je 0x14008dd76
cmp dword [rsp + 0x24], 0x32
je 0x14008dd7d
jmp 0x14008dd84
mov eax, 2
jmp 0x14008dd86
mov eax, 1
jmp 0x14008dd86
mov eax, 3
jmp 0x14008dd86
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x1400b12a0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400b0d80
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400b12df
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1401643f0]
jmp 0x1400b12e9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1401261e0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret

Function at 0x140128d30
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140127fe0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140128d97
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1401643f8]
jmp 0x140128db9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1401292c0
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret
Function at 0x14012d070
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400929b0
sub rsp, rax
mov rax, qword [0x1401c30e8]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1401c7910]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14012d262
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14012d1b6
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14012d1b6
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14012d19b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14012d138
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14012d222
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14012d281
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14012d25d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14012d281
jmp 0x14012d10e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140092cc0
add rsp, 0x1498
pop rdi
pop rsi
ret