joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rsi
push rax
mov rbp, rsp
mov rsi, rcx
cmp dword [0x1400cb400], 0xa
jl 0x140001023
mov eax, dword [0x1400cb404]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140001069
mov eax, 0x1a0
call fcn.1400957c0
sub rsp, rax
mov rdx, rsp
mov byte [rsi], 0
sub rsp, 0x20
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
add rsp, 0x20
mov r8d, dword [0x1400cb404]
mov ecx, dword [0x1400cb400]
lea edx, [r8 + 1]
imul edx, r8d
and edx, 1
cmp ecx, 0xa
jl 0x140001090
test edx, edx
je 0x140001090
mov eax, 0x1a0
call fcn.1400957c0
sub rsp, rax
mov rdx, rsp
mov byte [rsi], 0
sub rsp, 0x20
mov cx, 2
call qword [sym.imp.WS2_32.dll_WSAStartup]
add rsp, 0x20
jmp 0x140001023
test eax, eax
jne 0x1400010c1
jmp 0x1400010a4
test edx, edx
je 0x1400010c1
mov byte [rsi], 1
mov eax, dword [0x1400cb404]
mov ecx, dword [0x1400cb400]
lea edx, [rax + 1]
imul edx, eax
and edx, 1
cmp ecx, 0xa
jge 0x1400010a0
cmp ecx, 0xa
jl 0x1400010d2
test edx, edx
je 0x1400010d2
nop word [rax + rax]
jmp 0x1400010d0
mov rax, rsi
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
Function at 0x1400042d0
Capabilities:
Get system information on windows
Terminate process

Disassembly:
push rbp
push rsi
push rax
mov rbp, rsp
cmp dword [0x1400cb500], 0xa
jl 0x1400042f0
mov eax, dword [0x1400cb504]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x14000432b
mov eax, 0x30
call fcn.1400957c0
sub rsp, rax
mov rsi, rsp
sub rsp, 0x20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
cmp dword [0x1400cb500], 0xa
jl 0x14000434b
mov eax, dword [0x1400cb504]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14000434b
mov eax, 0x30
call fcn.1400957c0
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
add rsp, 0x20
jmp 0x1400042f0
cmp dword [rsi + 0x20], 3
jbe 0x14000435a
mov al, 1
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140004370
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x108
lea rbp, [rsp + 0x80]
mov rsi, rcx
sub rsp, 0x20
lea rdi, [rbp - 0x80]
mov ecx, 0x100
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rsi
mov rdx, rdi
call fcn.140001c20
add rsp, 0x20
cmp dword [0x1400cb508], 0xa
jl 0x140004444
mov eax, dword [0x1400cb50c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140004444
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, 0x100
call fcn.1400957c0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov ecx, 0x100
mov rdx, rdi
call rbx
mov rcx, rsi
mov rdx, rdi
call fcn.140001c20
add rsp, 0x20
mov eax, 0x100
call fcn.1400957c0
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
mov ecx, 0x100
mov rdx, rdi
call rbx
mov rcx, rsi
mov rdx, rdi
call fcn.140001c20
add rsp, 0x20
cmp dword [0x1400cb508], 0xa
jl 0x140004444
mov eax, dword [0x1400cb50c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x1400043d0
mov rax, rsi
lea rsp, [rbp + 0x88]
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004460
Capabilities:
Terminate process

Disassembly:
push rbp
push rsi
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov qword [rbp], 0xfffffffffffffffe
cmp dword [0x1400cb510], 0xa
jl 0x14000448d
mov eax, dword [0x1400cb514]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x1400044d8
mov eax, 0x20
call fcn.1400957c0
sub rsp, rax
mov rsi, rsp
mov eax, 0x30
call fcn.1400957c0
sub rsp, rax
mov qword [rbp - 8], rsp
sub rsp, 0x20
mov rcx, rsi
call fcn.140004370
add rsp, 0x20
cmp dword [0x1400cb510], 0xa
jl 0x1400044f7
mov eax, dword [0x1400cb514]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400044f7
mov eax, 0x20
call fcn.1400957c0
sub rsp, rax
mov rcx, rsp
sub rsp, 0x20
call fcn.140004370
add rsp, 0x20
jmp 0x14000448d
mov qword [rbp - 0x10], rsi
sub rsp, 0x20
lea rdx, str.C:_A_Za_z0_9__
mov rcx, qword [rbp - 8]
mov r8d, 1
call fcn.140004650
add rsp, 0x20
mov rsi, qword [rbp - 0x10]
jmp 0x14000454b
mov rdx, qword [rax + 0x10]
add rdx, rcx
sub rsp, 0x30
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
xor r8d, r8d
mov r9, qword [rbp - 8]
mov rsi, rax
call fcn.140053fa0
add rsp, 0x30
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140004558
mov rcx, qword [rsi]
mov rdx, qword [rsi + 0x10]
add rdx, rcx
sub rsp, 0x30
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
xor r8d, r8d
mov r9, qword [rbp - 8]
call fcn.140053fa0
add rsp, 0x30
cmp dword [0x1400cb518], 0xa
jl 0x1400045b4
mov ecx, dword [0x1400cb51c]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x1400045b4
mov rax, qword [rbp - 0x10]
cmp qword [rax + 0x18], 0x10
mov rcx, rax
jb 0x140004520
mov rcx, qword [rax]
jmp 0x140004520
test al, al
mov rsi, qword [rbp - 0x10]
jne 0x1400045de
sub rsp, 0x20
mov rcx, qword [rbp - 8]
call fcn.140004860
mov rcx, rsi
call fcn.140001f60
add rsp, 0x20
mov al, 1
lea rsp, [rbp + 8]
pop rsi
pop rbp
ret
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400267d0
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov ebx, edx
mov rsi, rcx
cmp dword [0x1400cc0e8], 0xa
jl 0x140026823
mov eax, dword [0x1400cc0ec]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140026823
movzx edi, bl
mov eax, reloc.WS2_32.dll_recv
call fcn.1400957c0
sub rsp, rax
mov r8, rsp
mov dword [r8], edi
sub rsp, 0x20
mov rcx, rsi
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x20
mov eax, reloc.WS2_32.dll_recv
call fcn.1400957c0
sub rsp, rax
mov r8, rsp
movzx edi, bl
mov dword [r8], edi
sub rsp, 0x20
mov rcx, rsi
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x20
cmp dword [0x1400cc0e8], 0xa
jl 0x140026869
mov eax, dword [0x1400cc0ec]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x1400267fa
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x140026af0
Capabilities:
Get socket status

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [sym.imp.WS2_32.dll_select]
mov r14, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x140026b2e
mov rax, qword [rsi + 0x20]
mov r9, qword [rsi + 0x18]
mov r8, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
call rbx
mov rax, qword [rsi + 0x20]
mov r9, qword [rsi + 0x18]
mov r8, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
call rbx
mov edi, eax
cmp dword [0x1400cc0f8], 0xa
jl 0x140026b68
mov eax, dword [0x1400cc0fc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140026b10
cmp dword [0x1400cc100], 0xa
jl 0x140026bf2
mov eax, dword [0x1400cc104]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140026bf2
nop word cs:[rax + rax]
mov rax, qword [rsi + 0x20]
mov r9, qword [rsi + 0x18]
mov r8, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
call rbx
mov ecx, dword [0x1400cc0fc]
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
cmp dword [0x1400cc0f8], 0xa
jl 0x140026b2e
test eax, eax
je 0x140026b2e
mov rax, qword [rsi + 0x20]
mov r9, qword [rsi + 0x18]
mov r8, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
call rbx
jmp 0x140026b90
test edi, edi
jns 0x140026c2b
nop word cs:[rax + rax]
call r14
cmp dword [0x1400cc100], 0xa
jl 0x140026c22
mov ecx, dword [0x1400cc104]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140026c22
call r14
jmp 0x140026c00
cmp dword [rax], 4
je 0x140026b2e
movsxd rax, edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400287c0
Capabilities:
Get socket status

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [sym.imp.WS2_32.dll_select]
mov r14, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x1400287fc
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call rbx
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call rbx
mov edi, eax
cmp dword [0x1400cc1c8], 0xa
jl 0x140028834
mov eax, dword [0x1400cc1cc]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x1400287e0
cmp dword [0x1400cc1d0], 0xa
jl 0x1400288ae
mov eax, dword [0x1400cc1d4]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x1400288ae
nop
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call rbx
mov ecx, dword [0x1400cc1cc]
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
cmp dword [0x1400cc1c8], 0xa
jl 0x1400287fc
test eax, eax
je 0x1400287fc
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call rbx
jmp 0x140028850
test edi, edi
jns 0x1400288eb
nop word cs:[rax + rax]
call r14
cmp dword [0x1400cc1d0], 0xa
jl 0x1400288e2
mov ecx, dword [0x1400cc1d4]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x1400288e2
call r14
jmp 0x1400288c0
cmp dword [rax], 4
je 0x1400287fc
movsxd rax, edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140028a20
Capabilities:
Get socket status

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, qword [sym.imp.WS2_32.dll_select]
mov r14, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x140028a5b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor edx, edx
xor r9d, r9d
call rbx
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor edx, edx
xor r9d, r9d
call rbx
mov edi, eax
cmp dword [0x1400cc1e0], 0xa
jl 0x140028a92
mov eax, dword [0x1400cc1e4]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140028a40
cmp dword [0x1400cc1e8], 0xa
jl 0x140028b0c
mov eax, dword [0x1400cc1ec]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140028b0c
nop dword [rax]
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor edx, edx
xor r9d, r9d
call rbx
mov ecx, dword [0x1400cc1e4]
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
cmp dword [0x1400cc1e0], 0xa
jl 0x140028a5b
test eax, eax
je 0x140028a5b
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x20], rax
xor edx, edx
xor r9d, r9d
call rbx
jmp 0x140028ab0
test edi, edi
jns 0x140028b3b
call r14
cmp dword [0x1400cc1e8], 0xa
jl 0x140028b32
mov ecx, dword [0x1400cc1ec]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140028b32
call r14
jmp 0x140028b10
cmp dword [rax], 4
je 0x140028a5b
movsxd rax, edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140028dd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [sym.imp.WS2_32.dll_recv]
mov rax, qword [rsi + 0x18]
mov r9d, dword [rax]
mov rax, qword [rsi + 0x10]
mov r8d, dword [rax]
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call rdi
cmp dword [0x1400cc200], 0xa
jl 0x140028e7f
mov ecx, dword [0x1400cc204]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140028e7f
nop word [rax + rax]
mov rax, qword [rsi + 0x18]
mov r9d, dword [rax]
mov rax, qword [rsi + 0x10]
mov r8d, dword [rax]
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call rdi
mov rax, qword [rsi + 0x18]
mov r9d, dword [rax]
mov rax, qword [rsi + 0x10]
mov r8d, dword [rax]
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rdx, qword [rcx]
mov rcx, qword [rax]
call rdi
mov ecx, dword [0x1400cc204]
lea eax, [rcx + 1]
imul eax, ecx
and eax, 1
cmp dword [0x1400cc200], 0xa
jl 0x140028de0
test eax, eax
jne 0x140028e20
jmp 0x140028de0
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140028e90
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov esi, r9d
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp dword [0x1400cc208], 0xa
jl 0x140028ec8
mov eax, dword [0x1400cc20c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140028fbf
mov r15, qword [sym.imp.WS2_32.dll_send]
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x140028ef0
cmp dword [rax], 4
jne 0x140028f9d
nop word cs:[rax + rax]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
mov r9d, esi
call r15
mov ebp, eax
cmp dword [0x1400cc210], 0xa
jl 0x140028f55
mov eax, dword [0x1400cc214]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x140028f55
mov rcx, r14
mov rdx, rbx
mov r8d, edi
mov r9d, esi
call r15
mov rcx, r14
mov rdx, rbx
mov r8d, edi
mov r9d, esi
call r15
cmp dword [0x1400cc210], 0xa
jl 0x140028ef0
mov eax, dword [0x1400cc214]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140028f1b
jmp 0x140028ef0
test ebp, ebp
jns 0x140028f9d
cmp dword [0x1400cc218], 0xa
jl 0x140028f73
mov eax, dword [0x1400cc21c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140028f98
call r12
cmp dword [0x1400cc218], 0xa
jl 0x140028ed8
mov ecx, dword [0x1400cc21c]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140028ed8
call r12
jmp 0x140028f73
cmp dword [0x1400cc208], 0xa
jl 0x14002908f
mov eax, dword [0x1400cc20c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
je 0x14002908f
mov r15, qword [sym.imp.WS2_32.dll_send]
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
jmp 0x140028fe0
cmp dword [rax], 4
jne 0x140028ec8
nop dword [rax + rax]
mov rcx, r14
mov rdx, rbx
mov r8d, edi
mov r9d, esi
call r15
cmp dword [0x1400cc210], 0xa
jl 0x140029043
mov ecx, dword [0x1400cc214]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140029043
mov rcx, r14
mov rdx, rbx
mov r8d, edi
mov r9d, esi
call r15
mov rcx, r14
mov rdx, rbx
mov r8d, edi
mov r9d, esi
call r15
cmp dword [0x1400cc210], 0xa
jl 0x140028fe0
mov eax, dword [0x1400cc214]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x140029009
jmp 0x140028fe0
test eax, eax
jns 0x140028ec8
cmp dword [0x1400cc218], 0xa
jl 0x140029065
mov eax, dword [0x1400cc21c]
lea ecx, [rax + 1]
imul ecx, eax
and ecx, 1
jne 0x14002908a
call r12
cmp dword [0x1400cc218], 0xa
jl 0x140028fcf
mov ecx, dword [0x1400cc21c]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x140028fcf
call r12
jmp 0x140029065
movsxd rax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14006c200
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov al, 1
cmp qword [rcx + 0x68], 0
je 0x14006c3a4
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14006c3a4
nop word cs:[rax + rax]
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp dword [0x1400cd790], 0xa
jl 0x14006c268
mov ecx, dword [0x1400cd794]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x14006c268
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
jmp 0x14006c230
cmp eax, 0xffffffff
je 0x14006c3a2
lea rdi, [rsp + 0x50]
lea r14, [rsi + 0x74]
lea r15, [rsp + 0x28]
lea rbx, [rsp + 0x30]
nop word cs:[rax + rax]
mov rcx, qword [rsi + 0x68]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, r14
mov r8, rbx
mov r9, rdi
call qword [rax + 0x40]
cmp dword [0x1400cd790], 0xa
jl 0x14006c2dc
mov ecx, dword [0x1400cd794]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x14006c2dc
mov rcx, qword [rsi + 0x68]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdx, r14
mov r8, rbx
mov r9, rdi
call qword [rax + 0x40]
jmp 0x14006c290
cmp eax, 3
je 0x14006c3b0
cmp eax, 1
je 0x14006c2f6
test eax, eax
jne 0x14006c3a2
mov byte [rsi + 0x71], 0
mov rdi, qword [rsp + 0x28]
sub rdi, rbx
je 0x14006c399
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp dword [0x1400cd790], 0xa
jl 0x14006c394
mov ecx, dword [0x1400cd794]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
je 0x14006c394
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
lea rbx, [rsp + 0x30]
nop word cs:[rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rbx
mov r8, rdi
call r14
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rbx
mov r8, rdi
call r14
cmp dword [0x1400cd790], 0xa
jl 0x14006c394
mov ecx, dword [0x1400cd794]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
jne 0x14006c350
cmp rdi, rax
jne 0x14006c3a2
cmp byte [rsi + 0x71], 0
sete al
jmp 0x14006c3a4
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov byte [rsi + 0x71], 0
mov al, 1
jmp 0x14006c3a4

Function at 0x14007e4d0
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
sub r9, rdx
je 0x14007e4f7
mov rax, rdx
not rax
add rax, r8
mov ecx, r9d
and ecx, 3
cmp rax, 3
jae 0x14007e4fd
mov eax, 0x84222325
xor r8d, r8d
jmp 0x14007e558
mov eax, 0x84222325
ret
and r9, 0xfffffffffffffffc
mov eax, 0x84222325
xor r8d, r8d
nop dword [rax]
movzx r10d, byte [rdx + r8]
xor r10d, eax
imul eax, r10d, 0x1b3
movzx r10d, byte [rdx + r8 + 1]
xor r10d, eax
imul eax, r10d, 0x1b3
movzx r10d, byte [rdx + r8 + 2]
xor r10d, eax
imul eax, r10d, 0x1b3
movzx r10d, byte [rdx + r8 + 3]
xor r10d, eax
imul eax, r10d, 0x1b3
add r8, 4
cmp r9, r8
jne 0x14007e510
test rcx, rcx
je 0x14007e587
add rdx, r8
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, byte [rdx + r8]
xor r9d, eax
imul eax, r9d, 0x1b3
inc r8
cmp rcx, r8
jne 0x14007e570
ret
Function at 0x140083ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov ebx, r9d
mov esi, r8d
mov rdi, rdx
mov r14, rcx
mov r12d, dword [0x1400cdf70]
mov ebp, dword [0x1400cdf74]
cmp ebp, 0xa
jl 0x140083f12
lea eax, [r12 + 1]
imul eax, r12d
and eax, 1
je 0x140083f12
nop
jmp 0x140083f10
xor r15d, r15d
xorps xmm6, xmm6
jmp 0x140083f30
inc r15
cmp r15d, 0x100
je 0x140084152
mov rax, qword [r14 + 0x18]
mov ecx, esi
cmp si, 0xffff
jne 0x140083fe0
mov cx, 0x107
cmp r15d, 0x5f
jne 0x140083fe0
test bl, bl
jne 0x140083ff8
nop word cs:[rax + rax]
mov rax, qword [rdi + 0x28]
test rax, rax
jne 0x140083f9c
mov ecx, 0x20
call fcn.140095590
cmp dword [0x1400cdf78], 0xa
jl 0x140083f91
mov ecx, dword [0x1400cdf7c]
lea edx, [rcx + 1]
imul edx, ecx
and edx, 1
jne 0x140084166
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov qword [rdi + 0x28], rax
mov edx, dword [0x1400cdf80]
mov ecx, dword [0x1400cdf84]
cmp ebp, 0xa
jl 0x140084020
lea r8d, [r12 + 1]
imul r8d, r12d
and r8d, 1
je 0x140084020
lea r8d, [rdx + 1]
imul r8d, edx
and r8d, 1
cmp ecx, 0xa
jge 0x1400840d3
jmp 0x1400840fa
mov rax, qword [rax + 8]
mov rax, qword [rax + 0x18]
test word [rax + r15*2], cx
setne al
xor al, bl
jne 0x140083f60
lea eax, [r12 + 1]
imul eax, r12d
and eax, 1
cmp ebp, 0xa
jl 0x140083f20
test eax, eax
je 0x140083f20
jmp 0x140084150
cmp ecx, 0xa
jl 0x140084050
lea ecx, [rdx + 1]
imul ecx, edx
and ecx, 1
je 0x140084050
mov ecx, r15d
and cl, 7
mov edx, 1
shl edx, cl
mov r9d, r15d
shr r9d, 3
movzx r10d, byte [rax + r9]
jmp 0x140084093
mov ecx, r15d
and cl, 7
mov edx, 1
shl edx, cl
mov r9d, r15d
shr r9d, 3
movzx r10d, byte [rax + r9]
or r10b, dl
mov byte [rax + r9], r10b
mov r11d, dword [0x1400cdf80]
mov ecx, dword [0x1400cdf84]
lea r8d, [r11 + 1]
imul r8d, r11d
and r8d, 1
cmp ecx, 0xa
jl 0x1400840a0
test r8d, r8d
je 0x1400840a0
or r10b, dl
mov byte [rax + r9], r10b
jmp 0x140084050
mov r12d, dword [0x1400cdf70]
mov ebp, dword [0x1400cdf74]
lea eax, [r12 + 1]
imul eax, r12d
and eax, 1
cmp ebp, 0xa
jl 0x140084004
test eax, eax
je 0x140084004
mov rax, qword [rdi + 0x28]
cmp ecx, 0xa
jl 0x1400840fa
test r8d, r8d
je 0x1400840fa
mov ecx, r15d
and cl, 7
mov r8d, 1
shl r8d, cl
mov r9d, r15d
shr r9d, 3
movzx r10d, byte [rax + r9]
or r10b, r8b
mov byte [rax + r9], r10b
mov ecx, r15d
and cl, 7
mov r8d, 1
shl r8d, cl
mov r9d, r15d
shr r9d, 3
movzx r10d, byte [rax + r9]
or r10b, r8b
mov byte [rax + r9], r10b
mov edx, dword [0x1400cdf80]
mov ecx, dword [0x1400cdf84]
cmp ecx, 0xa
jl 0x14008413b
lea r11d, [rdx + 1]
imul r11d, edx
and r11d, 1
jne 0x1400840f3
mov rax, qword [rdi + 0x28]
jmp 0x140084020
jmp 0x140084150
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xorps xmm0, xmm0
nop dword [rax]
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
jmp 0x140084170
Function at 0x140092a50
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x28
mov r12d, r9d
mov r15, r8
mov rsi, rdx
mov rbp, rcx
test rcx, rcx
je 0x140092c2b
test rdx, rdx
je 0x140092c2b
movabs rax, 0x7fffffffffffffff
cmp r8, rax
ja 0x140092c2b
cmp dword [rcx], 0
mov qword [rsp + 0x20], r14
mov r14, qword [rsp + 0x70]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
jne 0x140092abf
mov r8, r14
mov edx, 0x100
call fcn.140092db0
test al, al
je 0x140092b50
movzx eax, byte [rsi]
mov rcx, rsi
mov edi, 0x1505
test al, al
je 0x140092ae5
nop
imul rdi, rdi, 0x21
movzx eax, al
lea rcx, [rcx + 1]
add rdi, rax
movzx eax, byte [rcx]
test al, al
jne 0x140092ad0
xor edx, edx
mov eax, edi
div dword [rbp]
mov rax, qword [rbp + 0x10]
mov r13d, edx
mov rbx, qword [rax + rdx*8]
test rbx, rbx
je 0x140092b30
nop dword [rax]
cmp dword [rbx + 0x20], edi
jne 0x140092b27
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140092b23
inc rax
test ecx, ecx
jne 0x140092b10
test edx, edx
je 0x140092b71
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x140092b00
mov ecx, 0x28
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbx, rax
test rax, rax
jne 0x140092b92
xor r8d, r8d
lea edx, [rax + 0xe]
mov rcx, r14
call fcn.14008ec50
xor al, al
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
test r12b, 8
je 0x140092b7e
cmp qword [rbx + 8], 0xffffffffffffffff
jne 0x140092b89
cmp qword [rbx + 0x10], 0xffffffffffffffff
je 0x140092c16
xor r8d, r8d
lea edx, [r8 + 0xa]
jmp 0x140092b48
mov qword [rax], rsi
xorps xmm1, xmm1
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + r13*8]
mov qword [rbx + 0x18], rcx
mov rax, qword [rbp + 0x10]
mov qword [rax + r13*8], rbx
mov dword [rbx + 0x20], edi
mov qword [rbx + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rcx, qword [rbp + 8]
mov edx, dword [rbp]
test rcx, rcx
js 0x140092bce
cvtsi2sd xmm1, rcx
jmp 0x140092be3
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x1400b2db8]
comisd xmm1, xmm0
jbe 0x140092c16
cmp edx, 0x80000000
jae 0x140092c16
add edx, edx
mov r8, r14
mov rcx, rbp
call fcn.140092db0
test al, al
je 0x140092b50
test r12b, 8
je 0x140092c20
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x140092b52
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
lea edx, [r8 + 0x12]
call fcn.14008ec50
xor al, al
add rsp, 0x28
pop r15
pop r12
pop rsi
pop rbp
ret
Function at 0x1400964fc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140096536
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14009653b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140096584
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400b2e00]
cmp byte [rcx + rax], 0
je 0x140096584
dec r8
sub rdx, 1
jne 0x14009656a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret