joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Mqs_ttpl_tlic_tcommon_tflashgallery_tmata_tewebeditor_tstat_tih_torderforms_tvitpvt_ttwig_tintroduction_tram_taccreditation_tusercpannouncepm_tcall_tcd_tfam_tspecialoffers_tibg_tvmc_tqb_tftt_tlinklist_thtmleditor_tmodx_tquarantine_tindigenous_tmam_tbabies_tke_tprace_ttizersgif_tdev_tserverinfo_thelloworld_tjennifer_tmarcus_tmethods_temailtest_tlogstats_tcuteeditorfiles_tfire_tdisclaim_tjsp_ttopten_tgba_tplaceholder_tchallenge_trubrik_twpcustom_tlat_tnaviimg_tgh
mov r10, rax
sub rbx, rax
movabs rdi, 0x3e22cbce4a9027c5
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
mov rax, rcx
lea r9, [r9 + 0xa]
sub rax, rdx
add r11d, 0xa
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xa
jb 0x140003580
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Mqs_ttpl_tlic_tcommon_tflashgallery_tmata_tewebeditor_tstat_tih_torderforms_tvitpvt_ttwig_tintroduction_tram_taccreditation_tusercpannouncepm_tcall_tcd_tfam_tspecialoffers_tibg_tvmc_tqb_tftt_tlinklist_thtmleditor_tmodx_tquarantine_tindigenous_tmam_tbabies_tke_tprace_ttizersgif_tdev_tserverinfo_thelloworld_tjennifer_tmarcus_tmethods_temailtest_tlogstats_tcuteeditorfiles_tfire_tdisclaim_tjsp_ttopten_tgba_tplaceholder_tchallenge_trubrik_twpcustom_tlat_tnaviimg_tgh
mov r10, rax
sub rbx, rax
movabs rdi, 0x3e22cbce4a9027c5
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
add r11d, 6
cmp r11d, 6
jb 0x140004d10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140005ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Mqs_ttpl_tlic_tcommon_tflashgallery_tmata_tewebeditor_tstat_tih_torderforms_tvitpvt_ttwig_tintroduction_tram_taccreditation_tusercpannouncepm_tcall_tcd_tfam_tspecialoffers_tibg_tvmc_tqb_tftt_tlinklist_thtmleditor_tmodx_tquarantine_tindigenous_tmam_tbabies_tke_tprace_ttizersgif_tdev_tserverinfo_thelloworld_tjennifer_tmarcus_tmethods_temailtest_tlogstats_tcuteeditorfiles_tfire_tdisclaim_tjsp_ttopten_tgba_tplaceholder_tchallenge_trubrik_twpcustom_tlat_tnaviimg_tgh
mov r10, rax
sub rbx, rax
movabs rdi, 0x3e22cbce4a9027c5
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19c
sub rcx, rax
movzx eax, byte [rcx + rsi]
add r11d, 6
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0xc]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140005cf0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000aa20
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000aa82
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000c660
test al, al
jne 0x14000aa94
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000aa50
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x63
mov dword [rbp - 0x20], 0x340006
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x470021
mov dword [rbp - 0x18], 0x3c0031
mov dword [rbp - 0x14], 0x48002e
mov dword [rbp - 0x10], 0x2c003f
call fcn.140005e60
mov rcx, rax
call 0x14000aa20
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x6c
mov dword [rbp - 0x20], 0x340006
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x470021
mov dword [rbp - 0x18], 0x3c0031
mov dword [rbp - 0x14], 0x3b005f
call fcn.140002590
mov rcx, rax
call 0x14000aa20
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x50023
mov dword [rbp - 0x1c], 0x650017
mov dword [rbp - 0x18], 0x700018
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000aa20
Function at 0x14000c1d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000c3fe
mov word [rbp + 0x50], 0x714d
mov word [rbp + 0x58], 0x714d
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000c284
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000c270
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000c2b5
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000c2a0
cmp rdi, rbx
jne 0x14000c3d2
mov r13, rsi
mov word [rbp - 0x50], 0x714d
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000c2f6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000c2e2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000c3f8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x71002c
call fcn.1400027f0
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000c368
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x710037
call fcn.1400027f0
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000c368
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x71002c
mov dword [rbp - 0x42], 0x71000c
call fcn.1400027f0
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x71002c
call fcn.1400027f0
movzx eax, word [rax]
cmp edi, eax
jl 0x14000c3c5
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x710037
call fcn.1400027f0
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000c3c5
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x71002c
mov dword [rbp - 0x32], 0x71000c
call fcn.1400027f0
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000c3d2
inc r14
jmp 0x14000c2d0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000c3fe
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000c240
mov rax, qword [rbp - 8]
jmp 0x14000c400
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000c570
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000aa82
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000c660
test al, al
jne 0x14000aa94
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000aa50
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x63
mov dword [rbp - 0x20], 0x340006
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x470021
mov dword [rbp - 0x18], 0x3c0031
mov dword [rbp - 0x14], 0x48002e
mov dword [rbp - 0x10], 0x2c003f
call fcn.140005e60
mov rcx, rax
call 0x14000aa20
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x6c
mov dword [rbp - 0x20], 0x340006
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x470021
mov dword [rbp - 0x18], 0x3c0031
mov dword [rbp - 0x14], 0x3b005f
call fcn.140002590
mov rcx, rax
call 0x14000aa20
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x50023
mov dword [rbp - 0x1c], 0x650017
mov dword [rbp - 0x18], 0x700018
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000aa20
Function at 0x14000e320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x19001e
mov dword [rbp - 0x1c], 0x650016
mov dword [rbp - 0x18], 0x430018
mov dword [rbp - 0x14], 0x27005e
mov dword [rbp - 0x10], 0x50008
mov dword [rbp - 0xc], 0x9000f
call fcn.140002e40
mov rcx, rax
call rbx
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400161a0], rax
mov dword [rbp - 0x20], 0x18001a
mov dword [rbp - 0x1c], 0x60001d
mov dword [rbp - 0x18], 0x15001a
mov dword [rbp - 0x14], 0x270018
mov dword [rbp - 0x10], 0x50008
mov dword [rbp - 0xc], 0x9000f
call fcn.140002e40
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140015470]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400161b0], rax
mov word [rbp - 0x10], 0x3919
mov byte [rbp - 0xe], 9
call fcn.140005220
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6516191e
mov dword [rbp - 0x1c], 0x6c143518
mov dword [rbp - 0x18], 0x6c171c0f
mov word [rbp - 0x14], 0x6f34
call fcn.140001180
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6c071f04
mov dword [rbp - 0x1c], 0x7d091e06
mov dword [rbp - 0x18], 0x67061923
mov word [rbp - 0x14], 0x6f22
call fcn.140001180
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400154f0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e8], rax
mov byte [rbp - 0x10], 0x6f
call fcn.140004e60
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015420]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160f0], rax
mov dword [rbp - 0x10], 0x666c020b
call fcn.1400029f0
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015450]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e0], rax
mov byte [rbp - 0x10], 0x6f
call fcn.140004e60
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400154b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160d8], rax
mov dword [rbp - 0x10], 0x27670106
mov byte [rbp - 0xc], 0x6c
call fcn.140003790
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015400]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2f01
mov byte [rbp - 0xe], 9
call fcn.140005220
mov rcx, qword [0x1400161b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x1400077a2
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
xor r8d, r8d
cmp r8, rdx
jae 0x1400077de
mov r9b, byte [rcx + r8]
test r9b, r9b
jne 0x1400077bd
inc r8
jmp 0x1400077aa
lea r10d, [r9 - 0x20]
cmp r9b, 0x61
movzx r9d, r9b
movzx r10d, r10b
cmovb r10d, r9d
imul r9d, eax, 0x21
movzx eax, r10b
add eax, r9d
jmp 0x1400077b8
ret
Function at 0x14000903c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140009086
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140009086
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140009086
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140009086
cmp dword [rcx + 0x84], 0xe
jbe 0x140009086
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009088
xor al, al
add rsp, 0x28
ret
Function at 0x1400705bd
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140104a20
mov rax, rcx
neg rcx
test rax, 7
je 0x140104a3d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140104a98
test al, 7
jne 0x140104a30
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x140104a51
mov rdx, qword [rax - 8]
test dl, dl
je 0x140104ac2
test dh, dh
je 0x140104abc
shr rdx, 0x10
test dl, dl
je 0x140104ab6
test dh, dh
je 0x140104ab0
shr rdx, 0x10
test dl, dl
je 0x140104aaa
test dh, dh
je 0x140104aa4
shr edx, 0x10
test dl, dl
je 0x140104a9e
test dh, dh
jne 0x140104a51
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400705ea
Capabilities:
Query environment variable

Disassembly:
jmp 0x1401161f0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140115d70
lea rcx, [rsp + 0x20]
call fcn.140115dc0
movzx eax, al
test eax, eax
jne 0x140116235
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.140115da0
mov rax, qword [rsp + 0x40]
jmp 0x14011632f
lea rcx, [rsp + 0x20]
call fcn.140115ec0
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.140115e60
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400707e3
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14007024d
lea rcx, [rsp + 0x28]
call fcn.140070aae
movzx eax, al
test eax, eax
jne 0x1401162cf
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14007166b
lea rcx, [rsp + 0x20]
call fcn.140115da0
mov rax, qword [rsp + 0x50]
jmp 0x14011632f
lea rcx, [rsp + 0x20]
call fcn.140115ec0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.140071fb7
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.14007077a
lea rcx, [rsp + 0x28]
call fcn.1400724f3
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.14007166b
lea rcx, [rsp + 0x20]
call fcn.140115da0
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret

Function at 0x1400708dd
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x14008fea0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.14008f820
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14008fedf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14019d020]
jmp 0x14008fee9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x140070a36
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x14008fdd0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14008f7a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14008fe11
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x14019d020]
jmp 0x14008fe17
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x140070ab8
Capabilities:
Get geographical location

Disassembly:
jmp 0x140123bb0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140122ae0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140123c17
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x14019d030]
jmp 0x140123c39
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.140070342
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x140070ac7
Capabilities:
Terminate process

Disassembly:
jmp 0x140079200
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret