joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e4350
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x57], 0
mov rbp, rcx
je 0x1400e4530
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0x8719637309815153
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [r15 + rax]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
xor byte [rax + 0x17], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
xor byte [rax + 0x18], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
xor byte [rax + 0x19], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0x8719637309815153
xor byte [rax + 0x12], r10b
xor byte [rax + 0x1a], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
movabs r9, 0x8719637309815153
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
mov r8, qword [rsp + 0x50]
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
add rax, 0x1d
mov rdx, qword [rsp + 0x48]
lea rcx, [rax + r14]
cmp rcx, 0x57
jb 0x1400e43f0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x57], 0
add rsp, 0x30
pop rbp
ret
Function at 0x1400f83d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400f8404
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400f83f0
ret
Function at 0x1400fd180
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400fd24c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1400fd24c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1400fd265
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x1400fd23c
cmp byte [rax], 0x5c
jne 0x1400fd236
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x1400fd236
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1400fd222
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x1400fd233
test r8b, 0x10
jne 0x1400fd236
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x1400fd236
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400f93f0
test edi, edi
jne 0x1400fd1a0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1400f93e0
int3
Function at 0x140100480
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1401a4028]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rdx
mov qword [rbp - 0x41], rdx
xor r12d, r12d
mov dword [rbp - 0x69], r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
mov dword [rbp - 0x39], 0x80000002
mov dword [rbp - 0x35], 0x80000003
mov dword [rbp - 0x31], 0x80000004
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], 0xf
mov byte [rdx], r12b
mov dword [rbp - 0x69], 1
lea r15, [rbp - 0x39]
nop
mov eax, dword [r15]
xor ecx, ecx
cpuid
mov dword [rbp - 0x29], eax
mov dword [rbp - 0x25], ebx
mov dword [rbp - 0x21], ecx
mov dword [rbp - 0x1d], edx
mov rax, qword [0x1401ae340]
test rax, rax
jne 0x1401005d6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r10, rsi
nop word [rax + rax]
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r11d, dword [rax + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x1401005b6
mov ebx, dword [r11 + 0x18]
test ebx, ebx
je 0x1401005b6
mov edi, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec ebx
lea rax, [rdi + rbx*4]
mov eax, dword [rax + r8]
add rax, r8
mov edx, 0x266971c2
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1401005b2
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x140100590
cmp edx, 0x6efa194f
je 0x140100678
test ebx, ebx
jne 0x140100570
mov rax, qword [r10]
mov r10, rax
cmp rax, rsi
je 0x1401005cc
cmp qword [rax + 0x30], 0
jne 0x140100540
mov rax, r12
mov qword [0x1401ae340], rax
mov r8d, 0x10
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], r12
lea rax, [rbp - 0x19]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140100600
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x61]
call fcn.1400d9d80
nop
lea rdx, [rbp - 0x61]
cmp qword [rbp - 0x49], 0x10
cmovae rdx, qword [rbp - 0x61]
mov r8, qword [rbp - 0x51]
mov rcx, r14
call fcn.1400d9700
nop
lea rcx, [rbp - 0x61]
call fcn.1400d96a0
add r15, 4
lea rax, [rbp - 0x2d]
cmp r15, rax
jne 0x140100500
mov rax, r14
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140106970
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [r11 + 0x24]
add rax, r8
movzx eax, word [rax + rbx*2]
mov eax, dword [rcx + rax*4]
add rax, r8
jmp 0x1401005cf
Function at 0x1401009c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1401a4028]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rdx
mov qword [rsp + 0x28], rdx
xor r14d, r14d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x60], ax
mov dword [rsp + 0x28], 0x32
mov rax, qword [0x1401ae320]
test rax, rax
jne 0x140100ad6
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov r11, rbp
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140100ab7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140100ab7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0xf686ae20
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140100ab2
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x140100a90
cmp edx, 0xe5e69c1c
je 0x140100b81
test r8d, r8d
jne 0x140100a70
mov rax, qword [r11]
mov r11, rax
cmp rax, rbp
je 0x140100acc
cmp qword [rax + 0x30], r14
jne 0x140100a40
mov rax, r14
mov qword [0x1401ae320], rax
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call rax
test eax, eax
jne 0x140100b9d
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, 0x19c
mov eax, dword [rdx + rcx]
mov ebx, 0x1c8
add rbx, rcx
test al, 1
jne 0x140100b30
or eax, 1
mov dword [rdx + rcx], eax
mov dword [rbx + 6], 0x123fefd
mov dword [rbx], 0x28230760
mov word [rbx + 4], 0x640e
lea rcx, [0x14015f230]
call fcn.140106ffc
nop
cmp byte [rbx + 9], 0
je 0x140100b5d
xor byte [rbx], 0x23
xor byte [rbx + 1], 0x3d
xor byte [rbx + 2], 0x7f
xor byte [rbx + 3], 0x7d
xor byte [rbx + 4], 0x7d
xor byte [rbx + 5], 1
xor byte [rbx + 6], 0x8f
xor byte [rbx + 7], 0x8d
xor byte [rbx + 8], 0x23
mov byte [rbx + 9], 0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x140100b72
mov rdx, rbx
jmp 0x140100bc5
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x140100acf
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x140100bb7
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400d9d80
mov rax, rsi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140106970
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140103420
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x12d0]
mov eax, 0x13d0
call fcn.14015a100
sub rsp, rax
movaps xmmword [rsp + 0x13c0], xmm6
mov rax, qword [0x1401a4028]
xor rax, rsp
mov qword [rbp + 0x12b0], rax
mov rbx, rdx
mov rdi, rcx
call fcn.14012622c
mov dword [rsp + 0x24], eax
mov r9d, 1
mov dword [rbp + 0x12a4], 0xffffffff
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x140103480
movd xmm4, dword [rdi]
mov edx, 0x270
movd xmm1, dword [rbx]
xorps xmm5, xmm5
movsd xmm3, qword [0x140184a70]
xorps xmm2, xmm2
movsd xmm6, qword [0x140184b08]
mov r10d, 2
mov dword [rsp + 0x20], edx
cvtdq2pd xmm4, xmm4
cvtdq2pd xmm1, xmm1
nop word [rax + rax]
cmp edx, 0x270
jne 0x140103532
lea r8, [rsp + 0x28]
mov r9d, edx
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401034f0
mov edx, dword [rsp + 0x20]
jmp 0x14010361f
cmp edx, 0x4e0
jb 0x14010361f
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rbp + r8*4 + 0x8e4]
xor edx, dword [rbp + r8*4 + 0x8e8]
btr edx, 0x1f
xor edx, dword [rbp + r8*4 + 0x8e4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rbp + r8*4 + 0xf18]
xor ecx, edx
mov dword [rsp + r8*4 + 0x24], ecx
inc r8
cmp r8, 0xe3
jb 0x140103550
mov r8d, 0xe3
nop dword [rax]
mov edx, dword [rbp + r8*4 + 0x8e4]
xor edx, dword [rbp + r8*4 + 0x8e8]
btr edx, 0x1f
xor edx, dword [rbp + r8*4 + 0x8e4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rbp + r8*4 - 0x468]
xor ecx, edx
mov dword [rsp + r8*4 + 0x24], ecx
inc r8
cmp r8, 0x26f
jb 0x1401035a0
mov edx, dword [rbp + 0x12a0]
xor edx, dword [rsp + 0x24]
btr edx, 0x1f
xor edx, dword [rbp + 0x12a0]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [rbp + 0x554]
xor edx, edx
mov dword [rbp + 0x8e0], ecx
mov dword [rsp + 0x20], edx
mov eax, edx
xorps xmm0, xmm0
inc edx
mov ecx, dword [rsp + rax*4 + 0x24]
mov eax, ecx
shr eax, 0xb
and eax, dword [rbp + 0x12a4]
xor ecx, eax
mov dword [rsp + 0x20], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
subsd xmm0, xmm5
mulsd xmm0, xmm3
mulsd xmm3, xmm6
addsd xmm2, xmm0
sub r10, 1
jne 0x1401034e0
divsd xmm2, xmm3
subsd xmm1, xmm4
mulsd xmm1, xmm2
addsd xmm1, xmm4
cvttsd2si eax, xmm1
mov rcx, qword [rbp + 0x12b0]
xor rcx, rsp
call fcn.140106970
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x1401036c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea r14d, [rsi + 0x14]
mov rax, qword gs:[0x58]
mov r15, qword [rax]
mov ebx, 0x1c98
mov eax, dword [rbx + r15]
mov ebp, 0x900
test al, 1
jne 0x14010376a
or eax, 1
mov dword [rbx + r15], eax
call fcn.14012622c
mov edx, eax
mov dword [r15 + rbp + 0x1384], 0xffffffff
mov dword [r15 + rbp + 4], eax
lea ecx, [rsi + 1]
lea r8, [rbp + 8]
add r8, r15
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x140103740
mov dword [r15 + rbp], 0x270
mov eax, dword [rbx + r15]
mov r12d, 0x1c88
test al, 2
jne 0x14010378c
or eax, 2
mov dword [rbx + r15], eax
mov qword [r15 + r12], rsi
mov qword [r15 + r12 + 8], 0x3d
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
mov rdx, r14
mov rcx, rdi
call fcn.1400e3a70
lea rbx, [r15 + rbp]
lea r13, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
nop
dec r14
mov qword [rsp + 0x28], rbx
mov rbp, qword [r15 + r12]
mov rdx, qword [r15 + r12 + 8]
sub rdx, rbp
cmp rdx, 0xffffffffffffffff
jne 0x1401037f7
mov rcx, rbx
call fcn.140106650
mov esi, eax
shl rsi, 0x20
mov rcx, rbx
call fcn.140106650
mov eax, eax
or rsi, rax
jmp 0x140103807
inc rdx
lea rcx, [rsp + 0x28]
call fcn.140106450
mov rsi, rax
lea rax, [rsi + rbp]
movzx r9d, byte [rax + r13]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14010383c
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140103831
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14010384b
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call fcn.1400eab50
test r14, r14
jne 0x1401037c0
mov rax, rdi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140106650
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1401066b1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140106670
mov ecx, dword [r10]
jmp 0x14010679a
cmp ecx, 0x4e0
jb 0x14010679a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401066d0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140106720
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x14010772c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140107776
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140107776
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140107776
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140107776
cmp dword [rcx + 0x84], 0xe
jbe 0x140107776
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140107778
xor al, al
add rsp, 0x28
ret
Function at 0x14011d770
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x14011d7a7
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x14011d790
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x14011d8a8
sub rcx, r10
cmp r9, 8
jb 0x14011d880
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp r11, rax
jb 0x14011d800
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x14011d8a8
add r10, r11
sub r9, r11
nop word [rax + rax]
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x14011d890
test r8d, r8d
sete al
ret
Function at 0x14011d8b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x14011da54
cmp r9, 4
jb 0x14011d8fa
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14011d8e0
xor r11d, r11d
test r9, r9
je 0x14011da54
cmp r9, 8
jb 0x14011da2e
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14011d92c
cmp rdx, r8
jae 0x14011da2e
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14011d941
cmp rdx, r10
jae 0x14011da2e
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x14011d9eb
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x14011d980
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x14011da20
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
pxor xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x14011da00
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x14011da54
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop dword [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14011da40
add rsp, 8
ret

Function at 0x140123c14
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140123c98
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140166c30]
cmp byte [rcx + rax], 0
je 0x140123c98
dec r8
sub rdx, 1
jne 0x140123c7e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret