joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400018b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x20
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
add rdx, 0x10
mov qword [rsp + 0x10], rdx
xor eax, eax
cmp dword [0x14004b4a4], 1
mov dword [rsp + 0x1c], eax
je 0x140001921
mov eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp]
mov r8, qword [rsp + 0x10]
movsxd r9, eax
mov r8b, byte [r8 + r9]
mov r9d, eax
and r9d, 0xf
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 0x10
mov dword [rsp + 0x1c], eax
jne 0x1400018d9
mov dword [0x14004b4a4], 1
add rsp, 0x20
ret

Function at 0x140001930
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x12
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b4b4], 1
mov dword [rsp + 0x24], eax
je 0x1400019b2
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x12
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 9
mov dword [rsp + 0x24], eax
jne 0x14000195a
mov dword [0x14004b4b4], 1
add rsp, 0x28
ret

Function at 0x1400019c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x1b
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b4dc], 1
mov dword [rsp + 0x24], eax
je 0x140001a42
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x1b
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 0x1b
mov dword [rsp + 0x24], eax
jne 0x1400019ea
mov dword [0x14004b4dc], 1
add rsp, 0x28
ret

Function at 0x140001a50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x18
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b4e8], 1
mov dword [rsp + 0x24], eax
je 0x140001ad2
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x18
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 6
mov dword [rsp + 0x24], eax
jne 0x140001a7a
mov dword [0x14004b4e8], 1
add rsp, 0x28
ret
Function at 0x140001ae0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x1a
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b4f4], 1
mov dword [rsp + 0x24], eax
je 0x140001b62
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x1a
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 5
mov dword [rsp + 0x24], eax
jne 0x140001b0a
mov dword [0x14004b4f4], 1
add rsp, 0x28
ret

Function at 0x140001b70
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x1c
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b508], 1
mov dword [rsp + 0x24], eax
je 0x140001bf2
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x1c
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 0x10
mov dword [rsp + 0x24], eax
jne 0x140001b9a
mov dword [0x14004b508], 1
add rsp, 0x28
ret

Function at 0x140001c00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x1b
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b524], 1
mov dword [rsp + 0x24], eax
je 0x140001c82
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x1b
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 0x15
mov dword [rsp + 0x24], eax
jne 0x140001c2a
mov dword [0x14004b524], 1
add rsp, 0x28
ret

Function at 0x140001c90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x1a
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b550], 1
mov dword [rsp + 0x24], eax
je 0x140001d12
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x1a
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 0x1d
mov dword [rsp + 0x24], eax
jne 0x140001cba
mov dword [0x14004b550], 1
add rsp, 0x28
ret
Function at 0x140001d20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x1f
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b56c], 1
mov dword [rsp + 0x24], eax
je 0x140001da2
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x1f
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 0x15
mov dword [rsp + 0x24], eax
jne 0x140001d4a
mov dword [0x14004b56c], 1
add rsp, 0x28
ret

Function at 0x140001db0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x1e
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b588], 1
mov dword [rsp + 0x24], eax
je 0x140001e32
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x1e
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 0x16
mov dword [rsp + 0x24], eax
jne 0x140001dda
mov dword [0x14004b588], 1
add rsp, 0x28
ret

Function at 0x140001e40
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x1d
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b5a4], 1
mov dword [rsp + 0x24], eax
je 0x140001ec2
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x1d
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 0x15
mov dword [rsp + 0x24], eax
jne 0x140001e6a
mov dword [0x14004b5a4], 1
add rsp, 0x28
ret

Function at 0x140001ed0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x1d
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b5b4], 1
mov dword [rsp + 0x24], eax
je 0x140001f52
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x1d
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 9
mov dword [rsp + 0x24], eax
jne 0x140001efa
mov dword [0x14004b5b4], 1
add rsp, 0x28
ret
Function at 0x140001f60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x20
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
add rdx, 0x10
mov qword [rsp + 0x10], rdx
xor eax, eax
cmp dword [0x14004b5d8], 1
mov dword [rsp + 0x1c], eax
je 0x140001fd1
mov eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp]
mov r8, qword [rsp + 0x10]
movsxd r9, eax
mov r8b, byte [r8 + r9]
mov r9d, eax
and r9d, 0xf
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 0x16
mov dword [rsp + 0x1c], eax
jne 0x140001f89
mov dword [0x14004b5d8], 1
add rsp, 0x20
ret

Function at 0x140001fe0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x11
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b5e0], 1
mov dword [rsp + 0x24], eax
je 0x140002062
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x11
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 3
mov dword [rsp + 0x24], eax
jne 0x14000200a
mov dword [0x14004b5e0], 1
add rsp, 0x28
ret

Function at 0x140002070
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x15
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b5e8], 1
mov dword [rsp + 0x24], eax
je 0x1400020f2
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x15
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 3
mov dword [rsp + 0x24], eax
jne 0x14000209a
mov dword [0x14004b5e8], 1
add rsp, 0x28
ret

Function at 0x140002100
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x13
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b604], 1
mov dword [rsp + 0x24], eax
je 0x140002182
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x13
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 0x18
mov dword [rsp + 0x24], eax
jne 0x14000212a
mov dword [0x14004b604], 1
add rsp, 0x28
ret
Function at 0x140002190
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x12
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b60c], 1
mov dword [rsp + 0x24], eax
je 0x140002212
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x12
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 3
mov dword [rsp + 0x24], eax
jne 0x1400021ba
mov dword [0x14004b60c], 1
add rsp, 0x28
ret

Function at 0x140002220
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x1d
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b614], 1
mov dword [rsp + 0x24], eax
je 0x1400022a2
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x1d
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 3
mov dword [rsp + 0x24], eax
jne 0x14000224a
mov dword [0x14004b614], 1
add rsp, 0x28
ret

Function at 0x1400022b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x17
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b61c], 1
mov dword [rsp + 0x24], eax
je 0x140002332
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x17
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 2
mov dword [rsp + 0x24], eax
jne 0x1400022da
mov dword [0x14004b61c], 1
add rsp, 0x28
ret

Function at 0x140002340
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x13
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b624], 1
mov dword [rsp + 0x24], eax
je 0x1400023c2
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x13
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 3
mov dword [rsp + 0x24], eax
jne 0x14000236a
mov dword [0x14004b624], 1
add rsp, 0x28
ret
Function at 0x1400023d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x14
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b62c], 1
mov dword [rsp + 0x24], eax
je 0x140002452
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x14
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 3
mov dword [rsp + 0x24], eax
jne 0x1400023fa
mov dword [0x14004b62c], 1
add rsp, 0x28
ret

Function at 0x140002460
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x11
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b634], 1
mov dword [rsp + 0x24], eax
je 0x1400024e2
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x11
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 3
mov dword [rsp + 0x24], eax
jne 0x14000248a
mov dword [0x14004b634], 1
add rsp, 0x28
ret

Function at 0x1400024f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
add rdx, 0x11
mov qword [rsp + 0x18], rdx
xor eax, eax
cmp dword [0x14004b63c], 1
mov dword [rsp + 0x24], eax
je 0x140002572
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov dword [rsp + 4], eax
movsxd r8, eax
mov r8b, byte [rdx + r8]
mov r9d, 0x11
xor edx, edx
div r9d
mov eax, dword [rsp + 4]
mov r9d, edx
mov rdx, qword [rsp + 8]
movsxd r9, r9d
xor r8b, byte [rdx + r9]
movsxd rdx, eax
mov byte [rcx + rdx], r8b
add eax, 1
cmp eax, 3
mov dword [rsp + 0x24], eax
jne 0x14000251a
mov dword [0x14004b63c], 1
add rsp, 0x28
ret

Function at 0x140010c7c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140010cc6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010cc6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010cc6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010cc6
cmp dword [rcx + 0x84], 0xe
jbe 0x140010cc6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140010cc8
xor al, al
add rsp, 0x28
ret
Function at 0x140012218
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140012246
xor eax, eax
jmp 0x14001232c
cmp qword [rcx + 0x68], 0
je 0x140012257
call fcn.140012348
jmp 0x14001232c
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001226e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140012270
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400122a2
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140036390
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140012326
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400122d9
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140012302
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14002295c
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140012326
cmp rsi, rbx
ja 0x1400122e0
test rsi, rsi
je 0x140012326
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14002295c
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14001f1cc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001f23b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001f23b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001f23b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001f23b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001f23b
cmp dword [rcx + 0x84], 0xe
jbe 0x14001f23b
cmp dword [rcx + 0xf8], 0
je 0x14001f23b
mov ecx, ebx
call fcn.14001f2ec
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001f0c8
nop
cmp dword [rbp + 0x20], 0
je 0x14001f289
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001f294
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14001f1cc

Function at 0x14001f3d0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001f1cc
Function at 0x14002a394
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14002a3c4
xor eax, eax
jmp 0x14002a487
mov rbp, rbx
cmp word [rax], si
je 0x14002a3e9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14002a3d0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14002a3cc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14002a2b4
movsxd r14, eax
test eax, eax
jne 0x14002a427
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14002a3bd
mov rcx, r14
call fcn.140027338
mov rdi, rax
test rax, rax
jne 0x14002a440
xor ecx, ecx
call fcn.140026550
jmp 0x14002a41c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14002a2b4
test eax, eax
jne 0x14002a471
mov rcx, rdi
call fcn.140026550
jmp 0x14002a47b
xor ecx, ecx
call fcn.140026550
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14002d8a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400257a4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x14002d941
cmp ebx, dword [rsp + 0x30]
je 0x14002d93a
test esi, esi
je 0x14002d93a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14002d915
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14002d922
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14002d8ff
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14002d926
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14002d943
mov eax, 1
jmp 0x14002d943
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret