joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140060ac4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1401ea028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x1401ef360], edx
mov edi, edx
mov ebx, 1
je 0x140060c04
lea r9d, [rbx + 5]
mov edx, 0x80001004
lea r8, [rsp + 0x20]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
nop dword [rax + rax]
test eax, eax
je 0x140060b54
lea rcx, [rsp + 0x20]
call fcn.14010f628
mov ebp, eax
lea esi, [rbx + 0x7f]
lea r14, [0x1401ef2e0]
mov dl, sil
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
nop dword [rax + rax]
mov byte [r14], al
add esi, ebx
add r14, rbx
cmp esi, 0x100
jl 0x140060b2e
jmp 0x140060c04
movzx edx, di
mov ecx, edx
and ecx, 0x3ff
sub ecx, 4
je 0x140060bde
sub ecx, 0xd
je 0x140060b8f
cmp ecx, ebx
je 0x140060b77
mov ebx, 3
jmp 0x140060c04
mov cl, 0x81
movzx eax, cl
lea rdx, [0x1401ef260]
add cl, bl
mov byte [rax + rdx], bl
cmp cl, 0xfe
jbe 0x140060b79
jmp 0x140060c04
movdqa xmm0, xmmword [0x1401ad6d0]
movq rax, xmm0
mov qword [0x1401ef2f1], rax
mov dword [0x1401ef2f9], eax
mov word [0x1401ef2fd], ax
mov byte [0x1401ef2ff], al
movq rax, xmm0
mov qword [0x1401ef350], rax
mov dword [0x1401ef358], eax
mov byte [0x1401ef35c], al
movups xmmword [0x1401ef2e1], xmm0
movups xmmword [0x1401ef340], xmm0
jmp 0x140060c04
mov eax, 0xfc00
and dx, ax
mov eax, 0x800
cmp dx, ax
jne 0x140060c04
mov r8d, 0x5e
lea rcx, [0x1401ef301]
mov dl, bl
call fcn.140133710
mov eax, dword [0x1401ef360]
cmp eax, 0xffffffff
je 0x140060c1d
cmp eax, edi
je 0x140060c1d
test edi, edi
mov eax, 2
cmovne ebx, eax
mov dword [0x1401ef360], edi
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401313d0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x1400636c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
cmp qword [rdx + 0x18], 8
mov rdi, rcx
mov rax, qword [rdx + 0x10]
mov r11, rdx
jb 0x1400636e3
mov r11, qword [rdx]
xor r9d, r9d
lea rbx, [rax + rax]
movabs r8, 0xcbf29ce484222325
mov ecx, r9d
mov r10, r8
movabs rsi, 0x100000001b3
test rbx, rbx
je 0x14006371d
movzx eax, byte [rcx + r11]
inc rcx
xor r10, rax
imul r10, rsi
cmp rcx, rbx
jb 0x140063709
mov eax, dword [rdx + 0x20]
mov rcx, r8
and eax, 0x1ff
mov rdx, r9
mov dword [rsp + 8], eax
movzx eax, byte [rsp + rdx + 8]
inc rdx
xor rcx, rax
imul rcx, rsi
cmp rdx, 4
jb 0x14006372f
mov qword [rsp + 8], rcx
movzx eax, byte [rsp + r9 + 8]
inc r9
xor r8, rax
imul r8, rsi
cmp r9, 8
jb 0x140063749
mov rbx, qword [rsp + 0x10]
mov rcx, r10
mov rsi, qword [rsp + 0x18]
mov rdx, r10
shl rcx, 6
mov eax, 0x9e3779b9
shr rdx, 2
add rcx, r8
add rax, rdx
add rax, rcx
xor rax, r10
and rax, qword [rdi + 0x30]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x140063860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmp qword [r8 + 0x18], 8
mov rax, r8
jb 0x140063872
mov rax, qword [r8]
cmp qword [rdx + 0x18], 8
mov r10, rdx
mov r9, qword [rdx + 0x10]
jb 0x140063883
mov r10, qword [rdx]
mov ecx, 1
cmp r9, qword [r8 + 0x10]
jne 0x1400638d4
test r9, r9
je 0x1400638c5
movzx r11d, word [r10]
movzx ebx, word [rax]
cmp r11w, bx
jb 0x1400638d4
sub r10, rax
cmp r11w, bx
ja 0x1400638d4
cmp r9, rcx
je 0x1400638c5
add rax, 2
sub r9, rcx
movzx r11d, word [r10 + rax]
movzx ebx, word [rax]
cmp r11w, bx
jae 0x1400638a7
jmp 0x1400638d4
mov eax, dword [rdx + 0x20]
xor eax, dword [r8 + 0x20]
test eax, 0x1ff
setne cl
mov rbx, qword [rsp + 8]
mov al, cl
ret
Function at 0x14008c7e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
lea r8, str.CODEFRAGMENT
mov r14d, ebx
mov r15d, ebx
mov r12, r9
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x14008c870
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x14008c870
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
test rax, rax
je 0x14008c870
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov r14, rax
mov r15d, edi
jmp 0x14008c88a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov dword [rcx], r15d
mov qword [r12], r14
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140092838
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401ea028]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, qword [0x1401eb8a8]
test rdi, rdi
je 0x14009296a
mov rbx, qword [rdi]
cmp rbx, qword [rdi + 8]
je 0x140092955
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.14009270c
cmp qword [rbp - 0x18], 0x10
lea rdx, [rbp - 0x30]
mov rcx, rbx
cmovae rdx, qword [rbp - 0x30]
cmp qword [rbx + 0x18], 0x10
jb 0x14009289c
mov rcx, qword [rbx]
call fcn.1401119d4
mov edi, eax
test eax, eax
je 0x1400928f6
call fcn.140111d38
cmp dword [rax], 0x11
jne 0x1400928e6
cmp qword [rbp - 0x18], 0x10
lea rcx, [rbp - 0x30]
cmovae rcx, qword [rbp - 0x30]
call fcn.140111700
cmp qword [rbp - 0x18], 0x10
lea rdx, [rbp - 0x30]
mov rcx, rbx
cmovae rdx, qword [rbp - 0x30]
cmp qword [rbx + 0x18], 0x10
jb 0x1400928df
mov rcx, qword [rbx]
call fcn.1401119d4
mov edi, eax
test edi, edi
je 0x1400928f6
lea rcx, str.Error_renaming_intermediate_file
call fcn.14010fe60
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14009292d
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140092928
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092987
call fcn.1401313f8
and qword [rbp - 0x20], 0
add rbx, 0x20
mov rdi, qword [0x1401eb8a8]
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rax, qword [rdi + 8]
cmp rbx, rax
jmp 0x14009286f
mov rcx, rdi
call fcn.1400630b0
mov edx, 0x18
mov rcx, rdi
call fcn.1401313f8
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401313d0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
call fcn.14010f9a4
int3
Function at 0x140094ed0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140094efd
xor eax, eax
jmp 0x140094ffa
cmp qword [rcx + 0x68], 0
je 0x140094f0e
call fcn.140029ff0
jmp 0x140094ffa
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140094f25
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140094f27
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140094f5c
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140133300
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140094ff4
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x140094f97
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x140094fcf
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.14011c240
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x140095014
cmp rbp, r15
ja 0x140094fa5
mov r8, rbx
test rbx, rbx
je 0x140094ff4
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.14011c240
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
sub rdi, rbp
jmp 0x140094ff7

Function at 0x140095794
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401ea028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140095809
cmp byte [rcx + 0x71], 0
je 0x140095809
or edx, 0xffffffff
call fcn.140095420
cmp eax, 0xffffffff
je 0x14009585e
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x140068c32.0]
test eax, eax
je 0x140095824
sub eax, 1
je 0x140095828
cmp eax, 2
jne 0x14009585e
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401313d0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140095855
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.14011bf54
cmp rdi, rax
jne 0x14009585e
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14009580b
xor al, al
jmp 0x14009580b
Function at 0x14009da90
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x1401ea028]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov ebx, 0x104
mov qword [r8], r15
mov r9d, ebx
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x14009db03
movzx eax, word [rcx + rdx]
test ax, ax
je 0x14009db03
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x14009dae1
lea rax, [rdx - 2]
test r9, r9
lea r8, [0x140198d48]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov word [rax], r15w
call fcn.140097860
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14009db73
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x14009dc42
mov edx, 0xc9
mov rcx, qword [rbp + 0x168]
call fcn.14009d5d8
mov esi, eax
jmp 0x14009dc45
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.14009d910
mov esi, eax
test eax, eax
jns 0x14009dbb0
mov rcx, qword [rbp + 0x168]
lea r8, [0x140198ce4]
mov r9d, eax
mov edx, 0xcf
call fcn.14009d5a0
jmp 0x14009dc45
lea r8, [0x140198d50]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140097860
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14009dbee
mov edx, 0xd5
jmp 0x14009db60
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14009d910
mov esi, eax
test eax, eax
jns 0x14009dc26
mov rcx, qword [rbp + 0x168]
lea r8, [0x140198ce4]
mov r9d, eax
mov edx, 0xd7
call fcn.14009d5a0
mov rcx, rbx
call fcn.14009d670
jmp 0x14009dc45
mov rcx, rbx
call fcn.14009d670
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x14009dc52
mov rcx, rdi
call fcn.14009d670
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.1401313d0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400a0ab4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, r8
mov cl, byte [rcx + 8]
mov rsi, rdx
cmp cl, 2
je 0x1400a0b04
cmp byte [rbx + 0xb], 0
jne 0x1400a0b04
cmp byte [rbx + 0xc], 0
jne 0x1400a0b04
mov edx, 1
cmp cl, dl
jne 0x1400a0b15
mov r9, qword [rbx + 0x38]
mov rcx, rsi
call fcn.14011bf54
cmp byte [rbx + 0xd], 0
je 0x1400a0b04
mov rcx, qword [rbx + 0x38]
call fcn.140109c64
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test cl, cl
jne 0x1400a0b1f
mov rax, qword [rbx + 0x40]
jmp 0x1400a0b21
xor eax, eax
test rax, rax
je 0x1400a0b78
test cl, cl
jne 0x1400a0b30
mov rax, qword [rbx + 0x40]
jmp 0x1400a0b32
xor eax, eax
add rax, rdi
cmp rax, qword [rbx + 0x50]
jb 0x1400a0b55
test cl, cl
jne 0x1400a0b44
mov eax, dword [rbx + 0x3c]
jmp 0x1400a0b46
xor eax, eax
lea edx, [rax + r8]
mov rcx, rbx
call fcn.1400a0e3c
mov cl, byte [rbx + 8]
test cl, cl
jne 0x1400a0b5f
mov rcx, qword [rbx + 0x40]
jmp 0x1400a0b61
xor ecx, ecx
mov r8, rdi
mov rdx, rsi
call fcn.140133300
cmp byte [rbx + 8], 0
jne 0x1400a0b04
add qword [rbx + 0x40], rdi
jmp 0x1400a0b04
lea r8, str.GetCurrentPtr_____0
mov edx, 0xdd
lea rcx, str.com_rpcmidlmidlrtcommon_stream.cxx
call fcn.14009bc1c
int3

Function at 0x1400a208c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401ea028]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x38], rcx
movdqa xmm0, xmmword [0x1401ad6b0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400a2144
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
xor r8d, r8d
lea rdx, [0x14016e692]
mov rcx, rbx
call fcn.14002b0fc
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400a2193
inc rdx
mov rcx, qword [rbp - 0x30]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400a213d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a21b3
call fcn.1401313f8
jmp 0x1400a2193
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140059970
lea edx, [rdi - 1]
lea rcx, [rbp - 0x30]
call fcn.140029120
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop dword [rax + rax]
test eax, eax
je 0x1400a20e8
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401313d0
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call fcn.14010f9a4
int3
Function at 0x1400a21c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1401ea028]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov qword [rbp - 0x38], rcx
movdqa xmm0, xmmword [0x1401ad6b0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jne 0x1400a2273
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
xor r8d, r8d
lea rdx, [0x14016e692]
mov rcx, rbx
call fcn.14002b0fc
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400a22be
inc rdx
mov rcx, qword [rbp - 0x30]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400a226c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a22e0
call fcn.1401313f8
jmp 0x1400a22be
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140059970
lea edx, [rdi - 1]
lea rcx, [rbp - 0x30]
call fcn.140029120
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
nop dword [rax + rax]
test eax, eax
je 0x1400a2217
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401313d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14010f9a4
int3
Function at 0x1400a6200
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x80], rbx
mov qword [rbp + 0x88], rsi
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], r14
mov rax, qword [0x1401ea028]
xor rax, rbp
mov qword [rbp + 0x68], rax
mov eax, dword [rsp]
sub rsp, 0x10
lea rsi, [rsp + 0x20]
mov eax, dword [rsi]
mov r8d, 0x30
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [rax + rax]
test rax, rax
je 0x1400a6325
mov rdi, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
mov eax, dword [rbp + 0x3c]
mov r14d, eax
lea ebx, [rax - 1]
not rbx
and rbx, rsi
lea rsi, [rdi + 0x2000]
sub rbx, rax
cmp rbx, rsi
jb 0x1400a6325
mov r8d, 0x30
lea rdx, [rbp + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop dword [rax + rax]
test rax, rax
je 0x1400a6325
add rdi, qword [rbp + 0x20]
test dword [rbp + 0x28], 0x1000
je 0x1400a629e
test dword [rbp + 0x2c], 0x100
je 0x1400a62d9
mov eax, 1
jmp 0x1400a6327
mov rax, qword [rbp + 8]
cmp rbx, rax
jb 0x1400a6325
cmp rax, rsi
mov r9d, 4
mov r8d, 0x1000
mov rdx, r14
cmovae rsi, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop dword [rax + rax]
lea r9, [rbp]
mov r8d, 0x104
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop dword [rax + rax]
jmp 0x1400a6327
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.1401313d0
mov rbx, qword [rbp + 0x80]
mov rsi, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x90]
mov r14, qword [rbp + 0x98]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x1400ebf24
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
push r15
cmp qword [r8 + 0x18], 8
mov r14, rdx
mov r11, qword [r8 + 0x10]
mov r10, r8
jb 0x1400ebf4f
mov r10, qword [r8]
lea rdx, [r11 + r11]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x1400ebf82
movzx eax, byte [rcx + r10]
movabs rbx, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rbx
cmp rcx, rdx
jb 0x1400ebf64
and r9, qword [0x1401ef600]
mov r15, qword [0x1401ef5e8]
add r9, r9
mov r10, qword [0x1401ef5d8]
mov rax, qword [r15 + r9*8]
cmp qword [r15 + r9*8], r10
jne 0x1400ebfa9
mov rcx, r10
jmp 0x1400ebfb1
mov rcx, qword [r15 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400ec06b
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x1400ebfcb
mov rdx, qword [r8]
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x10]
cmp rbp, 8
jb 0x1400ebfdc
mov rcx, qword [rcx]
cmp rbx, r11
jne 0x1400ec012
test rbx, rbx
je 0x1400ec017
movzx edi, word [rcx]
movzx esi, word [rdx]
cmp di, si
jb 0x1400ec012
sub rcx, rdx
cmp di, si
ja 0x1400ec012
cmp rbx, 1
je 0x1400ec017
add rdx, 2
dec rbx
movzx edi, word [rdx + rcx]
movzx esi, word [rdx]
cmp di, si
jae 0x1400ebff7
mov rax, qword [rax]
jmp 0x1400ebf9e
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400ec024
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
jb 0x1400ec02e
mov r8, qword [r8]
test r11, r11
je 0x1400ec068
movzx edx, word [r8]
movzx r9d, word [rcx]
cmp dx, r9w
jb 0x1400ec06b
sub r8, rcx
cmp dx, r9w
ja 0x1400ec06b
cmp r11, 1
je 0x1400ec068
add rcx, 2
dec r11
movzx edx, word [rcx + r8]
movzx r9d, word [rcx]
cmp dx, r9w
jae 0x1400ec048
jmp 0x1400ec06b
mov r10, rax
mov rbx, qword [rsp + 0x18]
mov rax, r14
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov qword [r14], r10
pop r15
pop r14
ret
Function at 0x1400edb60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x1400edb8d
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x1400edbbc
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x1400edb9e
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400edbf4
cmp qword [rcx + rdx*8], rdi
jne 0x1400edbe9
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400edbed
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400edc01
cmp qword [rcx + rdx*8], rdi
jne 0x1400edc01
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140028ef4
mov edx, 0x30
mov rcx, rdi
call fcn.1401313f8
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ee3bc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r13, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x1400ee3f8
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r13*2]
xor ecx, ecx
test r11, r11
je 0x1400ee42f
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rdi, 0x100000001b3
imul rdx, rdi
inc rcx
cmp rcx, r11
jb 0x1400ee411
mov r8, qword [r9 + 0x30]
and r8, rdx
mov r14, r8
add r14, r14
mov r12, qword [r9 + 0x18]
mov rdi, qword [r9 + 8]
cmp rdi, qword [r12 + r14*8]
je 0x1400ee4fe
mov rdi, qword [r12 + r14*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r12 + r14*8]
je 0x1400ee4fe
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1400ee476
mov rax, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x1400ee483
mov r11, qword [r10]
cmp r13, rcx
jne 0x1400ee456
mov r15, r13
test r13, r13
je 0x1400ee4c0
movzx ecx, word [r11]
movzx edx, word [rax]
cmp cx, dx
jb 0x1400ee456
sub r11, rax
cmp cx, dx
ja 0x1400ee456
cmp r15, 1
je 0x1400ee4c0
dec r15
add rax, 2
movzx ecx, word [r11 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x1400ee4a2
jmp 0x1400ee456
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.140028ef4
mov edx, 0x30
mov rcx, rbx
call fcn.1401313f8
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400ee595
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400ee533
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r14*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x1400ee553
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400ee582
cmp rax, rdi
jne 0x1400ee55e
mov qword [rdx + r8*8], rbx
jmp 0x1400ee582
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400ee582
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rcx, r9
call fcn.1400eda78
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret