joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e430
Capabilities:
Create directory
Delete file
Encode data using xor
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call fcn.140090d00
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x104
call fcn.1400625b0
xor edx, edx
mov r8d, 0x104
mov rcx, rax
mov rdi, rax
call fcn.140090d00
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14004e5e2
movsx r8d, byte [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x160], rbx
xor ebx, ebx
mov ecx, ebx
mov dword [rsp + 0x20], 0xdabfe7a6
mov dword [rsp + 0x24], 0xd3cacdd5
mov dword [rsp + 0x28], 0xdcc8c0c8
mov word [rsp + 0x2c], 0x908f
nop dword [rax + rax]
lea eax, [rcx - 0x7d]
inc ecx
xor byte [rdx], al
lea rdx, [rdx + 1]
cmp ecx, 0xd
jb 0x14004e4e0
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x2d], bl
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
movdqa xmm0, xmmword [0x1400a54b0]
lea rcx, [rsp + 0x20]
movsx r8d, byte [rsp + 0x40]
mov r9, rax
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x96e5f9e7
mov byte [rsp + 0x34], 0x97
nop word [rax + rax]
lea eax, [rbx - 0x7d]
inc ebx
xor byte [rcx], al
lea rcx, [rcx + 1]
cmp ebx, 0x14
jb 0x14004e550
mov rbx, qword [rsp + 0x160]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov byte [rsp + 0x34], 0
call qword [sym.imp.USER32.dll_wsprintfA]
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r8d, 1
lea rcx, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x14004e5e2
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edx, 6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rdi
call fcn.1400624fc
mov al, 1
mov rdi, qword [rsp + 0x168]
add rsp, 0x150
pop rbp
ret
mov rcx, rdi
call fcn.1400624fc
mov rdi, qword [rsp + 0x168]
xor al, al
add rsp, 0x150
pop rbp
ret
Function at 0x14004eb20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
movdqa xmm0, xmmword [0x1400a5500]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xfbf4f1e7
mov dword [rbp - 0x2c], 0xeae9d9cb
mov word [rbp - 0x28], 0xc0e8
mov byte [rbp - 0x26], 0x9d
xor ecx, ecx
lea rdx, [rbp - 0x40]
nop word [rax + rax]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0x1a
jb 0x14004eb70
mov byte [rbp - 0x26], 0
lea rax, [rbp - 0x40]
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x14004eb90
mov rdx, qword [rbx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x14004ed53
mov rax, rbx
lea rdi, [rbx + 0x18]
cmp qword [rbx + 0x18], 0xf
jbe 0x14004ebc4
mov rax, qword [rbx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400610d0
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rdx, qword [rbp - 8]
test eax, eax
jne 0x14004eca3
cmp rdx, 0xf
jbe 0x14004ec54
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ec4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ed47
call fcn.1400624fc
lea rdi, [rbx + 0x18]
movdqa xmm0, xmmword [0x1400a5090]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14004ec9f
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14004ec9a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004ed4d
mov rcx, r8
call fcn.1400624fc
mov al, 1
jmp 0x14004ed22
cmp rdx, 0xf
jbe 0x14004ecda
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ecd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004ed47
lea rdi, [rbx + 0x18]
call fcn.1400624fc
movdqa xmm0, xmmword [0x1400a5090]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x14004ed20
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14004ed1b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004ed4d
mov rcx, r8
call fcn.1400624fc
xor al, al
mov byte [rbx], 0
mov qword [rdi], 0xf
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
call fcn.1400788cc
nop
call fcn.1400788cc
nop
call fcn.14004b330
int3
Function at 0x140050d90
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0xb
jb 0x140050da0
mov byte [rcx + 0xb], 0
mov rax, rcx
ret
Function at 0x140052a80
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0xc
jb 0x140052a90
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x140052ab0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0xa
jb 0x140052ac0
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x140052ae0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x18
jb 0x140052af0
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x140052b10
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x1a
jb 0x140052b20
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret

Function at 0x140052b40
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 3
jb 0x140052b50
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x140052b70
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x1d
jb 0x140052b80
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret

Function at 0x140052ba0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0xf
jb 0x140052bb0
mov byte [rcx + 0xf], 0
mov rax, rcx
ret
Function at 0x140054100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
lea rdi, [0x1400b5e40]
mov rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x140054120
sub rax, 0x16
xor esi, esi
cmp rax, 1
ja 0x1400541d4
lea rax, [rbp - 0x40]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x20], 0xe2f7e5e0
mov byte [rbp + 0x24], 0x87
mov ecx, esi
lea rdx, [rbp + 0x20]
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 4
jb 0x140054152
mov byte [rbp + 0x24], sil
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rsi
lea rax, [rbp + 0x20]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x140054180
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x40]
call fcn.1400608e0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x1400541b0
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.1400608e0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14004ed60
lea rdi, [0x1400b6060]
mov rax, rbx
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x1400541e0
cmp rax, 1
jbe 0x14005428d
lea rax, [rbp - 0x20]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x20], 0xe9e6e7e2
mov dword [rbp + 0x24], 0x8afde6f2
mov ecx, esi
lea rdx, [rbp + 0x20]
nop
lea eax, [rcx - 0x7d]
xor byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 7
jb 0x140054210
mov byte [rbp + 0x27], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
lea rax, [rbp + 0x20]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140054240
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.1400608e0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rsi
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140054267
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.1400608e0
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.14004ed60
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005bbe0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x14
jb 0x14005bbf0
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x14005bc60
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x29
jb 0x14005bc70
mov byte [rcx + 0x29], 0
mov rax, rcx
ret

Function at 0x14005bd80
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x10
jb 0x14005bd90
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x14005c1a0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x3f
jb 0x14005c1b0
mov byte [rcx + 0x3f], 0
mov rax, rcx
ret

Function at 0x14005c4c0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x11
jb 0x14005c4d0
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x14005c520
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x17
jb 0x14005c530
mov byte [rcx + 0x17], 0
mov rax, rcx
ret

Function at 0x14005c6c0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0xd
jb 0x14005c6d0
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x14005cce0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x1b
jb 0x14005ccf0
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret

Function at 0x14005cf90
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x56
jb 0x14005cfa0
mov byte [rcx + 0x56], 0
mov rax, rcx
ret

Function at 0x14005cfc0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x8a
jb 0x14005cfd0
mov byte [rcx + 0x8a], 0
mov rax, rcx
ret

Function at 0x14005d000
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x25
jb 0x14005d010
mov byte [rcx + 0x25], 0
mov rax, rcx
ret

Function at 0x14005d030
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x2e
jb 0x14005d040
mov byte [rcx + 0x2e], 0
mov rax, rcx
ret
Function at 0x14005d060
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x34
jb 0x14005d070
mov byte [rcx + 0x34], 0
mov rax, rcx
ret

Function at 0x14005d090
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x4f
jb 0x14005d0a0
mov byte [rcx + 0x4f], 0
mov rax, rcx
ret

Function at 0x14005d0c0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x5f
jb 0x14005d0d0
mov byte [rcx + 0x5f], 0
mov rax, rcx
ret

Function at 0x14005d0f0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x3e
jb 0x14005d100
mov byte [rcx + 0x3e], 0
mov rax, rcx
ret

Function at 0x14005d120
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x41
jb 0x14005d130
mov byte [rcx + 0x41], 0
mov rax, rcx
ret

Function at 0x14005d150
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x243
jb 0x14005d160
mov byte [rcx + 0x243], 0
mov rax, rcx
ret

Function at 0x14005d190
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 5
jb 0x14005d1a0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x14005d1c0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x21
jb 0x14005d1d0
mov byte [rcx + 0x21], 0
mov rax, rcx
ret

Function at 0x14005d1f0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x26
jb 0x14005d200
mov byte [rcx + 0x26], 0
mov rax, rcx
ret

Function at 0x14005d220
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov rax, rcx
mov r8d, r10d
mov r9d, 0x83
nop
lea edx, [r9 + r8]
inc r8d
xor word [rax], dx
lea rax, [rax + 2]
cmp r8d, 2
jb 0x14005d230
mov word [rcx + 4], r10w
mov rax, rcx
ret

Function at 0x14005d250
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov rax, rcx
mov r8d, r10d
mov r9d, 0x83
nop
lea edx, [r9 + r8]
inc r8d
xor word [rax], dx
lea rax, [rax + 2]
cmp r8d, 0xf
jb 0x14005d260
mov word [rcx + 0x1e], r10w
mov rax, rcx
ret

Function at 0x14005d280
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 7
jb 0x14005d290
mov byte [rcx + 7], 0
mov rax, rcx
ret
Function at 0x14005d2b0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x13
jb 0x14005d2c0
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x14005d6d0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 4
jb 0x14005d6e0
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x14005d700
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 6
jb 0x14005d710
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x14005d730
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 9
jb 0x14005d740
mov byte [rcx + 9], 0
mov rax, rcx
ret
Function at 0x14005dbe0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14005dc11
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14005dc8b
mov rdi, r14
mov rcx, rbx
call fcn.14005f2f0
test rax, rax
jle 0x14005dc63
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1400910c0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14005dc7b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14005dc83
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14005dc25
sub r14, rdi
jmp 0x14005dd6f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14005dca2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14005dca4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14005dcd6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400910c0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14005dd6c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14005dd11
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14005dd4d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400757c4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14005dd6c
cmp rbp, rax
ja 0x14005dd20
test rbp, rbp
je 0x14005dd6c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400757c4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14005e680
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rax, rcx
nop word [rax + rax]
lea edx, [r8 - 0x7d]
inc r8d
xor byte [rax], dl
lea rax, [rax + 1]
cmp r8d, 0x15
jb 0x14005e690
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x140062b9c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140062be6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140062be6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140062be6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140062be6
cmp dword [rcx + 0x84], 0xe
jbe 0x140062be6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140062be8
xor al, al
add rsp, 0x28
ret
Function at 0x140062e10
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140062e4a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140062e4f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140062e98
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400948c0]
cmp byte [rcx + rax], 0
je 0x140062e98
dec r8
sub rdx, 1
jne 0x140062e7e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140073bd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14008ec50
sub rsp, rax
mov rax, qword [0x1400b3040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14007ebe4
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140073c1f
mov rax, rbp
jmp 0x140073d27
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xb5050]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14007f2cc
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0xb5050]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140073d23
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140073d23
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14007f2cc
test rax, rax
js 0x140073d23
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140073d23
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140073d15
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140073d15
cmp byte [rcx], 0xd
jne 0x140073cfb
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140073d0a
cmp byte [rcx + 1], 0xa
jne 0x140073d0a
inc rcx
jmp 0x140073d0a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xb34b0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140073cdd
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140073d27
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14008ec20
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret