joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400261a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1413a4a50]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140026213
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14002624a
test eax, eax
js 0x140026224
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14002623d
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x1413a4ab0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140024090
mov rcx, rax
call fcn.140024200
mov ecx, 7
int 0x29
ud2
Function at 0x140029970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x1400299a0
test ecx, ecx
jne 0x1400299f0
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x1400299ac
test ecx, ecx
jne 0x1400299f0
mov rcx, rdi
call fcn.140029850
movzx eax, al
test bpl, bpl
jne 0x1400299f7
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x1400299e3.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x140029b68]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x1400299e3.2
xor eax, eax
test bpl, bpl
je 0x1400299bc
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x140029b49
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x140029a2a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x140029aa9
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x140029a70
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x140029a8b
inc rax
dec rdi
cmp rax, 1
jne 0x140029a50
jmp 0x140029aa9
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x140029a8b
cmp ebx, 0x5c
je 0x140029a8b
inc rax
dec rdi
cmp rax, 1
jne 0x140029a70
jmp 0x140029aa9
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x140029b57
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x140029ad3
mov al, 9
cmp rdx, 2
je 0x140029ad7
cmp rdx, 1
jne 0x140029ae7
cmp byte [r8], 0x2e
jne 0x140029ae7
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140029ae7
mov al, 0xa
jmp 0x140029ae7
cmp byte [r8], 0x2e
jne 0x140029ae7
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov byte [rsi + 8], al
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], rdx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x1400299e3.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x1400299e3.2
mov ecx, 2
jmp case.0x1400299e3.2
lea r8, [0x1413a3bd0]
call fcn.140053540
ud2
lea r8, [0x1413a3be8]
call fcn.140053540
ud2
Function at 0x14002e850
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x1413a4a50]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x14002e8bc
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x14002e8cb
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x14002e903
cmp eax, 0x103
je 0x14002e90d
test eax, eax
js 0x14002e8e8
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x14002e903
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, [0x1413a4ab0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140024090
mov rcx, rax
call fcn.140024200
mov ecx, 7
int 0x29
ud2

Function at 0x14002fcf0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140026e30
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
test rax, rax
je 0x14002fda7
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov r8b, 1
call fcn.14002e970
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x14002fda7
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14002fd79
test rsi, rsi
je 0x14002fda5
mov rcx, qword [0x1413b6bb8]
xor esi, esi
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14002fda7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rsi, rsi
je 0x14002fda0
mov rcx, qword [0x1413b6bb8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, rbx
jmp 0x14002fda7
xor esi, esi
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003b180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x40]
call fcn.140026e30
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
test rcx, rcx
je 0x14003b1f6
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.14003b360
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x14003b204
movdqu xmm6, xmmword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14003b224
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x14003b215
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x28]
call fcn.140027040
mov qword [rsi], 0
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
ret
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x14003b215
mov rcx, qword [0x1413b6bb8]
xor edx, edx
mov r8, rdi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x14003d1b0
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov r14, rdx
mov rsi, rcx
movzx eax, byte [0x1413b6ad0]
mov rcx, qword [0x1413b6bb8]
test rcx, rcx
jne 0x14003d1fc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14003d2ca
mov rcx, rax
mov qword [0x1413b6bb8], rax
mov r8d, 0x10
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14003d2ca
mov rbx, rax
mov qword [rax], r14
mov qword [rax + 8], rdi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14003d700]
xor edi, edi
xor ecx, ecx
mov rdx, rsi
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14003d2bc
mov rcx, qword [rbx]
mov qword [rbp - 0x18], rbx
mov rax, qword [rbx + 8]
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rax
call qword [rax]
mov rax, qword [rbp - 0x10]
cmp qword [rax + 8], 0
mov rsi, qword [rbp - 0x18]
je 0x14003d295
cmp qword [rax + 0x10], 0x11
jae 0x14003d27e
mov r8, qword [rbp - 0x20]
jmp 0x14003d286
mov r8, qword [rbp - 0x20]
mov r8, qword [r8 - 8]
mov rcx, qword [0x1413b6bb8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1413b6bb8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov edi, 1
mov rax, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], rdi
mov ecx, 8
mov edx, 0x10
call fcn.1400533b0
ud2
Function at 0x14003dbd0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.1400450c0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov qword [rbp + 0xfd8], rdx
mov r14, rcx
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.140045940
mov dword [rbp + 0xfe8], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea r15, [rbp + 0xfe8]
mov qword [rbp + 0xfc8], r15
lea r12, [0x1400337b0]
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xfb0]
mov rcx, r14
mov rdx, rsi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x14003ddbe
mov r13, qword [sym.imp.KERNEL32.dll_SleepEx]
lea rsi, [rbp + 0xfb0]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov qword [rbp + 0xfe0], r14
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0xfe8], 0
je 0x14003dc97
cmp dword [rbp + 0xfec], 0
jne 0x14003ddd3
mov ebx, dword [rbp + 0xff0]
test rbx, rbx
je 0x14003ddd3
cmp ebx, 0x1000
ja 0x14003de17
xor r14d, r14d
nop dword [rax + rax]
cmp r14, rbx
ja 0x14003de03
lea rdx, [r14 + rbp]
add rdx, 0xffffffffffffffb0
mov r8d, ebx
sub r8d, r14d
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r15
mov qword [rsp + 0x20], r12
mov rcx, qword [rbp + 0xfd8]
mov r9, rsi
call rdi
test eax, eax
je 0x14003ddc6
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r13
cmp dword [rbp + 0xfe8], 0
je 0x14003dd40
cmp dword [rbp + 0xfec], 0
jne 0x14003ddcc
mov eax, dword [rbp + 0xff0]
add r14, rax
cmp r14, rbx
jne 0x14003dce0
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
mov qword [rbp + 0xfc8], r15
mov qword [rsp + 0x20], r12
mov r14, qword [rbp + 0xfe0]
mov rcx, r14
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x14003dc97
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14003ddd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14, qword [rbp + 0xfe0]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call rsi
mov rcx, qword [rbp + 0xfd8]
call rsi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, [0x1413a4d98]
mov rcx, r14
mov rdx, rbx
call fcn.140053840
jmp 0x14003de2b
lea r8, [0x1413a4d98]
mov edx, 0x1000
mov rcx, rbx
call fcn.1400535c0
ud2
Function at 0x14003deb0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14003deef
mov rax, qword [rbp - 0x20]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x14002ae40]
mov qword [rbp - 0x28], rax
lea rax, [0x1413a4f10]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, [0x1413a4f48]
lea rcx, [rbp - 0x60]
call fcn.140053480
ud2

Function at 0x14003fd80
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
cmp qword [rdx], 0
jne 0x14003fe8f
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
test rax, rax
jne 0x14003fdb8
mov rdx, qword [rbx + 0x10]
lea rax, [rdx + 0xf]
cmp rax, 0xf
jbe 0x14003fe52
xor eax, eax
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
je 0x14003fe71
sub rax, rdx
add rdx, qword [rbx]
mov r8, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp rax, rcx
cmovae rax, rcx
mov dword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003fe0e
mov eax, dword [rsp + 0x30]
mov ecx, 2
test rax, rax
jne 0x14003fe2b
jmp 0x14003fe20
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14003fe26
cmp eax, 0x6d
jne 0x14003fe42
mov byte [rsi + 1], 0
jmp 0x14003fe36
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
xor eax, eax
mov byte [rsi], al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x14003fe38
mov r8d, 0x10
mov rcx, rbx
call fcn.1400532f0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
cmp rax, rdx
jne 0x14003fdc5
mov r8d, 1
mov rcx, rbx
mov rdx, rax
call fcn.1400532f0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
jmp 0x14003fdc5
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140054750
ud2

Function at 0x1400496cc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400494c8
Function at 0x1416e4058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1416e41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1416e4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416e406f
add dl, dl
jne 0x1416e4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416e40f6
xor eax, eax
add dl, dl
jne 0x1416e40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416e41ad
add dl, dl
jne 0x1416e40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416e40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416e40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416e40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1416e40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1416e407e
mov eax, 1
add dl, dl
jne 0x1416e4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416e4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416e40fb
sub eax, ebx
mov ebx, 1
jne 0x1416e414c
mov ecx, 1
add dl, dl
jne 0x1416e412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1416e413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416e4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416e407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1416e4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1416e4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416e415d
cmp eax, 0x7d00
jae 0x1416e419b
cmp eax, 0x500
jb 0x1416e4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416e407e
cmp eax, 0x7f
ja 0x1416e419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1416e407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1416e41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1416e407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000c2c7
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
test cl, 1
je 0x14000c2d7
xor eax, eax
add rsp, 0x28
ret
lea rcx, [0x1403b9759]
mov edx, 2
call fcn.1402e7815
mov rdx, rax
mov eax, 1
jmp 0x14000c2d2

Function at 0x14000c2f2
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
xor eax, eax
cmp rax, qword [rdx]
jo 0x14000c317
mov rax, qword [rdx + 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rdx]
movups xmmword [rsi], xmm0
add rsp, 0x28
pop rdi
pop rsi
ret
movabs rdi, 0x8000000000000000
lea rcx, [0x1403b98dd]
mov edx, 4
call fcn.1402e7815
mov qword [rsi + 8], rax
mov qword [rsi], rdi
jmp 0x14000c310
Function at 0x140017dc1
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140002f02
test rax, rax
je 0x140017dec
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140036fc4

Function at 0x140017ef0
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140002f02
test rax, rax
je 0x140017f21
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140037456

Function at 0x1400180d7
Capabilities:
Get geographical location

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.140002f02
test rax, rax
je 0x140018108
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
mov rdx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140030ff2

Function at 0x140018119
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x308
mov r14, rdx
mov rbx, rcx
mov rcx, rdx
call fcn.140002f02
movabs r12, 0x8000000000000000
test rax, rax
je 0x140018155
lea rsi, [rsp + 0x148]
mov rcx, rsi
mov rdx, r14
call fcn.140002e30
cmp byte [rsi], 0
je 0x14001818b
mov rax, qword [rsp + 0x150]
mov qword [rbx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rbx], rax
jmp 0x140018e8c
cmp byte [rsp + 0x149], 0
je 0x140018ea0
cmp byte [rsp + 0x14a], 0x5b
jne case.0x140008fb4.228
dec byte [r14 + 0x30]
je 0x140018ecd
mov qword [rsp + 0x38], rbx
inc qword [r14 + 0x28]
mov qword [rsp + 0x68], 0
mov edx, 8
mov r8d, 0x80
xor ecx, ecx
call fcn.1400ad647
lea rcx, [rsp + 0x130]
mov qword [rcx], rax
mov qword [rsp + 0xa0], rdx
mov qword [rcx + 8], rdx
and qword [rcx + 0x10], 0
mov al, 1
mov dword [rsp + 0x44], eax
lea r12, [rsp + 0xa8]
lea rbp, [rsp + 0x88]
lea rdi, [0x1402f30e7]
lea rbx, [0x1403b9963]
mov qword [rsp + 0x60], r14
lea rdx, [rsp + 0xa8]
mov qword [rdx], 5
add al, byte [0x12b018eb0]
invalid
lea rdx, [rsp + 0xa8]
mov qword [rdx], 0x15
mov rcx, r14
call fcn.1402e70a0
jmp 0x140018175
Function at 0x14003265b
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6c8
mov rdi, rdx
mov r12, rcx
lea rsi, [rsp + 0x5c8]
mov rcx, rsi
call fcn.140002e30
cmp byte [rsi], 0
je 0x1400326a9
mov rax, qword [rsp + 0x5d0]
cmp byte [rsp + 0x5c9], 0
je 0x14003467c
cmp byte [rsp + 0x5ca], 0x5b
jne 0x14003468d
dec byte [rdi + 0x30]
je 0x1400346a9
mov qword [rsp + 0x48], r12
inc qword [rdi + 0x28]
mov edx, 8
mov r8d, 0x110
xor ecx, ecx
call fcn.1400ad647
lea rcx, [rsp + 0x2b8]
mov qword [rcx], rax
mov qword [rcx + 8], rdx
and qword [rcx + 0x10], 0
mov al, 1
mov dword [rsp + 0x84], eax
lea rsi, [rsp + 0xa0]
mov qword [rsp + 0x60], rdi
lea rdx, [rsp + 0x128]
mov qword [rdx], 5
jmp 0x1400346b8
lea r8, [0x1402f39e8]
lea rdx, [rsp + 0x128]
mov qword [rdx], 0x15
invalid
add byte [rax], al
invalid
mov rcx, rdi
Function at 0x14003f5f2
Capabilities:
Encrypt data using dpapi

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
movabs rdi, 0x8000000000000013
lea rcx, [rsp + 0x48]
mov dword [rcx], r8d
lea rax, [rsp + 0x38]
and dword [rax], 0
mov qword [rcx + 8], rdx
and qword [rax + 8], 0
and dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
and qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.crypt32.dll_CryptUnprotectData
test eax, eax
je 0x14003f65a
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rax
add rdi, 6
jmp 0x14003f662
call sub.KERNEL32.dll_GetLastError
mov dword [rsi + 8], eax
mov qword [rsi], rdi
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x14005710a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov r13, qword [rsp + 0x90]
movabs rax, 0x1ffffffffffffff8
test r9, rax
je 0x1400571a1
mov r14, r9
mov r15, r9
shr r15, 3
and r14, 0xfffffffffffffff8
lea rdx, [rbx + r14]
imul r12, r15, 0xe
lea r8, [rbx + r12]
mov qword [rsp + 0x20], r13
mov rcx, rbx
mov r9, r15
call fcn.14005710a
mov rbx, rax
lea rdx, [rdi + r14]
lea r8, [rdi + r12]
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov r9, r15
call fcn.14005710a
mov rdi, rax
add r14, rsi
add r12, rsi
mov qword [rsp + 0x20], r13
mov rcx, rsi
mov rdx, r14
mov r8, r12
mov r9, r15
call fcn.14005710a
mov rsi, rax
mov rcx, qword [r13]
movzx edx, word [rbx]
movzx r8d, word [rdi]
call fcn.1400571f6
mov ebp, eax
mov rcx, qword [r13]
movzx edx, word [rbx]
movzx r8d, word [rsi]
call fcn.1400571f6
cmp bpl, al
jne 0x1400571e2
mov rcx, qword [r13]
movzx edx, word [rdi]
movzx r8d, word [rsi]
call fcn.1400571f6
xor bpl, al
cmovne rdi, rsi
mov rbx, rdi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140057544
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov rdx, r8
mov r8, r9
call fcn.14005739c
add r14, 8
lea rdx, [rdi + 8]
mov rcx, r14
mov r8, rsi
call fcn.14005739c
mov edx, 8
mov rcx, rdi
mov r8, rbx
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140057593