joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ea00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000ea28
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000ea4e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000ea50
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000eaa9
test ecx, ecx
jle 0x14000ea89
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000eaa9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000eaa9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x14000ead0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000eb01
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x14000eb1f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000eb3b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000eb3d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000eb79
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000ec0e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000ebb4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000ebee
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000ec0e
cmp rbx, rax
ja 0x14000ebc0
test rbx, rbx
je 0x14000ec0e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000f030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000f054
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000f097
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x14000f097
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x14000f1c8
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000f0da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000f105
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14000f1cd
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000f17a
sub eax, 1
je 0x14000f17a
cmp eax, 2
jne 0x14000f1c8
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14000f1cd
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14000f1ab
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000f1c8
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000f1cd
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1400105b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140010679
cmp byte [rcx + 0x71], 0
je 0x140010679
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001066c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140010628
sub eax, 1
je 0x14001062c
cmp eax, 2
jne 0x14001066c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14001065a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001066c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x140010750
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
sub rsp, 0x48
mov rsi, r8
mov rbp, rdx
cmp rdx, r8
je 0x140010854
mov rdx, qword [0x140063638]
movabs r8, 0x100000001b3
mov qword [rax + 0x18], rbx
mov rbx, rbp
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
mov r12, qword [rbp + 8]
mov qword [rax - 0x28], r13
mov qword [rax - 0x30], r14
movzx r14d, byte [rbp + 0x10]
mov qword [rax - 0x38], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [0x140063628]
xor r14, rax
movzx eax, byte [rbp + 0x11]
imul r14, r8
mov qword [rsp + 0x68], rdx
xor r14, rax
movzx eax, byte [rbp + 0x12]
imul r14, r8
xor r14, rax
movzx eax, byte [rbp + 0x13]
imul r14, r8
xor r14, rax
imul r14, r8
and r14, qword [0x140063650]
shl r14, 4
add r14, rdx
mov rax, qword [r14]
mov r13, qword [r14 + 8]
mov qword [rsp + 0x60], rax
nop dword [rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.140045f24
dec qword [0x140063630]
cmp rdi, r13
je 0x14001085e
cmp rbx, rsi
jne 0x140010800
cmp qword [rsp + 0x60], rbp
jne 0x14001082e
mov qword [r14], rbx
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
mov qword [r12], rbx
mov qword [rbx + 8], r12
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x70]
mov rax, rsi
add rsp, 0x48
pop rsi
pop rbp
ret
cmp qword [rsp + 0x60], rbp
jne 0x14001086d
mov qword [r14], r15
mov rax, r15
jmp 0x140010870
mov rax, r12
mov qword [r14 + 8], rax
cmp rbx, rsi
je 0x14001082e
mov r13, qword [rsp + 0x68]
nop
movzx r14d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r14, rax
movzx eax, byte [rbx + 0x11]
imul r14, rdx
xor r14, rax
movzx eax, byte [rbx + 0x12]
imul r14, rdx
xor r14, rax
movzx eax, byte [rbx + 0x13]
imul r14, rdx
xor r14, rax
imul r14, rdx
and r14, qword [0x140063650]
shl r14, 4
add r14, r13
mov rbp, qword [r14 + 8]
nop dword [rax]
nop word [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.140045f24
dec qword [0x140063630]
cmp rdi, rbp
je 0x140010909
cmp rbx, rsi
jne 0x1400108e0
jmp 0x14001082b
mov qword [r14], r15
mov qword [r14 + 8], r15
cmp rbx, rsi
jne 0x140010880
jmp 0x14001082e
Function at 0x1400112c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1400112f8
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140010ea0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140011464
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400113dc
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140011453
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x140011419
mov r10, qword [rdx]
cmp r10, rax
je 0x140011413
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140011453
cmp r9, rdx
je 0x14001142f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x140011479
cmp r9, rdx
jne 0x140011420
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140011360
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140011453
Function at 0x1400151b0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1400151e1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1400636a8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1400636b8]
lea rdx, [rdi + rdi]
call fcn.140010ea0
mov rax, qword [0x1400636a8]
lea r9, [rdi - 1]
mov qword [0x1400636d0], r9
mov qword [0x1400636d8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140015354
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1400636b8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400152a0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140015315
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1400152dd
mov r10, qword [rdx]
cmp r10, rax
je 0x1400152d7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140015315
cmp r9, rdx
je 0x1400152f1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140015329
cmp r9, rdx
jne 0x1400152e2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14001534f
mov r9, qword [0x1400636d0]
jmp 0x140015251
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140015315
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400179f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r10d, r10d
mov rdi, r9
lea r9, section..data
mov rbp, r8
mov r15, rdx
mov rbx, rcx
mov r11, rdx
test r8, r8
je 0x140017a54
lea rdx, [r8 - 1]
test rdx, rdx
je 0x140017a4c
nop
movzx eax, byte [r11]
movzx ecx, dl
and cl, 0x1f
inc r11
mov eax, dword [r9 + rax*4]
rol eax, cl
xor r10d, eax
sub rdx, 1
jne 0x140017a30
movzx eax, byte [r11]
xor r10d, dword [r9 + rax*4]
test rdi, rdi
je 0x140017aa4
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x140017a60
mov r8, rdi
test rax, rax
je 0x140017aa4
lea rdx, [rax - 1]
test rdx, rdx
je 0x140017a9c
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, dl
and cl, 0x1f
inc r8
mov eax, dword [r9 + rax*4]
rol eax, cl
xor r10d, eax
sub rdx, 1
jne 0x140017a80
movzx ecx, byte [r8]
xor r10d, dword [r9 + rcx*4]
xor edx, edx
mov eax, r10d
div dword [rbx]
xor esi, esi
lea r14, [rbx + rdx*8]
mov rbx, qword [rbx + rdx*8 + 8]
test rbx, rbx
je 0x140017b35
nop dword [rax + rax]
cmp qword [rbx + 8], rbp
jne 0x140017ade
mov rcx, qword [rbx]
mov r8, rbp
mov rdx, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140017ade
lea r9d, [rax + 1]
jmp 0x140017ae1
xor r9d, r9d
mov rax, qword [rbx + 0x10]
cmp rax, rdi
je 0x140017b1b
test rax, rax
je 0x140017b17
test rdi, rdi
je 0x140017b17
mov r8, rdi
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140017b13
inc rax
test ecx, ecx
jne 0x140017b00
test edx, edx
je 0x140017b1b
xor eax, eax
jmp 0x140017b20
mov eax, 1
test r9d, r9d
je 0x140017b29
test eax, eax
jne 0x140017b50
mov rsi, rbx
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x140017ac0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
cmp dword [rsp + 0x60], 0
mov rdi, qword [rbx + 0x18]
je 0x140017b8c
mov rax, qword [rbx + 0x20]
test rsi, rsi
jne 0x140017b6a
mov qword [r14 + 8], rax
jmp 0x140017b6e
mov qword [rsi + 0x20], rax
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140017b7c
call fcn.14001cef0
mov rcx, qword [rbx]
call fcn.14001cef0
mov rcx, rbx
call fcn.14001cef0
mov rax, rdi
jmp 0x140017b37

Function at 0x140017d90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 0x28]
mov r10, rcx
cmp eax, 0xfffffffe
jb 0x140017da2
mov eax, 0x1d
ret
lea ecx, [rax + 1]
mov qword [rsp + 0x28], rcx
mov rcx, r10
jmp fcn.140017bd0
Function at 0x14001cb20
Capabilities:
Parse pe header

Disassembly:
mov r10, r8
mov r9, rdx
cmp rdx, 0x40
jb 0x14001cb8d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001cb93
movsxd rax, dword [rcx + 0x3c]
test eax, eax
js 0x14001cb93
lea rdx, [rax + 0x18]
cmp r9, rdx
jb 0x14001cb93
add rax, rcx
add rdx, 0xe0
cmp dword [rax], 0x4550
jne 0x14001cb93
movzx r8d, word [rax + 4]
mov r11d, 0x14c
cmp r8w, r11w
je 0x14001cb76
mov r11d, 0x8664
cmp r8w, r11w
jne 0x14001cb93
cmp r9, rdx
jbe 0x14001cb93
mov edx, 0x2000
test word [rax + 0x16], dx
jne 0x14001cb93
mov eax, dword [rax + 0x28]
add rax, r10
ret
cmp r9, 0x10
jb 0x14001cbb4
cmp dword [rcx], 0x464c457f
jne 0x14001cbb4
movzx edx, byte [rcx + 4]
mov r8d, edx
sub r8d, 1
je 0x14001cbbf
cmp r8d, 1
jne 0x14001cbb4
cmp r9, 0x40
jae 0x14001cbc5
movabs rax, 0xfffabadafabadaff
ret
cmp r9, 0x34
jb 0x14001cbb4
sub edx, 1
je 0x14001cbdb
cmp edx, 1
jne 0x14001cbb4
cmp word [rcx + 0x10], 2
jne 0x14001cbb4
mov rax, qword [rcx + 0x18]
ret
cmp word [rcx + 0x10], 2
jne 0x14001cbb4
mov eax, dword [rcx + 0x18]
ret
Function at 0x14001e740
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov edx, 0x1f
cmp eax, 0xffffffff
mov dword [rbx], eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x14001e7a0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
mov edx, 0x1f
test eax, eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400404a0
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x140040500
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140040500
movsxd rax, dword [rcx + 0x3c]
test eax, eax
js 0x140040500
lea r8, [rax + 0x18]
cmp rdx, r8
jb 0x140040500
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140040500
lea rcx, [r8 + 0xe0]
cmp rdx, rcx
jb 0x140040500
mov r10d, 0x20b
mov ecx, 0xf0
cmp word [rax + 0x18], r10w
mov r9d, 0xe0
cmovne ecx, r9d
add rcx, r8
xor r8d, r8d
cmp rdx, rcx
cmovb rax, r8
ret
xor eax, eax
ret

Function at 0x1400451a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15d, dword [rcx]
lea rsi, [rdx + 8]
movsxd rbx, r8d
lea r13, [rcx + 8]
movabs r10, 0xaaaaaaaaaaaaaaab
mov r8d, 3
mov rax, r10
xor edi, edi
lea rbp, [rbx + r15]
mul rbp
mov rax, r10
shr rdx, 1
lea rcx, [rdx + rdx*2]
mov rdx, rbp
sub rdx, rcx
lea rcx, [r15*4 + 3]
sub r8d, edx
test rdx, rdx
cmove r8d, edi
mul rcx
movsxd rcx, r8d
lea rax, [rbx + 9]
shr rdx, 1
add rax, rdx
mov dword [r9], r8d
add rcx, rax
call fcn.14001cf70
mov r14, rax
test rax, rax
je 0x140045243
mov rcx, rbp
call fcn.14001cf70
mov rbp, rax
test rax, rax
jne 0x14004524a
mov rcx, r14
call fcn.14001cef0
xor eax, eax
jmp 0x140045365
test ebx, ebx
jle 0x14004525d
mov r8, rbx
mov dl, 0x41
mov rcx, rbp
mov edi, ebx
call sub.VCRUNTIME140.dll_memset
movsxd rdi, edi
mov r8, r15
mov rdx, r13
lea rcx, [rdi + rbp]
call sub.VCRUNTIME140.dll_memcpy
lea r8, [rdi + r15]
mov rdx, rbp
lea rbx, [r14 + 8]
lea r9, [r8 + rbp]
cmp r8, 3
jl 0x1400452f6
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
sub r8, 3
shr rax, 2
movzx eax, byte [rax + rsi]
mov byte [rbx], al
movzx ecx, byte [rdx]
movzx eax, byte [rdx + 1]
and ecx, 3
shr rax, 4
shl rcx, 4
or rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rbx + 1], al
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx + 2]
and ecx, 0xf
shr rax, 6
shl rcx, 2
or rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rbx + 2], al
movzx eax, byte [rdx + 2]
add rdx, 3
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov byte [rbx + 3], al
add rbx, 4
cmp r8, 3
jge 0x140045290
sub r9, rdx
je 0x140045351
movzx eax, byte [rdx]
shr rax, 2
movzx eax, byte [rax + rsi]
mov byte [rbx], al
movzx ecx, byte [rdx]
and ecx, 3
shl rcx, 4
cmp r9, 1
jne 0x140045323
movzx eax, byte [rcx + rsi]
mov byte [rbx + 1], al
mov al, 0x3d
jmp 0x140045340
movzx eax, byte [rdx + 1]
shr rax, 4
or rax, rcx
movzx eax, byte [rax + rsi]
mov byte [rbx + 1], al
movzx eax, byte [rdx + 1]
and eax, 0xf
movzx eax, byte [rsi + rax*4]
lea rcx, [rbx + 2]
mov rbx, rcx
mov byte [rcx], al
add rbx, 2
mov byte [rcx + 1], 0x3d
mov rcx, rbp
call fcn.14001cef0
sub ebx, r14d
mov rax, r14
sub ebx, 8
mov dword [r14], ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140045a28
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140045aac
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400557a0]
cmp byte [rcx + rax], 0
je 0x140045aac
dec r8
sub rdx, 1
jne 0x140045a92
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140046b78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140046bc2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140046bc2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140046bc2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140046bc2
cmp dword [rcx + 0x84], 0xe
jbe 0x140046bc2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140046bc4
xor al, al
add rsp, 0x28
ret