joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d910
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140016c60], rbx
je 0x14000d977
cmp rax, rbx
jne 0x14000d96a
mov ebx, 1
mov esi, ebx
jmp 0x14000d97c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000d94f
mov ebx, 1
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000d994
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000da00
mov eax, dword [0x140016c68]
test eax, eax
jne 0x14000d9f5
mov dword [0x140016c68], ebx
lea r15, [0x140010bb8]
lea rdi, [0x140010ba0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000d9e7
test eax, eax
jne 0x14000d9eb
cmp qword [rdi], r14
je 0x14000d9dc
mov rax, qword [rdi]
mov rcx, qword [0x140010b58]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000d9be
test eax, eax
je 0x14000d9fb
mov eax, 0xff
jmp 0x14000db56
mov dword [0x1400163e4], ebx
mov edi, 0x1f
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000da27
lea rdx, [0x140010b98]
lea rcx, [0x140010b60]
call sub.msvcrt.dll__initterm
mov dword [0x140016c68], 2
test esi, esi
jne 0x14000da35
mov rax, r14
xchg qword [0x140016c60], rax
cmp qword [0x140016c80], r14
je 0x14000da68
lea rcx, [0x140016c80]
call fcn.14000dfd0
test eax, eax
je 0x14000da68
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140016c80]
mov r9, qword [0x140010b58]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000da81
mov eax, 0xff
jmp 0x14000db56
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000db07
test ax, ax
je 0x14000da9c
test edx, edx
jne 0x14000db07
sub ax, bx
cmp ax, di
ja 0x14000dab2
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000da9c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400019fc
mov dword [0x1400163e0], eax
cmp dword [0x140016400], r14d
jne 0x14000daf0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400163e4], r14d
jne 0x14000db05
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400163e0]
jmp 0x14000db56
cmp ax, 0x22
jne 0x14000db1b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000da8a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140146000
add rsp, 0x28
jmp 0x14000d910
Function at 0x18000dec0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x18000dee5
cmp rax, rcx
je 0x18000deeb
cmp rdx, 4
jae 0x18000deef
xor eax, eax
xor r8d, r8d
jmp 0x18000df80
pop rbp
jmp fcn.180002e30
xor eax, eax
pop rbp
ret
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x18006d3f0]
movdqa xmm3, xmmword [0x18006d400]
pxor xmm1, xmm1
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x18000df10
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x18000df97
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x18000df80
pop rbp
ret
Function at 0x1800132d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x180076a98]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x180013341
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x18001336e
test eax, eax
js 0x18001334d
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x180013364
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, [0x180076af8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.180012940
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.180012ad0
mov ecx, 7
int 0x29
ud2
Function at 0x180019230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov qword [rbp - 0x20], rcx
movzx r15d, byte [rdx + 0x18]
mov byte [rdx + 0x18], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 2
mov qword [rbp - 8], 0
mov r12, qword [rdx + 8]
movzx esi, word [rdx + 0x10]
mov eax, 2
xor edi, edi
xor r13d, r13d
jmp 0x18001929c
Function at 0x1800194e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
movdqa xmmword [rbp - 0x10], xmm6
mov rdi, r8
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov rbx, qword [rsi + 0x10]
xor r14d, r14d
mov eax, 0
cmp rbx, 3
jb 0x180019551
movzx r8d, byte [rbx + rcx - 2]
mov r9d, r8d
and r9b, 0xf0
xor r14d, r14d
cmp r9b, 0xa0
jne 0x180019551
xor r14d, r14d
cmp byte [rbx + rcx - 3], 0xed
jne 0x180019551
movzx r14d, byte [rbx + rcx - 1]
and r8d, 0xf
and r14d, 0x3f
shl r8d, 0x10
shl r14d, 0xa
or r14d, r8d
mov al, 1
cmp rdi, 3
jb 0x18001962c
cmp byte [rdx], 0xed
jne 0x180019635
movzx r15d, byte [rdx + 1]
mov r8d, r15d
and r8b, 0xf0
cmp r8b, 0xb0
setne r8b
xor al, 1
or al, r8b
jne 0x180019635
cmp rbx, 3
jb 0x180019591
add rbx, 0xfffffffffffffffd
mov qword [rsi + 0x10], rbx
movzx r12d, byte [rdx + 2]
shl r15d, 6
lea r8, [rdi + 1]
mov rax, qword [rsi]
mov rcx, rax
sub rcx, rbx
cmp rcx, r8
jb 0x18001971f
and r15d, 0x3c0
or r15d, r14d
or r12d, r15d
lea r8d, [r12 + 0x10000]
mov r9d, r8d
shr r9d, 0x12
shr r8d, 4
and r8d, 0xff00
or r8d, r9d
shl r15d, 0xa
and r15d, 0xff0000
or r15d, r8d
shl r12d, 0x18
or r12d, r15d
movd xmm6, r12d
pand xmm6, xmmword [0x18006d4d0]
por xmm6, xmmword [0x18006d4e0]
cmp rcx, 3
stc
add ecx, dword [rdi]
xchg byte [rbx + 1], al
add byte [rax], al
add rdx, 3
mov rcx, qword [rsi + 8]
movd dword [rcx + rbx], xmm6
add rbx, 4
mov qword [rsi + 0x10], rbx
add rdi, 0xfffffffffffffffd
jmp 0x1800196c3
test rdi, rdi
je 0x1800196c0
lea rax, [rdx + rdi]
mov r9, rdx
jmp 0x180019658
add r9, 2
cmp r8, rax
cmovne r8, r9
nop dword [rax]
invalid
add byte [rax], 0
add byte [rax], al
mov r9, r8
cmp r8, rax
je 0x1800196c0
lea r8, [r9 + 1]
movzx r10d, byte [r9]
test r10b, r10b
jns 0x180019650
cmp r10b, 0xe0
jb 0x18001963e
cmp r10b, 0xed
jne 0x18001968f
cmp r8, rax
je 0x1800196c0
lea r8, [r9 + 2]
cmp r8, rax
je 0x1800196c0
cmp byte [r9 + 1], 0x9f
ja 0x1800196bc
add r9, 3
mov r8, r9
jmp 0x180019650
add r9, 2
cmp r8, rax
cmove r9, r8
xor r8d, r8d
cmp r9, rax
setne r8b
add r8, r9
cmp r10b, 0xf0
jb 0x180019650
xor r9d, r9d
cmp r8, rax
setne r9b
add r8, r9
jmp 0x180019650
mov byte [rsi + 0x18], 0
mov rax, qword [rsi]
sub rax, rbx
cmp rax, rdi
jb 0x1800196f2
add rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
mov qword [rsi + 0x10], rbx
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r14, rdx
mov rdx, rbx
mov r8, rdi
call fcn.18006a960
mov rdx, r14
mov rcx, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
jmp 0x1800196cb
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r13, rdx
mov rdx, rbx
call fcn.18006a960
mov rdx, r13
mov rax, qword [rsi]
mov rbx, qword [rsi + 0x10]
mov rcx, rax
sub rcx, rbx
jmp 0x1800195b0
mov qword [rsp + 0x20], 1
mov r8d, 4
mov r9d, 1
mov rcx, rsi
mov r14, rdx
mov rdx, rbx
call fcn.18006a960
mov rdx, r14
mov rax, qword [rsi]
mov rbx, qword [rsi + 0x10]
jmp 0x18001960e
Function at 0x180019ba0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
lea ebp, [rsp + 0x80]

Function at 0x18001b490
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
lea ebp, [rsp + 0x70]
mov r8, rdx
Function at 0x1800258e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x90
lea rbp, [rsp + 0x80]
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x40]
call fcn.180017f80
mov rax, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x38]
mov rcx, rax
neg rcx
jno 0x18002592d
mov qword [rbp - 0x20], rdi
movabs rax, 0x8000000000000000
mov qword [rbp - 0x28], rax
jmp 0x18002595e
mov rcx, qword [rbp - 0x30]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x58]
call fcn.1800257f0
mov rbx, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x20]
mov rax, rbx
neg rax
jno 0x1800259e5
mov eax, edi
and eax, 3
cmp eax, 1
jne 0x1800259ca
lea rax, [rdi - 1]
mov qword [rbp - 0x10], rax
mov rax, qword [rdi - 1]
mov qword [rbp - 8], rax
mov rax, qword [rdi + 7]
mov qword [rbp], rax
mov rax, qword [rax]
test rax, rax
je 0x18002598e
mov rcx, qword [rbp - 8]
call rax
mov r8, qword [rbp - 8]
mov rax, qword [rbp]
cmp qword [rax + 8], 0
je 0x1800259b7
cmp qword [rax + 0x10], 0x11
jb 0x1800259a8
mov r8, qword [r8 - 8]
mov rcx, qword [0x182093f98]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x182093f98]
xor edx, edx
mov r8, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movabs rax, 0x8000000000000000
mov qword [rsi], rax
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov r14, qword [rbp - 0x18]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180025a04
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r14
jmp 0x1800259d7
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
je 0x1800259d7
mov rcx, qword [0x182093f98]
xor edx, edx
mov r8, rdi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x18002b410
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rdi, rdx
cmp qword [rdx], 0
jne 0x18002b504
mov rsi, rcx
mov rbx, qword [rdi + 0x18]
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
cmp r8, rdx
je 0x18002b4ca
sub r8, rdx
add rdx, qword [rbx + 8]
mov rax, qword [rdi + 0x10]
mov ecx, 0xffffffff
cmp r8, rcx
cmovae r8, rcx
mov dword [rbp - 0x28], 0
mov rcx, qword [rdi + 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18002b485
mov eax, dword [rbp - 0x28]
mov ecx, 2
test rax, rax
jne 0x18002b49c
jmp 0x18002b4a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x18002b4a9
cmp eax, 0x3e5
jne 0x18002b4ba
mov ecx, 1
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov byte [rsi + 1], 1
jmp 0x18002b4ad
mov byte [rsi + 1], 0
xor eax, eax
mov byte [rsi], al
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov al, 1
jmp 0x18002b4af
test r8, r8
mov ecx, 0x10
mov eax, 1
cmove rax, rcx
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rbx
mov rdx, r8
mov r8, rax
call fcn.18006a960
mov r8, qword [rbx]
mov rdx, qword [rbx + 0x10]
jmp 0x18002b441
mov qword [rbp - 0x28], 0
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.18006ac00
int3
Function at 0x180038950
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x180038992
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x18003899a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1800389ab
jmp 0x1800389c2
xor r10d, r10d
jmp 0x180038a4d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1800389c2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1800389d9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1800389f9
add r11, r8
jmp 0x180038b29
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x180038ac2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x180038a70
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x180038adf
mov r9d, dword [rdx + r10]
mov r8d, 4
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jb 0x180038af0
jmp 0x180038b0b
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x180038b0b
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x180038b25
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x18003cd50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rbx, qword [rcx]
mov rdi, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rbx, 0x20
jb 0x18003ce38
mov r8, qword [rcx + 8]
mov r10, qword [rcx + 0x20]
mov rdx, r8
mov r9, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov rax, r9
rol rax, 0xc
mov r11, rcx
rol r11, 7
add r11, rax
rol r8, 1
mov rax, r10
imul rdx, rbp
imul rcx, rbp
imul r9, rbp
imul r10, rbp
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
add r11, r8
rol rcx, 0x1f
imul rdx, rsi
imul rcx, rsi
rol r9, 0x1f
movabs rax, 0x85ebca77c2b2ae63
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r9, rsi
imul r10, rsi
sub r11, r15
xor r11, rcx
imul r11, rsi
sub r11, r15
xor r11, r9
imul r11, rsi
sub r11, r15
xor r11, r10
imul r11, rsi
add rax, r11
jmp 0x18003ce3f
mov rax, qword [rcx + 0x18]
add rax, r14
add rax, rbx
lea r8, [rdi + 0x28]
and ebx, 0x1f
cmp rbx, 8
jb 0x18003ce87
mov edx, ebx
shr rdx, 3
imul rcx, rdx, 0xfffffffffffffff8
add rbx, rcx
nop dword [rax]
mov rcx, qword [r8]
add r8, 8
imul rcx, rbp
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
sub rdx, 1
jne 0x18003ce60
movabs r9, 0x165667b19e3779f9
cmp rbx, 4
jb 0x18003ceb4
mov edx, dword [r8]
add r8, 4
imul rdx, rsi
xor rax, rdx
rol rax, 0x17
imul rax, rbp
add rax, r9
sub rbx, 4
test rbx, rbx
je 0x18003cedd
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
sub rbx, 1
jne 0x18003cec0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r9
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret
Function at 0x1400161a0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
call fcn.140021c40
test rax, rax
je 0x1400161be
call fcn.140021ff0
mov rbx, qword [rax + 0x90]
jmp 0x1400161c0
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400161eb
mov dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x14001cf70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140108480]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [0x140108a28]
mov edi, edx
mov esi, ecx
mov rbx, rax
cmp byte [rax + 0x4df5], 0
jne 0x14001cfdb
cmp byte [rax + 0x4df6], 0
jne 0x14001cfdb
movsx r9d, word [rax + 0x6020]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140022d00
test sil, 2
je 0x14001d120
jmp 0x14001d081
movss xmm0, dword [rax + 0x3a10]
mov ecx, dword [rax + 0x4ac0]
movaps xmm1, xmm0
mulss xmm1, dword [0x14007a1b4]
mulss xmm0, dword [0x14007a1a8]
addss xmm1, dword [rax + 0xe0]
addss xmm0, dword [rax + 0xe4]
test cl, 1
jne 0x14001d044
or ecx, 1
mov dword [rax + 0x4ac0], ecx
movss dword [rax + 0x4ad0], xmm1
movss dword [rax + 0x4ad4], xmm0
xor eax, eax
mov qword [rbx + 0x4ad8], rax
mov dword [rbx + 0x4ac4], 1
mov rax, qword [0x140108a28]
movss xmm0, dword [rbx + 0x3a6c]
lea r8, str.Tooltip__02d
mulss xmm0, dword [0x14007a15c]
lea rcx, [rsp + 0x20]
or dword [rax + 0x4ac0], 0x40
mov edx, 0x10
movss dword [rax + 0x4b20], xmm0
movsx r9d, word [rbx + 0x6020]
call fcn.140022d00
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001d0d1
lea r11, [0x1400781a0]
cmp r9b, 0x23
jne 0x14001d0b4
cmp byte [r8], r9b
jne 0x14001d0b4
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001d0a1
not ecx
call fcn.140021340
test rax, rax
je 0x14001d120
cmp byte [rax + 0xca], 0
je 0x14001d120
mov byte [rax + 0xcf], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd2], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xec], 1
mov edx, 0x10
inc word [rbx + 0x6020]
movsx r9d, word [rbx + 0x6020]
call fcn.140022d00
or edi, 0x2030347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.14001a240
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140072d70
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400212a0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140108a28]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140021303
mov qword [rsp], rbx
lea rbx, [0x1400781a0]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400212e3
cmp byte [r8], r9b
jne 0x1400212e3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400212d0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x60e8]
not eax
mov r8, qword [r10 + 0x60f0]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14002132f
cmp dword [r8 + 8], eax
je 0x140021336
add r8, 0x48
cmp r8, rcx
jne 0x140021320
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x1400213c0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x140021410
lea r11, [0x1400781a0]
cmp r9b, 0x23
jne 0x1400213f3
cmp byte [r8], r9b
jne 0x1400213f3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400213e0
not ecx
jmp fcn.140021340

Function at 0x140021cd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x1400781a0]
movsxd rcx, dword [rcx + 0x108]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0x110]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x40fc], ebx
jne 0x140021d67
movsxd r8, edx
xor r9d, r9d
mov edx, 4
mov ecx, ebx
call fcn.14001ec30
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret