joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000ebc0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x128]
xor esi, esi
mov qword [0x1000463c0], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x24]
mov r8d, 0x104
xor ecx, ecx
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
and eax, eax
mov byte [rsp + rax + 0x24], 0
mov r8d, ebx
xor edx, edx
mov rcx, rsp
call fcn.10000eda0
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x1000463c0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x24]
call fcn.100001ba0
call sub.kernel32.dll_GetCommandLineA
mov qword [0x10002c2e0], rax
mov r14, rax
jmp 0x10000ed47
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x10000ec48
cmp byte [r14], 0
je 0x10000ed51
nop
xor dil, dil
mov r12, r14
xor ebx, ebx
jmp 0x10000ecb0
mov al, byte [r14]
cmp al, 1
jb 0x10000eca8
sub al, 0x20
jbe 0x10000ec84
sub al, 2
je 0x10000ec90
jmp 0x10000eca8
test dil, dil
je 0x10000ecb6
add ebx, 1
jmp 0x10000ecac
cmp byte [r14 + 1], 0x22
je 0x10000eca0
test dil, dil
sete dil
jmp 0x10000ecac
add r14, 1
jmp 0x10000ecac
add ebx, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x10000ec70
test esi, esi
je 0x10000ed44
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.10000eda0
xor dil, dil
mov r14, r12
mov rdx, qword [0x1000463c0]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x10000ed38
mov al, byte [r14]
cmp al, 1
jb 0x10000ed28
sub al, 0x20
jbe 0x10000ecfc
sub al, 2
je 0x10000ed10
jmp 0x10000ed28
test dil, dil
je 0x10000ed3e
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x10000ed34
cmp byte [r14 + 1], 0x22
je 0x10000ed20
test dil, dil
sete dil
jmp 0x10000ed34
add r14, 1
jmp 0x10000ed34
mov al, byte [r14]
mov byte [r13], al
add r13, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x10000ece8
mov byte [r13], 0
nop
add esi, 1
cmp byte [r14], 0
jne 0x10000ec4c
mov dword [0x1000463b0], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x1000463c0]
call fcn.10000c090
mov rax, qword [0x1000463c0]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x128]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x1000108a0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rsi
lea rsp, [rsp - 0x78]
mov rbx, rcx
mov rsi, rdx
mov rcx, rsi
xor r8d, r8d
mov edx, 0x20
call fcn.100001ea0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
lea rax, [rsi + 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rsi + 0xc]
mov qword [rsp + 0x40], rax
lea rax, [rsi + 8]
mov qword [rsp + 0x38], rax
lea rax, [rsi + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbx + 0x20]
xor r9, r9
xor r8, r8
xor edx, edx
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [rbx + 8], eax
test eax, eax
sete bl
jne 0x10001093c
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call sub.kernel32.dll_FileTimeToSystemTime
lea rcx, [rsp + 0x68]
call fcn.100024d20
movsd qword [rsi + 0x18], xmm0
nop
mov al, bl
nop
lea rsp, [rsp + 0x78]
pop rsi
pop rbx
ret
Function at 0x100010c80
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xb0]
mov qword [rbp - 0x68], rbx
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x60], 0
nop
mov qword [rbp - 0x58], 0
lea rdx, [0x10002fd00]
lea r9, [rbp - 0x58]
mov rcx, qword [rbp - 0x10]
mov r8d, 1
call fcn.1000081c0
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp - 8]
call fcn.1000108a0
test al, al
je 0x100010e18
cmp dword [rbp - 0x30], 0
jle 0x100010e18
mov eax, dword [rbp - 0x2c]
add eax, 1
mov dword [rbp - 0x34], eax
mov edx, eax
shl rdx, 1
lea rcx, [rbp - 0x40]
call fcn.10000ad80
nop
movsxd rax, dword [rbp - 0x30]
mov qword [rbp - 0x58], rax
lea rdx, [0x10002fd00]
lea r9, [rbp - 0x58]
mov rcx, qword [rbp - 0x10]
mov r8d, 1
call fcn.1000081c0
mov eax, dword [rbp - 0x30]
lea ebx, [eax - 1]
mov dword [rbp - 0x44], 0xffffffff
nop word [rax + rax]
add dword [rbp - 0x44], 1
mov eax, dword [rbp - 0x2c]
add eax, 1
mov dword [rbp - 0x34], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x20]
lea r9, [rbp - 0x34]
mov r8, qword [rbp - 0x40]
mov edx, dword [rbp - 0x44]
call sub.advapi32.dll_RegEnumKeyExW
mov dword [rbp - 0x48], eax
cmp eax, 0x103
je 0x100010e0c
nop
cmp dword [rbp - 0x48], 0
je 0x100010dcc
mov edx, dword [rbp - 0x48]
lea rcx, [rbp - 0x60]
call fcn.100028d20
mov r8, qword [rbp - 0x60]
mov edx, 1
lea rcx, [0x10002fa78]
call fcn.100027520
mov rcx, rax
lea rdx, [0x100010d96]
mov r8, rbp
call fcn.10000fb60
nop dword [rax]
cmp dword [rbp - 0x34], 0
jne 0x100010ddf
lea rcx, [rbp - 0x50]
xor edx, edx
call fcn.100006c50
jmp 0x100010dec
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x50]
call fcn.100006be0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov edx, dword [rbp - 0x44]
lea rcx, [rax + rdx*8]
mov rdx, qword [rbp - 0x50]
call fcn.100006c50
cmp ebx, dword [rbp - 0x44]
ja 0x100010d38
nop
mov rcx, rbp
call fcn.100010c30
nop dword [rax]
nop
mov rcx, rbp
call fcn.100010c50
mov rbx, qword [rbp - 0x68]
lea rsp, [rbp]
pop rbp
ret
Function at 0x100010e80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0xb0]
mov qword [rbp - 0x68], rbx
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x60], 0
nop
mov qword [rbp - 0x58], 0
lea rdx, [0x10002fd00]
lea r9, [rbp - 0x58]
mov rcx, qword [rbp - 0x10]
mov r8d, 1
call fcn.1000081c0
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp - 8]
call fcn.1000108a0
test al, al
je 0x100011018
cmp dword [rbp - 0x28], 0
jle 0x100011018
mov eax, dword [rbp - 0x24]
add eax, 1
mov dword [rbp - 0x34], eax
mov edx, eax
shl rdx, 1
lea rcx, [rbp - 0x40]
call fcn.10000ad80
nop
movsxd rax, dword [rbp - 0x28]
mov qword [rbp - 0x58], rax
lea rdx, [0x10002fd00]
lea r9, [rbp - 0x58]
mov rcx, qword [rbp - 0x10]
mov r8d, 1
call fcn.1000081c0
mov eax, dword [rbp - 0x28]
lea ebx, [eax - 1]
mov dword [rbp - 0x44], 0xffffffff
nop word [rax + rax]
add dword [rbp - 0x44], 1
mov eax, dword [rbp - 0x24]
add eax, 1
mov dword [rbp - 0x34], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x20]
lea r9, [rbp - 0x34]
mov r8, qword [rbp - 0x40]
mov edx, dword [rbp - 0x44]
call sub.advapi32.dll_RegEnumValueW
mov dword [rbp - 0x48], eax
cmp eax, 0x103
je 0x10001100c
nop
cmp dword [rbp - 0x48], 0
je 0x100010fcc
mov edx, dword [rbp - 0x48]
lea rcx, [rbp - 0x60]
call fcn.100028d20
mov r8, qword [rbp - 0x60]
mov edx, 1
lea rcx, [0x10002fa78]
call fcn.100027520
mov rcx, rax
lea rdx, [0x100010f96]
mov r8, rbp
call fcn.10000fb60
nop dword [rax]
cmp dword [rbp - 0x34], 0
jne 0x100010fdf
lea rcx, [rbp - 0x50]
xor edx, edx
call fcn.100006c50
jmp 0x100010fec
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x50]
call fcn.100006be0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov edx, dword [rbp - 0x44]
lea rcx, [rax + rdx*8]
mov rdx, qword [rbp - 0x50]
call fcn.100006c50
cmp ebx, dword [rbp - 0x44]
ja 0x100010f38
nop
mov rcx, rbp
call fcn.100010e30
nop dword [rax]
nop
mov rcx, rbp
call fcn.100010e50
mov rbx, qword [rbp - 0x68]
lea rsp, [rbp]
pop rbp
ret

Function at 0x100028430
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x50]
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
mov rsi, rcx
mov edi, edx
mov r12d, r8d
mov r13, r9
mov qword [rbp - 8], 0
nop
mov edx, r12d
mov ecx, edi
xor r9d, r9d
xor r8, r8
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
test ebx, ebx
jle 0x1000284b1
movsxd rdx, ebx
sub rdx, 1
lea rcx, [rbp - 8]
call fcn.100007090
cmp ebx, 1
jle 0x1000284a0
mov r8, qword [rbp - 8]
mov r9d, ebx
mov edx, r12d
mov ecx, edi
call sub.kernel32.dll_GetLocaleInfoW
mov ebx, eax
nop
mov rcx, rsi
mov rdx, qword [rbp - 8]
xor r8d, r8d
call fcn.100006a30
jmp 0x1000284bc
mov rcx, rsi
mov rdx, r13
call fcn.100004b50
nop
mov rcx, rbp
call fcn.100028410
mov rbx, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
lea rsp, [rbp]
pop rbp
ret
Function at 0x1000286a0
Capabilities:
Get geographical location

Disassembly:
push rbp
mov rbp, rsp
lea rsp, [rsp - 0x60]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0
nop
xor ebx, ebx
nop dword [rax]
add ebx, 1
mov eax, ebx
lea rdx, [0x100047e00]
lea rcx, [rdx + rax*8 - 8]
xor edx, edx
call fcn.100004b50
mov eax, ebx
lea rdx, [0x100047e40]
mov dword [rdx + rax*4 - 4], 0xffffffff
cmp ebx, 7
jl 0x1000286c0
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
lea r8, [rbp - 0xc]
mov ecx, esi
mov r9d, 0xb
mov edx, 0x100b
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x100028774
nop
mov byte [rsp + 0x20], 1
lea rdx, [rbp - 0xc]
xor r9d, r9d
mov r8d, 0xa
lea rcx, [rbp - 0x18]
call fcn.100005670
mov rcx, qword [rbp - 0x18]
mov edx, 1
call fcn.100021bc0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x100028774
lea rcx, [0x100028540]
mov r8d, ebx
mov edx, esi
mov r9d, 4
call sub.kernel32.dll_EnumCalendarInfoA
lea rcx, [0x1000285f0]
mov r8d, ebx
mov edx, esi
mov r9d, 3
call sub.kernel32.dll_EnumCalendarInfoA
nop dword [rax]
nop
mov rcx, rbp
call fcn.100028680
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea rsp, [rbp]
pop rbp
ret

Function at 0x100028e10
Capabilities:
Check os version

Disassembly:
lea rsp, [rsp - 0xb8]
mov qword [0x100047e80], 0
mov dword [rsp + 0x20], 0x94
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_GetVersionExA
mov eax, dword [rsp + 0x30]
mov dword [0x100047cc0], eax
mov eax, dword [rsp + 0x24]
mov dword [0x100047cd0], eax
mov eax, dword [rsp + 0x28]
mov dword [0x100047ce0], eax
mov eax, dword [rsp + 0x2c]
mov dword [0x100047cf0], eax
lea rdx, [0x100047d01]
lea rcx, [rsp + 0x34]
mov r8d, pe_nt_image_headers64
call fcn.100001ba0
lea rcx, [rsp + 0x34]
call fcn.100002900
mov byte [0x100047d00], al
lea rcx, str.kernel32
call sub.kernel32.dll_GetModuleHandleA
mov qword [0x100047e90], rax
test rax, rax
je 0x100028eb8
mov rcx, qword [0x100047e90]
lea rdx, str.GetDiskFreeSpaceExA
call sub.kernel32.dll_GetProcAddress
mov qword [0x100047e80], rax
nop
cmp dword [0x100047cd0], 6
jae 0x100028ecc
mov dword [0x10002cb90], 0
nop
cmp dword [0x100047cd0], 6
jb 0x100028ee8
cmp dword [0x100047ce0], 1
jb 0x100028ee8
mov dword [0x10002cba0], 2
nop
lea rsp, [rsp + 0xb8]
ret
Function at 0x140fae0f8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140fae102
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140fae12b
pop rbp
sub rbp, 0x33
sub rbp, 0x1ebe0f8
sub rsp, 0x20
jmp 0x140fae14a
mov rax, 0x1ebe0f8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xeed5f10
xor byte [rax], dl
inc rax
dec rcx
jne 0x140fae169
jmp 0x140fae180
pop rax
cdq
stc
wait
cdq
sub al, 0x10
adc byte [rax], dl
pop rax
xchg ecx, eax
rcr dword [rax], 1
adc dword [rax], edx
adc byte [rax + 0x11], bl
stc
pop rax
xlatb
rcr byte [rcx], 1
adc byte [rax], dl
adc byte [rax - 0x29], bl
sar byte [rax], cl
adc byte [rax], dl
adc byte [rax - 0x19], bl
pop rax
adc ecx, edx
wait
xchg ecx, eax
sbb al, 0x10
adc byte [rax], dl
pop rax
adc eax, edi
pop rax
test al, 0x74
invalid
Function at 0x141ec00b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141ec0237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141ec00e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141ec00c7
add dl, dl
jne 0x141ec00ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141ec014e
xor eax, eax
add dl, dl
jne 0x141ec00fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141ec0205
add dl, dl
jne 0x141ec010e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ec011b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ec0128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ec0135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141ec0142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141ec00d6
mov eax, 1
add dl, dl
jne 0x141ec015e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ec016b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141ec0153
sub eax, ebx
mov ebx, 1
jne 0x141ec01a4
mov ecx, 1
add dl, dl
jne 0x141ec0186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141ec0193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141ec017b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141ec00d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141ec01c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141ec01cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141ec01b5
cmp eax, 0x7d00
jae 0x141ec01f3
cmp eax, 0x500
jb 0x141ec01ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141ec00d6
cmp eax, 0x7f
ja 0x141ec01f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141ec00d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141ec022a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141ec00d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140000650
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rcx
mov r9d, 0x12345678
xor r10d, r10d
nop dword [rax]
movzx eax, byte [r10 + r11]
test al, al
je 0x1400006a5
lea ecx, [rax + 0x20]
lea r8d, [rax - 0x41]
movzx edx, cl
cmp r8b, 0x19
cmova edx, eax
inc r10
movsx eax, dl
xor eax, r9d
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0xe
xor eax, ecx
shr eax, 7
xor eax, ecx
imul r9d, eax, 0x27d4eb2d
cmp r10, 0x1000
jb 0x140000660
mov eax, r9d
shl eax, 0xd
xor r9d, eax
mov eax, r9d
shr eax, 7
add r9d, eax
mov eax, r9d
shl eax, 0xf
xor eax, r9d
ret

Function at 0x1400006d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x120
mov edi, ecx
call fcn.140000ba2
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
nop
mov rcx, qword [r11 + 0x50]
xor eax, eax
add rcx, 4
nop word [rax + rax]
movzx edx, word [rcx - 4]
test dx, dx
je 0x140000767
mov byte [rsp + rax + 0x20], dl
movzx edx, word [rcx - 2]
test dx, dx
je 0x140000764
mov byte [rsp + rax + 0x21], dl
movzx edx, word [rcx]
test dx, dx
je 0x14000075e
mov byte [rsp + rax + 0x22], dl
movzx edx, word [rcx + 2]
test dx, dx
je 0x140000758
mov byte [rsp + rax + 0x23], dl
movzx edx, word [rcx + 4]
test dx, dx
je 0x140000752
mov byte [rsp + rax + 0x24], dl
add rcx, 0xa
add rax, 5
cmp rax, 0xff
jb 0x140000700
jmp 0x140000767
add rax, 4
jmp 0x140000767
add rax, 3
jmp 0x140000767
add rax, 2
jmp 0x140000767
inc rax
mov byte [rsp + rax + 0x20], 0
mov r9d, 0x12345678
xor r10d, r10d
movzx r8d, byte [rsp + r10 + 0x20]
test r8b, r8b
je 0x1400007bd
lea eax, [r8 + 0x20]
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r10
movsx eax, cl
xor eax, r9d
imul ecx, eax, 0x1000193
mov eax, ecx
shr eax, 0xe
xor eax, ecx
shr eax, 7
xor eax, ecx
imul r9d, eax, 0x27d4eb2d
cmp r10, 0x1000
jb 0x140000775
mov eax, r9d
shl eax, 0xd
xor r9d, eax
mov eax, r9d
shr eax, 7
add r9d, eax
mov eax, r9d
shl eax, 0xf
xor eax, r9d
cmp eax, edi
je 0x1400007fb
mov r11, qword [r11]
cmp r11, rbx
jne 0x1400006f0
xor eax, eax
mov rbx, qword [rsp + 0x130]
add rsp, 0x120
pop rdi
ret
mov rax, qword [r11 + 0x20]
mov rbx, qword [rsp + 0x130]
add rsp, 0x120
pop rdi
ret
Function at 0x180001dd0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
xor ecx, ecx
mov r8d, 0x20
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
cmp eax, 0xc0000000
jb 0x180001e70
mov ebx, eax
xor ebx, 0x80000000
je 0x180001e70
mov rcx, qword [0x18003bb58]
test rcx, rcx
jne 0x180001e3e
call sub.KERNEL32.dll_GetProcessHeap
test rax, rax
je 0x180001f3e
mov rcx, rax
mov qword [0x18003bb58], rax
mov r8d, 4
xor edx, edx
call sub.KERNEL32.dll_HeapAlloc
test rax, rax
je 0x180001f3e
mov dword [rax], ebx
mov rcx, qword [0x18003bb58]
xor edx, edx
mov r8, rax
call fcn.180018e4d
mov rcx, qword [rdi + 0x30]
jmp 0x180001f14
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [0x18003bbd8]
test rax, rax
je 0x180001ec2
test eax, 0x4000
jne 0x180001ece
mov rax, qword [rsp + 0x50]
movups xmm0, xmmword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
jmp 0x180001ee9
call fcn.180026bb0
test eax, 0x4000
je 0x180001e9a
lea r8, [0x18002d138]
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x50]
call fcn.180006570
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rdi + 0x28], rcx
movups xmm0, xmmword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov qword [rdi + 0x18], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rdi + 0x20], rcx
movups xmmword [rdi + 8], xmm0
mov rcx, qword [rdi + 0x30]
mov qword [rdi], rax
mov qword [rdi + 0x40], 0
add rcx, 0xffffffffffffff00
mov qword [rdi + 0x38], rcx
mov rcx, rdi
mov rdx, rsi
call fcn.1800065a0
nop
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
mov ecx, 4
mov edx, 4
call fcn.180026270
ud2
Function at 0x180003ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r11, rdx
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rdi, r11
movzx esi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rsi]
cmp byte [rdi], bpl
jne 0x180003b60
cmp r10, rax
jb 0x180003bd4
cmp r10, rdx
ja 0x180003be8
add rax, r9
xor edi, edi
nop
cmp rsi, rdi
je 0x180003b62
lea rbx, [rdi + 1]
cmp byte [rax + rdi], cl
mov rdi, rbx
jne 0x180003b40
jmp 0x180003bc3
ja 0x180003b6a
mov rax, r10
cmp r11, r8
jne 0x180003b12
add r14, r15
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
nop dword [rax]
lea rbx, [r15 + 1]
movzx edx, byte [r15]
test dl, dl
js 0x180003ba0
mov r15, rbx
sub ecx, edx
jns 0x180003bba
jmp 0x180003bc5
cmp rbx, r14
je 0x180003bf9
and edx, 0x7f
shl edx, 8
movzx ebp, byte [r15 + 1]
add r15, 2
or edx, ebp
sub ecx, edx
js 0x180003bc5
xor al, 1
cmp r15, r14
jne 0x180003b80
jmp 0x180003bc5
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea r8, str.C:ujincehaeapufzvmisckkfuxrmgtogmicylowfngigfwinvddcojboupkwaxbbetckopvpwkuttdnpnxnwlsahksgdqlxlkklsjibhfbkefrqnhqqjdfdijtbwkkycnjb
mov rcx, rax
mov rdx, r10
call fcn.180026490
ud2
lea r8, str.C:ujincehaeapufzvmisckkfuxrmgtogmicylowfngigfwinvddcojboupkwaxbbetckopvpwkuttdnpnxnwlsahksgdqlxlkklsjibhfbkefrqnhqqjdfdijtbwkkycnjb
mov rcx, r10
call fcn.1800263c0
ud2
lea rcx, str.called__Option::unwrap____on_a__None__valuestack_backtrace:_n
lea r8, str.C:ujincehaeapufzvmisckkfuxrmgtogmicylowfngigfwinvddcojboupkwaxbbetckopvpwkuttdnpnxnwlsahksgdqlxlkklsjibhfbkefrqnhqqjdfdijtbwkkycnjb
mov edx, 0x2b
call fcn.180026440
ud2
Function at 0x180018740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
sub rsp, 0x38
movsxd rax, dword [rcx + 0x3c]
mov r15, rdx
mov rbp, rcx
mov r8d, dword [rax + rcx + 0x88]
test r8d, r8d
jne 0x180018769
xor eax, eax
add rsp, 0x38
pop r15
pop rbp
ret
mov qword [rsp + 0x58], rsi
lea rax, [r8 + rcx]
mov esi, dword [rax + 0x20]
xor ecx, ecx
mov qword [rsp + 0x60], rdi
add rsi, rbp
mov qword [rsp + 0x30], r12
mov edi, ecx
mov r12d, dword [rax + 0x1c]
mov qword [rsp + 0x28], r13
add r12, rbp
mov r13d, dword [rax + 0x18]
mov qword [rsp + 0x20], r14
mov r14d, dword [rax + 0x24]
add r14, rbp
test r13, r13
je 0x180018825
mov qword [rsp + 0x50], rbx
nop dword [rax]
mov ebx, dword [rsi]
mov rcx, r15
call fcn.180018e30
mov r10, rax
add rbx, rbp
je 0x18001880e
test r15, r15
je 0x18001880e
xor r9d, r9d
test rax, rax
je 0x180018809
mov r8, r15
mov rcx, rbx
sub r8, rbx
nop dword [rax + rax]
movzx eax, byte [rcx]
cmp al, byte [r8 + rcx]
jb 0x180018803
ja 0x1800187fb
inc rcx
mov rax, rcx
sub rax, rbx
cmp rax, r10
jb 0x1800187e0
jmp 0x180018809
mov r9d, 1
jmp 0x180018809
mov r9d, 0xffffffff
test r9d, r9d
je 0x18001881e
inc rdi
add rsi, 4
add r14, 2
cmp rdi, r13
jb 0x1800187b0
mov rbx, qword [rsp + 0x50]
xor ecx, ecx
movzx eax, word [r14]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
cmp cx, ax
jae 0x180018846
lea r12, [r12 + rax*4]
mov eax, dword [r12]
mov r12, qword [rsp + 0x30]
add rax, rbp
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x180018860
Capabilities:
Access peb ldr_data

Disassembly:
mov r9, qword gs:[0x60]
mov r10, rcx
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov r8, qword [rdx + 0x20]
test r8, r8
je 0x1800188ad
lea rcx, [fcn.180018860]
nop dword [rax]
mov rdx, qword [r8 + 0x20]
cmp rcx, rdx
jb 0x1800188a5
mov eax, dword [r8 + 0x30]
add rax, rdx
cmp rcx, rax
jbe 0x1800188af
mov r8, qword [r8]
test r8, r8
jne 0x180018890
xor edx, edx
mov rcx, qword [r9 + 0x18]
add rcx, 0x20
mov rax, qword [rcx]
cmp rax, rcx
je 0x1800188ce
nop
cmp qword [rax + 0x20], rdx
je 0x1800188d1
mov rax, qword [rax]
cmp rax, rcx
jne 0x1800188c0
xor eax, eax
ret
mov qword [rax + 0x20], r10
mov eax, 1
ret
Function at 0x1800209b0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800209e0
xor eax, eax
jmp 0x180020aa3
mov rbp, rbx
cmp word [rax], si
je 0x180020a05
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800209ec
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800209e8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180020900
movsxd r14, eax
test eax, eax
jne 0x180020a43
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800209d9
mov rcx, r14
call fcn.18001e254
mov rdi, rax
test rax, rax
jne 0x180020a5c
xor ecx, ecx
call fcn.18001ef68
jmp 0x180020a38
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180020900
test eax, eax
jne 0x180020a8d
mov rcx, rdi
call fcn.18001ef68
jmp 0x180020a97
xor ecx, ecx
call fcn.18001ef68
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret