joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056cc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 1
mov qword [rbp - 8], 0
test rdx, rdx
je 0x140056e9f
mov rdi, rdx
lea rcx, [rbp - 0x18]
xor edx, edx
mov r8, rdi
call fcn.14008c090
movabs r12, 0x2d358dccaa6c78a5
movabs r13, 0x8bb84b93962eacc9
mov r15d, 0x3e
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Users_swizzer_.cargo_registry_src_index.crates.io_6f17d22bba15001f_lettre_0.11.7_src_transport_smtp_pool_sync_impl.rs
jmp 0x140056d58
mov rax, qword [rbp - 0x10]
mov byte [rax + r14], bl
inc r14
mov qword [rbp - 8], r14
dec rdi
je 0x140056e9f
call fcn.140057170
mov r14, rax
cmp qword [rax], 0
je 0x140056d80
mov r9, r14
add r9, 8
mov rcx, qword [r14 + 8]
jmp 0x140056dab
call fcn.140057190
mov rcx, rdx
test rax, rax
movabs rax, 0xef6f79ed30ba75a
cmove rcx, rax
mov r9, r14
add r9, 8
mov qword [r14], 1
mov qword [r14 + 8], rcx
lea r10, [rcx + r12]
mov rax, r10
xor rax, r13
mul r10
mov r8, rdx
xor r8, rax
mov rax, r8
mul r15
lea rax, [r8 + r8]
shl r8, 6
sub r8, rax
cmp r8, 0xf
ja 0x140056e1b
movabs rax, 0x5a6b1b9954d8f14a
add rcx, rax
nop word cs:[rax + rax]
add r10, r12
mov rax, rcx
xor rax, r13
mul rcx
xor rdx, rax
mov r8, rdx
shl r8, 6
sub r8, rdx
sub r8, rdx
add rcx, r12
cmp r8, 0x10
jb 0x140056df0
mov rax, rdx
mul r15
movzx ebx, byte [rdx + rsi]
mov qword [r9], r10
test bl, bl
js 0x140056e50
mov r14, qword [rbp - 8]
cmp r14, qword [rbp - 0x18]
jne 0x140056d40
lea rcx, [rbp - 0x18]
call fcn.14004d810
jmp 0x140056d40
mov rax, qword [rbp - 0x18]
mov r14, qword [rbp - 8]
sub rax, r14
cmp rax, 1
ja 0x140056e77
mov r8d, 2
lea rcx, [rbp - 0x18]
mov rdx, r14
call fcn.14008c090
mov r14, qword [rbp - 8]
mov eax, ebx
shr al, 6
or al, 0xc0
and bl, 0xbf
mov rcx, qword [rbp - 0x10]
mov byte [rcx + r14], al
mov byte [rcx + r14 + 1], bl
add r14, 2
mov qword [rbp - 8], r14
dec rdi
jne 0x140056d58
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x20]
mov qword [rax + 0x10], rcx
mov rcx, qword [rbp - 0x18]
mov qword [rax], rcx
mov rcx, qword [rbp - 0x10]
mov qword [rax + 8], rcx
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140056f80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140056fc2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140056fca
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140056fdb
jmp 0x140056ff2
xor r10d, r10d
jmp 0x14005707d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140056ff2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140057009
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140057029
add r11, r8
jmp 0x14005715b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400570f2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400570a0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140057110
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140057122
jmp 0x14005713d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14005713d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140057157
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14005f7b0
Capabilities:
Get hostname

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp - 4], 0
lea r8, [rbp - 4]
mov ecx, 5
xor edx, edx
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
jne 0x14005f806
call fcn.140084fa0
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], edx
mov qword [rbp - 0x38], 1
test rax, rax
je 0x14005f806
lea rcx, [rbp - 0x30]
call fcn.140084fc0
mov ebx, dword [rbp - 4]
test rbx, rbx
mov qword [rbp - 0x10], rbx
je 0x14005f838
lea rdi, [rbx + rbx]
movzx eax, byte [0x1400ebd19]
mov edx, 2
mov rcx, rdi
call fcn.140013c30
test rax, rax
je 0x14005f8cf
mov rdx, rax
jmp 0x14005f83d
mov edx, 2
lea r8, [rbp - 4]
mov ecx, 5
mov qword [rbp - 0x18], rdx
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
je 0x14005f876
mov r8d, dword [rbp - 4]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp - 0x18]
call case.0x14002f09b.169
movups xmm0, xmmword [rbp - 0x38]
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
jmp 0x14005f8a9
call fcn.140084fa0
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], edx
shl rdx, 0x20
or rdx, 2
mov qword [rsi + 8], rdx
movabs rcx, 0x8000000000000000
mov qword [rsi], rcx
test rax, rax
je 0x14005f8a9
lea rcx, [rbp - 0x38]
call fcn.140084fc0
mov rdx, qword [rbp - 0x10]
test edx, edx
mov rcx, qword [rbp - 0x18]
je 0x14005f8c3
add rdx, rdx
mov r8d, 2
call fcn.140013c40
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov ecx, 2
mov rdx, rdi
call fcn.14008d3a0
int3

Function at 0x140066c70
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
mov r8d, dword [rdx + 0x80]
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x140066c9a
call fcn.140039c00
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x140068e70
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rdx, rcx
cmp rdx, 0x20
jae 0x140068e83
pop rbp
jmp fcn.140043b40
nop
pop rbp
jmp fcn.140043620
Function at 0x14008c910
Capabilities:
Resolve dns

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov r14, r9
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.14003dba0
mov rdx, qword [rbp - 0x28]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x14008c999
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x60], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x58], 1
mov qword [rbp - 8], 0
lea r8, [rbp - 0x60]
lea r9, [rbp - 8]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x14008c9cc
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x14008c9e0
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x14008ca00
mov rcx, qword [rbp - 0x20]
mov r8d, 1
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.140013c40
mov rcx, qword [r14]
mov rax, qword [rbp - 8]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x14008ca00
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140013c40
nop
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x140004390
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov rax, qword [0x140042140]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14, rcx
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov r8d, edx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbp, rax
test rax, rax
je 0x140004547
lea r9, [rsp + 0x20]
mov r8d, 8
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140004547
mov ecx, dword [rsp + 0x20]
shr rcx, 3
mov eax, 8
mul rcx
mov rsi, rax
mov rax, 0xffffffffffffffff
cmovb rsi, rax
mov rcx, rsi
call fcn.140024990
mov rdi, rax
test rax, rax
je 0x14000443a
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x14000443d
mov rdi, rbx
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, rdi
mov rcx, rbp
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x14000453a
mov eax, dword [rsp + 0x20]
test rax, 0xfffffffffffffff8
jbe 0x14000453a
mov rsi, rdi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.msvcrt.dll_memset
mov r9d, 0x208
lea r8, [rsp + 0x60]
mov rdx, qword [rsi]
mov rcx, rbp
call sub.KERNEL32.dll_K32GetModuleFileNameExW
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.1400020f0
nop
mov rax, qword [rsp + 0x48]
lea r8, [rax + rax]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rdx, qword [rsp + 0x38]
mov rcx, r14
call fcn.1400050a0
mov r8d, 2
lea rdx, [0x140033a90]
mov rcx, r14
call fcn.1400050a0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x140004520
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000451b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000456f
call fcn.140024988
inc ebx
add rsi, 8
mov ecx, dword [rsp + 0x20]
shr rcx, 3
movsxd rax, ebx
cmp rax, rcx
jb 0x140004472
test rdi, rdi
je 0x140004547
mov rcx, rdi
call fcn.140024988
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140024ab0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140028790
nop
int3
Function at 0x1400068e0
Capabilities:
Patch process command line

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140042140]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, rcx
mov rsi, rdx
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14000692f
mov eax, 0xffffd8e7
jmp 0x140006a06
mov rcx, qword [rsi]
lea r8, [rsp + 0x40]
mov qword [rsp + 0xb0], rbx
mov r9d, 0x30
xor edx, edx
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0x20], 0
call rdi
mov r14d, 2
mov ebx, eax
mov ecx, r14d
call fcn.140028970
mov rcx, rax
lea rdx, str.QueryProcess_info_pointer_:__p__ret_:__d_n
mov r9d, ebx
mov r8, rdi
call fcn.140007130
test ebx, ebx
js 0x1400069c0
mov rdx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov rcx, qword [rsi]
lea r8, [rsp + 0x30]
add rdx, 0x10
mov qword [rsp + 0x20], rax
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rsp + 0x30]
add rdi, qword [rbp + 0x58]
mov qword [rbp + 0x58], rdi
lea rbp, str.ProcessID_:__u__EntryPoint_1_:__p_n
jmp 0x1400069d3
mov rdi, qword [rbp + 0x50]
add rdi, qword [rbp + 0x58]
mov qword [rbp + 0x58], rdi
lea rbp, str.ProcessID_:__u__EntryPoint_0_:__p_n
mov ebx, 0x10
mov ecx, r14d
mov ebx, dword [rsi + rbx]
call fcn.140028970
mov rcx, rax
mov r9, rdi
mov r8d, ebx
mov rdx, rbp
call fcn.140007130
mov r14, qword [rsp + 0xb8]
xor eax, eax
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140024ab0
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011c60
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140042140]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, r9
mov rax, r8
mov rsi, rdx
mov r14, rcx
mov qword [rsp + 0x58], rdx
xor edi, edi
movzx r8d, byte [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14000ce80
mov rbx, qword [0x140042e08]
mov r8, qword [rbx + 8]
lea rdx, [0x140042e08]
lea rcx, [0x140042e08]
call fcn.140009700
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov rcx, qword [0x140042e08]
mov rax, qword [rsp + 0x48]
mov qword [0x140042e08], rax
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x50]
mov qword [0x140042e10], rax
mov qword [rsp + 0x50], rdi
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], dil
jne 0x140011d3a
nop dword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140009700
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.1400126d0
mov edx, 0x60
mov rcx, rdi
call fcn.140024988
cmp byte [rbx + 0x19], 0
je 0x140011d00
mov rcx, qword [rsp + 0x48]
mov edx, 0x60
call fcn.140024988
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.140011100
movzx edx, byte [0x140042df8]
movzx ecx, byte [rax]
mov byte [0x140042df8], cl
mov byte [rax], dl
lea rcx, [rax + 8]
mov rdx, qword [0x140042e00]
mov r8, qword [rcx]
mov qword [0x140042e00], r8
mov qword [rcx], rdx
movzx edx, byte [rax]
call fcn.140018170
nop
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x140011d91
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
lea rdx, str.Luna_Start
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140042dc0], rax
lea rdx, str.Luna_EmbedSettings
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140042dd0], rax
lea rdx, str.Luna_Inject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140042dc8], rax
lea rdx, str.Luna_useembed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140042dd8], rax
lea rdx, str.Luna_checkisusingembed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140042de0], rax
lea rdx, str.Luna_embedcallback
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140042de8], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov r8d, 0x64
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [0x140042df0], rax
lea rax, [0x1400071a0]
mov qword [rsp + 0x38], rax
lea rax, [0x1400071d0]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140003980]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140003980]
mov qword [rsp + 0x20], rax
lea r9, [fcn.140003980]
lea r8, [fcn.140003980]
lea rdx, [0x140007180]
lea rcx, [0x140007190]
call qword [0x140042dc0]
nop
mov rcx, rsi
call fcn.140002b20
mov rax, r14
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140024ab0
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140016830
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x1400169e1
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.140015e80
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x1400169a6
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x140016920
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140016995
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14001695d
mov r10, qword [rdx]
cmp r10, rax
je 0x140016957
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140016995
cmp r9, rdx
je 0x140016971
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400169bb
cmp r9, rdx
jne 0x140016962
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1400168d0
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140016995
lea rcx, str.invalid_hash_bucket_count
call fcn.1400227fc
int3
Function at 0x140023340
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14002337a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14002337f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400233c8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140037310]
cmp byte [rcx + rax], 0
je 0x1400233c8
dec r8
sub rdx, 1
jne 0x1400233ae
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140025480
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400254ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400254ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400254ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400254ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400254ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400254cc
xor al, al
add rsp, 0x28
ret

Function at 0x140025700
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
call fcn.1400260a0
mov rdi, qword [rsp + 0x70]
mov qword [rax + 0x138], rbx
mov rbx, qword [rdi + 8]
call fcn.1400260a0
mov qword [rax + 0x128], rbx
mov rax, qword [rsi]
mov rbx, qword [rax + 0x38]
call fcn.1400260a0
mov ecx, dword [0x1400439c8]
mov r9, rdi
mov byte [rsp + 0x38], 1
mov r8, rbp
mov edx, 0x10
mov qword [rax + 0x130], rbx
xor ebx, ebx
mov rax, qword gs:[0x58]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov rcx, qword [rax + rcx*8]
mov eax, dword [rsp + 0x80]
mov dword [rdx + rcx], eax
mov rdx, r14
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rax
call fcn.140027540
call fcn.1400260a0
mov rcx, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov qword [rax + 0x138], rbx
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x50]
mov dword [rcx], 1
add rsp, 0x40
pop r14
ret
Function at 0x1400287d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x140042140]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14002880c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140025328
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400288c8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14002892e
test ebx, ebx
jne 0x14002892e
lea ecx, [rax + 2]
call fcn.140025328
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140024ab0
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret