joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403a5540
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x1403d4b30]
lea r15, [rsp + 0x150]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1402b7800
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1403ab220
test al, al
je 0x1403a5653
cmp word [rsp + 0x150], 0x5a4d
jne 0x1403a560d
mov rcx, r14
call fcn.1402b7800
movsxd r14, dword [rsp + 0x18c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1403ab220
test al, al
je 0x1403a56e7
cmp dword [rbx], 0x4550
jne 0x1403a5726
mov al, 1
test rdi, rdi
je 0x1403a56be
mov qword [rdi], r14
jmp 0x1403a56be
mov ecx, 1
call fcn.14021c050
test al, al
je 0x1403a56bc
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14010dcd0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1403a5693
mov ecx, 1
call fcn.14021c050
test al, al
je 0x1403a56bc
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14010dcd0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401f8290
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x1403a56a9
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401f8290
mov rcx, rdi
call fcn.14010e2d0
xor eax, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1403a56d8
call fcn.140278ca0
int3
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.14021c050
test al, al
je 0x1403a56bc
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14010dcd0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1403a568d
mov ecx, 1
call fcn.14021c050
test al, al
je 0x1403a56bc
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14010dcd0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1403a5693
Function at 0x1403a5770
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140430040]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x1403d4b30]
lea r15, [rsp + 0x150]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1402b7800
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1403ab220
test al, al
je 0x1403a5883
cmp word [rsp + 0x150], 0x5a4d
jne 0x1403a583d
mov rcx, r14
call fcn.1402b7800
movsxd r14, dword [rsp + 0x18c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1403ab220
test al, al
je 0x1403a5917
cmp dword [rbx], 0x4550
jne 0x1403a5956
mov al, 1
test rdi, rdi
je 0x1403a58ee
mov qword [rdi], r14
jmp 0x1403a58ee
mov ecx, 1
call fcn.14021c050
test al, al
je 0x1403a58ec
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.14010dcd0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1403a58c3
mov ecx, 1
call fcn.14021c050
test al, al
je 0x1403a58ec
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.14010dcd0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401f8290
movsx r8, byte [rsi + 0x17]
test r8, r8
jns 0x1403a58d9
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401f8290
mov rcx, rdi
call fcn.14010e2d0
xor eax, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
cmp rcx, qword [0x140430040]
je 0x1403a5908
call fcn.140278ca0
int3
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.14021c050
test al, al
je 0x1403a58ec
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.14010dcd0
lea rcx, [rsp + 0x30]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1403a58bd
mov ecx, 1
call fcn.14021c050
test al, al
je 0x1403a58ec
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.14010dcd0
lea rcx, [rsp + 0x30]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1403a58c3
Function at 0x14001f3a0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001f3c8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001f3c8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40a8c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x18000fdc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
lea esi, [rdx + 0x255]
mov rdi, r8
mov ebx, edx
mov r14, rcx
cmp edx, esi
jae 0x18000fe2f
mov eax, ebx
sub eax, 0x90
je 0x18000fe52
sub eax, 0x59
je 0x18000fe0e
cmp eax, 0xc7
jne 0x18000fe25
mov rax, qword [rdi]
mov qword [rax + 8], 0
mov eax, 1
jmp 0x18000fe33
mov ecx, 0x10
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi + 8], rax
mov qword [rdi], rax
test rax, rax
je 0x18000fe49
add ebx, 0xc7
cmp ebx, esi
jb 0x18000fde7
mov eax, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [r14]
mov dword [rdi + 0x14], eax
xor eax, eax
jmp 0x18000fe33
Function at 0x18001df90
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x18007b130]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r15, r8
mov ebx, edx
mov rdi, rcx
movdqa xmm0, xmmword [0x18005e7f0]
movdqa xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
movdqa xmm1, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
movdqa xmmword [r11 - 0x48], xmm0
mov byte [r11 - 0x58], 0
lea r14d, [rdx + 0x486]
cmp edx, r14d
jae 0x18001e0aa
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x38]
nop dword [rax]
cmp ebx, 0x12a
ja 0x18001e07e
je 0x18001e079
mov eax, ebx
sub eax, 0x1d
je 0x18001e061
sub eax, 0xc1
je 0x18001e03b
cmp eax, 5
jne 0x18001e09b
mov rbp, rdi
cmp qword [rdi + 0x1a], 0
jne 0x18001e09b
xor bl, bl
jmp 0x18001e0af
lea rcx, str.tlf_Latn_ZZ
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x18001e09b
xor r9d, r9d
mov r8, rax
mov edx, 0xe4
xor ecx, ecx
call fcn.180020600
jmp 0x18001e09b
xor r9d, r9d
lea r8, str.NEW_YORK
mov edx, 0xe4
xor ecx, ecx
call fcn.180020600
jmp 0x18001e09b
mov rsi, rdi
jmp 0x18001e09b
mov eax, ebx
sub eax, 0x1a4
je 0x18001e192
cmp eax, 0x47
jne 0x18001e09b
mov eax, 1
xchg dword [rsi + 0x11c], eax
add ebx, 0xc1
cmp ebx, r14d
jb 0x18001e010
movzx ebx, byte [rsp + 0x30]
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x18001e0f2
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e0ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e18b
call fcn.1800434d8
movdqa xmm0, xmmword [0x18005e7f0]
movdqa xmmword [rsp + 0x90], xmm0
mov byte [rsp + 0x80], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18001e144
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e13f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001e18b
call fcn.1800434d8
movdqa xmm0, xmmword [0x18005e7f0]
movdqa xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x18001e1d6
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001e1d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001e1d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rbp + 0xa]
lea rdx, [rsp + 0x40]
mov ecx, 0xac
call fcn.18003b620
movzx eax, word [rbp + 8]
mov word [rsp + 0x30], ax
mov qword [rsp + 0x20], r15
mov r9d, 0x9e
lea r8, [rsp + 0x30]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.18000b180
mov ebx, eax
jmp 0x18001e0af
call fcn.1800434d8
movzx eax, bl
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800439f0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800203c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
movaps xmmword [rax - 0x38], xmm6
lea ebp, [rcx - 4]
movaps xmmword [rax - 0x48], xmm7
mov r14, r8
movaps xmmword [rax - 0x58], xmm8
mov rsi, rdx
movaps xmmword [rax - 0x68], xmm9
mov edi, ecx
cmp ecx, ebp
jbe 0x1800205c7
movsd xmm7, qword [0x18005def0]
xor r15d, r15d
movsd xmm8, qword [0x18005dcf0]
xorps xmm6, xmm6
movsd xmm9, qword [0x18005de80]
mov ebx, dword [rsp + 0xc0]
mov eax, edi
sub eax, 0xb4
je 0x1800205c7
sub eax, 1
je 0x18002049d
sub eax, 3
je 0x180020538
cmp eax, 1
jne 0x18002050b
mov rcx, qword [0x18007b1f8]
mov edx, 0xf9
call fcn.18001c230
test al, al
je 0x18002052b
mov rdx, qword [0x18007b1f8]
lea rcx, [rsp + 0xc0]
mov r9d, 0xdc
mov byte [rsp + 0xc0], 1
xor r8d, r8d
call fcn.18001cde0
mov edx, 0x10d
mov rcx, rsi
call fcn.180016460
test al, al
je 0x18002051a
mov ebx, r15d
jmp 0x18002050b
movsd xmm0, qword [rsi]
lea rdx, [rsp + 0xd8]
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x86
xor r9d, r9d
xor r8d, r8d
movsd qword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], r15
movsd qword [rsp + 0xd8], xmm6
call fcn.18001ffc0
mov qword [rsp + 0xd8], rax
movaps xmm0, xmm9
movsd xmm1, qword [rsp + 0xd8]
addsd xmm1, qword [r14]
addsd xmm1, xmm7
mulsd xmm1, xmm8
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movsd qword [rsp + 0xd8], xmm0
dec edi
cmp edi, ebp
ja 0x180020421
jmp 0x1800205c7
mov rcx, qword [0x18007b1f8]
mov edx, 0x8a
call fcn.180024800
mov dword [rsp + 0xd8], r15d
jmp 0x1800205c7
mov rcx, qword [rsi + 0x28]
call qword [rsi + 0x20]
test al, al
je 0x1800205af
mov ebp, dword [rsp + 0xc0]
mov edi, 0x116
nop
mov eax, edi
sub eax, 0x113
je 0x1800205a2
sub eax, 1
je 0x180020594
sub eax, 1
je 0x180020588
cmp eax, 1
jne 0x1800205a5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, 0xd9
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov rdx, rsi
mov ebp, eax
call fcn.180019d50
jmp 0x1800205a5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, ebp
jmp 0x1800205a5
mov eax, 0x10624dd3
mul ebx
mov ebx, edx
shr ebx, 6
jmp 0x1800205a5
call qword [rsi + 0x50]
dec edi
cmp edi, 0x112
ja 0x180020550
mov rcx, qword [0x18007b1f8]
mov edx, 0x8a
call fcn.180024800
mov dword [rsp + 0xd8], ebx
mov rax, qword [rsp + 0xd8]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm7, xmmword [rsp + 0x70]
mov rsp, r11
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002ba70
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18007b130]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, r8
mov rsi, rdx
mov qword [rsp + 0x48], 0
mov eax, 0xf
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x38], 0
lea ebp, [rcx + 9]
movzx ebx, byte [rsp + 0x30]
cmp ecx, ebp
jae 0x18002bc8b
lea edi, [rcx - 0x6d]
lea r15, [0x180000000]
lea r13d, [rax + 0x44]
cmp edi, 0x13
ja case.0x18002bae5.5
mov ecx, dword [r15 + rdi*4 + 0x2bcf0]
add rcx, r15
jmp rcx
cmp byte [rsi + 0x118], 0
jne 0x18002bc7b
lea r9, [rsi + 0x78]
mov r8, qword [rsi]
mov edx, 0x7d
mov rcx, qword [rsi + 0x100]
call fcn.1800098d0
mov byte [rsi + 0x118], al
jmp case.0x18002bae5.5
mov r9d, 0x4e
mov ecx, dword [0x18007b790]
test ecx, ecx
cmovs r9d, r13d
mov eax, dword [0x18007b794]
cdq
mov r8d, eax
xor r8d, edx
sub r8d, edx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, eax
lea rcx, str.ippsPowx_64fc_A26_timing_test
call fcn.1800432b0
mov r9d, 0x45
mov ecx, dword [0x18007b798]
test ecx, ecx
mov eax, 0x57
cmovg r9d, eax
mov eax, dword [0x18007b79c]
cdq
mov r8d, eax
xor r8d, edx
sub r8d, edx
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, eax
lea rcx, str.WINCODEC_ERR_COMPONENTNOTFOUND
call fcn.1800432b0
mov r8d, dword [0x18007b7a0]
lea rdx, [0x18005bc48]
test r8d, r8d
lea rax, [0x18004b9f0]
cmovs rdx, rax
lea rcx, str.IMAGE_SAMPLE_C_B_V4_V1
call fcn.1800432b0
jmp case.0x18002bae5.5
lea rcx, str.L2_loadalignh_pbr
call fcn.1800432b0
lea rcx, str.Negate_input_video.
call fcn.1800432b0
jmp case.0x18002bae5.5
lea rdx, str.Nyderlandai
lea rcx, str.dpb__disable_problem_breakpoint__prob_brk_id_
jmp 0x18002bc68
lea rdx, str.in_val_name
lea rcx, str.browser_sync::SyncBackendHostImpl::Shutdown
jmp 0x18002bc68
xor r9d, r9d
mov r8d, 0x118
mov rdx, rsi
xor ecx, ecx
call fcn.1800094c0
test al, al
je 0x18002bc7b
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x18002bc1b
mov rcx, qword [r14]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsi + 0x80]
lea r8, [rsp + 0x38]
mov edx, 0x83
call fcn.18000a340
mov r8d, 0x3e
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.18001c040
mov ebx, eax
jmp case.0x18002bae5.5
mov rdx, qword [0x18007d360]
lea rcx, str.City:__s_n
call fcn.1800432b0
inc edi
lea eax, [rdi + 0x6d]
cmp eax, ebp
jae case.0x18002bae5.19
jmp 0x18002bad1
xor bl, bl
jmp case.0x18002bae5.19
movzx ebx, byte [rsi + 0x118]
mov rax, qword [rsp + 0x50]
cmp rax, 0x10
jb 0x18002bcc7
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002bcc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002bcc2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800434d8
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800439f0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x180035ac0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r15d, r8d
imul r12d, r8d, 0x2ee
mov r13, rdx
mov rdi, rcx
mov r14d, r8d
cmp r8d, r12d
ja 0x180035cd1
mov ebp, dword [rsp + 0x80]
mov esi, dword [rsp + 0x80]
nop word [rax + rax]
cmp r14d, 0x7f7a
ja 0x180035cab
je 0x180035c96
mov eax, r14d
sub eax, 0xa2
je 0x180035c91
sub eax, 0x61
je 0x180035c79
cmp eax, 0x4eb9
jne 0x180035cc1
mov esi, 7
cmp dword [rdi], esi
jge 0x180035c0f
mov r8d, dword [rdi + 8]
nop word [rax + rax]
mov dword [rsp + 0x88], r8d
lea rax, [rsp + 0x80]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x7f
mov dword [rsp + 0x80], esi
xor edx, edx
xor ecx, ecx
call fcn.18001f380
mov r8d, dword [rdi + 8]
add ebp, eax
imul ecx, r8d, 7
inc esi
mov eax, 0x6bca1af3
inc ecx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x13
sub ecx, eax
xor eax, eax
cmp ecx, 7
setl al
add eax, 0xc
cmp esi, eax
jle 0x180035b60
mov esi, 1
cmp dword [rdi], esi
jle 0x180035c4e
nop
mov eax, dword [rdi + 8]
lea r8, [rsp + 0x88]
mov dword [rsp + 0x88], eax
mov r9d, 0x7f
lea rax, [rsp + 0x80]
mov dword [rsp + 0x80], esi
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.18001f380
add ebp, eax
inc esi
cmp esi, dword [rdi]
jl 0x180035bd0
jmp 0x180035c4e
jle 0x180035c4e
mov eax, dword [rdi + 8]
lea r8, [rsp + 0x88]
mov dword [rsp + 0x88], eax
mov r9d, 0x7f
lea rax, [rsp + 0x80]
mov dword [rsp + 0x80], esi
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call fcn.18001f380
add ebp, eax
inc esi
cmp esi, dword [rdi]
jl 0x180035c11
mov eax, dword [rdi + 8]
lea r8, [rsp + 0x80]
mov r9d, 0xc7
mov dword [rsp + 0x80], eax
xor edx, edx
xor ecx, ecx
call fcn.1800190f0
lea esi, [rax - 0x14f4f5]
add esi, ebp
jmp 0x180035cc1
movzx eax, word [rdi]
mov word [0x18007b2b0], ax
movzx eax, word [r13]
mov word [0x18007b2b2], ax
jmp 0x180035cc1
mov ebp, dword [rdi + 4]
jmp 0x180035cc1
mov edx, dword [0x18007b2b0]
mov rcx, qword [0x18007b2a8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
jmp 0x180035cc1
cmp r14d, 0x9ed6
je 0x180035cbf
cmp r14d, 0xedf0
je 0x180035cd1
jmp 0x180035cc1
mov ebx, esi
imul eax, r15d, 0x7d
add r14d, eax
cmp r14d, r12d
jbe 0x180035b10
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003b550
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, dword [rsp + 0x40]
lea esi, [rcx + 0x134]
mov rbp, rdx
mov edi, ecx
cmp ecx, esi
jae 0x18003b5ab
mov r14, qword [rsp + 0x50]
nop word [rax + rax]
mov eax, edi
sub eax, 4
je 0x18003b5a1
sub eax, 0x46
je 0x18003b5c0
sub eax, 7
je 0x18003b5ab
cmp eax, 0x46
jne 0x18003b5a4
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18003b5a4
mov ebx, dword [rbp + 4]
add edi, 0x4d
cmp edi, esi
jb 0x18003b580
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
lea rdx, [0x18005b538]
lea rcx, str.data.dat
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x18003b608
mov edx, 0x18
lea rcx, [0x180064200]
mov r9, rax
lea r8d, [rdx - 0x17]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, 1
je 0x18003b604
lea rcx, str._____FUNCTIONNAME
call fcn.1800432b0
xor eax, eax
jmp 0x18003b5ad
lea rcx, str.PQ_OsvgCRl2AsrPxGWJNRw
call fcn.1800432b0
xor eax, eax
jmp 0x18003b5ad
Function at 0x180043180
Capabilities:
Manipulate console buffer

Disassembly:
mov r9d, 0x98
xor r8d, r8d
xor edx, edx
xor ecx, ecx
jmp fcn.1800181b0

Function at 0x1800431c0
Capabilities:
Reference http user-agent string

Disassembly:
mov r8, rdx
mov edx, pe_nt_image_headers64
jmp fcn.18000cbf0

Function at 0x1800432a0
Capabilities:
Reference http user-agent string

Disassembly:
xor r8d, r8d
mov edx, 0xf9
jmp fcn.18000cbf0
Function at 0x140003270
Capabilities:
Check os version

Disassembly:
push rdi
sub rsp, 0x140
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 0x11c
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0x11c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400032cc
cmp dword [rsp + 0x24], 6
jb 0x1400032b6
cmp dword [rsp + 0x24], 6
jne 0x1400032ba
cmp dword [rsp + 0x28], 1
jae 0x1400032ba
mov al, 1
jmp 0x1400032ce
cmp dword [rsp + 0x24], 6
jne 0x1400032cc
cmp dword [rsp + 0x28], 1
jne 0x1400032cc
mov al, 1
jmp 0x1400032ce
xor al, al
add rsp, 0x140
pop rdi
ret

Function at 0x1400035c8
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x280
xor eax, eax
mov word [rsp + 0x260], ax
lea rax, [rsp + 0x262]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
mov dword [rsp + 0x270], 0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x14000361c
mov eax, 0x43
mov word [rsp + 0x50], ax
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x260], ax
mov eax, 0x3a
mov word [rsp + 0x262], ax
mov eax, 0x5c
mov word [rsp + 0x264], ax
xor eax, eax
mov word [rsp + 0x266], ax
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x270]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea rcx, [rsp + 0x270]
call fcn.140003598
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x270]
call fcn.140003598
mov word [rsp + 0x44], ax
lea rcx, [rsp + 0x270]
call fcn.140003598
mov word [rsp + 0x46], ax
mov dword [rsp + 0x274], 0
jmp 0x1400036dd
mov eax, dword [rsp + 0x274]
inc eax
mov dword [rsp + 0x274], eax
cmp dword [rsp + 0x274], 8
jge 0x140003702
lea rcx, [rsp + 0x270]
call fcn.140003598
movsxd rcx, dword [rsp + 0x274]
mov byte [rsp + rcx + 0x48], al
jmp 0x1400036cd
movzx eax, word [rsp + 0x46]
mov ecx, dword [rsp + 0x4a]
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8d, dword [rsp + 0x40]
lea rdx, str._08lX_04lX_lu
mov rcx, qword [rsp + 0x290]
call qword [0x140007158]
xor eax, eax
add rsp, 0x280
pop rdi
ret