joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009b077
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401216d8]
jne 0x14009049a
rol rcx, 0x10
test cx, 0xffff
jne 0x140090496
repz ret
ror rcx, 0x10
jmp 0x14009afd0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14041ce90]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14041cf88]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14009b055
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14041ce90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14009b077
mov rax, qword [rsp + 0x88]
mov qword [0x14041cf88], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14041cf28], rax
mov rax, qword [0x14041cf88]
mov qword [0x14041ce00], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14041cf10], rax
mov dword [0x14041cdf0], 0xc0000409
mov dword [0x14041cdf4], 1
mov rax, qword [0x1401216d8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401216e0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14041ce88], eax
mov ecx, 1
call fcn.1400be4a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400f2998]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14041ce88], 0
jne 0x14009b0fe
mov ecx, 1
call fcn.1400be4a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14009b530
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x5b0
mov rbp, rcx
mov rcx, qword [0x14041d368]
mov ebx, r9d
mov rdi, r8
mov rsi, rdx
call fcn.140097e80
test rax, rax
je 0x14009b584
mov r10, qword [rsp + 0x5e0]
mov r9d, ebx
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], r10
call rax
jmp 0x14009b619
mov ecx, 2
call fcn.1400be4a0
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x98
call fcn.140091a50
mov rax, qword [rsp + 0x5b8]
mov dword [rsp + 0x40], 0xc000000d
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14009b605
test ebx, ebx
jne 0x14009b605
lea ecx, [rax + 2]
call fcn.1400be4a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc000000d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400ab0b0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x50
mov edi, r8d
mov r13, rdx
mov r14, rcx
call fcn.140097d90
xor ebx, ebx
cmp qword [0x14041d710], rbx
mov rbp, rax
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0x30], ebx
jne 0x1400ab1dc
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x1400ab2ef
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ab2ef
mov rcx, rax
call fcn.140097cc0
lea rdx, [0x1400f2c70]
mov rcx, rsi
mov qword [0x14041d710], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140097cc0
lea rdx, [0x1400f2c58]
mov rcx, rsi
mov qword [0x14041d718], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140097cc0
lea rcx, [rsp + 0x98]
mov qword [0x14041d720], rax
call fcn.1400932e0
test eax, eax
je 0x1400ab18f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.14009b3a0
cmp dword [rsp + 0x98], 2
jne 0x1400ab1dc
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140097cc0
test rax, rax
mov qword [0x14041d730], rax
je 0x1400ab1dc
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.140097cc0
mov qword [0x14041d728], rax
mov rcx, qword [0x14041d728]
mov qword [rsp + 0x80], r12
cmp rcx, rbp
je 0x1400ab288
cmp qword [0x14041d730], rbp
je 0x1400ab288
call fcn.140097e80
mov rcx, qword [0x14041d730]
mov rsi, rax
call fcn.140097e80
test rsi, rsi
mov r12, rax
je 0x1400ab288
test rax, rax
je 0x1400ab288
call rsi
test rax, rax
je 0x1400ab253
lea rcx, [rsp + 0x34]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400ab253
test byte [rsp + 0x40], 1
jne 0x1400ab288
lea rcx, [rsp + 0x30]
call fcn.1400933d0
test eax, eax
je 0x1400ab275
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.14009b3a0
cmp dword [rsp + 0x30], 4
jb 0x1400ab282
bts edi, 0x15
jmp 0x1400ab2c6
bts edi, 0x12
jmp 0x1400ab2c6
mov rcx, qword [0x14041d718]
cmp rcx, rbp
je 0x1400ab2c6
call fcn.140097e80
test rax, rax
je 0x1400ab2c6
call rax
test rax, rax
mov rbx, rax
je 0x1400ab2c6
mov rcx, qword [0x14041d720]
cmp rcx, rbp
je 0x1400ab2c6
call fcn.140097e80
test rax, rax
je 0x1400ab2c6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14041d710]
call fcn.140097e80
mov r12, qword [rsp + 0x80]
test rax, rax
je 0x1400ab2ef
mov r9d, edi
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400ab2f1
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c26a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0xb0
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov esi, ecx
mov r9d, 0x78
and ecx, 0x3ff
mov rbp, r8
mov ebx, edx
lea edx, [r9 - 0x77]
lea r8, [rsp + 0x20]
bts ecx, 0xa
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1400c2789
movzx ecx, byte [rsp + 0x20]
xor edx, edx
mov qword [rsp + 0xc8], rdi
test cl, cl
lea r8, [rsp + 0x20]
mov edi, edx
je 0x1400c273a
nop
lea eax, [rcx - 0x61]
add r8, 1
cmp al, 5
ja 0x1400c2720
add cl, 0xd9
jmp 0x1400c272a
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x1400c272a
add cl, 0xf9
movsx eax, cl
mov cl, byte [r8]
add edi, edi
test cl, cl
lea edi, [rax + rdi*8 - 0x30]
jne 0x1400c2710
cmp esi, edi
je 0x1400c277c
test ebx, ebx
je 0x1400c277c
mov rdi, qword [rbp]
movzx eax, byte [rdi]
lea rcx, [rdi + 1]
nop
cmp al, 0x41
jl 0x1400c2758
cmp al, 0x5a
jle 0x1400c275e
sub al, 0x61
cmp al, 0x19
ja 0x1400c2769
mov al, byte [rcx]
add edx, 1
add rcx, 1
jmp 0x1400c2750
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp edx, ecx
je 0x1400c2781
mov eax, 1
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140090480
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x1400c3320
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400c3367
or eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140090480
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.1400cddc0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140090480
add rsp, 0x38
ret
Function at 0x1400ccab0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1401216d8]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x14041d7c0]
mov r15, r9
mov r13d, r8d
test eax, eax
mov r14d, edx
mov rbx, rcx
jne 0x1400ccb31
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400ccb14
mov dword [0x14041d7c0], 1
jmp 0x1400ccb36
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1400ccb2b
mov dword [0x14041d7c0], 2
jmp 0x1400ccb5b
mov eax, dword [0x14041d7c0]
cmp eax, 1
jne 0x1400ccb4e
mov r9d, dword [rbp + 0x60]
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1400ccc62
cmp eax, 2
je 0x1400ccb5b
test eax, eax
jne 0x1400ccc60
mov esi, dword [rbp + 0x68]
xor edi, edi
test esi, esi
jne 0x1400ccb6a
mov rax, qword [rbx]
mov esi, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
movsxd r12, eax
je 0x1400ccc60
jle 0x1400ccc60
xor edx, edx
mov rax, 0xffffffffffffffe0
mov rcx, r12
div r12
cmp rax, 1
jb 0x1400ccc60
add rcx, 0x10
cmp rcx, 0x400
ja 0x1400ccbe8
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400ccbc6
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400dbd60
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1400ccc60
mov dword [rbx], 0xcccc
jmp 0x1400ccbfb
call fcn.1400930c0
test rax, rax
mov rbx, rax
je 0x1400ccbff
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x1400ccc60
mov r9d, r12d
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1400ccc4a
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
mov r8, rbx
test eax, eax
lea edx, [r9 + 2]
mov ecx, esi
jne 0x1400ccc39
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1400ccc42
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x1400ccc5c
call fcn.1400937d0
mov eax, edi
jmp 0x1400ccc62
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140090480
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400ccdc0
Capabilities:
Get geographical location

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x50
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1401216d8]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x14041d7c4]
mov r15, r9
mov r13d, r8d
test eax, eax
mov r14d, edx
mov rbx, rcx
jne 0x1400cce78
lea edx, [rax + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400cce24
mov dword [0x14041d7c4], 1
jmp 0x1400cce86
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x1400cce72
mov dword [0x14041d7c4], 2
mov r9d, dword [rbp + 0x60]
mov r8, r15
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140090480
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, dword [0x14041d7c4]
cmp eax, 2
je 0x1400cce39
test eax, eax
je 0x1400cce39
cmp eax, 1
jne 0x1400cceae
mov esi, dword [rbp + 0x68]
xor edi, edi
test esi, esi
jne 0x1400cce95
mov rax, qword [rbx]
mov esi, dword [rax + 4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
movsxd r12, eax
jne 0x1400cceb2
xor eax, eax
jmp 0x1400cce4c
jle 0x1400cceae
xor edx, edx
mov rax, 0xffffffffffffffe0
div r12
cmp rax, 2
jb 0x1400cceae
lea rcx, [r12 + r12 + 0x10]
cmp rcx, 0x400
ja 0x1400ccf05
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400ccee7
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400dbd60
sub rsp, rax
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x1400cceae
mov dword [rbx], 0xcccc
jmp 0x1400ccf18
call fcn.1400930c0
test rax, rax
mov rbx, rax
je 0x1400ccf1c
mov dword [rax], 0xdddd
add rbx, 0x10
test rbx, rbx
je 0x1400cceae
mov r9d, r12d
mov r8, rbx
mov edx, r13d
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1400ccf6f
mov eax, dword [rbp + 0x60]
or r9d, 0xffffffff
xor edx, edx
test eax, eax
mov qword [rsp + 0x38], rdi
mov r8, rbx
mov ecx, esi
mov qword [rsp + 0x30], rdi
jne 0x1400ccf5e
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
jmp 0x1400ccf67
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x1400ccf81
call fcn.1400937d0
mov eax, edi
jmp 0x1400cce4c
Function at 0x1400ce4a0
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov qword [r11 + 8], rbp
lea rdx, [rsp + 0x20]
xor ebx, ebx
mov ecx, 0x105
mov qword [r11 + 0x10], rsi
lea rdi, [rsp + 0x20]
mov ebp, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp eax, 0x104
mov esi, eax
jle 0x1400ce538
mov qword [rsp + 0x160], r12
lea r12d, [rax + 1]
lea edx, [rbx + 1]
movsxd rcx, r12d
call fcn.14009b1d0
test rax, rax
mov rdi, rax
jne 0x1400ce519
call fcn.140093890
mov esi, ebx
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
jmp 0x1400ce530
test esi, esi
mov ebp, 1
je 0x1400ce530
mov rdx, rax
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov r12, qword [rsp + 0x160]
test esi, esi
mov rsi, qword [rsp + 0x158]
je 0x1400ce557
cmp byte [rdi + 1], 0x3a
jne 0x1400ce562
movzx ecx, byte [rdi]
call fcn.1400d5070
lea ebx, [rax - 0x40]
jmp 0x1400ce562
call fcn.140093890
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
test ebp, ebp
mov rbp, qword [rsp + 0x150]
je 0x1400ce576
mov rcx, rdi
call fcn.1400937d0
mov eax, ebx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140090480
mov rbx, qword [rsp + 0x168]
add rsp, 0x140
pop rdi
ret
Function at 0x1400ce6b0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
test ecx, ecx
mov ebp, r8d
mov rdi, rdx
mov ebx, ecx
je 0x1400ce72d
lea eax, [rcx + 0x40]
lea rcx, [rsp + 0x78]
mov byte [rsp + 0x79], 0x3a
mov byte [rsp + 0x7a], VarDateFromDisp
mov byte [rsp + 0x7b], 0
mov byte [rsp + 0x78], al
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x1400ce6f2
cmp eax, 1
jne 0x1400ce734
call fcn.1400938c0
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayDestroy
call fcn.140093890
xor esi, esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], SafeArrayGetElemsize
mov qword [rsp + 0x20], rsi
call fcn.14009b530
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call fcn.1400ce4a0
mov ebx, eax
test rdi, rdi
je 0x1400ce774
test ebp, ebp
jg 0x1400ce76d
call fcn.140093890
xor esi, esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
mov qword [rsp + 0x20], rsi
call fcn.14009b530
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov esi, ebp
mov byte [rdi], 0
jmp 0x1400ce776
xor esi, esi
test ebx, ebx
je 0x1400ce792
add bl, 0x40
mov byte [rsp + 0x61], 0x3a
mov byte [rsp + 0x62], 0x2e
mov byte [rsp + 0x60], bl
mov byte [rsp + 0x63], 0
jmp 0x1400ce79c
mov byte [rsp + 0x60], 0x2e
mov byte [rsp + 0x61], 0
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x1400ce85b
test rdi, rdi
je 0x1400ce7ef
cmp eax, esi
jge 0x1400ce7d2
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call fcn.140093890
mov dword [rax], SafeArrayDestroyData
mov byte [rdi], 0
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp eax, ebp
mov edx, 1
cmovg ebp, eax
movsxd rcx, ebp
call fcn.1400943b0
test rax, rax
mov rbx, rax
jne 0x1400ce82e
call fcn.140093890
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.1400938c0
mov dword [rax], 8
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
lea r9, [rsp + 0x30]
lea rcx, [rsp + 0x60]
mov r8, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x1400ce85b
cmp eax, ebp
jge 0x1400ce85b
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400938f0
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d3a10
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov rbp, rdx
xor edi, edi
xor edx, edx
lea r8d, [rdi + 1]
mov esi, ecx
call fcn.1400c3620
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x1400d3bb4
lea r8d, [rdi + 2]
xor edx, edx
mov ecx, esi
call fcn.1400c3620
cmp rax, 0xffffffffffffffff
je 0x1400d3bb4
mov qword [rsp + 0x40], rbx
mov rbx, rbp
mov qword [rsp + 0x50], r14
sub rbx, rax
test rbx, rbx
jle 0x1400d3b33
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0x1000
lea edx, [rdi + 8]
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x1400d3ab9
call fcn.140093890
mov dword [rax], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.140093890
mov eax, dword [rax]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov edx, 0x8000
mov ecx, esi
mov qword [rsp + 0x48], r12
call fcn.1400d3f70
mov r12d, eax
nop
mov r8d, ebx
cmp rbx, r14
mov rdx, rbp
cmovge r8d, r14d
mov ecx, esi
call fcn.1400c3830
cmp eax, 0xffffffff
je 0x1400d3af5
cdqe
sub rbx, rax
test rbx, rbx
jg 0x1400d3ad0
jmp 0x1400d3b0e
call fcn.1400938c0
cmp dword [rax], 5
jne 0x1400d3b0a
call fcn.140093890
mov dword [rax], SafeArrayGetElemsize
or rdi, 0xffffffffffffffff
mov edx, r12d
mov ecx, esi
call fcn.1400d3f70
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x48]
jmp 0x1400d3b8c
test rbx, rbx
jns 0x1400d3b96
xor r8d, r8d
mov rdx, rbp
mov ecx, esi
call fcn.1400c3620
cmp rax, 0xffffffffffffffff
je 0x1400d3a9a
mov ecx, esi
call fcn.1400c9630
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb rdi, rdi
neg rdi
sub rdi, 1
cmp rdi, 0xffffffffffffffff
jne 0x1400d3b96
call fcn.140093890
mov dword [rax], SafeArrayGetElemsize
call fcn.1400938c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
cmp rdi, 0xffffffffffffffff
je 0x1400d3a9a
xor r8d, r8d
mov rdx, r13
mov ecx, esi
call fcn.1400c3620
cmp rax, 0xffffffffffffffff
je 0x1400d3a9a
xor eax, eax
jmp 0x1400d3aa1
call fcn.140093890
mov rbp, qword [rsp + 0x58]
mov eax, dword [rax]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
Function at 0x1400db26c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1401216d8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.140091a50
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, reloc.OLEAUT32.dll_SysStringByteLen
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call fcn.140091a50
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x1400db2ff
cmp dword [rsp + 0x24], 5
jb 0x1400db319
jmp 0x1400db315
cmp dword [rsp + 0x30], esi
jne 0x1400db319
cmp dword [rsp + 0x24], 4
ja 0x1400db315
jne 0x1400db319
cmp dword [rsp + 0x28], 0
jbe 0x1400db319
mov byte [rbx + 0x18], sil
lea rax, [0x1400f8e68]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.1400dabe0
movzx ecx, byte [0x140123160]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x140123160], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140090480
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1405d953e
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xbea9bea8
stosb byte [rdi], al
adc ebp, ebp
test eax, 0xed13aabe
xor dword [rcx], edi
push rbx
jp 0x1405d9541
cmp al, 0x6b
xor dword [rcx + rax], edx
test al, 0x21
sbb byte [rsi], dl
test dword [rdi], esi
jge 0x1405d95ba
mov esp, 0xd7d832c4
cmp dword [rdx], edi
add edi, dword [rdx + 0x15d22562]
pop rdx
xchg esp, eax
sub edx, dword [rbx]
sbb byte [rdx - 2], 0x1f
lahf
adc dword [rax - 0x8ac05af], esp
test byte [rdi - 0x3bef3adf], cl
invalid
invalid
Function at 0x41c030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x41c08a
call fcn.0041e988
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x41c08a
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x41c0ac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.0041bab0
test rdi, rdi
mov esi, eax
je 0x41c0aa
test rbx, rbx
je 0x41c0aa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x426cd7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0044cf98]
jne 0x42338a
rol rcx, 0x10
test cx, 0xffff
jne 0x423386
repz ret
ror rcx, 0x10
jmp 0x426c30
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x004528b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x004529a8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x426cb5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x004528b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x426cd7
mov rax, qword [rsp + 0x88]
mov qword [0x004529a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x00452948], rax
mov rax, qword [0x004529a8]
mov qword [0x00452820], rax
mov rax, qword [rsp + 0x90]
mov qword [0x00452930], rax
mov dword [0x00452810], 0xc0000409
mov dword [0x00452814], 1
mov rax, qword [0x0044cf98]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0044cfa0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004528a8], eax
mov ecx, 1
call fcn.00431450
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0043ff08]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004528a8], 0
jne 0x426d5e
mov ecx, 1
call fcn.00431450
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret